Initial meeting

Oct 26, 2026

Loot Boxes—What Exactly Are They and Do They Constitute Gambling?

The concept of the loot box has become an integral part of the video game world. This makes it all the more surprising that the term—at least so far—is not defined in German law, even though there has been a debate for years regarding the regulation or classification of loot boxes under gambling law. Generally, a “loot box” is understood to be a virtual “box” in a video game whose contents are not predetermined and are determined at random. Players can obtain, for example, in-game advantages or cosmetic modifications (skins) from these boxes. Typically, players who wish to obtain a loot box must purchase it. This is often done through so-called in-game purchases using in-game currency—that is, the virtual currency used in the respective game (e.g., gold coins). Players can either earn the in-game currency required to purchase them, purchase it with real money, or do both. “Earning” loot boxes is also possible in many games, at least to a limited extent. There are thus many different ways—sometimes even within the same game—for players to obtain them. But do such loot boxes qualify as gambling subject to licensing requirements, and if so, are there ways to change this classification?

When Does an Activity Qualify as Gambling?

In Germany, the administrative law definition of gambling is based on the State Treaty on Gambling (GlüStV). According to Section 3(1) of the GlüStV, gambling occurs when a fee is charged in connection with a game to obtain a chance of winning, and the decision regarding the win depends entirely or predominantly on chance. The concept of a “chance of winning”—and, by extension, the concept of a “win”—appears problematic in the context of classifying loot boxes under gambling law. On the one hand, it is argued that a “win” constitutes “a not entirely insignificant financial asset.” On the other hand, it is argued that the aforementioned definition fails to do justice to the spirit and purpose of the GlüStV—namely, the goal of gambling regulation to prevent addiction—and that, for this reason, winning outcomes beyond traditional financial benefits should also satisfy the definition of a “win.” Furthermore, the requirement of payment may pose a problem in the context of classifying loot boxes under gambling law. However, if loot boxes are purchased using in-game currency, which in turn must be acquired with real money, it can reasonably be assumed that the requirement of payment is met in the sense required here. Should loot boxes therefore generally be classified as gambling? 

When do Loot Boxes Qualify as Gambling?

Given this context, one might get the impression that loot boxes must always be classified as games of chance. However, this conclusion would be questionable, to say the least. For example, the required element of payment would likely be absent in cases where in-game currency can only be acquired by actually playing the game and not through purchases with real money. In any case, if there is no market—or secondary market—for the virtual items acquired in loot boxes, or if these items are not even tradable within the game, there is no “winnings” that constitute a non-trivial asset. Whether this is sufficient to rule out the classification of loot boxes as gambling under gambling law, however, appears questionable. This is particularly so because the Joint Gaming Authority of the German States (GGL), which is responsible in Germany for supervising internet-based gambling offerings, had already advocated for stricter regulation of loot boxes and similar phenomena as early as March 1, 2024. In November 2025, the Bundesrat, in a motion for a resolution, also called on the federal government to impose stricter regulations on loot boxes and similar game mechanics. In this regard, it can be concluded that the classification of loot boxes under gambling law always requires a case-by-case analysis. A business model incorporating loot boxes should therefore always be reviewed for feasibility by a law firm with expertise in gambling law.

Attorney Dr. Lutz Auffenberg, LL.M. (London)

I. https://fin-law.de

E. info@fin-law.de

subscribe to Newsletter

This Blog Article as Podcast?

The Gist of It:

Presentation

    Contact

    info@fin-law.de

    Oct 19, 2026

    Regulating the Core of Crypto – Will MiCAR Also Regulate DeFi Soon?

    The EU Regulation on Markets in Crypto-Assets (MiCAR) was only adopted in May 2023, and its provisions have been fully in effect only since the beginning of 2025. Nevertheless, European regulators are already considering changes and expansions to the regulatory framework for crypto-assets in Europe. From May 20, 2026, through the end of September 2026, market participants were able to take part in a public consultation conducted by the European Commission and share their views on the currently applicable MiCAR rules and any need for changes to the regulation. In addition to examining the current MiCAR regulations, the consultation also focused on the question of to what extent MiCAR should cover the topic of Decentralized Finance (DeFi) in the future. Under the current legal framework, MiCAR regulates exclusively the centralized crypto market of centrally operating crypto-asset service providers (CASPs) and issuers of crypto-assets. Fully decentralized protocols that operate without an operator subject to regulatory oversight remain unregulated to date, as the regulator explicitly clarified in Recital 22 of MiCAR. The recital further states that crypto-asset services should not fall within the scope of MiCAR if they are provided in an exclusively decentralized manner without an intermediary. Whether this objective will still hold true in the future is, at the very least, highly doubtful, particularly following the submission of opinions by the European Central Bank (ECB) and the European Securities and Markets Authority (ESMA).

    ESMA and the ECB Advocate for the Inclusion of DeFi in MiCAR

    The European Commission’s own consultation paper specifically asks participants whether DeFi protocols should be included in the MiCAR regulation, in order to assess the extent to which new rules for transactions involving DeFi protocols should be introduced. In its opinion, ESMA points out that there are sometimes differing views within the EU regarding when exactly a service is fully decentralized within the meaning of Recital 22 of MiCAR. This legal uncertainty leads to “decentralization washing,” by which it means that providers of activities that are actually regulated as crypto-asset services attempt to obscure their liability by portraying the service as decentralized. Furthermore, the exclusion of DeFi from MiCAR creates scope for regulatory arbitrage when providers of purported DeFi services establish themselves in a Member State where the competent supervisory authority imposes less stringent requirements for demonstrating decentralization. ESMA therefore proposes amending MiCAR to clarify exactly when full decentralization is deemed to exist. In addition, it suggests introducing a new crypto-asset service that would subject interaction with DeFi protocols to authorization and supervision by the competent authorities. The ECB takes a similar stance in its opinion and suggests that, at the very least, access points to DeFi protocols should be regulated. It argues that, for example, in the case of access to DeFi protocols through regulated CASPs, only certain (qualified) investor groups should be offered such access.

