Executive Summary
On 27 July 2026, BaFin published a Supervisory Communication (6/2026) on money laundering and terrorist financing risks associated with virtual IBAN (vIBAN) structures. While acknowledging the operational benefits of vIBANs, BaFin highlights the transparency challenges that may arise in certain payment arrangements and sets out its's expectations regarding risk management, monitoring and customer due diligence measures.
BaFin notes that certain vIBAN structures may increase the risk of misuse for money laundering and terrorist financing purposes, including in connection with informal financial transfer systems and so-called “Underground Banking” arrangements.
Although the communication does not introduce new regulatory obligations, it provides valuable insight into BaFin's supervisory expectations and the measures firms should consider when assessing and mitigating AML risks associated with virtual IBAN arrangements.
For whom is this relevant?
The communication is particularly relevant for payment service providers (PSPs), electronic money institutions (EMIs) and credit institutions involved in vIBAN structures.
What are BaFin's concerns?
BaFin's communication is driven by concerns that certain vIBAN structures may reduce transparency over the parties involved in a payment chain and make it more difficult to identify the origin and destination of funds. According to the regulator, these risks may be particularly relevant in complex or cross-border arrangements and in connection with informal financial transfer systems, including so-called “Underground Banking” arrangements.
The communication is particularly relevant for PSPs operating vIBAN models and for credit institutions providing master accounts or vIBAN infrastructure. BaFin specifically highlights structures where information on end customers or beneficial owners may not be readily available throughout the payment chain.
Importantly, BaFin does not question the use of virtual IBANs as such. Rather, the regulator's focus is on ensuring that firms appropriately identify, assess and mitigate the financial crime risks that may arise from certain vIBAN arrangements.
Key takeaways for PSPs, EMIs and banks
Many of the risk indicators identified by BaFin will already be familiar to firms from a broader AML and financial crime perspective. However, the communication suggests that certain characteristics of vIBAN structures, particularly limited transparency over end customers and complex PSP arrangements, may increase the likelihood of these risks materialising.
Institutions using virtual IBAN arrangements should consider:
- reviewing whether vIBAN structures are appropriately reflected in their AML risk assessments;
- assessing whether they have sufficient visibility over customers, beneficial owners and payment flows;
- evaluating whether transaction monitoring systems effectively identify risks associated with complex vIBAN arrangements; and
- ensuring appropriate oversight of third-party providers and partner institutions involved in the structure.
The communication also indicates that virtual IBAN arrangements may receive increased supervisory attention as part of future AML reviews and inspections.
Looking ahead
BaFin's Supervisory Communication applies immediately and will remain in force until 10 July 2027, when the new EU Anti-Money Laundering Regulation (AMLR) becomes applicable.
The publication should therefore be viewed in the wider context of increasing regulatory focus on payment infrastructures and financial crime risks across Europe. While the communication does not introduce new legal requirements, it provides a clear indication of how BaFin currently assesses AML risks associated with virtual IBAN structures and the measures it expects firms to have in place.
Firms operating vIBAN models should use this opportunity to review their existing control frameworks and ensure that transparency risks are appropriately addressed ahead of the AMLR regime.
BaFin's message is clear: virtual IBANs remain a legitimate and widely used payment solution, but firms should carefully assess the transparency and financial crime risks that may arise from certain vIBAN structures. Institutions that can demonstrate robust governance, customer due diligence and transaction monitoring arrangements will be better placed to meet supervisory expectations and respond to future regulatory scrutiny.
