Key Facts

• Bank: Norddeutsche Landesbank Girozentrale (Nord/LB)
• Headquarters: Hanover, Germany
• Regulator: German Federal Financial Supervisory Authority (BaFin)
• Violation: Breach of Money Laundering Act (GwG) provisions
• Deficiencies: Considerable backlog in updating customer data; process failures in customer due diligence
• Legal Basis: Section 51(2) Sentence 1 GwG; Section 44(1) KWG
• Order Date: 3 August 2026 (announcement)
• Legally Binding Since: 14 June 2026
• Required Action: Submit and implement remediation plan; bring all customer data to current and complete status
• Broader Context: Part of BaFin’s new “Anti-Financial-Crime” division enforcement push

Direct Answer

On 3 August 2026, Germany’s financial regulator BaFin announced that it had ordered Norddeutsche Landesbank Girozentrale (Nord/LB) to fix “significant deficiencies” in its anti-money laundering controls, specifically a “considerable backlog” in updating customer data and structural shortcomings in customer due diligence processes.

The Hanover-headquartered lender violated provisions of the country’s Money Laundering Act (GwG) by failing to keep client records current and properly monitor business relationships. The legally binding order, effective since 14 June 2026, requires NordLB to submit and implement a comprehensive remediation plan to update all customer data and bring it into full compliance with statutory requirements.

The enforcement action coincides with BaFin’s broader structural crackdown on financial institutions, including the creation of a dedicated “Anti-Financial-Crime” division (Division A) effective 1 July 2026, and mirrors identical orders issued against other state-backed lenders like Helaba.

In this article:

• The Regulatory Order: What BaFin Found
• Legal Basis: The Money Laundering Act (GwG)
• The Specific Deficiencies Identified
• BaFin’s Corrective Action
• NordLB’s Response and Remediation Progress
• Broader Regulatory Context: BaFin’s Enforcement Push
• Industry Precedents: Helaba and Others
• What This Means for Financial Institutions
• FAQ

By Adv. Shoeb Hakim — Criminal defence, AML, digital forensics, and cybercrime specialist; former General Counsel, Credit Suisse; training police and judiciary since 1996.

The Regulatory Order: What BaFin Found

On 3 August 2026, Germany’s Federal Financial Supervisory Authority (BaFin) announced that it had ordered Norddeutsche Landesbank Girozentrale (Nord/LB) to remedy significant deficiencies in its anti-money laundering (AML) controls.

BaFin determined that the Hanover-headquartered lender violated provisions of Germany’s Money Laundering Act (GwG) due to a considerable backlog in keeping customer data current.

The order has been legally binding since 14 June 2026.

Legal Basis: The Money Laundering Act (GwG)

The order was issued under Section 51(2) Sentence 1 of the Money Laundering Act (GwG) and Section 44(1) of the Banking Act (KWG).

Key provisions of the GwG:

Under Germany’s Money Laundering Act, companies are required to:

• Fulfil comprehensive customer due diligence obligations
• Continuously monitor business relationships
• Ensure documents, data, and information are updated at appropriate intervals
• Prevent their services from being used for criminal activity or the financing of terrorism

The purpose of the GwG:

The Money Laundering Act regulates the obligations that companies must fulfil to prevent money laundering and terrorism financing. Credit institutions are specifically required to ensure that their services are not misused to channel proceeds from criminal offences into the legal financial system.

The Specific Deficiencies Identified

BaFin identified two primary categories of deficiencies:

1. Considerable Backlog in Customer Data Updating

The regulator found a “erheblicher Rückstand” (considerable backlog) in updating essential client records.

This meant that NordLB’s ongoing customer tracking was outdated, rendering its ability to monitor business relationships ineffective.

2. Structural Process Failures

BaFin cited distinct shortcomings in the bank’s active customer due diligence (CDD) procedures.

The deficiencies affected customer due diligence obligations, specifically process failures and a considerable backlog in updating customer data.

Statutory Breaches

By failing to keep data current and properly monitor business relationships, NordLB breached mandatory safeguards meant to prevent financial crimes, such as money laundering and terrorism financing.

BaFin’s Corrective Action

BaFin has legally directed NordLB to take specific corrective measures:

1. Submit a Remediation Plan

NordLB must submit a concept for customer data updating.

