Payment Services under ZAG

The provision of payment services has been largely harmonized in the European Union since the creation of the first Payment Services Directive 2007/64/EC in 2007. Currently, the regulatory obligations of payment institutions are governed by the provisions of the second EU Payment Services Directive (EU) 2015/2366 (PSD2), which EU member states had to transpose into their respective national laws by 13^t January 2018. The German legislator complied with this obligation by enacting the German Payment Services Supervision Act (ZAG). Anyone who wishes to provide payment services in Germany on a commercial basis or at least to an extent that requires the establishment of a commercial business must first obtain a license from BaFin in accordance with Section 10 (1) ZAG and, once the license has been granted by the authority, be subject to ongoing supervision. Subject to authorization are activities such as activities regarding deposit and withdrawal transactions and all activities necessary for the management of payment accounts for customers, the execution of payment transactions such as transfers, direct debits or payment card transactions with and without the granting of credit, the acquisition business and the issuance of payment instruments. Companies that wish to offer money remittance services or make payment initiation services or account information services available to their customers also require prior authorization from BaFin.

Companies wishing to provide payment services in Germany or within the European Union must meet strict requirements in order to obtain the necessary authorization from BaFin. In addition to a detailed and sustainable business plan, which must include both the planned business figures for the first three financial years and a plausible description of the planned services in the field of payments, applicants must also describe in particular how their future corporate management and internal control mechanisms will be structured. In this context, it must be explained in detail how it will be ensured that the business organization will meet the regulatory requirements with regard to, among other things, risk management, IT security in accordance with the DORA requirements, money laundering obligations, accounting obligations, and numerous other regulatory obligations. In addition, as part of the ownership control process in the authorization procedure, comprehensive information about the shareholders and other persons with influence over the applicant’s company must be provided, together with evidence of the shareholders’ reliability and good reputation. Finally, the intended directors, of whom there must be at least two, must also be reliable and professionally qualified to provide the payment services to be offered. They must also demonstrate sufficient availability to perform their management duties, whereby, according to BaFin’s administrative practice, a total of at least 40 hours of combined availability must generally be available.

It often does not make sense for companies to apply to BaFin for their own authorization under Section 10 (1) ZAG. This may be because the time, administrative, and financial costs of a licensing procedure are disproportionate to the advantages of obtaining a ZAG license, or because supervision by BaFin following the granting of a license is not desired. In individual cases, companies can make use of the exemptions provided for in the ZAG and implement their business models without first applying for a license under the ZAG. Exemptions may exist, among other things, for business models in which central settlement facility or commercial agents with a mandate to negotiate or conclude contracts are interposed, in which the company concerned provides only supporting technical services, or in which payment transactions are carried out solely via payment instruments within limited networks or exclusively for the purchase of goods or services within a very limited range of products. However, some exemptions are subject to reporting requirements to BaFin, compliance with which is mandatory. If, for a specific business model, neither applying for a separate license makes economic sense nor an exemption applies, it may occasionally be possible to obtain an exemption by making minor changes to the implementation plan. In any case, a viable and functionally sound solution must be developed for each individual case to ensure that payment services requiring authorization are not inadvertently provided without BaFin authorization. The authority may immediately suspend and wind down such services by means of an administrative act that is enforceable with immediate effect. The persons responsible for the company may also be liable to prosecution for providing unauthorized payment services in accordance with Section 63 (1) No. 4 ZAG, which is punishable by imprisonment of up to five years.

The lawyer responsible for advising on the licensing requirements for payment services and for regulatory advice on the design of payment-related business models at our law firm is Attorney Dr. Lutz Auffenberg, LL.M. (London).