Account terminated over a money laundering suspicion: the three working days cover only the transfer

When your own account stops executing transfers without warning and a termination letter from the bank lands in the post shortly afterwards, one very practical question comes first: how long does this take, and who decides? The short answer is that two entirely different clocks are running. For a single reported transfer, Germany's Money Laundering Act (Geldwäschegesetz, GwG) sets a hard deadline of three working days. For a block on the whole account and for termination of the contract, that deadline does not apply, because both rest on different legal grounds. Confuse the two clocks and you are waiting for a date that never comes for your account.

The occasion for this guide is a notice from BaFin, the German Federal Financial Supervisory Authority, dated October 20, 2026. The regulator warns in it about job offers under which workers are to accept third-party payments into their own domestic bank account and forward them on instruction or exchange them for crypto assets. That activity triggers anti-money-laundering procedures at every bank, and at the end of that chain, in many cases, comes termination of the account. How the scheme itself works we described at length in August: crypto job offers using your own bank account and the money mule scheme. This piece starts one step later, with the consequences.

What BaFin said about crypto job offers on October 20

The authority published a consumer notice that day about job offers advertised under the names "KBG Beratung" and "KBG Pro" as administrative or assistant work from home. The operative finding states in so many words that there is a suspicion "that the unknown operators are providing payment services and crypto-asset services without authorisation". The operators, in other words, are not known to the regulator. At the same time the notice makes explicitly clear that there is no connection with KBG Pro GmbH, based in Stuttgart; the genuine company, according to the authority, neither operates the website nor offers the job. Its name was misused.

The activity described is set out briefly and precisely in the notice: accept third-party payments into your own domestic bank account and forward them on instruction or exchange them for crypto assets. Where the money comes from, the regulator adds straight away. The funds originate "presumably from third parties who have themselves become victims of criminal acts, in particular fraud". The warning was published on the basis of Section 8(7) of the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz) and Section 10(7) of the Crypto Markets Supervision Act (Kryptomärkteaufsichtsgesetz). Anyone wanting to read the full text can find it at the regulator: BaFin consumer notice of October 20, 2026.

Money mule, or Finanzagent in German, is the technical term for a person who forwards other people's money through their own account and thereby breaks the trail between offender and proceeds. In the same notice the regulator names the older label under which the same activity used to be advertised: "work as a trust assistant". The change of wording is no detail. Search for the old term and you find warnings going back to 2021; search for the new one and you often find nothing.

Account blocked or account terminated: two different events

Advice articles run the two terms together, although they carry different legal consequences. A block on an account halts access while the contract remains in place; the balance still belongs to the account holder. A termination of the account ends the contract itself, and with it the bank's obligation to maintain the account. Between the two sits the plain transaction block, where a single transfer is held up and everything else carries on.

For those affected that makes a tangible difference. With a transaction block, patience and proof of where the money came from are often enough. With an indefinite block on the account, what is at stake is access to your own balance. With a termination, it is additionally about getting an account at all again, because rent, wages and insurance are barely manageable without a payment account. The three situations call for three different responses, and letters from credit institutions do not always name the situation unambiguously. In case of doubt, it helps to look at whether the letter names a notice period or not.

Why the bank has to file a report when money laundering is suspected

Banks and savings banks are not acting at their own discretion here. Section 43(1) of the Money Laundering Act obliges them to report whenever facts exist indicating that an asset derives from a criminal offence capable of being a predicate offence to money laundering. That duty applies, in the words of the provision, "irrespective of the value of the asset concerned or the size of the transaction". There is therefore no de minimis threshold; even a small irregular payment has to be reported.

The addressee of the suspicious activity report is the Financial Intelligence Unit, housed within the German customs administration. Reports are analysed there and, where the suspicion firms up, passed on to the public prosecutor. Important for understanding your own position: a report is neither a criminal complaint nor a verdict. The law requires the notification as soon as the pattern fits, and it says nothing initially about the guilt of an account holder.

