Sanctions under Anti-Money Laundering Law: What the New CJEU Ruling on Corporate Fines Means

The ruling was based on an Austrian case. Under local regulations, a sanction against a legal entity was, among other things, subject to a natural person having previously been formally granted suspect status and a culpable breach being attributed to them. The ECJ considers such additional requirements to be problematic under EU law if they make the effective sanctioning of companies more difficult.

The core of the decision

At the heart of the decision is the question of the conditions under which companies can be sanctioned for breaches of anti-money laundering obligations. The ECJ emphasizes that while legal entities can only act through natural persons, it does not follow that a corporate sanction always requires the prior individual determination of responsibility of a specific person.

Articles 58 to 60 of Directive (EU) 2015/849 (fourth Anti-Money Laundering Directive – “4AMLD”) oblige Member States to ensure that obliged entities can be held liable for breaches of national implementing provisions. These obliged entities explicitly include legal entities, such as credit and financial institutions as well as certain companies outside the financial sector.

Articles 60(5) and (6) of the 4th AMLD regulate the conditions under which the conduct of natural persons can be attributed to a legal entity. In the ECJ's view, however, this does not result in an obligation to sanction these individuals beforehand or to name them in the decision.

The ECJ wants to prevent national attribution rules from clouding this view of the organization. If sanctions against companies were to regularly fail because no individual natural person can be clearly identified within complex organizational structures, the purpose of the Directive could be undermined.

However, it is equally important to note that the ECJ does not create corporate liability without preconditions. Authorities must still establish an infringement subject to a fine and respect constitutional guarantees. These include, in particular, the principle of culpability, the presumption of innocence, the principle of proportionality and the rights of defence.

Not a surprising development

The decision aligns with the ECJ's previous case law. In the "Deutsche Wohnen" case (Case C-807/21) in December 2023, the Court had already ruled on the General Data Protection Regulation (GDPR) that the imposition of an administrative fine on a legal entity must not be made dependent on additional national attribution requirements. Although the current decision concerns a Directive and not a Regulation, the 4AMLD nevertheless prescribes binding minimum standards for the design of national sanctioning systems.

At the same time, the ECJ emphasizes that fines still require intent or negligence. Strict liability based purely on results is not sufficient.

Significance for Germany

The decision is particularly relevant for Germany because corporate sanctions under Section 30 of the Act on Regulatory Offenses (OWiG) are traditionally linked to criminal offenses or regulatory offenses committed by specific managers. Additionally, Section 130 OWiG may be considered in the case of breaches of supervisory duties.

In addition, Section 56 of the German Money Laundering Act (GwG) contains an extensive catalogue of fines for breaches of money laundering obligations, for example in connection with risk analyses, due diligence requirements, documentation, reporting or internal safeguards.

Section 56 GwG explicitly formulates the regulatory offenses for intentional or reckless conduct; in the case of certain serious, repeated or systematic breaches, significant fines may be imposed on legal entities or associations of persons.

While the ECJ does not directly force Germany to introduce a separate corporate criminal law, it suggests that Section 56 GwG and the general rules of administrative offence law must be interpreted in conformity with EU law when it comes to the enforcement of money laundering obligations shaped by EU law.

Where a legal entity is itself an obliged entity, a sanction should not fail solely because no specific natural person has been formally identified as the offender and established as such in the decision.

This does not mean that German law must completely detach liability from individual actions. However, if anti-money laundering due diligence duties are breached, the sanctioning of the company must not fail because the authority cannot present a single name in the thicket of responsibilities.

This puts a stronger focus on the organization itself: Were risk analyses properly prepared and updated? Were internal safeguards adequate? Were there clear responsibilities, effective controls and robust escalation processes? Were suspected cases identified, documented and forwarded?

So far, there is no evidence of any targeted legislative adjustment to the German money laundering sanctioning system reacting specifically to the ECJ ruling.

While Section 56 GwG was amended as of 10 February 2026, the amendment in the published version concerned in particular individual cooperation and information duties, rather than a structural reorganization of corporate sanctions.

In practice, therefore, the interpretation of existing provisions in conformity with EU law is likely to be of decisive importance.

European development

The decision comes at a time when European anti-money laundering law is being restructured anyway. Regulation (EU) 2024/1624 (“AMLR”) establishes a directly applicable European regulatory framework for core anti-money laundering duties. The Regulation will apply essentially from 10 July 2027 and is intended to reduce the previous fragmentation caused by national transposition rules.

In addition, Directive (EU) 2024/1640 (sixth Anti-Money Laundering Directive – “6. AMLD”) contains requirements for member state mechanisms, supervision, registers, financial intelligence units and sanctions. It does not replace every national design but sets the framework for more harmonized anti-money laundering supervision.

For companies, this means that the trend is not towards fewer, but towards more harmonized and enforcement-oriented anti-money laundering requirements. The ECJ ruling fits into this development. Corporate responsibility should not fail due to formal national hurdles but should be effectively enforced.

What companies should do now

Companies should use the ruling as an opportunity to review their anti-money laundering organisation critically. The focus should be in particular on:

• Risk analysis and its regular updating,

• internal safeguards,

• clear responsibilities,

• documented decision-making and escalation channels,

• training and controls,

• and the handling and documentation of suspicious cases.

The decisive point is less the question of who committed a single error, but rather whether the organization as a whole was able to ensure adequate anti-money laundering controls. Companies that document processes, responsibilities and control measures transparently improve not only their compliance structure but also their defensive position in the event of regulatory action or fine proceedings.