Restorethe First
Read by Sayer Ji · Loading… · Ready

Lawfare · Debanking: a case study · September 23, 2026

Acquitted by the court.
Still flagged by the file.

Three days after Robert F. Kennedy Jr. spoke at his rally in Berlin, a commercial risk database used by banks around the world filed the German organizer Michael Ballweg under “NONCONVICTION TERROR.” Nobody told him. He has never been charged with a terrorism or violent offense. A German court later acquitted him of the fraud charges at the center of his case, and another court refused to put the money-laundering charges on trial. Since 2021 he has faced account closures or restrictions at more than a dozen banks and payment providers. In May 2026 the pattern reached the United States. This case study sets out what the records show, and what they don’t.

The short version · Berlin, 2020 · The six sources · How the label changed · The accounts · It reached America · Why it matters here · What Congress can do · What this page is not

Editorial ink illustration. In the foreground, an open wooden card-catalogue drawer full of identical blank index cards; one card stands raised with a small red tab clipped to it. Thin wires run from that single card back to a long row of bank teller windows receding into the distance, every one closed behind a lowered shutter.
Illustration for Restore the First. One entry in one file, wired to every counter.

The short version · the file against the record

What the database said, and what the courts found.

Michael Ballweg, a Stuttgart software entrepreneur, founded Querdenken 711 in 2020. It became one of Germany’s largest movements against the pandemic restrictions. The left column below is taken from his entry in LSEG World-Check, a screening database banks use to check customers for terrorism, crime and corruption risk. Ballweg got the entries through a data-protection access request. The right column is the public record.

Michael Ballweg, in a white Querdenken T-shirt dated Berlin 01.08.2020, standing on a stage in front of trees.
Michael Ballweg, founder of Querdenken 711, on stage in Berlin on August 1, 2020. Photo: Smokeonthewater / Wikimedia Commons, CC BY-SA 4.0, cropped.
The questionWhat the World-Check file saidWhat the public record shows
Terrorism Category “NONCONVICTION TERROR,” entered September 1, 2020 at 07:37. In May 2021, “Terror Related; Violent Crime” was added as a special-interest category. No terrorism charge, investigation or finding appears anywhere in the court record. The prosecution’s case, when it came, was about donations and taxes.
Violence “Aug 2020 – held violent demonstrations opposing safety restrictions implemented due to COVID-19.” The day before the August 29 rally, a Berlin court found that the organizer had taken “sufficient precautions,” “including by providing 900 stewards and 100 de-escalation teams.” Police reported the Reichstag incident at a separate assembly with a different leader. Details below
Fraud “Fraud” added April 3, 2023; retained in October 2024. Acquitted. The Stuttgart Regional Court acquitted him on July 31, 2025 on the central charge of attempted aggravated fraud in 9,450 cases. Court release, Aug. 4, 2025 ↗
Money laundering “Money Laundering” added April 3, 2023; retained in October 2024. Never tried. The Stuttgart Higher Regional Court held on January 24, 2024 that there was not the “sufficient suspicion” needed to open a trial on the money-laundering charges. Court release ↗
Tax From August 1, 2025: “Tax and Customs Violation,” described as a “suspended fine EUR 3,000.” Convicted on two counts of completed VAT evasion totaling €19.53, and three counts of attempted tax evasion of about €2,100. The court issued a warning and held back a fine of 30 daily rates of €100. Both sides appealed, so the judgment is not final. It also awarded him compensation for his pretrial detention.
Notice to the person None. The profile was created and changed without contacting him. He found out only by filing a data-protection access request. The March 2026 extract shows the profile still active.

Berlin, August 2020 · the sequence

A rally, a speech by an American, and a file opened three days later.

The sequence below comes from court releases, police reports, press coverage and the World-Check entries themselves. It shows timing. It does not show who asked for the entry, or why. The records Ballweg obtained don’t answer that question.

