BaFin Signals Tougher EU AML Rules for Virtual IBANs

Germany's financial regulator, BaFin, has issued a supervisory statement requiring institutions to heighten their anti-money laundering (AML) scrutiny of virtual International Bank Account Numbers (IBANs). The guidance directs institutions to conduct risk-based due diligence on the actual end-users of virtual IBANs, not just on the formal holder of the primary "master account." BaFin views these products as carrying significant transparency risks that can facilitate illicit finance.

This national-level guidance is a direct precursor to the EU's comprehensive new AML package. The forthcoming Anti-Money Laundering Regulation (AMLR), applicable from July 2027, will codify these expectations across the bloc, creating a distinct due diligence obligation for virtual IBAN users alongside traditional customers and beneficial owners. The Sixth AML Directive (AMLD6) will further require member-state account registries to track virtual IBANs and link them to their master accounts. Financial institutions and payment service providers using virtual IBANs should treat the BaFin statement as a supervisory readiness exercise, adapting their data architecture and compliance processes now to prepare for the stricter, harmonized EU regime.