Providing a business address does not, by itself, make a company an obliged entity under the German Anti-Money Laundering Act (Geldwäschegesetz, GwG). The decisive question is whether the provider offers further services which, together with the address, create a functioning business or administrative contact point for the customer. This may be relevant for operators of serviced offices, coworking spaces, virtual offices and business centers that offer, for example, mail handling, reception services, telephone services or meeting facilities. Depending on the overall service package and the actual day-to-day practice, the provider may qualify as a trust or company service provider (TCSP) and become subject to the GwG. In the GwG’s terms, a TCSP is a business that provides services to companies, such as forming them, managing them or giving them an address.

The Court of Justice of the European Union (CJEU) drew this line in its Citadeles nekustamie īpašumi judgment of 18 April 2024. On 10 March 2026, the Munich Administrative Court (Verwaltungsgericht München) applied the same reasoning to a German business center and found that the operator qualified as a TCSP.

At Schlun & Elseven Rechtsanwälte, our lawyers advise business address providers on whether the GwG applies to them and what it requires in practice.

When Does a Business Address Provider Become an Obliged Entity?

A business address provider becomes an obliged entity (Verpflichteter) when it provides an address together with other related services, for third parties, in the course of its business. The legal basis is Section 2(1) No. 13(c) GwG.

Under this provision, one of the services that makes a business a trust or company service provider (TCSP) is:

• providing a registered office, a business, administrative or postal address and other related services
• for a legal entity, a partnership or a legal arrangement such as a trust (Section 3(3) GwG).

The provision implements Article 3(7)(c) of the Fourth EU Anti-Money Laundering Directive (Directive (EU) 2015/849), which uses the same wording. The decisive word in both texts is “and.” Providing office space or permission to use an address is one thing. Providing an address combined with services that make the provider part of the customer’s administrative operations is another.

The supervisory authorities of Germany’s federal states, which oversee TCSPs, take the same view. Their joint interpretive guidance on the GwG for non-financial businesses (Auslegungs- und Anwendungshinweise, as of 18 June 2025) names virtual office providers as covered by Section 2(1) No. 13 GwG. This includes virtual offices offered as part of an office center. The guidance also states that simply renting office space, including furnished office space, is not covered. Address services provided only within a company’s own group do not create TCSP status either.

The Citadeles Judgment: Address Use Alone Is Not Enough

In Citadeles nekustamie īpašumi (Case C-22/23), the CJEU held that a landlord does not become a trust or company service provider (TCSP) merely because a tenant uses the rented premises as its registered office. The judgment of 18 April 2024 is the leading authority on the distinction between leasing premises and providing address services.

The Facts

Citadele was a Latvian company that bought, sold, let and managed its own real estate. Its leases allowed tenants to register the premises as their registered office. After an AML inspection, the Latvian tax authority treated this as a company service and fined Citadele €1,000 for failing to meet its obligations as an obliged entity. Citadele argued that it provided nothing beyond the lease itself.

The Court’s Reasoning

The CJEU distinguished two services:

• Leasing property is in principle limited to making premises available in return for rent.
• Providing a registered office or business address means providing a contact point for business and administrative purposes. The Court noted that this service can be obtained without any lease and usually includes additional services, such as forwarding administrative documents.

The Court relied on the wording “address and other related services.” In its view, making property available is not enough to qualify the landlord as a TCSP. This holds even when the property serves as a registered office or business, postal or administrative address. A lease clause allowing the tenant to register the address is not a “related service” either. The right to use the address is simply an ancillary right that comes with the lease.

The Ruling

A tenant may register the property as its registered office, with the landlord’s consent, and conduct business from it. That alone does not make the landlord a TCSP.

The Court added one caveat. The directive sets only minimum standards, so member states may adopt stricter rules or extend AML obligations to other types of business. For Germany, the relevant point is that Section 2(1) No. 13(c) GwG uses the same “and other related services” wording as the directive. The Citadeles reasoning therefore applies to German business address providers.

Munich Administrative Court Applies Citadeles to a Business Center

In its judgment of 10 March 2026 (case no. M 16 K 23.2653), the Munich Administrative Court held that an operator offering offices and coworking desks with additional services was an obliged entity under Section 2(1) No. 13(c) GwG. The judgment shows how low the threshold can be.

The Facts

The operator, a German GmbH, rented out individual offices and coworking desks. Its supervisory authority, a Bavarian district government, considered it a TCSP and asked it to complete a GwG compliance questionnaire. The operator returned it unsigned, denying any TCSP activity, and did not return a second questionnaire. The authority then ordered it to do so, threatened a coercive fine (Zwangsgeld) of €3,500 and charged a fee of €350.

The operator argued that it simply rented out offices. It offered no office or secretarial services, tenants had their own round-the-clock access, and the drinks and Wi-Fi in the building were free of charge.

The Court’s Test

The court dismissed the operator’s action. Following Citadeles, it held that renting premises only meets the first element of the test, providing an address. An obligation under the GwG arises only where related services are added.

