![Bafin [DEU] ¦ Risks of Virtual IBANs in Connection with Underground Banking](/assets/images/posts/pexels-rdne-8098274_1024.webp)
27 July 2026
Bafin [DEU] ¦ Risks of Virtual IBANs in Connection with Underground Banking
Virtual IBANs and underground banking: where payment efficiency becomes a money laundering risk
Virtual IBANs have become an established tool for payment segregation, reconciliation and automated allocation of customer funds. Their use can improve operational efficiency without creating a separate payment account for every customer. Yet the same structure can create significant weaknesses in customer transparency and transaction tracing, particularly where several payment service providers (PSPs), jurisdictions and corporate entities are involved.
German supervisory findings have identified heightened money laundering and fraud risks in certain virtual IBAN arrangements. The concern is not the virtual IBAN itself, but the way its architecture can separate the institution holding the master account from the customers who actually send and receive funds.
The structure behind a virtual IBAN
A virtual IBAN is an identifier assigned to a customer or payment relationship without necessarily being linked to an individual payment account. Incoming funds are credited to a central master or omnibus account, while the virtual IBAN allows the payment service provider to attribute each transaction to a particular customer.
This arrangement can involve several distinct parties. A credit institution may provide the master account and associated virtual IBANs to a payment service provider. That provider may then allocate individual virtual IBANs to its own customers. The credit institution may therefore have a direct relationship only with the payment service provider, while lacking sufficient information about the end customer, the customer’s business activity or the ultimate beneficial owner.
That separation creates a material control issue. The entity with access to the payment infrastructure may not have complete information about the parties generating the transactions. Conversely, the institution responsible for the master account may not be able to assess the economic purpose of individual payment flows without effective information sharing arrangements.
Why virtual IBANs can support underground banking
Underground banking comprises informal financial transfer systems that operate outside regulated banking and payment structures. Such systems may use intermediaries, commercial transactions, trade-based arrangements or alternative payment routes to move value while reducing visibility over its origin, destination and economic purpose.
Activities of this kind may constitute unauthorised banking business or unauthorised payment services. They may also provide infrastructure for concealing or transferring the proceeds of criminal conduct. The relevant predicate offense can be fraud, for example, where funds obtained through deceptive schemes are routed through apparently legitimate businesses or payment accounts. Other predicate offenses may also be involved, including illicit trade, corruption, tax-related crimes or organised criminal activity, depending on the underlying facts.
Virtual IBAN arrangements can become attractive to such networks because they allow transactions to be divided among numerous identifiers while the funds ultimately pass through a smaller number of central accounts. The formal account holder, the payment service provider and the actual user of the virtual IBAN may be different parties. This fragmentation can make it difficult to establish who controls the funds, who benefits from them and why the payments were made.
The laundering risk is particularly acute where the structure obscures the link between the proceeds of a predicate offense and the person or business receiving them. Payments may be layered through several entities, converted into apparently commercial receivables or combined with international transfers. The resulting transaction chain can make criminal proceeds appear connected to ordinary trade or payment activity.
Cross-border structures increase the information gap
Having a virtual IBAN with a specific country code does not necessarily mean that the underlying master account is held in that country. The master account may be maintained abroad, creating a cross-border structure in which the identifier suggests one jurisdiction while the account, service provider and end customer are located elsewhere.
This can complicate the allocation of regulatory responsibility and the retrieval of customer information. It may also hinder the assessment of country risk, beneficial ownership, source of funds and the purpose of individual transactions.
The risk increases where a payment service provider from a third country operates between the account-holding institution and the end customer. Supervisory analysis has identified high-value payment flows involving international companies, intermediaries in Hong Kong or mainland China, and vague payment references. Such features do not establish criminality on their own, but they can indicate elevated exposure to fraud, money laundering and misuse of payment services.
Indicators of elevated money laundering risk
A combination of factors may point to misuse of a virtual IBAN structure. These include a large number of virtual IBANs linked to a master account held for a foreign payment service provider, particularly one established in a third country. Risk also increases where the provider cannot demonstrate that it has fully recorded the end customers’ identities, addresses and beneficial owners.
Transaction activity should be examined closely where payment volumes are high but cannot be reconciled with the customer’s apparent business model. Newly incorporated companies, shared or unusual business addresses, minimal online presence and generic websites may indicate the use of shell or front companies. Similar concerns arise where recipients present no credible commercial presence or advertise goods and services that do not fit their stated business activity.
Generic payment references such as “payment for goods” or “balance invoice” provide little evidence of an underlying transaction. They become more concerning when combined with rapid account turnover, short-lived virtual IBANs, multiple intermediaries or complex international payment routes.