    Regulatory Proposals Remain True to the Centralized Approach

    It is apparent that the European Commission, ESMA, and the ECB all intend to place greater regulatory focus on decentralized services and the DeFi sector as a whole. However, the proposed measures will not alter the fundamental approach of excluding services provided purely in a decentralized manner via smart contract-based DeFi protocols. The MiCAR regulations systematically require a centrally acting responsible party to be the addressee of supervisory obligations. In this respect, even if the current proposals were implemented, interaction with DeFi protocols would remain possible from a supervisory perspective for users acting on their own responsibility. The regulation of so-called “gatekeepers,” who, as regulated CASPs, provide their customers with access to services operating via DeFi protocols, would not only bring DeFi protocols closer to the supervised financial markets but could also help close existing regulatory gaps regarding access to DeFi, which currently, in some cases, prevent interaction with such DeFi services within the regulated environment. Such issues still exist today, particularly in the area of anti-money laundering, for example regarding the question of how the obligation to identify and verify the counterparty can be implemented in the context of interactions with DeFi protocols.

    Attorney Dr. Lutz Auffenberg, LL.M. (London)

    I.  https://fin-law.de

    E. info@fin-law.de

    subscribe to Newsletter

    This Blog Article as Podcast?

    The Gist of It:

    Presentation

      Contact

      info@fin-law.de

      Oct 12, 2026

      BNPL and CCD2 – When Do Merchants Become Loan Brokers?

      Loans aren’t just useful for major purchases like real estate, cars, or equipment for expensive hobbies. In e-commerce, short-term financing—even for very small amounts—has long been common for all kinds of everyday purchases, such as vacuum cleaners, coffee machines, or video game consoles. Consumers use so-called “Buy Now, Pay Later” (BNPL) offers to finance purchase prices ranging from 50 to 1,000 euros—or even more—over shorter periods of a few weeks or months. Since such credit agreements—which are usually relatively easy to obtain—can lead consumers into debt problems just as much as consumer loans for life’s major purchases, European lawmakers have tightened the rules in this area and, with the Second EU Consumer Credit Directive (CCD2), established stricter regulations, including for providers of BNPL offers. Because the CCD2, as an EU directive, does not apply directly to market participants, EU member states must transpose its provisions into national law through national implementing legislation. With its Sales Financing Act (Absatzfinanzierungsgesetz), the German legislature has already made extensive amendments to the provisions of the German Civil Code (BGB) and the Introductory Act to the German Civil Code (EGBGB), the German Banking Act (KWG), the Payment Services Supervision Act (ZAG), and other existing laws—some of which have been in effect since May of this year (2026), while most will take effect on November 20, 2026. It has long been clear to banks and payment service providers that they must align their business models with the new regulations. However, in e-commerce, there will also be relevant changes for merchants themselves, which is why merchants and marketplace operators must also ask themselves when a payment or purchase transaction can become a consumer loan and what role they play in this context.

      When Exactly Do BNPL Offers Fall Under the New CCD2 Rules?

      BNPL is not a legal term in its own right or a specific type of contract under the BGB, but rather an umbrella term for sales financing models in which the consumer receives the goods or services immediately, while payment—in whole or in part—is deferred to a later date. In practice, this primarily includes purchase on account and installment purchases. It is not uncommon for an external BNPL provider to act as an intermediary, purchasing the receivable or structuring the financing. In the case of installment purchases, the consumer is allowed to pay the purchase price in several installments over a specified period. In the case of purchase on account, although the purchase price must be paid in full in a single lump sum, the consumer may be granted a one-time deferral of payment, which can also serve a loan-like financing function. According to the CCD2, such models are generally intended to be covered. In Recital 16 of the CCD2, the legislator clarifies that modern BNPL models—which are often interest- and fee-free—are specifically intended to be covered. This is because, under current law, there are exceptions for certain scenarios that BNPL providers have been able to utilize for their offers—such as loans of less than 200 euros or those that must be repaid within three months and for which only minimal costs are agreed upon for the consumer. These exceptions are now to be abolished as far as possible. In the future, there will be only one exception remaining in the area of invoice-based purchases, namely when the business grants the consumer—directly, without a third party providing a loan, a payment deferral, or other financial assistance—a payment period of no more than 50 days free of charge, and only limited costs may be incurred in the event of default. Other forms of sales financing may potentially fall within the scope of the new consumer credit law if they serve a function similar to financing. Whether a BNPL offer or other sales financing measure ultimately falls under the new regime always depends on its specific structure and must be assessed on a case-by-case basis.

      Who is Considered a Loan Broker Under the New Section 34k GewO?

      For e-commerce companies, these changes mean that merchants must exercise caution when structuring their own sales financing and drafting their sales contracts and terms and conditions to avoid becoming lenders themselves. Furthermore, merchants and marketplace providers are also subject to the new licensing requirement for loan brokers under Section 34k of the German Trade Regulation Act (GewO). This licensing requirement, which takes effect on November 20, 2026, applies to companies that, on a commercial basis and in exchange for compensation—which may consist of a monetary payment or another agreed-upon economic benefit—act as intermediaries in the conclusion of consumer loan agreements or financing arrangements, or that provide the opportunity to conclude such agreements. Anyone who advises third parties on consumer loan agreements or financing arrangements, or who otherwise assists in the conclusion of such an agreement, may also be subject to the licensing requirement under Section 34k GewO. Retailers who, for example, suggest BNPL providers or other lenders as payment methods to their consumer customers for the sale of their goods and receive agreed-upon economic benefits in return may be subject to the requirement to obtain prior authorization under Section 34k GewO from the competent authority. Depending on the federal state, the authorization must then be applied for either at the competent Chamber of Industry and Commerce (IHK) or the Trade Licensing Office. To obtain the permit, loan brokers must meet certain legal requirements. Consequently, sellers and e-commerce platforms must also ensure—when selecting the payment methods they accept—that they either offer only those payment methods that are not themselves classified as lenders, or, alternatively, apply for the required permit under Section 34k GewO from the competent authority.

      Attorney Dr. Lutz Auffenberg, LL.M. (London)

      I.  https://fin-law.de

      E. info@fin-law.de

      subscribe to Newsletter

      This Blog Article as Podcast?

      The Gist of It:

      Presentation

        Contact

        info@fin-law.de

        Sep 28, 2026

        The New Consumer Credit Directive—Who Is Affected by the New CCD2 Rules?

