BaFin Zahlungsinstituts-Register (§§ 43, 44 ZAG) explained

BaFin’s Zahlungsinstituts-Register and E-Geld-Instituts-Register under §§ 43 and 44 ZAG are Germany’s official public record of which payment and e-money institutions BaFin has licensed, what each may do, which agents act for them and where they have branches abroad. Next to them sits the BaFin Unternehmensdatenbank, the wider company database that also carries the BaFin-ID. The registers show your licence to the market, decide when an agent may start, and are the first check on a payment counterparty. This is the German counterpart of our REGAFI guide for France.

1. What the registers are

§ 43(1) ZAG requires BaFin to keep a payment institution register on its website. § 44(1) requires a separate e-money institution register, also kept up to date. Both implement Article 14 of PSD2 (Directive (EU) 2015/2366), which requires every member state to keep a public register of authorised payment institutions, their agents and their branches. Firms are entered in their home member state’s register.

BaFin runs both as one search portal on its MVP portal. Its guidance makes three points:

• Updated daily. Each page shows the date of the data.
• The data comes from you. BaFin publishes what institutions notify (branches under § 38(1), agents under § 25(1)), and the institutions are responsible for its accuracy.
• ZAG firms only. CRR credit institutions are not in it; they appear in the Unternehmensdatenbank.

§ 43(3) requires BaFin to pass register data to the European Banking Authority without delay, with the reasons whenever a licence or registration ends.

2. What the register lists

§ 43(1) sets out four kinds of entry for payment institutions, and § 44 applies the same model to e-money institutions. BaFin’s guidance arranges them in five sections:

The portal’s filter also has a category for branches of firms based outside the EEA. Under § 42 ZAG, a German branch of such a firm that provides payment services or issues e-money is treated as an institution in its own right. Branches of German institutions inside Germany are not listed.

3. How to read an entry

An institution’s page in the ZAG register shows its type (for example Zahlungsinstitut (ZAG) or E-Geld-Institut), its name and address, an ID number, and a table of its permissions, each with the date granted and, where it applies, the date it ended. The agent list and any EEA branches are reached from the institution’s page.

Each permission is named with its provision in § 1 ZAG, for example Finanztransfergeschäft (§ 1 Abs. 1 Satz 2 Nr. 6 ZAG) for money remittance, or Zahlungsauslösedienste (§ 1 Abs. 1 Satz 2 Nr. 7 ZAG) for payment initiation. That numbering dates from the 2018 recast of the ZAG for PSD2. In the Unternehmensdatenbank entries we checked, older permissions under the former numbering end on a 2018 date, with the PSD2 implementing act given as the reason. A document citing § 1 Abs. 2 ZAG for a payment service uses the old numbering.

The Unternehmensdatenbank can be searched by name, BaFin-ID, BaK number or Reg number. An entry shows the firm’s type (Gattung), address, identifiers, any dispute resolution body, and each permission with grant date, end date and reason for ending.

4. Agents under § 25 ZAG: from notice to entry

Under § 1(9) ZAG, an agent is a natural or legal person who, as a self-employed trader, provides payment services in the name of an institution. The agent’s acts are attributed to the institution. An institution that wants to use an agent must first send BaFin and the Deutsche Bundesbank the information listed in § 25(1):

1. the agent’s name and address;
2. a description of the internal controls the agent uses to meet the Geldwäschegesetz (GwG), updated without delay after any material change;
3. the names of the agent’s managers and, where the agent is not itself a payment service provider, evidence that they are reliable and professionally qualified;
4. which of the institution’s payment services the agent is mandated to provide;
5. where applicable, the agent’s identification code or number.

The timing rule follows. BaFin tells the institution within two months of receiving complete information whether the agent will be entered. The agent may not start providing payment services until it is entered in the register. Under § 43(2), BaFin can refuse entry if facts suggest the information is wrong, and it must tell the institution without delay. Changes to anything notified must be reported without delay, in writing or electronically, and the same two-month procedure applies to them.

Entry does not shift responsibility. Under § 25(2) the institution must ensure the agent is reliable, follows the law and discloses its agent status to customers, and must keep the evidence for five years after the status ends. Under § 25(3), BaFin can bar an institution that selected or monitored agents badly from using one or all of them.

