Financial services
Employment screening in the German financial services sector goes far beyond a simple background check. Section 25h of the German Banking Act (KWG), the German Anti-Money Laundering Act (GwG) and the Minimum Requirements for Risk Management (MaRisk) require transparent processes, documented risk-based decisions and the consistent application of employment screening across employees, external partners and third parties.
A criminal record certificate alone is no longer sufficient to meet these requirements.
Why financial institutions in Germany face stricter employment screening requirements
For financial institutions, employment screening is far more than an established HR practice. Various regulatory requirements call for organisations to identify risks at an early stage, implement appropriate control measures and document decisions in a transparent and auditable manner.
The most important requirements include:
- Section 25h of the German Banking Act (KWG): requires financial institutions to establish appropriate measures to prevent money laundering, terrorist financing and other criminal offences. This also includes suitable controls for employees, external service providers and third parties.
- Section 6(2((5) of the German Anti.Money Laundering Act (GwG): requires institutions to assess the reliability of employees through appropriate measures.
- MaRisk (Minimum requirements for risk management): requires transparent control processes, clearly defined responsibilities and appropriate oversight, particularly where outsourced processes and external service providers are involved.
What BaFin auditors actually look for
Today, regulatory audits focus on more than whether individual checks have been carried out. What matters is whether employment screening is embedded within the organisation as a transparent, consistent and well-documented process. Among another things, BaFin expects:
- Employment screening processes to b e clearly defined and documented.
- Risk-based decisions to be transparent and properly justified to candidates.
- Roles, responsibilities and governance structures to be clearly established.
- Requirements to be applied consistently across relevant employees, external partners and service providers.
A documented, audit-ready process increases transparency and makes it easier to demonstrate regulatory compliance during an audit.
Why a criminal record certificate alone no longer meets regulatory expectations
A Criminal record certificate provides only a snapshot of an individual's criminal record at a specific point in time. However, this alone is not sufficient to meet the requirements of modern compliance and risk management frameworks.
Depending on the role, level of risk and applicable regulatory requirements, a comprehensive employment screening program may also include:
- Identity and address verification
- Verification of education and employment history
- Reference checks
- Sanctions and watchlist screening
- Politically Exposed Person (PEP) screening
- Additional risk-based checks based on the role and level of responsibility
Only a combination of these screening components provides a comprehensive, risk-based assessment of a candidate.
What regulators actually focus on
Regulators such as BaFin no longer assess individual screening measures in isolation. Instead, the focus is on whether employment screening is implemented as a consistent, documented and risk-based process.
Additional requirements arise for organisations with international operations, external service providers or complex supply chains and outsourcing arrangements. In these environments, a standardised one-size-fits-all check is often no longer sufficient. Instead, screening measures must be selected based on risk, documented transparently and applied consistently across the organisation.
Employment screening checks for financial services
With DISA's platform, financial institutions can create role-based and risk-based screening profiles. This ensures that only the checks required for a specific role are carried out, while maintaining full documentation, transparency and compliance with regulatory requirements and the GDPR.
Depending on the role and risk profile, the following checks can be integrated:
verifies a candidate's identity before the employment screening process begins.
structured request and processing of the German Criminal Record Certificate (Führungszeugnis).
for roles involving financial responsibility or access to company assets.
determines whether an individual is classified as a Politically Exposed Person (PEP).
screens against national and international sanctions lists to support anti-money laundering (AML) compliance.
verifies education, professional qualifications and employment history.
periodic or event-driven repeat screening, for example following a change of role or a change in an individual's risk profile.
Audit-ready documentation and governance
For financial institutions, it is not only important that employment screening is carried out, but also that every step of the process is transparently documented and fully traceable at any time.
DISA's platform supports compliance, HR and risk teams with:
- A centralised record of all screening processes.
- Transparent decision-making and approval workflows for every individual and role.
- Consistent application of defined screening policies across departments, locations and external service providers,
- Data storage within the EU to support GDPR compliance and data governance requirements.
Demonstrating process, not just results
Today, regulators and internal auditors expect far more than proof that individual checks have been completed. They expect a documented process that clearly demonstrates which checks were carried out, why they were selected and how decisions were made.
A centralised platform enables screening activities, decisions and approvals to be documented in an audit-ready manner. This allows financial institutions not only to demonstrate compliance, but also to provide clear evidence of the transparent and consistent process behind it.
Why financial institutions choose DISA
Since 1998, DISA has been helping organisations implement professional employment screening solutions. Financial institutions across Germany, the Netherlands and other EMEA markets rely on our platform to meet regulatory requirements efficiently while ensuring their employment screening processes remain secure, transparent and fully traceable.
Key benefits at a glance:
- EU-only data storage - Your data is stored exclusively within the European Union, with no transfers to third countries
- Certified information security – Certified to ISO 27001, ISO 9001 and ISAE 3000 Type 2 standards.
- GDPR-compliant processes – With transparent candidate involvement throughout the entire screening process.
- Fast turnaround times – Screening results are typically available within five to ten working days.
- Seamless integration– Connect to existing HR and ATS systems via APIs.