        Starting November 20, 2026, new rules will apply to consumer loans. Through the implementation act concerning the Directive (EU) 2023/2225 on Consumer Credit Agreements and Regulating the Promotion of Climate-Neutral Mobility, the German legislature has transposed the new requirements of the Second Consumer Credit Directive (CCD2) into national law. The new rules bring numerous changes, though these do not affect only banks that issue consumer loans. To address recent developments in the area of small loans and payment deferrals—and the associated new risks for consumers—the rules also extend, in particular, to entities that are not regulated credit institutions or payment institutions. As a result, even unregulated companies operating in the retail sector will have to consider whether the new rules impose new requirements on their business models. The legislature has placed particular emphasis on so-called “Buy Now, Pay Later” (BNPL) offers, which allow consumers to purchase goods or services and pay for them at a later date. Under current law, there are exceptions for consumer loans of less than 200 euros, for those with a term of up to three months, and for BNPL, which exclude these forms of credit from the scope of consumer credit contract law. However, this will no longer be the case as of November 20, 2026.

        Companies Will Be Required to Comply with the New Consumer Credit Law in the Future?

        The new rules naturally apply to banks active in the lending business that extend credit to consumers. Payment institutions that are permitted to grant credit on a limited basis under their regulatory licenses—for example, by granting a line of credit in connection with payment services—should also expect to comply with the stricter consumer protection rules under CCD2. A particularly significant change is that, due to the elimination of sector-specific exemptions for microloans, short-term loans, and BNPL models, even unregulated retail companies may increasingly be affected by the provisions of the new consumer credit law, depending on the structure of their payment terms for consumer customers. This is because the new rules may also apply, for example, to certain arrangements involving sales financing, deferred payment of the purchase price, or installment payment agreements. The following overview shows which business models may be specifically affected and to what extent:

        What Changes Will There Be for Companies Affected by CCD2?

        Companies subject to the new regulations under consumer credit law must comply with numerous new obligations. Of particular relevance are the stricter requirements for fulfilling pre-contractual information obligations, which the legislature has revised for contracts to be concluded on the 20 of November, 2026, or later. The new list of pre-contractual information obligations for consumer loan agreements, financing assistance agreements, and loan brokerage agreements comprises a total of 28 items of information that businesses must provide to consumers. This includes, among other things, information about the business and the terms of the contract—in particular, the term, interest rates, late payment interest, and the annual percentage rate (APR)—as well as due dates, any provisions regarding prepayment penalties, and the total costs to the consumer. In addition, a representative example illustrating the total amount and the annual percentage rate (APR)—including the underlying assumptions—as well as a repayment schedule must be provided. Specific warnings regarding the consequences of failing to comply with contractual obligations must also be provided. Of particular relevance to companies that have not been regulated to date is the introduction of a mandatory registration requirement for lenders under the new Sales Financing Supervision Act (AbsFinAG) with BaFin as the competent supervisory authority. Companies subject to this registration requirement will also have to meet additional requirements when designing their employee compensation systems, particularly with regard to avoiding inappropriate incentives through performance targets. In addition, consumer credit lenders will be required to conduct a creditworthiness check before entering into a loan agreement, and the result of this check must be positive.

        What Should Companies with Consumer Customers Do by November 20, 2026?

        The requirements for unregulated companies with consumer customers will change significantly with the implementation of the CCD2 requirements into German law as of November 20, 2026. Affected companies are therefore advised to have their business models—and, in particular, their sales processes—thoroughly reviewed in light of the new requirements under consumer credit law. The following list of questions may provide some initial guidance:

        Attorney Dr. Lutz Auffenberg, LL.M. (London)

        I. https://fin-law.de

        E. info@fin-law.de

        subscribe to Newsletter

        This Blog Article as Podcast?

        The Gist of It:

        Presentation

          Contact

          info@fin-law.de

          Sep 21, 2026

          Strong Customer Authentication – Does SCA Really Prevent Agentic Payments?

          There are currently many trending topics in the payment services industry. Two of them are Agentic Payments and Agentic Commerce. In these cases, AI agents are provided with their own budgets to automatically make purchases, enter into contracts, and ultimately make payments on behalf of users based on their prompts. Strong Customer Authentication (SCA), which is mandated by payment service regulations and is fundamentally enshrined in Section 55 of Germany’s Payment Services Supervision Act (ZAG), is currently viewed as one of the most prominent obstacles to Agentic Payments. The regulation requires payment service providers to implement strong customer authentication whenever the payer wishes to access their payment account online, initiate an electronic payment transaction, or perform an action via remote access that involves the risk of payment fraud or other misuse. Strong customer authentication requires that, before carrying out the action, the customer must satisfy at least two of three factors from the categories of knowledge (e.g., password), possession (e.g., card or cell phone), and inherence (e.g., fingerprint or retinal scan). It is often argued that the currently applicable SCA requirements under the Second Payment Services Directive (PSD2) prevent the implementation of Agentic Payments. The problem is perceived as follows: Agentic Payments are intended to run in the background without user involvement, whereas SCA is triggered on a transaction-by-transaction basis, requiring user authorization for each individual transaction. As a result, the AI agent cannot initiate payment transactions on its own. But is this statement accurate in its entirety?

          When is Strong Customer Identification Not Required?

          The requirement to perform an SCA is the general rule and is stipulated in Section 55(1) of the ZAG. The payment industry is calling for a solution to the conflict between SCA and agentic commerce, arguing that the regulation should no longer require SCA verification on a transaction-by-transaction basis, but rather uniformly at the order level when the user instructs the AI agent to execute agentic payments via a prompt. However, there are already numerous exceptions to SCA today, which are regulated in Articles 10 et seq. of Delegated Regulation (EU) 2018/389. Particularly relevant in practice for agentic payments is the exception for payments to trusted recipients. According to this provision, the payment service provider is not required to request SCA if the payee is on a list of trusted payees that the payer has created through their account-holding payment service provider. In such cases, payment service providers are only required to request SCA when the payer creates or modifies the list of trusted payees. In the context of Agentic Commerce, this exemption would be feasible insofar as the SCA request—as proposed by market participants—could be shifted to the moment the order is placed with the AI agent. The resulting restriction on the AI agent’s ability to select providers would simultaneously provide a certain level of security for the user, who could not give the AI agent unlimited discretion. From a consumer protection perspective, such a safety net is certainly not detrimental to users of AI with agentic payment functionality.