2. Implement the Plan

The bank must execute the remediation plan to clean up its database and align its operations with statutory requirements.

3. Update All Customer Data

NordLB must bring all non-updated customer data to a current and complete state in accordance with legal requirements.

4. Regular Reporting

BaFin can require the institute to report regularly on the progress of deficiency remediation.

Legal Framework

The order was issued under Section 51(2) Sentence 1 of the GwG and Section 44(1) of the KWG. The publication of the measure is made pursuant to Section 57(1) of the GwG.

NordLB’s Response and Remediation Progress

NordLB responded to the regulatory order with a commitment to compliance.

Key Statements from the Bank:

• “We are working intensively to meet the requirements and have initiated appropriate measures”
• “The required plan has already been developed and is being consistently implemented”
• “Significant progress has already been achieved”

Regulatory Dialogue

The management noted it remains in a “close, constructive, and solution-oriented” dialogue with BaFin.

Remediation Progress

The lender claims that “significant progress” has already been accomplished to eliminate the backlogs and update the required systems.

Broader Regulatory Context: BaFin’s Enforcement Push

This enforcement action is part of a broader structural crackdown by German authorities on financial institutions.

Structural Reorganisation (Effective 1 July 2026)

BaFin completely restructured its internal divisions, creating a dedicated “Anti-Financial-Crime” division (Division A) to explicitly scale up targeted enforcement of AML/CTF prevention.

Key Features of the New Division:

• Repurposed “Division A” as the new Anti-Financial-Crime division
• Bundles AML/CTF prevention and the prosecution of unauthorised organisation
• Created approximately 30 new positions to strengthen enforcement

Regulatory Focus for 2026

BaFin announced specific enforcement priorities for 2026, including a plan for at least 75 special examinations. The regulator identified anti-money laundering and terrorism financing as continuing to pose a high and dynamic risk.

Legislative Changes

Germany has also implemented legislative changes to strengthen AML enforcement:

• The Money Laundering Act was amended effective 10 February 2026
• A new GwG Reporting Ordinance took effect from 1 March 2026
• EU AMLA standards are scheduled for July 2026, with stricter due diligence obligations from 2027
• The EU Anti-Money Laundering Regulation will be directly applicable to obliged entities under BaFin’s supervision from 10 July 2027

Industry Precedents: Helaba and Others

The NordLB enforcement mirrors identical recent administrative orders issued against other state-backed lenders.

Helaba Enforcement (July 2026)

Just two weeks before the NordLB announcement, BaFin informed about deficiencies at Landesbank Hessen-Thüringen (Helaba) in the prevention of money laundering and terrorism financing.

Deficiencies Identified at Helaba:

• Customer identification issues
• Deficiencies in reviewing and updating customer data
• Risk analysis shortcomings
• Transaction monitoring failures

Previous Helaba Penalty (December 2025)

BaFin had already imposed a €20,000 fine on Helaba for AML prevention deficiencies, criticising the bank’s data processing systems in that area as “only limitedly adequate”.

Pattern of Enforcement

The consecutive enforcement actions against Helaba and NordLB suggest a coordinated regulatory crackdown on state-backed lenders with inadequate AML controls. BaFin is sending a clear signal that no institution is immune from regulatory scrutiny.

What This Means for Financial Institutions

The NordLB enforcement action carries several important implications:

1. Customer Data is Not Optional

Regulators expect banks to maintain current, complete, and accurate customer data. A backlog in data updating is now being treated as a serious compliance violation, not a minor administrative issue.

2. Continuous Monitoring is Mandatory

Banks must continuously monitor business relationships and ensure that documents, data, and information are updated at appropriate intervals. This is not a one-time exercise but an ongoing obligation.

3. Process Failures Attract Regulatory Action

BaFin identified “structural shortcomings” in NordLB’s customer due diligence procedures. Institutions must have robust, documented, and effectively implemented processes for AML compliance.

4. Regulatory Scrutiny is Intensifying

With the creation of BaFin’s Anti-Financial-Crime division and the commitment to at least 75 special examinations in 2026, regulatory enforcement is scaling up.

5. State-Backed Lenders Are Not Immune

The enforcement actions against NordLB and Helaba demonstrate that even state-backed lenders are subject to rigorous regulatory oversight. No institution is too big or too connected to escape scrutiny.