  • Aug 1, 2020
    Querdenken 711 holds a large march in Berlin against pandemic measures. Reuters reports that marchers ignored mask and distancing rules. It does not describe any violence by him.
  • Aug 26–28, 2020
    Berlin authorities ban the planned August 29 assembly. On August 28 the Berlin Administrative Court largely overturns the ban. It finds no basis for predicting that the organizer would deliberately flout distancing rules, and notes that he had “taken sufficient precautions, including by providing 900 stewards and 100 de-escalation teams.” VG Berlin, press release 42/2020 ↗
  • Aug 29, 2020
    Tens of thousands gather on the Straße des 17. Juni and at the Victory Column. From the stage, Robert F. Kennedy Jr. speaks against “efforts to spread fear in the pandemic and impose a new surveillance state.” Ballweg urges the crowd to be watchful of extremists intent on violence: “We are democrats. Right- and left-wing extremism and fascist thought have no place in this movement.” The Irish Times ↗
  • Aug 29, 2020, 14:40
    At a separate standing assembly on the Platz der Republik, with its own registration and its own leader, “the assembly leader called for the barriers set up at the Reichstag lawn to be pushed over.” Shortly after 16:00, about 50 participants got over the barriers. These are the images the world saw as the “storming” of the Reichstag steps. Berlin Police report ↗
  • Aug 29–30, 2020
    The same police report describes the Querdenken rally as largely keeping to distancing rules on the road, with crowding near the stage. That required repeated announcements by police and by the organizer’s stewards. After the rally ended, police cleared a sit-in of about 100 people around the stage after midnight. Some resisted, and officers were assaulted. Berlin Police ↗
  • Sep 1, 2020, 07:37
    World-Check creates the entry. Category: “NONCONVICTION TERROR.” Biography: “Alleged leader (Leadership) of Querdenken 711.” Funding: “To be determined.” Reports: “Aug 2020 – held violent demonstrations opposing safety restrictions implemented due to COVID-19. Demonstrations previously banned by Berlin regional government, then conditionally permitted.”
  • Sep 4–7, 2020
    The internal correspondence LSEG disclosed covers only these few days. In it, the entry is updated with his age from a web article, and the update is routed to a content-research team. The disclosure contains nothing about why the entry was created, who approved the category, or which customers received it.
The speech. Robert F. Kennedy Jr. at the Victory Column, Berlin, August 29, 2020 (13 min). Video published by Querdenken 711 on its own video platform. Watch on the original site ↗ · Ballweg’s own opening speech that day: watch ↗

Sequence, not cause. An American spoke at a German rally on a Saturday, and on the following Tuesday morning the organizer was filed under terrorism. That is what the timestamps show. They do not show a request from any government, including our own, and we make no such claim. What they show is that a label with serious consequences was applied within days, on the basis of press coverage, and without the person ever being told.

The six sources · what the file cited, read in full

The file listed its evidence. The evidence doesn’t say what the file says.

World-Check cites public sources for each entry. LSEG says it gathers information from third-party public sources, offers no opinion of its own, and leaves decisions to the customer institution. Here is what each source cited in Ballweg’s 2020–2021 entry actually says.

  1. 1
    Berlin Administrative Court, August 28, 2020. The only official source on the list. It is the ruling that allowed his assembly, finding that he had taken “sufficient precautions” with 900 stewards and 100 de-escalation teams. It contradicts the “violent” framing rather than supporting it. Read it ↗
  2. 2
    The Irish Times, August 29, 2020. Describes “a largely peaceful protest.” Places the Reichstag incident at a separate gathering. Quotes Ballweg rejecting extremism and warning the crowd about extremists intent on violence. Read it ↗
  3. 3
    Deutsche Welle, May 10, 2020. Covers different events months earlier. It describes the Stuttgart demonstration Ballweg organized as the biggest “peaceful” one against the restrictions, and reports his criticism of broadcasters’ coverage. The attacks on journalists it reports happened elsewhere. Read it ↗
  4. 4
    Reuters, August 1, 2020. Reports the earlier Berlin march and the fact that marchers ignored masks and distancing. It does not connect him personally to violence or terrorism. Reuters ↗
  5. 5
    PledgeTimes, “Absurd coexistence.” A web article. Its cited text hasn’t yet been recovered from an archive, so we draw no conclusion from it. Archive pending
  6. 6
    web24.news, added in 2021. A web article that, according to LSEG’s own internal notes, was used to update his age. Age update only

The entry’s own sources contradict it. We read the four sources that can be checked. None of them says that Michael Ballweg committed, planned, encouraged or financed violence. The official one says the opposite. When the category was expanded in May 2021, the entry added: “no further information reported.”