          Additional Exceptions for Small-Value Payments and Specific Circumstances

          The list of trusted recipients is not the only solution for addressing the issue of SCA requests for Agentic Payments—or, at least, for significantly reducing the frequency of such requests. Payment service providers are also not required to perform strong customer authentication when the payer wishes to initiate small-value transactions electronically that meet certain requirements. For this to apply, the amount of the payment transaction must not exceed 30 euros, and the total amount of all previous payment transactions initiated by the payer without SCA must not exceed 100 euros. In addition, no more than five electronic payment transactions may have been initiated since the last time strong customer authentication was performed. These exceptions are well-suited to significantly reduce the number of SCA requests in the case of Agentic Payments, provided that the transactions in question are micropayments. Delegated Regulation (EU) 2018/389 also provides for further exceptions that may apply in specific cases. For example, there are exceptions for transactions between the payer’s own accounts with the same payment service provider, for recurring payments, and for low-risk payment transactions. In this regard, whether the exceptions apply ultimately depends on the specific use case. When designing business models in the areas of Agentic Payments and Agentic Commerce, companies should definitely be familiar with the exemptions set forth in Delegated Regulation (EU) 2018/389 and take them into account when developing their products.

          Attorney Dr. Lutz Auffenberg, LL.M. (London)

          I.  https://fin-law.de

          E. info@fin-law.de

          subscribe to Newsletter

          This Blog Article as Podcast?

          The Gist of It:

          Presentation

            Contact

            info@fin-law.de

            Sep 14, 2026

            Regulation of Finfluencers—What Should Be Considered?

            So-called “finfluencers” are social media influencers or content creators on platforms such as Instagram or TikTok who use their content to help their audience or followers better understand financial topics, investment ideas, and investment products. The fact that there is an ever-growing need for this is particularly evident in the 18- to 45-year-old age group, where many people turn to social media platforms to learn about financial topics. Many of these people view finfluencers as a good alternative to advice from traditional channels such as banks or similar institutions. While finfluencers can certainly perform valuable educational work by providing information and sharing knowledge, there are still dubious actors among them. These promote, for example, products that may not be suitable—or may not be as suitable—for potential investors in their audience, yet present them as suitable; or they exaggerate potential returns or downplay the risks associated with the advertised products. The offerors or issuers of the advertised products frequently pay finfluencers—in some cases substantial sums—for the reach and advertising they provide. Many users are completely unaware that finfluencers often receive payment, gifts, or other perks from their clients—that is, those who ultimately have a vested interest in selling the advertised products—in exchange for their posts and product recommendations.

            Are Finfluencers Subject to Licensing Requirements and to BaFin Supervision?

            With regard to regulatory authorisation requirements and the associated supervision by BaFin, there are certainly potential pitfalls for finfluencers. For example, the activity of investment advice—which requires authorization  under the German Banking Act (KWG) or the German Securities Trading Act (WpIG)—occurs when personal recommendations relating to transactions involving specific financial instruments are provided to clients or their representatives, provided that the recommendation is based on an assessment of the investor’s personal circumstances or is presented as suitable for them, and is not disclosed exclusively through information dissemination channels or to the general public. Since finfluencers typically direct their posts to the general public via information dissemination channels and do not have direct contact with clients—and thus the recommendation is not personalized—they generally do not meet the legal definition of investment advice. Nevertheless, legal uncertainties do arise in this context. This is because publicly expressed opinions on price trends or investment strategies may, according to a warning from ESMA, be legally qualified as an investment recommendation or an investment strategy recommendation under the European Market Abuse Regulation (MAR) or the German Securities Trading Act (WpHG), which may, in some cases, entail an obligation to register with BaFin. Furthermore, there is a risk that finfluencers could, through their activities, aid and abet the provision of unauthorized financial services. This could be the case, for example, if they advertise platforms or products that do not possess the required BaFin authorization. In such cases, the finfluencer in question may themselves become the target of regulatory measures or even face criminal charges for aiding and abetting the provision of unauthorized financial services.

            Regulators Impose High Standards for Legitimacy

            Finfluencers must, under all circumstances, comply with applicable regulatory requirements and due diligence obligations when carrying out their activities. In this context, the finfluencer’s expertise is considered an absolute prerequisite for conducting this activity in compliance with the law. These individuals may only discuss financial products that they fully understand themselves—and only if they do not pretend to possess expertise that they do not actually have. In addition, a strict obligation of transparency applies. The fact that a post constitutes a paid advertising partnership in exchange for monetary compensation or other benefits must be clearly and unambiguously disclosed. In this regard, the disclosure of these facts must be understandable, and the relevant information must be easily recognizable—it must not be hidden in hashtags or in fine print. The finfluencer’s personal interest in the products—for example, because they have invested in them themselves and would therefore benefit from rising prices—must also be disclosed to the audience in a timely and honest manner; otherwise, this could constitute unlawful market manipulation. Furthermore, BaFin and ESMA also require fairness and risk transparency from those involved. Accordingly, the information provided must be truthful and clear. Furthermore, a precise distinction must be made between facts and opinions. Particularly in the case of high-risk products such as futures or cryptocurrencies, the possibility of incurring losses must be clearly highlighted. Psychological pressure tactics (FOMO) or unscrupulous promises (“get rich quick”) must not be included in the content. It is the responsibility of the finfluencers themselves to conduct due diligence in advance to verify whether advertised partners or platforms hold the necessary regulatory approvals. It is also the finfluencer’s own responsibility to verify and ensure compliance with all other legal obligations, such as fulfilling any applicable registration requirements as a creator or distributor of investment recommendations or investment strategy recommendations.

            Attorney Dr. Lutz Auffenberg, LL.M. (London)

            I.  https://fin-law.de

            E. info@fin-law.de

            subscribe to Newsletter

            This Blog Article as Podcast?