Which account movements produce that pattern is well known in practice. Incoming payments from unknown third parties in quick succession, onward transfers of almost the same sum within hours, cash deposits with no discernible reason, payment behaviour that does not match the stated occupation, and transfers to crypto-asset trading venues immediately after money arrives. The job offers the regulator is warning about generate practically all of these signals at once. That an engagement is supposedly lawful and governed by a contract changes nothing, because the bank sees only the payments.

The deadline in Section 46(1) GwG: three working days, and what it really covers

This is where the most frequently confused point sits. Section 46(1) of the Money Laundering Act governs the execution of transactions, not the state of an account. A transaction for which a report under Section 43(1) has been filed may be executed at the earliest once the bank has been sent the consent of the Financial Intelligence Unit or the public prosecutor, or once the third working day after the day the report was dispatched has passed without execution being prohibited. For calculating the deadline, Saturday does not count as a working day. The provision says no more than that, and precisely therein lies the reason for the misunderstanding.

Two conclusions follow, and both clear up a widespread misreading. First, the three working days begin on the day the report was dispatched, not on the day the account holder notices the block. Days can lie between the two, during which the person affected knows nothing of the report at all. Second, the deadline covers the reported transfer, not the account. If access remains blocked after the three working days have run, that as a rule no longer rests on Section 46 GwG but on the contract with the bank and on the bank's own due diligence duties under Section 10 of the Money Laundering Act. For that part, the law names no upper limit in days.

From this follows a sober expectation about timing. A single held-up transfer has, after four to five calendar days, either been executed or prohibited. A block on an account that rests on the general terms and conditions and on the review of the business relationship ends only once the bank has completed that review. Anyone with payments to make in the meantime needs a second payment route, and sooner than most expect.

Why the credit institution is not allowed to give the reason

Many of those affected report the same thing: the bank says nothing, points to "internal reviews" and gives no information on the phone. It looks like poor service but it is required by law. Section 47(1) of the Money Laundering Act prohibits the bank from informing the contractual partner, the originator of a transaction or any other third party about an intended or filed report under Section 43(1), about an investigation opened on the basis of such a report, and about a request for information from the Financial Intelligence Unit.

This prohibition on disclosure, known in the jargon as tipping off, explains the behaviour of the case handlers entirely. An employee who gives the true reason breaches a provision of the Money Laundering Act. Exceptions under subsection 2 essentially cover only state bodies and other entities within a corporate group. Ask at the counter for the legal basis, then, and you get no answer, because providing information on this matter is forbidden.

In practice that means the route of complaining to the bank leads nowhere on this question. More promising is to make your own side demonstrable, that is, to underpin the origin and purpose of every irregular payment with documents, and to seek legal help in banking and criminal law as soon as a block lasts longer than a few days. Different rules apply to legal representatives and to courts than apply on the phone.

When a money laundering suspicion turns into criminal proceedings

Section 261 of the Criminal Code (Strafgesetzbuch) makes money laundering a criminal offence. It is punishable, among other things, to exchange, transfer or move an object deriving from an unlawful act, or to procure, keep or use it for oneself or a third party. The sentencing range runs up to five years' imprisonment or a fine. What matters for people who have fallen for a job offer, though, is subsection 6: anyone who "recklessly fails to recognise" that an object is of that kind faces up to two years' imprisonment or a fine.

Recklessness in criminal law means that the origin of the money was obvious and someone nonetheless failed to recognise it. Intent is not required for it. That is exactly why the line "but I didn't know where the money came from" protects less than many assume. The law does, however, provide an expressly regulated way out. Under Section 261(8) of the Criminal Code, no penalty is imposed on anyone who voluntarily reports the offence to the competent authority or causes such a report to be made, provided the offence had not at that point already been discovered in whole or in part and the offender knew this or had to reckon with it on a reasonable assessment of the circumstances.

The time pressure sits inside that condition. Once the bank has filed a report and proceedings are under way, the offence has regularly been "discovered", and the route through subsection 8 is closed. Anyone who notices a block on their account has often passed that point already without knowing it. Legal advice before the first step is therefore no luxury. Assessing your own position, and the question whether a report can still carry immunity, cannot be answered without knowledge of the file.

