Authorisation procedure

The ZAG sets out two different authorisation procedures: one in accordance with section 10 (1) sentence 1 of the ZAG for payment institutions, and one in accordance with section 11 (1) sentence 1 of the ZAG for electronic money institutions. The registration procedure in accordance with section 34 (1) sentence 1 of the ZAG is intended solely for companies wishing to provide account information services only. BaFin may only grant authorisation or registration if the relevant conditions applicable under sections 10, 11 and 34 of the ZAG are fulfilled. German law is supplemented by the ZAG Reports Regulation (ZAG-Anzeigenverordnung – ZAGAnzV), which provides further details on the requirements.

Besides the legal provisions set out in the ZAG and the accompanying regulations, BaFin also applies the EBA Guidelines on authorisation and registration under PSD2 (EBA/GL/2017/09) in the authorisation procedures in accordance with PSD2. The guidelines specify which information, documents and evidence must be submitted for the authorisation or registration procedure in the case of payment institutions or electronic money institutions. The guidelines therefore supplement the requirements under section 10 (2) of the ZAG concerning the information and evidence to be submitted for the authorisation procedure for payment institutions, section 11 (2) of the ZAG concerning the information and evidence to be submitted for the authorisation procedure for electronic money institutions and section 34 (1) of the ZAG concerning the information and evidence to be submitted for the registration procedure for applicants only wishing to provide account information services as a payment service within the meaning of section 1 (34) of the ZAG.

You can find a list of links providing an overview of the provisions of the ZAG, the ZAGAnzV and the EBA Guidelines on the authorisation procedure in accordance with section 10 (1) sentence 1 of the ZAG and the registration procedure in accordance with section 34 (1) sentence 1 of the ZAG at the end of this article.

The authorisation is subject to a fee. The fee for obtaining authorisation to provide a single payment service or for registering account information services is currently EUR 6,150; the fee for obtaining authorisation to provide several or all payment services is EUR 8,515. The legal basis is the German Act Establishing the Federal Financial Supervisory Authority (Finanzdienstleistungsaufsichtsgesetz – FinDAG ) in conjunction with the German Regulation on the Imposition of Fees and Allocation of Costs Pursuant to the FinDAG (Verordnung über die Erhebung von Gebühren und die Umlegung von Kosten nach dem Finanzdienstleistungsaufsichtsgesetz – FinDAGKostV. The withdrawal of an application from an application process is due to the incurred administrative cost as well subject to a proportional fee.

You can find a list of companies that have already been granted authorisation or registration by BaFin in the ZAG register of institutions under sections 43 and 44 of the ZAG. The European Banking Authority (EBA) also keeps a list of the institutions that are authorised/registered in all member states.

Ongoing supervision

Payment institutions and electronic money institutions are subject to ongoing supervision by the Deutsche Bundesbank and BaFin. They must fulfil a number of supervisory requirements which include complying at all times with the own funds requirements under supervisory law. At the same time, the institutions are subject to a series of notification and reporting obligations (see section 28 (1) of the ZAG et al.). Institutions under the ZAG which do not provide account information services only must also submit monthly returns (see the German Monthly Returns Regulation for ZAG Institutions (ZAG-Monatsausweisverordnung – ZAGMonAwV) and the German Capital Requirements Regulation for ZAG Institutions (ZAG-Instituts-Eigenmittelverordnung – ZIEV). Institutions that provide payment initiation services or account information services must take out insurance to cover insured events and must regularly submit details about their professional indemnity insurance to BaFin (see section 3 of the ZAGMonaAwV).

Management board members of institutions under the ZAG must be fit and proper and have practical and theoretical knowledge of the business concerned. Details of the requirements for management board members can be found in BaFin’s Guidance Notice on Management Board Members under the KWG, ZAG and KAGB (Merkblatt zu den Geschäftsleitern gemäß KWG, ZAG und KAGB - only available in German).

Institutions within the meaning of the ZAG must have a proper system of governance in place (see section 27 of the ZAG). Although BaFin Circular 09/2017 (BA) – Minimum Requirements for Risk Management (Mindestanforderungen an das Risikomanagement - MaRisk) is not explicitly applicable to ZAG institutions, it still offers these institutions guidance, especially in the area of outsourcing (AT 9), in relation to the requirements that apply as part of a proper system of governance. If institutions use the services of cloud providers, BaFin’s "Guidance on outsourcing to cloud service providers" ("Orientierungshilfe zu Auslagerungen an Cloud-Anbieter") offers further information.

Payment institutions must pay an annual fee which is calculated on the basis of their total assets. Detailed information on the fee can be found here. In addition, institutions are subject to audit obligations, i.e. their accounts must be audited each year by an auditor.

As payment service providers, institutions within the meaning of the ZAG are also obliged to report major operational and security incidents. BaFin has published details of the reporting obligations which can be found here.