How the label changed · 2020 to 2026

The courts narrowed the case. The file kept finding new headings.

The file

Terror, then violence, then fraud and money laundering, then tax.

  • Sep 1, 2020. “NONCONVICTION TERROR.” “Held violent demonstrations.”
  • May 17, 2021. Adds “Terror Related; Violent Crime.” “No further information reported.”
  • Apr 3, 2023. Category changed to “INDIVIDUAL”; “Fraud; Money Laundering” added while he is in pretrial detention.
  • Oct 10, 2024. Fraud and money-laundering tags kept, more than eight months after a court refused to try the money-laundering charges.
  • Aug 1, 2025. Changed to “Tax and Customs Violation,” the day after the fraud acquittal.
  • Mar 13, 2026. The extract shows the profile still active.

Source: World-Check current and archived extracts disclosed to Ballweg in response to his data-protection request, reviewed by Restore the First.

The courts

Arrest, nine months in custody, and a case that fell apart.

  • Jun 29, 2022. Arrested on suspicion of fraud and money laundering and held on flight-risk grounds.
  • Apr 4, 2023. Released after about nine months, when the Higher Regional Court found continued detention disproportionate.
  • Oct 6, 2023 / Jan 24, 2024. The Regional Court declines to open a trial on money laundering, and the Higher Regional Court confirms that decision. OLG Stuttgart ↗
  • Jul 31, 2025. Acquitted on the central fraud charge after more than 40 trial days. The judge said it could not be proven that he had used money raised for Querdenken for private purposes. He is warned over €19.53 in completed VAT evasion and about €2,100 in attempted evasion, and awarded compensation for his detention. LG Stuttgart ↗ · Staatsanzeiger ↗
  • Aug 2025. Both the prosecution and the defense appeal (“Revision”). The judgment is not final. LTO ↗

Official court releases and German press. Detention dates: n-tv, Apr. 4, 2023 ↗

The accounts · 2021 to 2026

No bank told him why. They just kept closing.

The closures started in 2021. In a letter dated March 10, 2022, Volksbank am Württemberg terminated three private and business accounts, effective May 20, 2022. It gave no reason. According to the trial court’s written judgment, the relationship dated back to October 2010. The business account had a €50,000 credit line, and there had never been a returned direct debit.

That year, closures or restrictions also hit accounts at N26, Wise, Commerzbank/comdirect, Triodos, VR Bank Bayern Mitte, Raisin, BMW Bank, Olinda, PayPal, American Express, Crypto.com, Bitpanda, Bitwala/Nuri and Kraken. So did the Swiss account of his operating company and the account of a family foundation. In 2023, a trust account his lawyer used to fund his defense was also terminated. In 2024, new applications in Germany and Switzerland kept failing. In February 2026, a corporate application processed through the identity-verification platform Sumsub ended with a single sentence: “Unfortunately, we were unable to verify your documents.” Sumsub later told him it was only the processor and that its client, the bank side, was responsible.

Ballweg says he has lived mainly on cash and Bitcoin since his arrest in June 2022. He also says Querdenken 711’s ability to raise money, and to pay for offices, IT and events, has been effectively frozen. Paying in cash and Bitcoin raises new questions about the source of his funds, and those questions become one more reason for the next refusal.

It reached America · 2026

A U.S. company, a U.S. bank, 63 days.

On March 12, 2026, Ballweg’s U.S. company, L7X LLC, opened a business account through Relay, a New York financial-technology firm. Relay says its underlying banking services are provided by Thread Bank, Member FDIC, of Rogersville, Tennessee. Relay Help Center ↗

On May 14, the compliance team closed it: “Effective today, we are no longer able to service your business. Your account has been closed by our compliance team.” The notice listed three broad reasons it might have happened (documentation, nature of business, or transactions that raised flags) without saying which applied. Three card payments totaling $3,303.68 were reversed. Relay said the remaining balance would be mailed by check after an investigation of up to 45 days. Ballweg reports that as of late August he had not received it.