Our own survey: one in twelve BaFin warnings describes this scheme

To gauge how common this case is, on October 23 we loaded all twelve consumer notices the regulator was listing on its financial fraud page at that point. The period runs from October 15 to October 23, 2026. Every page was retrieved individually and counted in full text. The result places the case of October 20 clearly.

The last three rows all apply to the same notice, namely that of October 20. In that lies a usable marker: the combination of the Payment Services Supervision Act and the Crypto Markets Supervision Act as a double legal basis characterises precisely the case in which private individuals are asked to hand over their own account. Warnings resting on the Crypto Markets Supervision Act alone, by contrast, concern unauthorised investment and trading offers, where the reader loses money but not their account. Six of the twelve belong in that second group. How to check such a page in a few minutes we showed with the September warnings: how to check whether a crypto provider is authorised. The count over a longer period is in our analysis of the Crypto Markets Supervision Act and the BaFin warnings.

What happens to the balance when an account is terminated

A termination does not make the balance disappear. The claim to payout remains, because the money belongs to the account holder and not to the bank. Three hurdles do turn up in the processing, though, and they count in practice. The bank needs to know a destination account it can pay out to. For as long as a suspicious activity report is under review, the payout itself can become the reported transaction and thus fall under the Section 46 GwG deadline again. And if the public prosecutor obtains an asset freezing order, access is decided by the courts and by no bank.

Three terms that are often mixed up therefore need separating. A block on an account comes from the bank. An attachment of an account comes from a creditor and concerns claims. An asset freezing order comes from the judiciary and secures suspected proceeds of crime. The documents that help are different in all three cases, and the same letter rarely helps against two of them.

One more point that surprises those affected: anyone who has forwarded other people's money frequently also faces restitution claims from the injured parties. Receive a transfer from a fraud and pass it on, and you can be liable to the injured party, even though the money left your own account long ago. The sum is then on the table although your own share of it was usually no more than a small commission. This civil-law side runs independently of the criminal proceedings and independently of the account termination.

The right to a basic account: what the Payment Accounts Act guarantees

Almost nothing in daily life works without a payment account. Hence the basic account, a payment account with elementary functions. Section 31(1) of the Payment Accounts Act (Zahlungskontengesetz) obliges every institution offering payment accounts to consumers to conclude a basic account contract with an entitled person where the application meets the statutory requirements. Entitled is every consumer lawfully resident in the European Union. Under subsection 2, the institution must offer conclusion without delay, at the latest within ten business days of receiving the application, and must confirm receipt of the application.

This right is strong but not unlimited. Section 36 of the Payment Accounts Act permits refusal where the applicant has been convicted within the past three years of an intentional offence to the detriment of that institution, its staff or its customers, where the institution has lawfully terminated an earlier basic account of the same applicant within the past year, or where it cannot meet the due diligence duties under Section 10 of the Money Laundering Act or Section 25j of the Banking Act in relation to that applicant. The last variant is the one that can bite after a money laundering suspicion.

For terminating an existing basic account, the law draws the lines tightly. Under Section 42 of the Payment Accounts Act, the account-holding institution may terminate only on the grounds named there, as a rule with at least two months' notice. Termination without notice is possible under subsection 4 only where the account holder intentionally uses the payment account for purposes that breach a statutory prohibition, or where they gave incorrect information in order to conclude the contract at all. The word intentionally is what matters here: recklessness, which already suffices in criminal law under Section 261(6) of the Criminal Code, is precisely not enough on the wording for terminating a basic account without notice. Anyone receiving a termination letter should therefore have it checked which subsection it rests on.

Statements and receipts: which documents carry proof of origin

With a bank, with the authorities and later possibly with a court, only what can be evidenced counts. It makes sense, therefore, to gather early and completely, and in this order: all account statements for the period concerned as PDFs; the employment contract or the agreement with the supposed employer including annexes; the complete communication including chat histories and voice messages; the job advertisement with its date and source; every instruction relating to an individual payment; proof of commissions received; and, if crypto assets were involved, the complete transaction list from the trading venues used along with deposit and withdrawal records.