Not every additional service is enough, however. According to the court, a service counts only if it is connected to the address and complements it. It must help equip the premises as a company’s seat. It must also give the overall offering a character that makes it more vulnerable to money laundering or terrorist financing than a plain commercial lease. The court drew on the Advocate General’s opinion in Citadeles, which states that such services require the provider’s active involvement.

Why the Operator Qualified

The court relied only on facts the operator did not dispute, largely taken from its own website. The operator advertised that setting up a company seat with it was easy, offered an address in a prime location and fully furnished desks, and targeted start-ups in particular. Tenants could use the Wi-Fi, get drinks and book meeting rooms and roof terraces.

In the court’s view, at least the drinks and the meeting rooms required the operator’s active involvement. Taken together, the offering made it easier for customers to set up a seat and start trading. It therefore also made it easier to fake a real business, in whole or in part. The court stressed that money laundering does not require an empty letterbox company. A furnished operation that only pretends to serve its stated purpose carries the same risk.

The authority had also alleged that the operator handled telephone lines and forwarded mail. The operator denied this, and the court did not need to decide the point.

What the Judgment Means for Providers

The court did not rely on telephone or mail services at all. Bookable meeting rooms and drinks, combined with marketing aimed at setting up a company seat, were enough. The case also shows that refusing to engage with the supervisory authority does not help, since the authority can enforce its information requests with coercive fines.

Serviced Offices, Coworking Spaces, Virtual Offices and Business Centers

Whether a provider is a TCSP depends on what it actually provides, not on what it calls its product. The same label, such as “business center” or “coworking,” can describe a plain lease or a full address service. The table below shows the starting point for the most common models.

The gray zone is the last row. In Citadeles, the Advocate General gave examples of related services that require the provider’s active involvement, and the Munich Administrative Court adopted them. They include:

• providing a contact point for the customer
• forwarding documents
• a dedicated fax service
• answering telephone calls
• obtaining bank statements
• providing meeting rooms.

No single service decides the question. According to the Munich court, what matters is whether the services, taken together, help equip the premises as a company’s seat and make the offering more vulnerable to abuse than a plain commercial lease. In the Munich case, bookable meeting rooms and drinks were enough.

Actual practice and marketing matter as much as the contract. A lease may say nothing about mail, but if reception staff routinely accept and forward a tenant’s letters, the provider is offering a related service in fact. The Munich court also relied heavily on how the operator advertised its offering on its own website. Providers therefore need to assess their real operational processes and marketing, not only their contract templates.

What TCSP Status Means in Practice

A provider that qualifies as a trust or company service provider (TCSP) must meet the full set of GwG obligations for every customer to whom it provides address services. Breaches can lead to substantial fines and public naming, and managers can be fined personally.

Registration and Supervision

TCSPs must register with their supervisory authority and state their specific activity, unless they already need a registration, license or approval under other rules (Section 51(5b) GwG). The supervisory authority is the body designated under federal or state law, which for TCSPs is an authority of the relevant federal state (Section 50 No. 9 GwG). That authority can carry out on-site inspections without a specific reason and issue orders to ensure compliance. An objection or court action against such an order does not suspend it.

Risk Management

TCSPs need effective risk management that suits the nature and scale of their business (Section 4 GwG). It has two parts:

• A risk analysis (Section 5 GwG). The provider must identify and assess the money laundering and terrorist financing risks of its business, document the analysis, review it regularly and make the current version available to the supervisory authority on request.
• Internal safeguards (Section 6 GwG). These are policies, procedures, and controls that manage and reduce those risks. They include internal rules on due diligence, reporting, and record keeping, checks on staff reliability, regular staff training, and a channel through which staff can report breaches confidentially.

A named member of management is responsible for risk management and for compliance with AML rules, and must approve both the risk analysis and the safeguards.

Customer Due Diligence (KYC)

Customer due diligence, often called know your customer (KYC) checks, covers the following core obligations under Section 10 GwG:

• identifying the customer and any person acting on its behalf, and checking that person’s authority
• clarifying whether the customer acts for a beneficial owner and, if so, identifying that person, including the customer’s ownership and control structure
• obtaining information on the purpose and intended nature of the business relationship
• checking whether the customer or beneficial owner is a politically exposed person (PEP)
• monitoring the business relationship on an ongoing basis.

The provider must identify the customer before the business relationship begins (Section 11 GwG). For a company, the provider must record its name, legal form, register number, registered address, and the names of its legal representatives. If the provider cannot complete due diligence, it must not enter into the relationship and must end any existing one.

Ultimate Beneficial Owners (UBOs)

A beneficial owner is the natural person who ultimately owns or controls the customer or on whose behalf a transaction is carried out, or a business relationship is established (Section 3 GwG). For most companies, this means anyone who directly or indirectly holds more than 25 percent of the capital or voting rights, or exercises comparable control. If no such person can be identified, the law treats the customer’s legal representative or managing partner as the beneficial owner. An extract from the Transparency Register (Transparenzregister), Germany’s central register of beneficial owners, is not enough on its own. The provider must collect the details from the customer.

