The Payment Services Supervision Act (ZAG)

The current act dates from July 17, 2017 and took effect on January 13, 2018, the deadline for PSD2, according to its official text. It has fourteen parts, from definitions and licensing to safeguarding, the European passport, conduct duties for all payment service providers and penalties.

Section 1 lists the payment services, from cash deposits and transfers to card acquiring, money remittance, payment initiation and account information. The ZAG reaches beyond banks and fintechs: the law firm SZA Schilling, Zutt & Anschütz names delivery platforms that pass customer money on to restaurants as an example. Section 2 lists the exceptions, among them commercial agents who act for only one side, technical service providers and instruments that work only in a limited network or for a narrow range of goods. A firm that relies on the limited network exception must notify BaFin once its payments over the last twelve months exceed one million euros.

A firm that provides payment services in Germany as a business needs written or electronic permission from BaFin under section 10, and an e-money issuer under section 11. BaFin decides within three months of a complete application, and it rejects a file that is still incomplete after twelve months. A provider of account information services alone registers under section 34 in place of a full license. The process and its costs are on payments regulation in Germany and BaFin license.

Section 12 sets the initial capital: 20,000 euros for money remittance alone, 50,000 euros for payment initiation alone, 125,000 euros for the other payment services and 350,000 euros for an e-money institution. Section 17 requires customer funds to be held apart at all times, either in a separate account at a credit institution or a central bank, in safe and liquid low-risk assets, or covered by an insurance policy or guarantee from a firm outside the group. Funds received for e-money must be safeguarded within five business days under section 18.

Part 10 of the ZAG applies to every payment service provider, banks included. Sections 48 to 52 give licensed payment initiation and account information services access to customer accounts through the bank's interface, the legal basis of open banking in Germany, and section 55 requires strong customer authentication. Sections 53 and 54 cover operational risks and incident reports.

The ZAG license also matters for euro stablecoins. Under MiCAR only a credit institution or an e-money institution may offer an e-money token to the public, so a German issuer outside banking needs an e-money license under section 11. The ZAG regulates the issuer; MiCAR adds the token rules.

Before an institution provides payment services through an agent, section 25 requires it to notify BaFin and the Bundesbank of the agent's name and address, its money laundering controls, its managers and the services it will offer. BaFin has two months to decide whether the agent goes into the register, and the agent may start only after the entry. Sections 38 and 39 carry the European passport: an institution licensed elsewhere in the EEA may work in Germany without a BaFin license.

BaFin published the ZAG-MaRisk, its minimum requirements for risk management at payment and e-money institutions, as circular 07/2024 (BA) on May 27, 2024, according to the Bundesbank page on payment and e-money institutions (in German). Institutions file monthly returns under section 29, and since January 17, 2025 DORA governs their IT risk. Under section 63, providing payment services or e-money business without a license is a crime that carries up to five years in prison.

The ZAG is the German Payment Services Supervision Act. It requires a BaFin license for payment services and e-money and carries the supervisory part of PSD2 into German law.

BaFin grants the licenses and takes supervisory measures. The Deutsche Bundesbank publishes the reporting forms and guidance for ZAG institutions, from the agent notification to the monthly returns, and works with BaFin on ongoing supervision.

Not to crypto-assets as such, which fall under MiCAR and the German Banking Act. It applies to the issuer of a euro e-money token outside banking, which needs an e-money license under the ZAG.

PSD3 is a directive, so Germany has to carry it into the ZAG again, and the E-Money Directive becomes part of the same framework. The conduct rules move into the directly applicable Payment Services Regulation. The status is on the PSD3 page.