We advise at the intersection of prevention, crisis response and enforcement.

The first hours after a dawn raid, a cyber incident or a money laundering suspicion determine how expensive the matter becomes. We take control so that your management remains able to act — and so that nothing is said or handed over that may later be used against you.

Ad-hoc crisis team

Immediate legal and strategic protection for the management body.

Managing authorities

Steering communications with public prosecutors, BaFin and international regulators.

You need to know what actually happened: robustly, discreetly and documented in a way that holds up before authorities. We establish the facts — and then represent them vis-à-vis prosecutors and supervisors.

Investigations

Tailored internal investigations conducted with the utmost discretion and methodological precision.

Defence and enforcement

Representation in enforcement proceedings, defence against sanctions and administrative fines.

Whether you should onboard, retain or exit a business partner depends on facts that are rarely in plain sight. We create the basis for that decision and structure contracts so that default, reputational and sanctions risks do not end up with you.

Counterparty risk

Analysis and legal structuring of contracts to minimise default, reputational and sanctions risks.

Deep-dive due diligence

Risk-based reviews in M&A transactions, joint ventures and strategic partnerships — financial crime, ESG, German Supply Chain Act (LkSG).

A monitor or special representative on site changes day-to-day operations for months. We know these proceedings both from operational implementation and from legal support, and set them up so that the requirements are met without paralysing your business.

Supporting mandates

Preparing and supporting companies faced with a government-appointed monitor (e.g. by US authorities) or a special representative (e.g. appointed by BaFin).

Own appointment

Acting as independent experts to restore regulatory trust.

You need a system that holds up under examination — not a rulebook that merely looks good. We build it, or bring your existing system to a standard that supervisors and auditors accept.

Build-up

Threat and risk assessment, control and governance concept, roles and responsibilities, policy framework, training architecture and reporting lines — tailored to your business model and supervisory environment.

Enhancement and effectiveness

Maturity assessment, closing control gaps and preparing effectiveness audits, e.g. under IDW PS 980, including documentation for supervisors and auditors.

Two things stand between a regulatory requirement and what your staff actually do: an intelligible instruction and an organisation able to deliver it. We design both together with your business functions, not from a desk far away.

Policy framework

A clear hierarchy of group policy, standard and procedural instruction — with unambiguous ownership, approval and review cycles, versioning, attestation and evidence of which rule covers which supervisory requirement.

Procedures

Translation into robust work instructions and control descriptions: who reviews what, in what order, with what discretion, with what documentation and with what escalation.

Target operating model

Structural and process organisation of the compliance function: delineation of first and second line, roles and interfaces, location and capacity model including near- and offshoring, committee structure, reporting lines and management KPIs.

Path to the target state

Baseline assessment, gap analysis and an implementation plan with defined milestones — so the target state does not stay on paper but is demonstrably reached in stages.

Requirements grow faster than your budget. That can only be resolved with technology that withstands scrutiny. We combine the legal requirement with knowledge of the systems meant to fulfil it — from our own operational responsibility in large groups.

Digitalising compliance processes

Mapping and redesigning manual workflows, eliminating media breaks, automating recurring review steps in onboarding, ongoing maintenance and reporting — with end-to-end, audit-proof documentation.

Selecting and validating solutions

Requirements definition, market screening and selection of RegTech applications for KYC, KYB, sanctions and PEP screening, transaction monitoring and adverse media research; followed by validation of rule sets, thresholds and hit rates — including tuning and evidence for supervisors.

Data as the foundation

Data quality, register connectivity and ownership data down to the ultimate beneficial owner are the prerequisite for any automation. We examine the origin, currency and verifiability of the data before decisions are based on it.

AI in control processes

Legal framework, governance and traceability when using artificial intelligence — purpose limitation and data protection, model and result documentation, final human decision, and the question of how an AI-supported result can be evidenced in proceedings.

Outsourcing and operations

Contractual and regulatory design of the use of external providers, instruction and audit rights, exit scenarios and the responsibility that remains in-house despite outsourcing.

After a supervisory finding, what counts is not a statement of intent but proof that the deficiency has truly been remedied. We have run such programmes ourselves in large institutions and lead them from root cause analysis to closure evidence.

Root cause analysis and action plan

Root cause analysis across process, control, system and culture; from this, a prioritised action plan with deadlines and responsibilities that stands up before authorities.

Clean-up of legacy portfolios

Look-back analyses and large-scale portfolio remediation — KYC remediation of entire client portfolios, transaction look-backs, filing of omitted suspicious activity reports, clean-up of screening and data quality deficiencies.

Programme management

Governance of a multi-year remediation programme: resource and vendor management, quality assurance, progress reporting to the management board, supervisory board and regulator.

Closure and evidence

Evidence of sustained effectiveness towards BaFin, special representatives or a monitor — including when a programme can be closed and what remains in business-as-usual afterwards.

You want to know what new requirements actually mean for your institution — not what the official journal says. We translate legislative projects into impact, effort and a roadmap you can defend at board level.

EU Anti-Money Laundering Regulation

Regulation (EU) 2024/1624 applies directly in all Member States from 10 July 2027 and replaces large parts of the German Money Laundering Act (GwG); it is flanked by the sixth Anti-Money Laundering Directive and the new EU authority AMLA, based in Frankfurt am Main, which will directly supervise selected high-risk institutions from 2028. We assess impact, regulatory gaps and the need to adapt due diligence, screening and documentation.

EU Anti-Corruption Directive

The directive that entered into force in May 2026 harmonises corruption offences and sanctions; Member States have two years to transpose it. For companies, the effective compliance management system therefore moves to the centre of the liability question. We review policies, third-party controls and training concepts against the new benchmark.

Further initiatives

Ongoing monitoring of adjacent regimes — sanctions law, supply chain, ESG reporting — and how they interact with existing control systems.

Sometimes you need a body outside the organisation: for reports that do not get through internally, for a confidential second opinion and for training that goes beyond slogans.

External ombudsman

Assuming the ombuds function and operating the internal reporting channel as a third party within the meaning of the German Whistleblower Protection Act — confidential under attorney privilege, with a clear escalation and documentation line.

Training for executives

Tailored training for management boards, managing directors, supervisory boards and compliance functions — based on real case constellations instead of slogans, including crisis exercises and dawn raid simulations.

Sounding board

A confidential second opinion for compliance officers and anti-money laundering officers: an interlocutor who knows the role from experience, for matters of principle, escalations and resource decisions.

If a key function is vacant, we fill it ourselves on an interim basis — in the role, with authority to instruct and a duty to report, not advising from the outside.

Functions

Anti-money laundering officer and deputy, compliance officer, head of financial crime, head of compliance or security — including regulatory notification and suitability requirements.

Special situations

Leading a remediation programme, integration after an acquisition or carve-out, stabilisation after an incident, support during a restructuring.

Build-up and handover

The mandate ends as planned: we document processes and decisions, onboard the permanent hire and hand over transparently.

Clarity of role

Before taking on the role we clarify its boundaries, liability and possible conflicts of interest, so that the operational function remains compatible with professional rules for attorneys.