Record Keeping

TCSPs must record and retain the information they collect during due diligence, together with their risk assessments (Section 8 GwG). They must keep these records for five years from the end of the calendar year in which the business relationship ends. They must destroy them after ten years at the latest, unless another statutory retention obligation applies.

Suspicious Activity Reports to the FIU

Facts may suggest that an asset comes from a criminal offense that could be a predicate offense for money laundering, meaning the underlying crime that generated the funds. They may also point to a link with terrorist financing. In either case, the provider must report this to the Financial Intelligence Unit (FIU) without delay, regardless of the amount involved (Section 43 GwG). According to the joint guidance of the federal states, obliged entities have had to register electronically with the FIU since 1 January 2024. The FIU analyzes these reports and passes information on possible money laundering to law enforcement. This can lead to a criminal money laundering investigation.

Fines and Publication

Intentional or reckless breaches of these obligations are administrative offenses under Section 56 GwG. Fines can reach €150,000 for intentional breaches and €100,000 for reckless ones. For serious, repeated or systematic breaches, the maximum rises to €1 million or twice the economic benefit gained from the breach.

Once a fine or measure can no longer be challenged, the authority must publish it on its website for five years, naming the individuals and companies responsible (Section 57 GwG). A departure from this requirement may only be considered in the narrowly defined statutory exceptions.

Personal Exposure for Managers

AML compliance is a management responsibility, and managers can be fined personally. The GwG obligations formally address the company as the obliged entity. Under Section 9 of the Act on Regulatory Offenses (Gesetz über Ordnungswidrigkeiten, OWiG), however, they extend to the company’s legal representatives, such as managing directors. They also extend to anyone expressly tasked with running the business or carrying out its duties on their own responsibility. A managing director who breaches GwG obligations can therefore be fined under Section 56 GwG in their own name.

Liability is not limited to whoever committed the breach. Under Section 130 OWiG, the owner of a business commits an administrative offense by failing to take the supervisory measures needed to prevent breaches. This applies if a breach then occurs that proper supervision would have prevented or made substantially more difficult. The required measures include appointing, carefully selecting and monitoring supervisory staff. Where the underlying breach is an administrative offense, the fine for failing to supervise is capped at the maximum for that breach.

The company itself can be fined as well. Under Section 30 OWiG, if a manager commits an offense that breaches the company’s duties, the authorities can also fine the company. They can do so even if they bring no proceedings against the individual.

The GwG also lets the supervisory authority act against individuals directly. It can remove managers of a TCSP who lack the required suitability or reliability (Section 51(5b) GwG). It can also temporarily ban a manager who committed a breach intentionally or negligently from holding a management position at any obliged entity. If the beneficial owner lacks the required suitability or reliability, the authority can prohibit the provider from offering TCSP services altogether.

What Does This Mean for Foreign Companies Using a German Business Address?

Foreign companies and international founders often rely on a German virtual office or business center address. They may use it as the registered office of a German limited liability company (Gesellschaft mit beschränkter Haftung, GmbH) or as the correspondence address for a branch. This applies whether the business is run from abroad or by founders already living in Germany. Where the provider qualifies as a trust or company service provider (TCSP), it must complete due diligence on the company before the contract begins.

The GwG places duties on the customer as well. Under Section 11(6) GwG, the customer must provide the information and documents the provider needs for identification. It must also disclose whether it acts for a beneficial owner and prove that person’s identity. During the business relationship, the customer must report changes without delay, such as a new managing director or a change in ownership.

In practice, international customers should have the following ready before signing:

• identification details for the company’s legal representatives
• an overview of the ownership and control structure, down to the natural persons behind it
• information on the purpose of the business relationship.

If the provider cannot complete due diligence, it must refuse the contract or end it (Section 10(9) GwG). A request for documents is therefore a legal obligation on the provider, not a sign of mistrust.

Review Contracts and Processes Before Changing KYC Controls

A business address alone does not trigger AML obligations. For any given provider, the answer depends on its complete service package and how it operates day to day. Citadeles is good news for landlords who only lease space. It is not a reason for a business center or coworking operator to drop KYC controls without first checking what it actually provides.

Before introducing, reducing or discontinuing KYC controls, providers should:

1. List every service offered alongside the address, including informal ones such as staff accepting parcels or forwarding letters.
2. Compare contract templates, price lists and website descriptions with what staff actually do.
3. Assess each customer category separately, since a provider may lease plain offices to some customers and sell virtual office packages to others.
4. Document the assessment and the reasons for the conclusion, so it can be shown to the supervisory authority if questioned.
5. Reassess whenever new services are added to the offering.

Getting this wrong in either direction has costs. A provider that stops due diligence while still qualifying as a TCSP risks fines and publication. A provider that is not an obliged entity may be spending time and money on compliance it does not need.

At Schlun & Elseven Rechtsanwälte, our lawyers review service models, contracts and operational processes for business address providers and assess whether the GwG applies. Where it does, we help set up the required risk analysis, due diligence procedures and registration. Contact us to discuss your service package.