            The Gist of It:

            Presentation

              Contact

              info@fin-law.de

              Sep 07, 2026

              Shopping Budget for the AI Agent – Do Agentic Payments Require Authorization Under the ZAG?

              AI technology has long since permeated every aspect of daily life. AI agents are used in nearly every aspect of personal and professional life and are handling their assigned tasks with increasing comprehensiveness. It was therefore only a matter of time before AI agents were allocated specific budgets to carry out their tasks. Recently, for example, Adyen, one of the world’s largest payment providers, introduced “Adyen Agentic,” a new tool designed to handle AI-triggered payments. It is clear that AI-supported services—such as organizing vacations or business trips, including flight, hotel, and rental car bookings, or AI-automated shopping for coordinating outfits based on the latest fashion trends and the user’s specified preferences—will become even more efficient once the AI user no longer has to handle the payment for services or goods themselves. Instead, the AI agent is simply given budgets and specific instructions—for example, regarding prices and delivery times acceptable to the user—and then handles everything else, just like a real assistant. For providers of such AI-powered shopping assistants, this raises the question of whether accepting budgets and making payments constitute payment services subject to licensing under Section 10(1) of the Payment Services Supervision Act (ZAG). If this were the case, a further question arises as to how such business models can be structured in compliance with regulatory requirements.

              Can AI Actually Provide Payment Services?

              In general, AI-based applications such as AI agents remain merely software and are therefore tools. As such, AI does not, in principle, have its own legal personality and therefore cannot, in and of itself, be subject to regulatory licensing requirements. However, in the vast majority of cases, there is an identifiable provider behind the AI agent who may be subject to obligations under the applicable regulatory provisions. In the case of the integration of payment services, the question of whether a license is required under Section 10(1) of the German Payment Services Act (ZAG) depends on exactly what the AI agent is intended to do in connection with payment transactions. For example, if funds are transferred to the provider’s accounts or wallets and used from there to pay for goods and services, this could constitute money remittance service, which is subject to licensing. If, instead, the AI agent were able to initiate payments from a user’s bank account—for example, because the AI agent is provided with the necessary online banking credentials—this could be classified as a payment initiation service requiring authorization within the meaning of Section 1(1), sentence 2, No. 7 of the ZAG. If the provider of the AI agent even sets up payment accounts in the user’s name, deposit and withdrawal transactions under Section 1(1), sentence 2, nos. 1 and 2 of the ZAG may also come into play. However, in all cases, the exceptions listed in Section 2(1) of the ZAG must also be taken into account. Of particular interest in the case of AI-based shopping assistants is the commercial agent exception under Section 2(1) of the ZAG. According to this provision, payment transactions are not considered payment services if they are carried out through a central clearing house or commercial agent who has been granted authority to negotiate or conclude contracts by either the payer or the payee for the purchase or sale of goods or services. If an AI shopping assistant acts exclusively in the user’s interest, there would, in principle, be grounds for this exception.

              What Opportunities Does Agentic Payments Offer to Licensed Payment Service Providers?

              Not only online store operators but also payment providers should respond to the trend of delegating purchasing decisions to AI agents. AI agents will make purchasing decisions dispassionately, based solely on the specifications of the prompt and their user. Traditional marketing psychology will therefore no longer work in online stores as it has in the past. Payment providers will need to ensure that AI agents used as shopping assistants have access to all necessary payment methods so that the AI can make the right decision for the user in terms of transaction costs and security and, above all, achieve the broadest possible integration with retail outlets. Already-licensed payment institutions can, in principle, also use their license under Section 10(1) ZAG for new business areas in the sphere of agentic payments and thus tap into new business opportunities. The development of proprietary AI-compatible products is possible, though this requires going through a new product process in accordance with AT 8.1 ZAG-MaRisk. In addition to developing their own offerings, authorized payment institutions can also provide their regulatory infrastructure to AI startups and, through an outsourcing solution, enable those startups’ business models to comply with the ZAG. In any case, Agentic Payments have strong disruptive potential in the payment services industry and thus offer opportunities for innovation and growth that cannot be ignored.

              Attorney Dr. Lutz Auffenberg, LL.M. (London)

              I.  https://fin-law.de

              E. info@fin-law.de

              subscribe to Newsletter

              This Blog Article as Podcast?

              The Gist of It:

              Presentation

                Contact

                info@fin-law.de

                Aug 10, 2026

                Payment Services Using E-Money Tokens – What Exceptions Should Be Provided for Under PSD3/PSR?

                Last summer, the European Banking Authority (EBA) caused quite a stir with its Opinion of June 10, 2026 regarding the interaction betweenSecond Payment Services Directive (PSD2) and MiCAR in the context of e-money tokens (EMT). With e-money tokens, the MiCAR regulator had created a new form of e-money. However, it had not sufficiently considered that e-money qualifies as funds within the meaning of the Second Payment Services Directive (PSD2) and that, as a result, the provision of certain crypto-asset services using EMTs may involve not only crypto-asset services requiring authorization but also payment services requiring a authorization. Consequently, such service providers require both a MiCAR authorization and a license under payment services supervisory law—in Germany, issued by BaFin pursuant to the Payment Services Supervision Act (ZAG). According to the EBA’s Opinion, this issue is particularly relevant in the area of crypto custody within the meaning of Art. 3(1)(17) MiCAR, to the extent that it is offered in connection with EMT. This service may also constitute the operation of a payment account, which requires authorization and would be classified under German law as a deposit and withdrawal transaction pursuant to Section 1(1), sentence 2, nos. 1 and 2 of the ZAG. According to the EBA’s clarification, transfer services for crypto-assets for customers within the meaning of Article 3(1)(26) of MiCAR may also constitute payment services subject to authorization. By contrast, the exchange of crypto-assets for a money amount and the exchange of crypto-assets for other crypto-assets, as defined in Article 3(1)(19) and (20) of MiCAR, shall not be considered payment services.