Fragmented transaction patterns are another important indicator. Funds may arrive from numerous unrelated parties, pass through several payment service providers and leave the structure shortly afterwards. The use of commercial invoices or trade payments does not remove the risk where the goods, counterparties, pricing or payment routes lack economic plausibility.
The connection with fraud proceeds
Fraud is a particularly relevant predicate offense in this context because fraudulent schemes often generate numerous payments from unrelated victims. Virtual IBANs can provide individual payment references for different customers or campaigns while directing the proceeds to a central account. This may enable a payment service provider to process substantial volumes without the underlying institution seeing a complete picture of the parties and activities involved.
Possible scenarios include investment fraud, invoice fraud, online marketplace fraud and business email compromise. In each case, the initial proceeds may be transferred through accounts held in the names of companies that appear to provide payment, consulting or trading services. Where the financial institution cannot identify the end customer or verify the commercial rationale, it may fail to connect the payment activity with the original deception.
The laundering process may then involve layering through international transfers, transfers between related companies or payments disguised as trade transactions. The central compliance question is therefore not merely whether the virtual IBAN is being used as designed. It is whether the institution can identify the persons behind the transactions and determine whether the funds are consistent with a legitimate economic activity.
What institutions should be able to demonstrate
The risk-based approach requires both credit institutions and payment service providers to understand the entire virtual IBAN structure. This includes identifying the roles of the account-holding institution, the master account holder, each intermediary and the end customer. Institutions should also establish who has access to beneficial ownership information and whether that information is reliable, current and available without undue delay.
Customer due diligence (CDD) should be proportionate to the complexity of the arrangement, the number of intermediaries, the jurisdictions involved and the degree of transparency over the end customer. Where the structure makes it difficult to attribute payments to the actual customer or beneficial owner, enhanced due diligence (EDD) may be necessary; in Germany, under section 15 of the German Money Laundering Act.
Relevant information includes the payment service provider’s business model, customer acceptance procedures, monitoring framework and internal controls. The institution providing the master account should not rely solely on contractual assurances. It should assess whether the payment service provider can identify its customers, verify beneficial ownership and provide complete transaction information when required.
Virtual IBAN users and their beneficial owners should also be recorded correctly in the relevant account retrieval system where applicable. Accurate data is essential for competent authorities and law enforcement agencies seeking to identify the persons behind payment activity.
Monitoring must follow the structure of the payments
Conventional transaction monitoring may be ineffective if it examines only individual payments or the formal master account holder. Controls should be capable of analysing relationships between virtual IBANs, end customers, counterparties, payment service providers and jurisdictions.
Monitoring should identify rapid inflows and outflows, unusual concentrations of funds, repeated transfers between connected entities and payment chains that lack a credible commercial explanation. It should also compare transaction activity with the customer profile, expected turnover, stated business sector and known counterparties.
A useful control framework should be able to detect patterns across the entire structure rather than treating each virtual IBAN as an isolated account. Alerts should be assessed using information about the end customer and beneficial owner, not only the name of the payment service provider formally linked to the master account.
Where information is missing, inconsistent or unavailable, the institution should treat that deficiency as a risk factor in its own right. It may need to restrict certain activities, request additional evidence, apply enhanced monitoring or reconsider whether the relationship can be maintained.
Governance and accountability
The risks associated with virtual IBANs should be reflected in the institution’s risk assessment, policies, procedures and training. Staff responsible for onboarding, correspondent relationships, payment operations, financial crime compliance and investigations need a shared understanding of how the structure operates and where responsibility for customer information lies.
The institution should be able to explain why the arrangement is commercially justified, how end customers are identified, how beneficial ownership is verified and how suspicious activity is detected. It should also maintain an audit trail showing the information obtained, the risk assessment performed and the reasons for decisions taken.
The German supervisory communication issued on 27 July 2026 applies until the EU Money Laundering Regulation takes effect on 10 July 2027. Its practical message is broader than the treatment of one payment product: payment transparency must extend to the person who ultimately controls or benefits from the funds.
Virtual IBANs can support legitimate payment activity, but they can also create an information gap that criminal networks exploit. Where that gap prevents an institution from tracing funds, identifying the beneficial owner or understanding the underlying economic purpose, the structure presents a material money laundering risk – particularly where fraud proceeds or unauthorised financial services may be involved.
Dive deeper
- Bafin ¦ Aufsichtsmitteilung 06/2026 (A): Risiken virtueller IBANs im Zusammenhang mit Underground-Banking ¦ Link
EU Sanctions Helpdesk
The EU Sanctions Helpdesk platform supports European operators in complying with European Union restrictive measures (also known as sanctions) imposed worldwide.
Aimed primarily at Small and Medium-sized Enterprises (SMEs), the Helpdesk offers resources and personalised help to companies performing sanctions due diligence checks.