Businesses that provide payment services in Germany require written authorisation from the Federal Financial Supervisory Authority (BaFin), because these businesses are subject to the German Payment Services Supervision Act (ZAG). In particular, German businesses should ensure that they carry out careful checks to establish whether or not they are subject to the act. If they are, and they do not have authorisation, they risk legal issues and severe financial penalties. In this article, we will discuss what the ZAG is, who it affects and which payments services are subject to or exempt from the act. We will also explore what businesses need to focus on when it comes to financial remittance and payment transactions via gift cards.
What's in this article?
- What is the Payment Services Supervision Act (ZAG)?
- Who does the ZAG affect?
- Which payment services are covered by the ZAG?
- What must businesses bear in mind when it comes to financial remittance?
- Which payment transactions are not covered by the ZAG?
- What must businesses bear in mind with gift card transactions?
What is the Payment Services Supervision Act (ZAG)?
The Payment Services Supervision Act (ZAG) is a German law that enables payment service providers and institutions to provide payment services. Originally, this was reserved exclusively for traditional banks. Thanks to the ZAG, all non-banks that provide commercial payment services can obtain authorisation to do so. This results in several rights, as well as duties that are regulated through the ZAG. Among other things, these include the requirement to obtain permission from the German Federal Financial Supervisory Authority (BaFin).
The ZAG was introduced to enable and enforce the supervision of payments services in Germany. It is the national implementation of the European Payment Services Directives. The origins of the ZAG lie in the first European Union Payment Services Directive, or PSD for short. When it first appeared in 2007, the PSD was intended to create a uniform legal framework for cross-border services from payment service providers across Europe. Germany transposed the directive into national law in 2009 through the Payment Services Implementation Act, also known as the Act Implementing the Supervisory Provisions of the Payment Services Directive. In doing so, current account business, financial transfer business and credit card business were removed from the list of banking transactions requiring authorisation. In essence, from this point onwards, banks were not the only institutions able to offer these payment services.
However, only a few years passed before changes needed to be made to the European directive. These included the recognition of new technologies and business models as digitalisation came to the fore. As a result, the second European Union Payment Services Directive (PSD2) was issued in 2015. This contained a set of new regulations intended to increase the security of payment transactions within the European market, as well as enabling greater competition through the expansion of payment services. The PSD2 also had to be "translated" into German law. In this respect, the German Payment Services Supervision Act, which is still valid, has been in force since January 2018 and is also known as the Act for Implementing the Second Payment Services Directive.
Who does the ZAG affect?
According to Section 1 of Article 1, the ZAG affects both payment institutions and payment service providers. The former are all businesses that provide commercial payment services. Payment services are considered to be commercial if they have been set up for a certain amount of time and aim to make a profit. Such payment services are subject to the ZAG even if they are only provided as an ancillary to add to activities outside of the financial sector.
Payment service providers (PSPs) include all e-money institutions, CRR credit institutions and payment institutions, as well as the European Central Bank, the Deutsche Bundesbank and other central banks in the European Union if they provide payment services outside of their capacity as a monetary authority. Also mentioned are the federal government, the states, the municipalities and the municipal associations, along with the bodies responsible for the federal or state administrations. By implication, this also means the public debt administration, social security institutions and the Federal Employment Agency – under the condition that they provide payment services outside of their sovereign authority.
To gain a basic understanding of payment services, it helps to think of a relationship between three people, where for every payment service, there are payers, payment recipients and payment service providers. Payment service providers help payers to transfer funds to recipients.
Which payment services are covered by the ZAG?