                Additions to the List of Exceptions for EMT in the Final Drafts of PSD3/PSR

                In essence, it is apparent that the provision of a specific service should ultimately be subject to a regulatory regime only to the extent necessary to enable it to be effectively supervised by the supervisory authorities. The final compromise drafts of the future third Payment Services Directive (PSD3-E) and the Payment Services Regulation (PSR-E), which have been available since April 2026, therefore provide for new exemptions for these cases. Article 2(2)(a1) of the PSR-E clarifies that payment transactions conducted exclusively in EMT directly from the payer to the payee without any involvement of intermediaries shall not fall within the scope of the PSR. Furthermore, pursuant to Article 2(2)lit. ha of the PSR-E, payment transactions executed by crypto-asset service providers (CASP) acting as intermediaries between buyers and sellers of EMT, in which EMT is exchanged for other EMT or other crypto-assets, are to be excluded from the scope of the PSR. The exchange of EMT for funds or other crypto-assets is also to be excluded if the CASP acts in its own name. Finally, another new exemption is provided for in Article 2(2) lit. la of the PSR-E, according to which payment transactions between CASPs or their branches for their own account are not to fall within the scope of the future PSR. This latest new exemption therefore applies not only to payment transactions involving EMT, but generally to payment transactions involving all types of monetary amounts between CASPs. In accordance with Article 1(3) of the PSD3-E, all of the new exemptions mentioned are intended to apply equally to the provisions of the future PSD3.

                Dual Authorisation Requirement for CASPs Under MICAR and ZAG Will Remain Possible in the Future

                While the new exemptions under the draft PSD3/PSR regulations exclude certain scenarios from the scope of payment services supervisory law. However, even under the new rules, there will still be many areas in which companies will be subject to supervision under both the provisions of MiCAR and those of the applicable payment services supervisory law. In Germany, these companies will require authorization under Art. 59 et seq. MiCAR and a authorization pursuant to Section 10(1) ZAG, unless other exemptions applicable to their specific business model can be invoked. In particular—as already noted in the interpretation of the cited EBA Opinion—trading activities that qualify as the exchange of crypto-assets for fiat currency or other crypto-assets are given preferential treatment. With the exception of payment transactions directly between authorized CASPs, the problem will persist that CASPs may provide payment services not only for EMT transactions but also, more generally, for fiat currency transactions—including all forms of e-money—as provided for in their respective business models, which they are not permitted to do without an additional license under Section 10(1) of the ZAG. Particularly common in this context are cases involving the transfer of funds, such as when customer funds are paid out to third parties in accordance with instructions. Such activities often constitute a financial transfer business that requires a license. In any case, it is worthwhile for companies to have their business model reviewed from a regulatory perspective by a specialized attorney in order to identify any problematic processes early on and, if necessary, restructure them.

                Attorney Dr. Lutz Auffenberg, LL.M. (London)

                I.  https://fin-law.de

                E. info@fin-law.de

                subscribe to Newsletter

                  Contact

                  info@fin-law.de

                  Aug 03, 2026

                  New BaFin Circular – Can Asset Investments Still Be Packaged Products Under the PRIIPs Regulation?

                  Asset investments continue to enjoy unwavering popularity in Germany as a means of financing companies and projects, and are defined and regulated by the Asset Investment Act (VermAnlG). Therefore, anyone wishing to issue such an asset investment and offer it publicly in Germany must comply with the regulatory requirements of the VermAnlG. However, the VermAnlG applies only if the offering does not fall within the scope of European Regulation (EU) 2020/1503 (Crowdfunding Regulation) or Regulation (EU) 2023/1114 (MiCAR). According to the wording of section 1(2) of the VermAnlG, products may not constitute asset investments within the meaning of the law if they qualify as securities under the Securities Prospectus Act or as units in investment funds under the Capital Investment Code, or if the funds raised are classified as deposits under the German Banking Act. However, if the product to be issued is an asset investment to which the VermAnlG applies, issuers and offerors must, among other things, also comply with the documentation and prospectus requirements arising from the VermAnlG. But what specific obligations must issuers and offerors fulfill in this context?

                  What Prospectus and Documentation Requirements Must Providers of Asset Investments Comply With?

                  In general, providers must prepare a sales prospectus in accordance with the requirements of sections 6 et seq. of the  VermAnlG before commencing a public offering of asset investments, have it approved by BaFin as the competent supervisory authority, and then publish this sales prospectus. However, the VermAnlG also provides for exceptions to these obligations. For example, offerings limited to twenty units of the same type of asset investment do not require a prospectus. The same applies to offerings whose total volume does not exceed EUR 100,000, as well as to offerings whose price per single unit is not less than EUR 200,000. In addition, there are exceptions for crowdfunding projects under the VermAnlG, as well as social projects and charitable and religious projects. In addition to the requirement to publish an approved sales prospectus, providers of asset investments must generally also prepare a so-called Asset Investment Information Sheet (VIB) and file it with BaFin after receiving its approval. This requirement also applies to asset investments for which a public offering is permitted without a sales prospectus because they fall under the exception for crowdfunding projects under the VermAnlG or under the exception for social projects. However, the obligation to prepare and file a VIB does not apply in any case if a Key Information Document (BIB) must already be published for the public offering of the asset investment in accordance with Regulation (EU) No. 1286/2014 (PRIIPs Regulation).

                  When is a KID Required for Asset Investments?

                  Under the PRIIPs Regulation, manufacturers of packaged investment products for retail investors must prepare and publish a KID. In such cases, the provider must, in any event, also target retail investors in the public offering of the asset investment. It can be difficult to determine on a case-by-case basis when a product is “packaged” within the meaning of the PRIIPs Regulation. Under the PRIIPs Regulation, a product is considered a packaged investment product if the amount to be repaid is subject to fluctuations due to its dependence on reference values or the performance of one or more assets that are not directly acquired by investors. According to BaFin, the amount to be repaid includes both interest and principal. BaFin further notes that the type of reference value is also a factor. According to this, the repayment amount’s dependence on internal reference values or interest rate indices—such as the Euribor—does not constitute a packaged product; dependence on external reference values, on the other hand, does. The exact classification is therefore always a matter of the individual case.

