Account Information Service as a Payment Service Requiring Authorization

As part of the second Payment Services Directive (EU) 2025/2366 (PSD2), the European legislator included account information services in the catalog of payment services requiring authorization, in addition to payment initiation services. Since the implementation of the PSD2 requirements, account information services have been included in Section 1 (1) sentence 2 no. 8 of the Payment Services Supervision Act (ZAG). According to the legal definition in Section 1 (34) ZAG, an account information service is an online service to provide consolidated information on one or more payment accounts held by the payment service user with one or more other payment service providers. Account information services are therefore characterized in particular by the fact that the provider does not accept funds from customers and also does not maintain payment accounts for its customers. Rather, it is a matter of providing account data that the provider can retrieve from the account-holding banks and payment institutions on behalf of its customers using access data (PIN and TAN) made available to it by the customer. It is irrelevant whether the account information service provider itself further processes the account information after retrieval and prepares it for its customers, for example in the context of financial analyses or asset overviews. Services where the provider is not given access to the account holder’s payment account credentials, but merely passes on account data provided to it in another way to the account holder, are not covered by the regulation. The regulation of account information services is therefore aimed at protecting against unauthorized access to payment account data.

Pure Account Information Service Providers Require Registration Instead of Authorization in Accordance to the ZAG

Companies that wish to offer account information services as their sole payment service can benefit from simplified requirements for the legitimization of the provision of these payment services. In such cases, Section 34 (1) sentence 1 ZAG only requires written registration with BaFin instead of a full license in accordance to the ZAG. Nevertheless, extensive requirements must be met when applying for registration as an account information service provider. For example, unlike a full license application, there is no requirement to demonstrate to BaFin that the company has regulatory initial capital. Similarly, pure account information service providers are not required to demonstrate the reliability of their shareholders as part of a holder control check. In addition to a few other simplifications, however, extensive information must also be provided in a registration application pursuant to Section 34 (1) sentence 1 ZAG. This includes, among other things, a description of the business model, including the intended provision of account information services and a budget plan for the first three financial years, a description of the business organization for compliance with regulatory obligations, and the appointment of at least two professionally qualified and reliable managers. If the provider plans to provide payment services in addition to account information services, registration pursuant to Section 34 (1) ZAG is not sufficient. In this case, a comprehensive application for authorization pursuant to Section 10 (1) ZAG must be submitted to BaFin.

Numerous Obligations Under the ZAG Do Not Apply to Account Information Service Providers

Pure account information service providers have an advantage over fully supervised payment institutions with a license under Section 10 (1) ZAG in that they are not required to fulfill all of the regulatory obligations set out in the ZAG. In particular, they are not required to maintain regulatory initial capital in the amount prescribed by law. Furthermore, the holders of significant shareholdings in the account information service provider’s company are not subject to any obligations to provide evidence of their reliability to BaFin. The financial requirements for payment institutions laid down in the regulation on the adequate capitalization and risk-bearing capacity of payment institutions (ZIEV) do not apply to pure account information service providers either. However, pursuant to Section 36 (1) ZAG, they must provide evidence of professional liability insurance or an equivalent bank guarantee for the period of their registration, covering damages resulting from unauthorized or fraudulent access to accounts in the course of providing account information services, both to their own customers and to the account-holding banks and payment institutions.

The lawyer responsible for regulatory advice on account information services and for applying for registration under Section 34 ZAG at our law firm is Attorney Dr. Lutz Auffenberg, LL.M. (London).