The following payment services are listed in the ZAG under Section 1 of Article 1. They are therefore subject to the relevant legal regulations:
- Deposit transactions: services that enable cash deposits to be made into a payment account, as well as all operations required to maintain a payment account
- Withdrawal transactions: services that enable cash withdrawals to be made from a payment account, as well as all operations required to maintain a payment account
- Direct debit transactions: payment transactions made by direct debit to a user's account or to the account of third-party payment service providers
- Payment card transactions: payment transactions made using a payment card to a user's account or to the account of third-party payment service providers
- Transfer transactions: payment transactions made via bank credit transfer to a user's account or to the account of a third-party payment service provider
- Payment transactions with grant of credit: payment transactions that are covered by a credit line for payment services users (see Section 4 of Article 3 of the ZAG)
- Acquisitions: the issuing of payment instruments or the acceptance and billing of payment transactions
- Money remittance transactions: services in which money is transferred in the name of the payer, the recipient or the payment service provider acting on their behalf. This is done without setting up a payment account
- Payment initiation services: services in which a payment order is initiated at the instigation of a user in relation to a payment account held with other payment service providers
- Account information services: services that provide account holders with information about their payment accounts with one or more payment service providers
Example: Lieferheld
The ZAG's definition of a payments service is broad. As a result, it also affects many non-financial services businesses. A prime example is the delivery service "Lieferheld", which has now been taken over and no longer operates under its original name. As an intermediary for food and drinks, the Cologne Regional Court classified Lieferheld as a "payment institution". Why? The business is deemed to provide financial remittance because the money paid by customers is, for the most part, passed on to the catering firms. Therefore, Lieferheld was subject to the Payment Services Supervision Act and required authorisation from BaFin to operate.
What must businesses bear in mind when it comes to financial remittance?
The "Lieferheld verdict" made by the Cologne Regional Court serves as a prime example of a business providing financial remittance and other businesses should take heed of the lessons learned. In case of doubt, almost every business model that involves the transfer of third-party funds is subject to the ZAG and therefore requires BaFin authorisation. This not only applies to delivery services for takeaway food, but also to all other delivery services. In most circumstances, internet marketplaces, platform models or employment agencies are also subject to the ZAG. Businesses should therefore take extra care to check whether they provide financial remittance services and, as a result, require authorisation.
BaFin carries out its own checks on businesses to assess whether they provide financial remittance services. However, even if the federal agency does not take action itself, it's still possible that businesses will be scrutinised by it. Lieferheld was once sued by a competitor with a similar business model who had obtained authorisation themselves. The competitor flagged a breach of competition law, due to the fact that Lieferheld had not obtained the relevant authorisation. The number of similar cases has increased significantly in recent years. Businesses want to avoid being at a disadvantage to their competitors. As a result, they are quick to insist on compliance with financial regulatory requirements. Violations are often reported directly to BaFin.
Examples: fiduciaries, collection agencies and factoring firms
The services of fiduciaries can also be considered to be a type of financial remittance if they accept and transfer sums of money. This also applies to all activities of collection agencies when it comes to recovering debts. According to BaFin, only the recovery of unpaid receivables (e.g. tax debts, medical bills, loan repayments etc.) does not fall under the ZAG regulations at present. Factoring is also considered to be a form of financial remittance, at least in cases where the service provided is focused on payment settlement from an economic point of view and not on financing the contractual partners.
Which payment transactions are not covered by the ZAG?
Section 2 of the ZAG outlines certain payment transactions that are not considered to be payments services. These can therefore be provided without authorisation. These are:
- Direct cash payments
- Payment transactions via commercial agents or central regulators for commercial cash transports
- Cash-back processes (e.g. cash withdrawals in a supermarket)
- Money-exchange transactions in cash
- Payment transactions based on a gift card, cheque, bill of exchange, traveller's cheque or a paper postal order
- Payment transactions within a payment or securities settlement system
- Payment transactions connected to securities asset servicing
- Technical services for the provision of payment services
- Payment systems in limited networks or with a limited product range, and instruments for social or tax purposes
- Payment transactions over electronic communications networks/services
- Group/internal payment transactions
- Cash-withdrawal services
- Receiving and transferring cash as part of a charitable activity
What must businesses bear in mind with gift card transactions?
Gift cards are a very common means of payment. Payment transactions via card within a limited network – known as a network payment system – are therefore particularly relevant for many businesses. Among other things, this applies to gift, customer or fuel cards which are only used by the business concerned. Payment cards, such as those used in canteens, sports stadiums, holiday parks or on university campuses are also part of the network payment system.
Furthermore, public transport cards, which are used to purchase tickets, also fall under this definition. According to the ZAG, payments made with these types of cards do not constitute a payments service. They therefore do not require authorisation from BaFin. Businesses can benefit from this exception, but they should also examine – on a case-by-case basis – whether the cards are in fact limited to a self-contained network. In many cases, there is a fine line between activities that do not require authorisation and those that do.
For more detailed information on the German Payment Services Supervision Act, you can refer to the relevant information sheet from BaFin. To learn about similar topics, take a look at our resource collection or contact our Sales team directly.