A second screening provider shows how presentation can decide the outcome. LexisNexis’s WorldCompliance profile of Ballweg opens with the headline “Found guilty of tax evasion.” The fraud acquittal, the warning and the pending appeals appear only on the following page. LexisNexis’s own device-level fraud report on him, from its ThreatMetrix product, logged 152 events across 36 devices and zero events marked as possible fraud.

Why it matters here · the mechanism, not the man

Nobody banned his speech. They took away the means to organize.

The mechanism

A private label, applied without notice, that nobody has to explain.

  • A database vendor compiles the entry from press coverage and says it offers no opinion. A verification processor says its client decides. Banks give no reasons, or reasons that fit any case. Each link in the chain can point to the next, so no one is responsible for the result.
  • The person affected isn’t told. He finds out one closed account at a time, and he has to file data requests in several countries to learn what is written about him. Fixing one screen doesn’t fix the copies that have already spread downstream.
  • This is the same failure the due-process case study describes: a consequential judgment reached without notice or a hearing, and carried across borders. There it was an arrest application. Here it is a line in a risk file.

Restore the First analysis, drawn from the records on this page.

The honest context

The principle has to protect people we disagree with, or it protects no one.

  • Ballweg is a contested figure in Germany. Since December 9, 2020, Baden-Württemberg’s domestic-intelligence office has had Querdenken 711 under observation as an extremist effort, citing some organizers’ links to the “Reichsbürger” milieu. LfV Baden-Württemberg ↗
  • That observation is an intelligence agency’s assessment of an organization, made without trial. It is not a criminal finding against Ballweg. It also came three months after World-Check had already filed him under terrorism.
  • Restore the First takes no position on German politics or on Querdenken’s views. Our position is content-neutral: a person should not lose access to banking because of a risk label that no court has adjudicated, that he was never told about, and that he has no effective way to contest.

Coalition position, September 2026.

What Congress can do

Americans already have the right to dispute a credit report. A terrorism label deserves at least that.

Ballweg is a German citizen, but the problem isn’t German. The same screening vendors serve American banks. An American who organizes a protest, runs a controversial publication, or speaks at a rally abroad can end up in a file like this and never know. These are coalition proposals, not pending bills.

ASK 1

Notice and a reason

When a U.S. bank or fintech closes or refuses an account in whole or in part because of a third-party risk-database match, the customer should be told which database, and given the specific category, unless a lawful sanctions or law-enforcement hold prevents it.

ASK 2

A right to dispute

Commercial risk-intelligence files used to deny Americans financial services should carry dispute, correction and downstream-notification duties comparable to those that apply to consumer reports, with a deadline to fix entries that official outcomes have contradicted.

ASK 3

No terror label without a basis

Terrorism and violent-crime categories should require a cited official finding, charge or designation. Press coverage of a protest should not be enough.

ASK 4

Enforce the standard we have

Federal banking regulators implementing Executive Order 14331 should review closures that rest on reputation or unexplained screening hits, including cross-border cases like this one, and report the results to Congress.

See all of the coalition’s remedies on What Congress can do →

What this page is not

Not a claim of coordination. The records don’t show who started the World-Check entry, whether any government asked for it, or that one database caused every account decision. We make none of those claims. The August 29–September 1 sequence is presented as timing only.

Not an allegation against any company. LSEG states that World-Check relies on third-party public sources, offers no independent opinion, and leaves decisions to its customers. It also provides a process to request correction. We describe the published effects of the entries, not anyone’s intent. Nothing here alleges that any bank or vendor broke the law.

Where the facts come from. The court outcomes, the Berlin court and police findings, and the executive order come from the official releases linked on this page. The World-Check wording, the LexisNexis and Sumsub results, the Volksbank letter and the Relay notice come from documents Ballweg obtained through data-protection requests or received directly, which Restore the First has reviewed. We have not published account numbers or internal identifiers. The bank-witness testimony comes from defense trial reports. The unreturned Relay balance and the effect on his daily life are his own account.

Status. The July 31, 2025 judgment is under appeal by both sides and is not final. As of September 23, 2026 we found no public report of a final appellate decision. We will update this page when there is one.