Since Brexit, UK banks, payment firms, investment firms and FinTechs have lost their EU passport.
Anyone who wants to serve clients in Germany now needs a German or EU licence, a local organisation and compliance functions that meet European standards. Many firms treat this as a cost to be contained. In practice, the way a firm sets up compliance is a strategic choice. It decides how fast a firm can enter the market, how much trust it earns from banks, clients and supervisors, and how well it can grow across the EU.
The Rules Keep Moving
Planning under uncertainty is not new. As The European Business Review notes, a strategy only creates value once it is turned into execution. For regulated firms, a growing share of that execution is now set by law, and the law is changing quickly.
The most important change is the EU Anti-Money Laundering Regulation (AMLR). From 10 July 2027, it will apply directly in all Member States and replace large parts of national anti-money laundering law. For the first time, firms across the EU will follow one rulebook on customer due diligence, beneficial ownership and internal controls. At the same time, a new EU authority, AMLA, is taking shape. From 2028, it will directly supervise up to 40 high-risk financial institutions that operate in several Member States.
Operational topics have also become regulatory topics. The Digital Operational Resilience Act (DORA) sets rules for IT risk, incident reporting and technology providers. The EU AI Act adds requirements for high-risk uses such as credit scoring.
As a recent TEBR analysis of how European fintechs are rethinking compliance shows, leading firms now treat compliance as an operating function, not a legal one.
Why a London Rulebook Is Not Enough
UK and EU rules share the same roots, but they have drifted apart since Brexit and will drift further under the AMLR. A compliance framework built in London cannot simply be copied to Frankfurt. German supervisors expect a local anti-money laundering officer with a deputy, written risk analyses mapped to German and EU law, and suspicious activity reports sent to the German Financial Intelligence Unit in a fixed format. From July 2027, the AMLR also requires a member of the management body to take responsibility for anti-money laundering compliance.
Even details matter. Under the AMLR, beneficial ownership starts at 25 per cent or more, and customer data must be updated at fixed intervals: at least once a year for higher-risk clients and at least every five years for all others. For firms with large client books, this alone can mean months of remediation work.
Build or Outsource?
The key decision is whether to build compliance teams in-house or to use an outside provider. German law allows key roles, such as the anti-money laundering officer or internal audit, to be outsourced, provided the supervisor is informed and clear outsourcing rules are followed.
Building in-house gives maximum control, but it takes time. Skilled staff who know German supervisory practice are scarce, and a new entity rarely has the scale to justify a full team from day one. Outsourcing gives quick access to experts, proven methods and local experience, and it turns fixed costs into planned fees. Specialist providers such as S+P Compliance Services take on these roles for international firms entering the German market.
What outsourcing does not do is shift responsibility. The board stays accountable. The AMLR also draws clear lines: approving the risk assessment, deciding on high-risk client relationships and filing suspicious activity reports must stay with the firm. The real question is not whether to outsource, but what to outsource and how to stay in control.
Many UK groups therefore choose a hybrid model. Governance, risk appetite and key decisions stay with the German entity, while specialist tasks, from AML monitoring to internal audit, are handled by an external team. This keeps control where the law places it and adds capacity where it is needed most.
A Typical Case
Consider a UK payments firm that obtains a German licence to serve clients across the EU. Its London team knows the product and the clients, but not German supervisory practice. Recruiting a full local team would take many months and delay the launch. Instead, the firm appoints a local managing director who owns all risk decisions. The anti-money laundering officer, compliance monitoring and internal audit are outsourced to a German provider. Monthly reports give the board a clear view of open issues, and the contract allows the firm to bring functions in-house once volumes grow. The result is a faster launch, a set-up the supervisor can follow, and a clear path to scale.
Three Choices for Leaders
- Structure: Branch or subsidiary? From January 2027, EU rules generally require third-country banks to open a branch before offering core banking services such as lending or deposit-taking in the EU. The chosen structure decides which compliance functions are needed locally.
- Group control: How much should stay with the UK parent? Services from London, such as IT platforms, client screening or back-office work, count as outsourcing or as IT third-party services in the EU. They need proper contracts, a register entry and active oversight, even within the same group.
- Steering: How is the provider managed? Clear service levels, reporting lines, audit rights and exit plans turn an outside provider into a controlled part of the business rather than a black box.
Technology Raises the Bar
Compliance work increasingly combines people with digital tools for client onboarding, screening and transaction monitoring. Used well, these tools raise quality and create the audit trail supervisors expect. Used carelessly, they create new risks, especially where AI influences decisions about clients. Here, too, leaders must decide which tasks can be automated and which need human judgement. When choosing an outsourcing partner, firms should ask not only about expertise, but also about tools, data protection and where data is stored.
A Practical Agenda for the Next Twelve Months
- Compare: Map UK policies against German and EU requirements, including the AMLR.
- Decide: Choose a sourcing model for each function, from anti-money laundering to internal audit.
- Contract: Set up provider and group agreements with clear service levels and exit rules.
- Prepare: Plan client data updates and adapt processes before the AMLR applies in July 2027.
- Report: Give management regular, concise reports that work as a steering tool rather than a formality.
Conclusion
Regulatory change will not slow down. For UK firms in Germany, the question is whether compliance holds them back or helps them compete. Firms that treat the 2027 deadlines as a strategic project gain faster market entry, a lower total cost of compliance and greater resilience when the rules change again. A well-planned outsourcing model can provide expertise, speed and stability, as long as leaders keep the key decisions in their own hands. Well organised, compliance is not the opposite of strategy. It is one of its foundations.
