Payment Services Supervision Act

The most important facts in brief:

1. The German Payment Services Supervision Act (ZAG) regulates the supervision and obligations of payment service providers and companies that conduct e-money transactions.
   
2. A license from the Federal Financial Supervisory Authority (BaFin) is required for the provision of payment services or the issuing of e-money. If the business is carried out without a license, the business may be discontinued, and the managing directors may face a prison sentence of up to 5 years or a fine.
3. The ZAG has a very broad scope of application, meaning that it also covers companies that are not directly related to payment transactions. For example, airlines, leasing companies or delivery services can be covered if they forward funds. Due to the high penalties, it is important to check whether the ZAG is relevant.

What is the ZAG? 

The German Payment Services Supervision Act (ZAG) regulates the supervision of payment service providers, i.e. companies that execute and process cash payments, as well as companies that conduct e-money transactions. In the European Economic Area, the provision of payment services and the issuing of e-money requires a license from the responsible supervisory authority, in Germany the Federal Financial Supervisory Authority (BaFin). The ZAG has a very broad scope of application, meaning that many companies are covered by the ZAG without realizing it, which can lead to high penalties from BaFin. For example, the delivery service Lieferheld was confronted with the fact that a competitor sued it for injunctive relief for its non-ZAG-compliant services.

Which services are covered by the ZAG?

The ZAG covers payment services, payment service providers and e-money issuers. Contrary to initial assumptions, not only banks are covered by the ZAG, but also companies from completely different sectors, e.g. delivery services, as they forward customer funds to restaurants and thus provide a financial transfer business. In particular, the term payment service is very broad, meaning that companies are quickly covered.

What are payment services within the meaning of the ZAG?

• Money remittance business: The term "money remittance business" is the catch-all term for payment services and covers the transfer of funds. Even though it is the catch-all term, it is of the utmost importance in practice. For example, when a delivery service forwards customers' money to restaurants, this constitutes a financial transfer transaction. Accordingly, many companies are unknowingly payment services. [Link to Hingst/Lösing, BKR 2012, 334 ff.?]
• Deposit and withdrawal business: This includes services that enable deposits and withdrawals to an account.
• Direct debit / payment card / credit transfer business: This includes services that cover the execution of payment transactions, such as the execution of direct debits, credit transfers or payment transactions using a payment card.
• Payment and granting of credit: This includes services for the execution of payment transactions that are covered by a credit line.
• Acquisition business: This includes the issuing of payment instruments (in particular credit cards) or services in connection with the settlement of payment transactions.

Payment initiation services / account information services: Services that initiate payment orders or provide account information for users.

What are payment service providers within the meaning of the ZAG? 

• Banks: In particular, payment service providers include traditional credit institutions. 
• Payment institutions & e-money institutions: These are companies that - without conducting specific banking transactions or financial services - require a ZAG-specific BaFin license due to the provision of payment services and the issuing of e-money. In Germany, 114 companies have such a license.

What are e-money issuers within the meaning of the ZAG?

E-money is a monetary claim that is issued against payment of a sum of money in order to be able to pay with it. Examples of e-money include PayPal credit, which represents a monetary claim against PayPal, or purchased vouchers that can be redeemed with persons other than the issuer.

The following companies are e-money issuers:

• Banks: E-money issuers include particularly traditional banks.
• E-money institutions: This includes companies that issue e-money without having a license as a credit institution.
• Government organizations: If the federal government, federal states, or municipalities conduct e-money transactions outside of government activities, these are also included.

What are the exceptions to the ZAG?

According to Section 2 ZAG, there are some exceptions that are not considered payment services:

• Cash transactions: For example, paying with cash, cash withdrawals, cash payments in supermarkets or changing cash.
• Commercial agents: Payments that are processed by a commercial agent, e.g. the payment that comes from the buyer to the company via the commercial agent.
• Paper vouchers: Vouchers issued in paper form.
• Investment: Payment transactions in the context of the settlement of securities transactions.
• Technical services: Technical services for the provision of payment services.
• [Very] Limited range of products or services: This does not include narrowly defined services and products, such as in the telecommunications sector.
• Group payments: Payment transactions within a group/association.
• Charitable activity: Receipt and transfer of cash as part of a charitable activity.

What obligations does the ZAG impose on companies?

Companies covered by the ZAG are subject to a variety of obligations. Compliance with these is very important, otherwise there is a risk of severe penalties from BaFin.

• Permission: Payment services, payment service providers and e-money issuers may only provide their services if they have written permission from BaFin. The application for a license is very extensive, for example, a detailed description of the business model is required, as well as information on the protection of access data, the safeguarding of customer funds, etc. However, it is important to note that the registration requirement only applies to companies and business activities.
• Registration: If you only want to operate a payment service that only provides account information services, you do not need a license but simply have to register with BaFin.
• Capital resources: Companies must have sufficient equity. The amount of equity capital required depends on the company's specific business. To this end, there is an obligation to inform BaFin and the German Federal Bank (Bundesbank) on a quarterly basis about capital adequacy.
• Examination of ownership structures when founding and acquiring shares: Holders of significant shareholdings (> 10% of capital shares or voting rights) are subject to very close scrutiny by BaFin.
• Safeguarding customer funds: To protect customers from losing their money, there is an obligation to invest customer funds securely. For example, customer funds may not flow into speculative investments and must be liquid so that customers can always access their money.
• Proper business organization: There are also many requirements regarding business organization. For example, there must be appropriate risk management, an emergency concept for IT systems, etc.
• Money laundering: Many money laundering regulations apply to companies covered by the ZAG. For example, there is an obligation to identify the business partner or to appoint a money laundering officer.
• Duty of disclosure: In addition to the aforementioned obligation to disclose equity capitalization, there is also an obligation to disclose significant shareholdings and imminent insolvency.

What are the penalties for violating the ZAG?

Violations of the ZAG can lead to very severe penalties, such as the cessation of business operations. The provision of payment services and the operation of e-money transactions without a license can lead to the cessation of business operations, and a prison sentence of up to 5 years is also possible.

The following penalties are possible for violations of the ZAG:

• Cessation of business operations: If payment services or e-money transactions are provided without the required license or registration, BaFin may demand the immediate cessation of business operations.
• Winding up unauthorized transactions: The cessation of business operations prevents future violations of the law. In order to terminate transactions that have already begun but have not yet been concluded, BaFin can also demand that unauthorized transactions be wound up.
• Prison sentence: According to Section 63 ZAG, there is also a prison sentence of up to 5 years for, among other things, intentionally providing payment services without a license or without registration or operating an e-money business. Even the negligent provision of payment services or the operation of e-money business without a license or registration is punishable by a prison sentence of up to 3 years. This penalty particularly also applies to board members or managing directors of companies that provide such services without a license or registration.
• Fines: Many violations of the law can result in fines of up to one million euros being imposed. In particular, fines can be imposed for failing to respond to BaFin's requests for information in full or on time. Corresponding fines may also be imposed if BaFin requirements are not met.

Overall, violations of the obligations of the Payment Services Supervision Act can result in considerable penalties. Accordingly, it is important and advisable to legally review your own business model in order to avoid corresponding penalties.

This article provides a non-binding overview of the subject area covered and does not replace legal advice. For further information or personal advice, please do not hesitate to contact us:

• Dr. Martin-Gross Langenhoff
• Dr. Carsten Lösing