Germany's financial supervisor BaFin has ordered Norddeutsche Landesbank Girozentrale (NordLB) to remediate significant deficiencies in customer due diligence and a considerable backlog in updating customer data, according to a public notice published on 3 August 2026. The measure carries no monetary fine but obliges the Hanover-based Landesbank to submit and implement a customer-data-updating concept to bring its anti-money-laundering controls back into compliance with the law.
The order has been legally binding since 14 June 2026 and was made public on Monday under BaFin's disclosure regime for supervisory measures. The regulator found that NordLB had violated the German Money Laundering Act, known as the GwG, in the way it managed customer information and periodic reviews across its business.
SCOPE OF THE ORDER
According to the notice, the supervisor identified significant deficiencies in the bank's customer due-diligence processes together with a considerable backlog in the periodic updating of customer information. Such gaps are a well-established red flag in anti-money-laundering supervision because they can undermine the ability to detect changes in customer risk profiles over time, including changes in beneficial ownership, sources of funds or business activities that would ordinarily trigger enhanced due diligence.
BaFin cited Section 51(2)(1) of the GwG and Section 44(1) of the Kreditwesengesetz (KWG), the German Banking Act, as the legal basis for its intervention. Section 44(1) KWG grants the regulator broad information and inspection powers over supervised institutions, while Section 51 GwG specifically sets out BaFin's authority to require remediation of AML shortcomings identified at credit and financial services institutions.
Publishing the measure on the BaFin website is itself part of the supervisor's enforcement toolkit. The disclosure regime is intended to create reputational incentives for compliance in addition to any direct legal obligation on the institution concerned, and BaFin has made increasing use of it in recent years to draw attention to systemic AML weaknesses across the German banking sector.
REMEDIATION RATHER THAN FINE
Rather than imposing a monetary penalty, BaFin has required NordLB to draw up and put into effect a formal concept for updating customer data. This type of remediation order is a common tool for the German supervisor when addressing systemic process weaknesses, and typically requires the institution to demonstrate measurable progress within an agreed timeframe, backed by internal governance and, in some cases, independent verification.
The absence of a fine does not mean the measure is a soft outcome. Building out a bank-wide customer-data-updating concept and implementing it across the customer base is a resource-intensive exercise, particularly for a Landesbank with a diverse book spanning corporate, real estate, public finance and capital markets clients. Bringing all of those relationships up to current AML standards requires significant investment in data, process and staff.
The public disclosure adds NordLB to a lengthening list of German banks that have faced formal BaFin measures over AML controls in recent years. The published notice is available on the supervisor's website under the section covering measures issued under the KWG, the securities institutions act and the GwG, and follows a period of heightened supervisory focus on customer due-diligence practices across the German banking industry.