                  According to the BaFin Circular of July 27, 2026, Asset Investments are Rarely Packaged Products

                  In its circular dated July 27, 2026, BaFin now clarifies that it generally does not classify asset investments as packaged investment products under the PRIIPs Regulation. It justifies this by stating that asset investments typically have the character of equity interests in companies and are therefore comparable to stocks. Such equity interests are exempt from the PRIIPs Regulation. According to this, the key factor in classifying asset investments is generally that they serve an equity-like function. Asset investments are therefore either part of the issuer’s equity or, in principle, have an equity-like character. Consequently, most asset investments are generally not to be classified as packaged investment products within the meaning of the PRIIPs Regulation. Already in the first part of the circular—the introduction—BaFin clarifies that providers of asset investments must therefore generally prepare a VIB and have it approved by BaFin. The approved VIB must then be filed with BaFin. Providers of asset investments that are planning a public offering in the future should be sure to take this clarification from BaFin into account in their planning and when drafting the required documentation. Providers of currently ongoing public offerings, particularly those who have published a BIB for their public offering, should urgently review the documents they have published or filed to ensure they are complete and accurate, or have them reviewed by specialized attorneys.

                  FIN LAW

                  I. https://fin-law.de

                  E. info@fin-law.de

                  subscribe to Newsletter

                  This Blog Article as Podcast?

                  The Gist of It:

                  Presentation

                    Contact

                    info@fin-law.de

                    May 19, 2026

                    Streamlining Prospectus Regulations – What Changes Will the EU Listing Act Bring in June 2026?

                    With the EU Listing Act, the European Union aims to make access to the capital market easier and more cost-effective. In particular, small and medium-sized enterprises (SMEs) should be able to raise capital more easily in the future without being hindered by excessive prospectus requirements. This initiative comes in response to growing criticism that European capital markets have become too bureaucratic and expensive compared to their international counterparts—particularly the United States. In this regard, the reform of the EU Prospectus Regulation specifically targets information and disclosure requirements. While initial changes will apply as soon as the Listing Act enters into force at the end of 2024, the key changes will largely take effect starting in March or June 2026. Of particular relevance is the expansion of existing exemptions from the prospectus requirement. Public offerings with a total consideration of up to 12 million euros within a twelve-month period in the Union will be exempt from the prospectus requirement starting June 5, 2026. Previously, the threshold was 8 million euros. For many growth companies, this means significantly simplified access to the capital market. Issuances by companies whose securities are already admitted to trading on a regulated market will also benefit from the new rules. The EU is thus responding to criticism that secondary issuances have so far entailed high costs and significant time commitments. The aim of the reform was therefore not only to make capital market transactions more efficient, but also to make the European capital market as a whole more attractive and competitive.

                    The EU Growth Issuance Prospectus and the EU Follow-on Prospectus as New Formats for Securities Prospectuses

                    A key component of the EU Listing Act is the new prospectus formats, which will take effect as early as March 5, 2026. These formats now distinguish between different types of issuers. For companies with securities already admitted to trading on a regulated market, the so-called EU follow-on prospectus is being introduced. The newly introduced EU growth issuance prospectus is intended to be available to small and medium-sized enterprises as well as issuers on SME growth markets and to facilitate fundraising. Both formats are designed to be concise, standardized, and easy to understand. The European regulator’s goal is to reduce preparation costs and improve readability for investors. In addition, mandatory requirements regarding the structure, order, and maximum length of certain prospectuses will be introduced as of June 5, 2026. This is intended to reduce the typical “information overload” that has made many prospectuses virtually unreadable to date. In addition, digital processes will be facilitated or introduced. For example, issuers, offerors, and financial intermediaries will be permitted in certain cases to inform investors exclusively electronically about prospectus supplements. New financial information can also be more easily integrated into existing prospectuses by reference. The shortened deadline for initial public offerings of shares on a regulated market is also likely to be particularly relevant in practice. In the future, prospectuses will only need to be published three working days before the end of the offer period, instead of the previous six. For issuers, this means greater flexibility and faster placements, and thus simpler and faster capital raising.

                    ESG Requirements Could Reduce the Simplification Effect

                    Despite all these simplifications, however, it remains unclear whether the Listing Act will actually advance the hoped-for “Capital Markets Union.” In particular, the new sustainability disclosures that are also planned could partially offset the simplification intended by the EU Listing Act. Specifically, disclosure requirements regarding ESG will be introduced as of June 5, 2026. These relate to sustainability reporting and compliance with certain sustainability targets. Furthermore, prospectus liability risks will remain significant. The increasing standardization of prospectuses also carries risks. While it improves comparability, it could simultaneously lead to such a standardized form of disclosure that the specific characteristics of individual issuers and their offerings may no longer be adequately taken into account. Nevertheless, the reforms and simplifications represent a step toward easier capital raising in Europe. Especially since the European regulator’s focus in recent years has been almost exclusively on increased compliance obligations, the simplifications mentioned above send a positive signal to the European capital market. It is therefore worthwhile for issuers, offerors, and financial intermediaries to carefully analyze the new prospectus formats and exemptions and to adapt their capital market strategy to the new legal framework now.

                    Attorney Dr. Lutz Auffenberg, LL.M. (London)

                    I.  https://fin-law.de

                    E. info@fin-law.de

                    subscribe to Newsletter

                    This Blog Article as Podcast?

                    The Gist of It:

                    Presentation

                      Contact

                      info@fin-law.de

                      May 12, 2026

                      Social Trading and Signal Following – What Regulatory Considerations Do Providers Need to Keep in Mind?

                      Over the past few years, numerous platforms have emerged on the market that offer so-called day traders the opportunity to invest directly in various financial instruments without the involvement of a broker. The available product portfolio includes not only traditional spot trades in stocks, debt securities, or cryptocurrencies, but also investments in futures, options, and derivative financial instruments. For day traders who do not have enough time to manage their portfolio themselves, so-called social trading or signal following may be of interest. This allows platform users to follow the trading activities of other platform users and implement their trading decisions at the same time. There are various forms of social trading and signal following, in which customers either have published trading algorithms or trading bots to automatically execute the suggested trading decisions in their account, or simply observe the trading activities of another trader to then decide on a case-by-case basis whether and to what extent a trade should also be executed. Social trading and signal following entail a number of regulatory pitfalls that both clients and providers should be aware of. The regulatory obligations of platform operators, signal providers, and clients differ fundamentally.

                      Which Stakeholders Require a BaFin License for Their Role in Social Trading?

