BaFin orders new deadlines for Deutsche Bank's transaction monitoring fixes

What happened

BaFin, the German Federal Financial Supervisory Authority, published a notice on 9 October 2026 about Deutsche Bank AG. The notice concerns the prevention of money laundering and terrorist financing.

The order is dated 15 September 2026. It became final, meaning legally binding, on 6 October 2026. BaFin cites Section 51(2), first sentence, of the Money Laundering Act in conjunction with Section 25h(5) of the Banking Act.

BaFin ordered new deadlines for the bank to fix deficiencies in the data processing systems it uses for transaction monitoring. These systems help detect money laundering and terrorist financing. According to BaFin, transaction monitoring needed to be realigned because of changed technical requirements. That required new remediation deadlines in some cases, so the September order updates the earlier orders.

Those earlier orders date from April 2021 and November 2023. In both, BaFin had already ordered the bank to promptly fix transaction monitoring deficiencies.

BaFin’s notice also sets out the background. Banks must run data processing systems to detect suspicious business relationships and payment transactions, and report relevant transactions to the Financial Intelligence Unit. The systems must be kept up to date to remain reliable. The notice does not publish the new deadline dates.

Why it matters

This section is analysis, not a finding by BaFin. The order is a deadline reset, and BaFin ties it to changed technical requirements.

Three orders across roughly five years suggest that remediation of monitoring data systems can span several supervisory cycles. They also suggest that supervisors keep the same system under review as the underlying technology and requirements change.

For other firms, the useful lesson concerns governance. A deadline set against one technical target can lose its basis when that target moves. The likely effect is that a supervisor reading a revised plan will want the reason for each change, and the person who approved it.

Practitioner angle

The notice addresses Deutsche Bank. Your exposure depends on your own remediation plan, so use the order as a test of how that plan is governed.

• Does your transaction monitoring remediation plan state which dependency each deadline rests on, whether data feeds, vendor releases, or model changes? Who re-baselines the plan when a technical requirement changes?
• Is each deadline change approved and recorded with the reason, as BaFin recorded its reason?
• Do you keep an audit trail linking each earlier supervisory or internal finding to the current plan?
• Do your systems stay “kept up to date”, in BaFin’s phrase, through a change calendar that covers data processing systems?
• What would your supervisor see if it compared your original and revised timelines?

Start with the last question. Put the original and revised timelines side by side and confirm that every shift has a recorded reason and a named approver.