FIU [DEU] ¦ 2025 Annual Report

Financial crime is becoming more industrial – and the FIU’s 2025 picture makes that clear

The 2025 picture of financial intelligence in Germany shows a system under pressure, but also a system that is maturing. The central message is not simply that more suspicious activity was reported. It is that the nature of the workload is changing. As reporting volumes rise, the analytical response is becoming more selective, more data-driven, and more focused on the threats that matter most for money laundering, fraud, and terrorism financing.

That shift reflects a wider trend across financial crime enforcement. Volume alone is not a useful measure of effectiveness. What matters is whether suspicious activity can be sorted, connected, and turned into actionable intelligence fast enough to stop criminal proceeds from moving into the legal economy. The German FIU’s 2025 activity shows exactly that logic in practice: fewer analysis reports than in the previous year, but a stronger concentration on high-risk cases and a larger impact on law enforcement and asset interruption.

Fraud and money laundering are converging

One of the clearest lessons from 2025 is that fraud is not just a predicate offence sitting upstream of money laundering. In many cases, the two are intertwined from the start. Criminal networks use payment infrastructure, merchant accounts, and digital onboarding processes as part of the fraud itself, while also using those same channels to move and disguise proceeds.

That convergence is especially visible in cyber-enabled fraud. The large-scale credit card fraud known as “Operation Chargeback” illustrates the point well. The case involved millions of cardholders in many jurisdictions, hundreds millions of euros estimated damage, and a business model built around deceptive subscriptions, fake websites, and merchant structures designed to keep transactions looking ordinary. The scheme did not rely on classic cash-based laundering. It exploited the regulated payments system itself.

That is a major warning sign for financial institutions. Fraud typologies can not be treated as purely customer-protection issues or card-network disputes. They are also money laundering indicators, especially when fake merchants, repeated small-ticket charges, technical obfuscation, or cross-border payment routing appear together.

Bastian Schwind-Wagner _Follow

"The 2025 findings show that financial crime is becoming more organised, more digital, and more closely tied to mainstream payment systems. Fraud, money laundering, and cross-border transfers are increasingly part of the same operational chain, which raises the pressure on banks, payment firms, and intelligence units to detect patterns earlier and act faster.

The shift toward risk-based analysis is the right response to that reality. Better reporting standards, stronger international cooperation, and faster data-driven tools are making it possible to focus on the cases that carry the highest threat, rather than just the largest volume of alerts."

The payment sector is at the center of the risk shift

The most striking statistical development in 2025 was the jump in suspicious activity reports (SARs) from credit institutions and digital financial service providers. Total reporting from the financial sector increased sharply, driven above all by classic banks and by digital-first providers that are often labelled neobanks. Digital financial providers now account for a much larger share of reporting than before, despite being fewer in number than traditional institutions.

That pattern suggests both, higher exposure and better detection. These providers operate with fast account opening, high transaction density, and often a strong cross-border customer base. Those features are commercially attractive, but they also create conditions that criminals can exploit. Fraud, mule activity, account takeover, and laundering through payment flows can scale quickly in such environments.

A digital business model does not automatically create a higher crime risk, but it does change the risk profile. Institutions with rapid onboarding, crypto access, and intense payment traffic need monitoring logic that can detect patterns at speed, not just after manual review.

Real estate, reporting requirements, and the tightening of thresholds

The real estate sector also saw changes that matter for financial crime prevention. New reporting rules in the property area were narrowed and clarified to reduce unnecessary uncertainty and to make the reporting obligation more precise. Thresholds were defined more tightly, including for third-party payments and deviations from market value.

That is a sensible move. Weakly defined reporting rules can flood central intelligence units with low-value notifications, while still missing the structured evasion tactics criminals use. By making the triggers more specific, the system becomes more usable for both reporters and analysts.

This is also a reminder that bad actors adapt quickly. When one threshold becomes harder to cross directly, they split payments, use intermediaries, or spread the activity across multiple entities. In property laundering, the real risk often lies not in a single obvious red flag, but in the pattern of structuring around several rules at once.

Why the analysis output fell while the input rose

A common mistake in interpreting financial intelligence statistics is to assume that fewer analysis reports mean less work or less effectiveness. In this case, the opposite is true. Suspicious activity reports (SARs) increased sharply, while the number of analysis reports sent out fell.

That is exactly what a more risk-based approach (RBA) should produce. When intake grows, an intelligence unit cannot and should not process everything equally. The point is to concentrate resources on the matters with the highest potential value for law enforcement. That creates a more selective pipeline, but a more useful one.

The trade-off is real. Less volume means some cases will receive less attention at the central level. But the benefit is that the cases that do get deeper treatment are more likely to lead to intervention, asset freezing, or case building. In a financial crime system overwhelmed by noise, selectivity is a control mechanism.

Softer clues, faster intervention

Another noteworthy development is the rise in immediate measures to block suspicious transactions before funds can fully enter the legal economy. The number of such interventions reached a new high, and the total value involved was far above the previous year.

That matters because timing is everything in financial crime. Once proceeds are dispersed, layered, or moved across borders, recovery becomes much harder. The ability to stop transfers temporarily can be the difference between a recoverable case and a lost one.

The rise in immediate measures also shows that intelligence is becoming more operational. It is not only feeding long-term investigations. It is also helping to prevent the completion of suspicious transfers in real time. For banks and payment firms, that means transaction monitoring must be tuned not just to create alerts, but to support timely intervention when a case is credible.

International cooperation is no longer optional

Financial crime cases increasingly cross borders from the first transaction. The 2025 picture shows this clearly. International requests, cross-border collaboration, and joint action with partner FIUs remain core to effective intelligence work.

The Germany/Luxembourg cooperation around large fraud and payment structures is a good example of how cross-border intelligence can unlock a case that would otherwise remain fragmented. The same is true for work inside European networks and within the Egmont Group. If the infrastructure, the merchant entities, the payment accounts, and the victims are spread across countries, the intelligence response must be as well.

This is where the future of financial crime control is heading. National systems will still matter, but the real value will come from how well they connect to each other. Harmonised reporting standards, common data formats, and faster automated exchange are becoming essential rather than optional.

Technology is becoming part of the investigation model

The FIU’s growing use of low-code tools, automated data handling, and data-driven analysis methods is another sign of where the field is going. Financial intelligence work used to depend heavily on manual processing and isolated case review.

Low-code development allows faster deployment of internal tools. Network analysis and anomaly detection help reveal links that would be hard to spot manually. Automated access by law enforcement and the broader use of structured digital reporting reduce delay. All of this points toward a more technical intelligence function.

But technology is not the answer by itself. It improves scale and speed, yet human judgment remains central. The real challenge is to combine automated filtering with experienced analytical review so that important signals are not lost in the process.

The next phase will be defined by precision

The clearest strategic takeaway from 2025 is that financial intelligence is moving toward precision. Better reporting standards, more targeted analysis, stronger cross-border exchange, and faster intervention tools all point in the same direction.

For banks, payment providers, and other obliged entities, this raises the bar. They need better internal monitoring, better data quality, and a sharper understanding of fraud as a laundering threat. For investigators and intelligence units, it means building case logic around networks, payment flows, and digital infrastructure rather than around isolated suspicious transactions.

The financial crime landscape is changing fast, but the underlying lesson is stable. Criminals seek efficiency, scale, and speed. The response must do the same.

Dive deeper

• Generalzolldirektion ¦ FIU, Jahresberichte der FIU ¦ Link