6. Compliance is a Continuous Obligation

The deficiencies at NordLB were not isolated incidents but reflected systemic failures in ongoing compliance processes. Institutions must embed AML compliance into their operational fabric.

FAQ

What did BaFin order NordLB to do?

BaFin ordered NordLB to fix significant deficiencies in its anti-money laundering controls, specifically a considerable backlog in updating customer data and structural shortcomings in customer due diligence processes.

When did the order become legally binding?

The order has been legally binding since 14 June 2026.

What law did NordLB violate?

NordLB violated provisions of Germany’s Money Laundering Act (GwG) by failing to keep customer data current and properly monitor business relationships.

What specific deficiencies did BaFin identify?

BaFin identified a “considerable backlog” in updating customer data and “deficits in the processes” for customer due diligence.

What must NordLB do to comply?

NordLB must submit and implement a comprehensive remediation plan to update all customer data and bring it into full compliance with legal requirements.

How has NordLB responded?

NordLB said it is working intensively to meet the requirements, has developed the required plan, is implementing it consistently, and has already achieved significant progress.

What is BaFin’s new Anti-Financial-Crime division?

Effective 1 July 2026, BaFin repurposed “Division A” as its new Anti-Financial-Crime division, bundling AML/CTF prevention and enforcement, with approximately 30 new positions created.

Are other banks facing similar enforcement?

Yes. BaFin issued an identical order against Landesbank Hessen-Thüringen (Helaba) in July 2026 over parallel transaction monitoring and CDD integration failures.

What is the legal basis for BaFin’s order?

The order was issued under Section 51(2) Sentence 1 of the Money Laundering Act (GwG) and Section 44(1) of the Banking Act (KWG).

Why does customer data updating matter for AML compliance?

Current customer data is essential for effective ongoing monitoring of business relationships and preventing the misuse of financial services for money laundering or terrorism financing.

What does this mean for other financial institutions?

Financial institutions should review their customer due diligence processes, ensure customer data is being updated regularly, and prepare for increased regulatory scrutiny under BaFin’s new Anti-Financial-Crime division.

KNOWLEDGE CHECK QUIZ

Q: What specific deficiencies did BaFin find at NordLB?
Ans: A considerable backlog in updating customer data and structural failures in customer due diligence (CDD).
Q: Under which laws was the BaFin order issued?
Ans: Section 51(2) of the Money Laundering Act (GwG) and Section 44(1) of the Banking Act (KWG).
Q: What is the primary requirement of the remediation plan?
Ans: The bank must update all customer data and bring it into full compliance with legal requirements.
Q: What structural change did BaFin implement in July 2026?
Ans: It created a dedicated “Anti-Financial-Crime” division (Division A) to centralize AML/CTF enforcement.

By Adv. Shoeb Hakim 
Criminal defence, AML, digital forensics, and cybercrime specialist; former General Counsel, Credit Suisse; training police and judiciary since 1996.

📌 Connect: https://www.linkedin.com/in/shoebhakim | https://shoebhakim.com/shoeb-hakim-blog/
📌 Visit my website for more articles: https://www.shoebhakim.com
📌 Visit my website for legal knowledge: https://www.vakilverse.com
📌 Visit my website for research fellowship: https://www.legalcomplaince.in

#AdvShoebHakim #NordLB #BaFin #AML #FinancialCrime #Compliance #BankingRegulation #GwG #RiskManagement #FinancialServices #RegulatoryEnforcement #ComplianceRisk

Additional Page Metadata (Structured for AI/GEO):

Author:
Adv. Shoeb Hakim

Author Bio (for schema markup):
Adv. Shoeb Hakim is a Mumbai-based criminal defence, AML, digital forensics and cybercrime specialist. Former General Counsel at Credit Suisse. Has been training police and judiciary since 1996. Provides expert commentary on anti-money laundering, regulatory compliance, and financial crime prevention.

Article Publisher:
Adv. Shoeb Hakim

Article Section:
Anti-Money Laundering | Regulatory Compliance | Banking Law | Financial Crime

Article Tags:
BaFin, NordLB, AML, money laundering, GwG, customer due diligence, regulatory enforcement, Anti-Financial-Crime division, Helaba, Germany, financial regulation, Adv Shoeb Hakim

Disclaimer: This content is for informational purposes only and does not constitute legal advice. Readers should consult qualified legal counsel for advice on their specific circumstances.