Payments Regulation Germany

A firm that wants to offer payment services in Germany needs written authorization from BaFin under section 10 of the Zahlungsdiensteaufsichtsgesetz (ZAG), unless it already holds a license from another EU state that it passports into Germany. The application covers the business plan, the identity and fitness of managers and qualifying shareholders, a description of internal governance and risk-control mechanisms, and proof of the starting capital the ZAG requires for the specific payment services the firm intends to offer. BaFin reviews the file and has to decide within three months of receiving a complete application, though incomplete filings reset that clock. Firms that only initiate payments or provide account information face lighter capital rules than those that hold customer funds.

Once licensed, a payment or e-money institution has to keep customer funds separate from its own money. The ZAG requires safeguarding either by depositing the funds in a separate account at a credit institution or by covering them with an insurance policy or comparable guarantee, so that customer money survives even if the payment firm itself fails. Deutsche Bundesbank supports BaFin in overseeing these firms, including their safeguarding arrangements and capital position on an ongoing basis, not only at the point of licensing.

Since 17 January 2025, the EU's Digital Operational Resilience Act (DORA) applies directly to payment and e-money institutions, adding a second layer of duties on top of the ZAG license. A regulated payment firm now needs a documented ICT risk management framework, has to test its systems for resilience, must report major ICT incidents to BaFin within set deadlines, and has to manage the risk that its critical IT vendors, including cloud providers, pose to its operations. A fintech that passed its ZAG licensing review before 2025 still has to bring its ICT governance up to DORA's standard, since the act applies regardless of when the license was granted.

The EU is replacing the second Payment Services Directive with PSD3, a new directive, and the Payment Services Regulation (PSR), a directly applicable regulation that will not need a new German transposition law the way the ZAG transposed PSD2. Negotiators reached provisional agreement on the package on 27 November 2025, and Herbert Smith Freehills Kramer expects the rules to apply from mid to late 2027. Coverage from Freshfields notes that BaFin has already signaled it expects authorization files from 2026 onward to reflect the direction the new rules will take, on requirements such as the IBAN name check before a transfer and stricter fund-safeguarding standards, so a firm applying for a ZAG license today effectively plans for both rulebooks at once.

Finance Loop is the meeting place for the legal, compliance and licensing teams who work through the ZAG, DORA and the coming PSD3 package in practice, alongside the banks, payment institutions and fintechs they advise or work inside. Finance Loop connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop supports When Banks Say 'No', a payments seminar at the NEXTOWER in Frankfurt for compliance, treasury and legal teams, where Dr. Julia Pfeil of Dentons speaks on payments governed by sanctions and anti-money laundering law. Finance Loop is a partner of the Digital Euro Association, host of the Digital Euro Conference in Frankfurt. Finance Loop also announced KI Exchange 2026 in Hamburg, a conference by Payment & Banking whose program covered AI governance and DORA compliance, with speakers expected from BaFin. Related pages: payments in Germany, KYC in Germany and financial crime in payments.

Not every payment provider needs a separate BaFin payment-institution license. CRR credit institutions authorized to operate in Germany can provide payment services without this additional ZAG authorization. Providers offering only account information services are subject to registration under section 34. Activities meeting the statutory exclusions in section 2 fall outside the ZAG definition of payment services, although notification duties can still apply. Payment institutions licensed in another EU state can operate in Germany through the required cross-border notification procedure within the scope of their authorization.

BaFin has to decide within three months of receiving a complete application. In practice this deadline runs from the point BaFin considers the file complete, so an incomplete or unclear application can extend the timeline well beyond three months.

DORA has applied directly to payment and e-money institutions across the EU since 17 January 2025, regardless of when their license was granted. DORA requires an ICT risk management framework, resilience testing, incident reporting to BaFin and oversight of critical IT vendors.