Businesses that provide payments services in Germany require written authorization from the Federal Financial Supervisory Authority (BaFin), because these businesses are subject to the Payment Services Supervision Act (ZAG). In particular, businesses should ensure they carry out careful checks to establish whether they are subject to the act. If they are, and they do not have authorization, they risk legal issues and severe financial penalties. In this article, we will discuss what the ZAG is, who it affects, and which payments services are subject to the act or are exempt from it. We will also explore what businesses need to focus on when it comes to financial remittance and payment transactions via gift cards.

What’s in this article?

• What is the Payment Services Supervision Act (ZAG)?
  
• Who does the ZAG affect?
  
• Which payments services are covered by the ZAG?
  
• What must businesses keep in mind when it comes to financial remittance?
  
• Which payment transactions are not covered by the ZAG?
  
• What must businesses keep in mind with gift card transactions?
  

What is the Payment Services Supervision Act (ZAG)?

The Payment Services Supervision Act (ZAG) is a German law that enables payment service providers and institutions to provide payments services. This was originally exclusively reserved for traditional banks. Thanks to the ZAG, all nonbanks that provide commercial payments services can obtain authorization to do so. This results in several rights, as well as duties that are regulated through the ZAG. Among other things, these include the requirement to obtain permission from the Federal Financial Supervisory Authority (BaFin).

The ZAG was introduced to enable and enforce the supervision of payments services in Germany. It is the national implementation of European Payment Services Directives. The origins of the ZAG lie in the first European Union Payment Services Directive, or PSD for short. When it first appeared in 2007, the PSD was intended to create a uniform legal framework for cross-border services from payment service providers across Europe. Germany transposed the directive into national law in 2009 through the Payment Services Implementation Act, also known as the Act implementing the supervisory provisions of the Payment Services Directive. In doing so, checking account business, financial transfer business, and credit card business were removed from the list of banking transactions requiring authorization. In essence: from this point on, banks were not the only institutions able to offer these payments services.

However, only a few years passed before changes needed to be made to the European directive. These included the recognition of new technologies and business models as digitalization came to the fore. As a result, the second European Union Payment Services Directive (PSD2) was issued in 2015. This contained a set of new regulations intended to increase the security of payment transactions within the European market, as well as enabling greater competition through the expansion of payments services. The PSD2 also had to be “translated” into German law: the Payment Services Supervision Act, which is still valid, has been in force since January 2018 and is also known as the Act for implementing the Second Payment Services Directive.

Who does the ZAG affect?

According to Section 1 of Article 1, the ZAG affects both payment institutions and payment service providers. The former are all businesses that provide commercial payments services. Payments services are considered to be commercial if they have been set up for a certain duration and aim to make a profit. Such payments services are subject to the ZAG even if they are only provided as an ancillary to further activity outside the financial sector.

Payment service providers (PSPs) include all e-money institutions, CRR credit institutions, and payment institutions, as well as the European Central Bank, the Deutsche Bundesbank, and other central banks in the European Union if they provide payments services outside of their capacity as a monetary authority. Also mentioned are the federal government, the states, the municipalities, and municipal associations, along with the responsible bodies of the federal or state administrations; by implication, this also means the public debt administration, social security institutions, and the Federal Employment Agency—under the condition that they provide payments services outside of their sovereign authority.

To gain a basic understanding of payments services, it helps to think of a relationship between three people: for every payments service, there are payers, payment recipients, and payment service providers. Payment service providers help payers to transfer funds to the recipients.

Which payments services are covered by the ZAG?

The following payments services are listed in the ZAG under Section 1 of Article 1. They are, therefore, subject to the relevant legal regulations:

• Deposit transactions: Services that enable cash deposits to be made into a payment account, as well as all operations required to maintain a payment account
  
• Withdrawal transactions: Services that enable cash withdrawals to be made from a payment account, as well as all operations required to maintain a payment account
  
• Direct debit transactions: Payment transactions made by direct debit to a user’s account or to the account of third-party payment service providers
  
• Payment card transactions: Payment transactions made using a payment card to a user’s account or to the account of third-party payment service providers
  
• Transfer transactions: Payment transactions made via bank credit transfer to a user’s account or to the account of a third-party payment service provider
  
• Payment transactions with grant of credit: Payment transactions that are covered by a credit line for payments services users (see Section 4 of Article 3 of the ZAG)
  