The last point in particular is underrated. Anyone who has used an exchange or a wallet must, in case of doubt, be able to explain every movement individually, and years later at that. A tool that logs deposits and withdrawals, purchases and transfers permanently supplies that evidence without rework. Which programs manage it for the German market we have set side by side: crypto tax software and portfolio trackers compared. For a review by the tax office and for a review by a bank, the documents are the same.

What does not help, by contrast: chats deleted after the fact, a closed exchange account, and explanations from memory. Deletion reads like concealment in any file, and the basis for proving your own good faith is gone afterwards.

A crypto exchange instead of a bank account: why the same duties apply there

A widespread error holds that exchanging into crypto assets gets around anti-money-laundering rules. The opposite is true. Since the European regulation on markets in crypto-assets took effect, providers of crypto-asset services need an authorisation, and they are subject to the same reporting and due diligence duties as banks. That is exactly what BaFin relies on when it publishes warnings under Section 10(7) of the Crypto Markets Supervision Act. What duties this brings for providers is set out in our overview of the MiCA licensing obligations for crypto companies.

In practice that means a suspicious activity report arises at a trading venue just as it does at a savings bank, and a halt on withdrawals there feels identical to the user. It becomes conspicuous above all when euro amounts arrive from unfamiliar senders and shortly afterwards Bitcoin or a stablecoin goes out to an external address. That pattern is the one the regulator describes in the notice of October 20, and it is easier for a trading venue to spot than for a bank, because it sees both sides of the movement.

From this follows a simple consequence for your own practice: trade with your own money, on a platform authorised in the European Union, into an account that runs in your own name. An overview of the trading venues with European authorisation is in our comparison of MiCA-regulated crypto exchanges. As soon as someone else's money or someone else's account comes into play, the matter is no longer a side job, whatever the contract calls it.

Five features that mark out a job offer of this kind

Prevention is easier than defence, and the offers follow a pattern. An advertisement is suspect when it promises administrative work from home with no professional requirements whatsoever, when your own current account is to be part of the working equipment, when the pay is agreed as a percentage of the sum passed through rather than as a salary, when instructions for individual transfers arrive through chat services instead of a company address, when time pressure measured in hours is built up, and when the supposed employer appears in no company database held by the regulator although it is providing payment services or crypto-asset services. The German police crime prevention bodies of the federal states and the federation describe the same features from their perspective and name the legal consequences too: information on money mules at polizei-beratung.de.

A look at the regulator's company database costs two minutes and answers the most important question of all, namely whether an authorisation exists at all. If it is missing, the rest of the offer's content is irrelevant. The same check is worth making, incidentally, before any deposit at an unfamiliar trading venue; the scheme involving the supposed recovery of lost funds works through exactly the same gap, as we showed in the case of the recovery scam.

Account terminated: the Section 46 GwG deadline covers only the transfer

The most important insight for those affected is the separation of the two clocks. Three working days is the statutory upper limit for a single reported transaction. For a block on the account and termination of the contract no such figure applies; there, the contract, the due diligence duties and, in a dispute, a court decide. Three steps follow from this, in this order:

1. Stop every further payment immediately and secure the documents. Execute no more transfers, close no account, delete no chat. In parallel, export the complete transaction list from the trading venues used and store it permanently; a tool from the comparison of crypto tax software and portfolio trackers handles that retroactively for the common exchanges.
2. Get legal advice before making any statement. Whether a report under Section 261(8) of the Criminal Code can still carry immunity depends on whether the offence had already been discovered. That question is decided on the file, not on a feeling, and it cannot be reversed once a statement has been made. At the same time, have it checked which subsection the termination letter rests on.
3. Restore your ability to pay, and keep things separate from now on. File an application for a basic account under Section 31 of the Payment Accounts Act; the institution must offer conclusion within ten business days or give reasons for refusing. For your own purchases and sales from then on, use only trading venues authorised in the European Union, for instance from our comparison of crypto exchanges, and never open an account for someone else's payments.

And the sentence that sums up the whole scheme: an employer who needs your bank account does not need your labour.

(As of October 23, 2026. This article is neither investment advice nor legal advice. Prices and fee structures change; check the terms with the provider before you buy.)