Payments Regulation in Germany

A firm that wants to offer payment services in Germany needs written authorization from BaFin under section 10 of the Zahlungsdiensteaufsichtsgesetz (ZAG), unless it already holds a license from another EU state that it passports into Germany. The application covers the business plan, the identity and fitness of managers and qualifying shareholders, a description of internal governance and risk-control mechanisms, and proof of the starting capital the ZAG requires for the specific payment services the firm intends to offer. BaFin reviews the file and has to decide within three months of receiving a complete application, though incomplete filings reset that clock. Firms that only initiate payments or provide account information face lighter capital rules than those that hold customer funds.

Once licensed, a payment or e-money institution has to keep customer funds separate from its own money. The ZAG requires safeguarding either by depositing the funds in a separate account at a credit institution or by covering them with an insurance policy or comparable guarantee, so that customer money survives even if the payment firm itself fails. Deutsche Bundesbank supports BaFin in overseeing these firms, including their safeguarding arrangements and capital position on an ongoing basis, not only at the point of licensing.

Since January 17, 2025, the EU's Digital Operational Resilience Act (DORA) applies directly to payment and e-money institutions, adding a second layer of duties on top of the ZAG license. A regulated payment firm now needs a documented ICT risk management framework, has to test its systems for resilience, must report major ICT incidents to BaFin within set deadlines, and has to manage the risk that its critical IT vendors, including cloud providers, pose to its operations. A fintech that passed its ZAG licensing review before 2025 still has to bring its ICT governance up to DORA's standard, since the act applies regardless of when the license was granted.

The EU is replacing the second Payment Services Directive with PSD3, a new directive, and the Payment Services Regulation (PSR), a directly applicable regulation that will not need a new German transposition law the way the ZAG transposed PSD2. Negotiators reached provisional agreement on the package on November 27, 2025, and Herbert Smith Freehills Kramer expects the rules to apply from mid to late 2027. Coverage from Freshfields notes that BaFin has already signaled it expects authorization files from 2026 onward to reflect the direction the new rules will take, on requirements such as the IBAN name check before a transfer and stricter fund-safeguarding standards, so a firm applying for a ZAG license today effectively plans for both rulebooks at once.

Finance Loop is the meeting place for the legal, compliance and licensing teams who work through the ZAG, DORA and the coming PSD3 package in practice, alongside the banks, payment institutions and fintechs they advise or work inside. It connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop supports When Banks Say 'No', a payments seminar at the NEXTOWER in Frankfurt for compliance, treasury and legal teams, where Dr. Julia Pfeil of Dentons speaks on payments governed by sanctions and anti-money laundering law. Finance Loop is a strategic partner of the Digital Euro Association, host of the Digital Euro Conference in Frankfurt. Finance Loop also announced KI Exchange 2026 in Hamburg, a conference by Payment & Banking whose program covered AI governance and DORA compliance, with speakers expected from BaFin. Related pages: payments in Germany, KYC in Germany and financial crime in payments.

Yes, unless it holds a license from another EU member state that it passports into Germany. Section 10 of the Zahlungsdiensteaufsichtsgesetz requires written BaFin authorization before a firm offers payment services in Germany, covering the business plan, management fitness, governance and required starting capital.

BaFin has to decide within three months of receiving a complete application. In practice this deadline runs from the point BaFin considers the file complete, so an incomplete or unclear application can extend the timeline well beyond three months.

Yes. DORA has applied directly to payment and e-money institutions across the EU since January 17, 2025, regardless of when their license was granted. It requires an ICT risk management framework, resilience testing, incident reporting to BaFin and oversight of critical IT vendors.