Germany
Germany combines federal law with state regimes for gambling and youth protection. BaFin licenses and supervises banks, payment firms, crypto providers and life insurers for anti-money laundering, the states' joint authority GGL oversees online gambling, and suspicious activity goes to the Financial Intelligence Unit. Remote onboarding uses a fixed list of methods, led by the eID and BaFin video identification, while telecoms, healthcare, travel and public services have their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
BaFin supervises banks, payment and e-money firms, crypto-asset service providers and life insurers for anti-money laundering. The states' joint gambling authority (GGL) supervises its online licensees, and state authorities supervise goods traders. Every obliged entity must register with the Financial Intelligence Unit's goAML system, whether or not it ever files a suspicious activity report.
Yes, but only through methods the Money Laundering Act lists: the ID card's online function (eID), a qualified electronic signature plus a payment from the customer's own account, an EU-notified eID, or video identification under BaFin's rules. A document and selfie check alone is not accepted. A bill passed by the Bundestag in October 2026 would add the EU Digital Identity Wallet.
In most financial sectors, yes. Banks, payment and e-money institutions, crypto-asset service providers and insurers authorised in another EU or EEA state can passport in under their home licence. Online gambling operators need a GGL licence, and online casino table games are licensed state by state. A non-EU crypto firm targeting German residents without authorisation commits a criminal offence.
Generally yes. The German data protection authorities' 2019 position paper treats biometric identification as prohibited in principle under Article 9 GDPR unless an exception applies, typically explicit consent naming the biometric data. Firms should offer a non-biometric route, such as the eID, so consent stays voluntary. Some laws give their own basis, such as the chip photo check by public bodies.
Telecom operators, healthcare providers, hotels, travel agencies, airlines and public authorities are not obliged entities, and insurers are covered only for life-type products. Their identity duties come from sector law instead: the Telecommunications Act for prepaid SIMs, social insurance law for health records, the Federal Registration Act for hotel guests and the Identity Card Act for public services.