• Acquisitions: The issuing of payment instruments or the acceptance and billing of payment transactions
  
• Money remittance transactions: Services in which money is transferred in the name of the payer, the recipient, or the payment service provider acting on their behalf. This is done without setting up a payment account
  
• Payment initiation services: Services in which a payment order is initiated at the instigation of a user in relation to a payment account held with other payment service providers
  
• Account information services: Services that provide account holders with information about their payment accounts with one or more payment service providers
  

Example: Lieferheld

The ZAG’s definition of a payments service is broad. As a result, it also affects many nonfinancial services businesses. A prime example is the delivery service “Lieferheld,” which has now been taken over and no longer operates under its original name. As an intermediary for food and drinks, the Cologne Regional Court classified Lieferheld as a “payment institution.” Why? The business is deemed to provide financial remittance because the money paid by customers is, for the most part, passed on to the catering firms. Therefore, Lieferheld was subject to the Payment Services Supervision Act and required authorization from BaFin to operate.

What must businesses keep in mind when it comes to financial remittance?

The “Lieferheld verdict” made by the Cologne Regional Court serves as a prime example of a business providing financial remittance, and other businesses should take heed of the lessons learned. In case of doubt, almost every business model that involves the transfer of third-party funds is subject to the ZAG and therefore requires BaFin authorization. This applies not only to delivery services for takeout food, but also to all other delivery services. In most circumstances, internet marketplaces, platform models, or employment agencies are also subject to the ZAG. Businesses should therefore take extra care to check whether they provide financial remittance services and, as a result, require authorization.

BaFin carries out its own checks on businesses to assess whether they provide financial remittance services. However, even if the federal agency does not take action itself, it’s possible that businesses will come under its scrutiny. Lieferheld was once sued by a competitor with a similar business model, who had actually obtained authorization himself. The competitor flagged a breach of competition law, due to the fact that Lieferheld had not obtained the relevant authorization. The number of similar cases has increased significantly in recent years. Businesses want to avoid suffering any disadvantages compared to their competitors, and they are thus quick to insist on compliance with financial regulatory requirements. Violations are often reported directly to BaFin.

Examples: Fiduciaries, collection agencies, and factoring firms

The services of fiduciaries can also be considered financial remittance, provided they accept and transfer sums of money. This also applies to all activities of collection agencies when it comes to recovering debts. According to BaFin, only the recovering of unpaid receivables (e.g., tax debts, medical bills, loan repayments, etc.) does not currently fall under the ZAG regulations. Factoring is also considered to be a form of financial remittance, at least in cases where the service provided is focused on payment settlement from an economic point of view and not on financing the contractual partners.

Which payment transactions are not covered by the ZAG?

Section 2 of the ZAG outlines certain payment transactions that are not considered payments services. These can, therefore, be provided without authorization. These are:

• Direct cash payments
  
• Payment transactions via commercial agents or central regulators for commercial cash transports
  
• Cash back processes (e.g., cash withdrawals in a supermarket)
  
• Money exchange transactions in cash
  
• Payment transactions based on a gift card, check, bill of exchange, traveler’s check, or paper postal order
  
• Payment transactions within a payment or securities settlement system
  
• Payment transactions connected to securities asset servicing
  
• Technical services for the provision of payments services
  
• Payment systems in limited networks or with a limited product range, and instruments for social or tax purposes
  
• Payment transactions over electronic communications networks/services
  
• Group/internal payment transactions
  
• Cash withdrawal services
  
• Receiving and transferring of cash as part of charitable activity
  

What must businesses keep in mind with gift card transactions?

Gift cards are a very common means of payment. Payment transactions via card within a limited network—known as a network payment system—are therefore particularly relevant for many businesses. Among other things, this applies to gift, customer, or fuel cards that are only used by the business concerned. Payment cards, such as those used in canteens, sports stadiums, holiday parks, or on college campuses are also part of the network payment system.

Furthermore, public transport cards, which are used to purchase tickets, also fall under this definition. According to the ZAG, payments made with such cards do not constitute a payments service. They therefore do not require authorization from BaFin. Businesses can benefit from this exception, but they should also examine—on a case-by-case basis—whether the cards are, in fact, limited to a self-contained network. In many cases, there is a fine line between activities that do not require authorization and those that do.

For more detailed information on the Payment Services Supervision Act, you can refer to the relevant information sheet from BaFin. To learn about similar topics, check out our resource collection or contact our sales team directly.