                      Operators of platforms that enable social trading or signal following generally require regulatory approval to conduct their business. If the trading signals made available relate to financial instruments in the traditional sense, such as stocks, bonds, certificates, futures, or derivatives, the platform operator generally needs authorization to provide the investment services of portfolio management, investment brokerage, or contract brokerage. If trading signals for crypto-assets are published, a licensing requirement under MiCAR may apply for portfolio management, the acceptance and transmission of orders for crypto-assets on behalf of clients, or the execution of orders for crypto-assets on behalf of clients. Users of the platform, on the other hand, do not typically trigger any licensing requirements simply by following signals using their own trading accounts. For signal providers, however, it depends heavily on the specific circumstances of each individual case. To the extent that investment decisions are merely published in the provider’s own securities account, this activity does not yet constitute a licensed activity. However, it is always necessary to carefully examine exactly how the signal provider’s trading decisions are implemented in the user’s account. To the extent that the signal provider receives a genuine mandate to execute trading decisions with effect on the user’s securities account, licensing requirements regarding portfolio management or investment brokerage may apply.

                      In Individual Cases, the Issuance of Signals May Trigger a Requirement to Register with BaFin

                      Even in situations where the act of providing trading signals does not itself trigger a licensing requirement under Section 15(1) WpIG or Section 32 KWG, signal providers may still be subject to a registration requirement with BaFin. This may be the case if the publication of trading signals is classified as an investment recommendation or an investment strategy recommendation. According to the legal definition in Art. 3(1)(35) MAR, investment recommendations are information containing explicit or implicit recommendations or suggestions regarding investment strategies in relation to one or more financial instruments or issuers, intended for distribution channels or the public, including an assessment of the current or future value or price of such instruments. Investment strategy recommendations, by contrast, are described in Article 3(1)(34) MAR as the production of information that directly or indirectly constitutes a specific investment proposal or, directly, a specific investment decision regarding a financial instrument or an issuer. If the publication of trading signals in social trading or signal following constitutes an investment recommendation or investment strategy recommendation in this sense, the signal provider may be required to register this activity with BaFin pursuant to Section 86 WpHG. In addition, the provider must fulfill certain compliance obligations and organize its business operations accordingly. Particularly relevant in this context is the obligation to disclose, report, and avoid conflicts of interest in accordance with Section 85 of the WpHG. Furthermore, the recommendations themselves must meet content requirements, including, among other things, clear indications distinguishing estimates from facts, the disclosure of relevant sources, and the date and time of publication.

                      Attorney Dr. Lutz Auffenberg, LL.M. (London)

                      I.  https://fin-law.de

                      E. info@fin-law.de

                      subscribe to Newsletter

                      This Blog Article as Podcast?

                      The Gist of It:

                      Presentation

                        Contact

                        info@fin-law.de

                        Apr 27, 2026

                        Raising Capital Through a Public Offering

                        Traditional bank financing is a type of financing involving many hurdles for many companies, especially for startups and SMEs. For one thing, banks typically require collateral before granting loans. For companies that are just getting started, this can already be a difficult—or even insurmountable—obstacle. On the other hand, banks are generally interested in regular payments consisting of interest and principal, and not so much in, for example, profit sharing or a bullet loan. However, these types of repayment or compensation are very attractive to the companies mentioned above. Investors in the capital market can offer such forms of economic participation. When companies and investors in the capital market come together, this often creates economically attractive options for both sides that can serve as interesting alternatives to traditional bank loans. Of course, if such markets were unregulated, they would pose a significant risk to retail investors and open the door to fraud by unscrupulous providers. For this reason, these markets are regulated in Germany by German and European legislation. Within the framework of these regulations, the term “public offering” frequently arises. For which products does this term play a role, and what exactly does the concept entail?

                        What is a Public Offering, and in Which Context is it Important?

                        Both Regulation (EU) 2017/1129 (the Prospectus Regulation), which regulates public offerings of securities in Europe, and Regulation (EU) 2023/1114, the Markets in Crypto-Assets Regulation (MiCAR), which establishes rules for crypto-asset markets in Europe, the concept of a public offer is of central importance. In both cases, the offering of the respective regulated products, insofar as it constitutes a public offer, is associated with far-reaching obligations for the respective issuers. The legal definitions are also virtually identical. According to the definition in the Prospectus Regulation, a public offer consists of a communication to the public in any form and by any means that contains sufficient information regarding the terms of the offer and the securities to be offered to enable an investor to decide whether to purchase or subscribe to those securities. If an offer constitutes a public offer within the meaning of the foregoing, this typically results in far-reaching obligations for the offerors and issuers. For securities, a published securities prospectus approved by the competent authority is generally required; for crypto-assets under MiCAR, a published and notified crypto-asset whitepaper is mandatory. These documentation requirements may also be accompanied by obligations regarding the distribution channels for the products. Is raising capital through such products therefore only possible if these extensive obligations are fulfilled?

                        Exemptions and Private Placements

                        The respective regulations do, however, provide for exceptions. For example, a public offering of securities is possible even without the prior publication of an approved prospectus if the offering is directed only at qualified investors or at fewer than 150 non-qualified investors per EU member state. Similar exemptions can also be found in MiCAR for the public offering of crypto-assets. Both regulations, however, also have their own specific exceptions. The regulation of crypto-assets is, in any case, modeled after the regulation of securities under the Prospectus Regulation. The situation is different, however, with so-called private placements. Although the term originates from securities law, the concept of a private placement is not defined in the Prospectus Regulation. Legal literature defines it as an offering that is not public, since a “personal connection” already exists between the issuer or its agent and the investor prior to the offering. Whether a private placement can also apply to crypto-assets has not yet been fully clarified; however, given MiCAR’s alignment with the Prospectus Regulation, there is strong evidence to suggest it does. Based on the above, startups and SMEs in particular can thus raise capital through products such as securities or crypto-assets—even without first fulfilling extensive documentation requirements—by means of clever structuring.

                        Attorney Dr. Lutz Auffenberg, LL.M. (London)

                        I.  https://fin-law.de

                        E. info@fin-law.de

                        subscribe to Newsletter

                        This Blog Article as Podcast?

                        The Gist of It:

                        Presentation

                          Contact

                          info@fin-law.de

                          to top