5. E-money agents and distributors

The ZAG has a separate category for e-money. Under § 1(10), an E-Geld-Agent is a self-employed trader who distributes and redeems e-money in the name of an e-money institution. Under § 32(1), an e-money institution may use such agents. § 25(1) applies to them with one difference: no evidence of reliability or professional qualification has to be filed. On its wording, that includes the two-month decision and the start-after-entry rule.

If a distributor also provides payment services for the institution, it acts as a § 25 agent for that part and the full § 25 information applies. § 32(2) lets BaFin bar an e-money institution that has selected or monitored its e-money agents badly. § 44(2) brings the agents of e-money institutions into the register on the same terms as § 43(1) no. 4. Our agent vs distributor guide covers where the line falls.

6. Passports, branches and EEA firms

Outbound. A German institution that wants an EEA branch or agents in another member state notifies BaFin and the Bundesbank under § 38(1), and § 25(4) sends foreign agents through the same procedure. BaFin passes the information to the host authority within one month of receiving a complete notice. Under § 38(5), it then decides within three months whether to enter the branch or agent, taking the host authority’s assessment into account. Under § 38(6), the branch or agents may start in the host state only after entry, and the institution must tell BaFin and the Bundesbank the date they start. This is why the register shows a start date for each branch. Services provided cross-border without a branch are notified under § 38(2), but the register’s branch section does not show them.

Inbound. Under § 39(1), an institution authorised in another EEA state may provide payment services in Germany through a branch, cross-border services or agents without a BaFin licence. The condition is that the activity is covered by its home authorisation and its agents are entered in the home state’s register. BaFin’s guidance confirms that such agents appear in that state’s register, not BaFin’s. In our searches the Unternehmensdatenbank also returned nothing for EEA payment or e-money institutions known to passport into Germany. Verify inbound firms in their home register and the EBA register.

7. The EBA central register and how the sources compare

Article 15(1) PSD2 requires the EBA to run a central register built from the national registers. Commission Delegated Regulation (EU) 2019/411 and Implementing Regulation (EU) 2019/410 govern it. It lists payment, account information and e-money institutions, exempted institutions, agents and EEA branches, among others. National authorities update it at least daily and remain responsible for accuracy. The EBA says the register has no legal effect: a listing does not authorise a firm, and an omission does not cancel an authorisation.

8. Verifying a counterparty, and keeping your own entry current

For a counterparty or an agent, the check is short and should be written down:

• Find the right register. Licensed in Germany: ZAG register. A bank: Unternehmensdatenbank. Licensed elsewhere in the EEA: home register plus the EBA register.
• Match the service. Compare the permission lines with what the firm will actually do for you. A firm licensed for money remittance only cannot run payment accounts for you.
• Check the agent link. In the agent search, an agent’s entry lists each institution it acts for, with that institution’s seat and the dates the agent was active. One agent may act for several institutions. An end date means the authority to act has ended.
• Keep the evidence. Save the entry with the data date shown on the page.

For your own entry, every change starts with your notice: agents under § 25(1), branches under § 38(9), name or seat changes under § 28(1). Our ZAGAnzV guide maps each event to its form.

9. Worked cases

Facts: a German payment institution signs a retail chain as an agent for cash-in and cash-out and plans to launch in three weeks.

What the rule says: § 25(1) gives BaFin two months from complete information to decide on entry, and the agent may not provide payment services before it is entered.

What the practitioner does: files the full § 25(1) set at once and moves the launch to after entry.

Outcome: the launch slips, but no payment service is provided by an unregistered agent and attributed to the institution.

Facts: a German e-money institution’s onboarding team finds that a prospective partner presents itself as a “BaFin-registered agent”. It is listed in the agent search, with an end date last year.

What the rule says: § 43(1) no. 4 records each agent’s start and end of activity. Agents stay visible for up to five years after their activity ends.

What the practitioner does: treats the entry as evidence that the partner is not an active agent for anyone. Asks which institution it now claims to act for, and checks whether that institution’s home register lists it.

Outcome: the partner is either properly listed or declined, and the file records why.

Facts: a German payment institution renames itself. Two months later, partners’ screening tools still show the old name.

What the rule says: a change of company name is notifiable under § 28(1) no. 3 ZAG, and BaFin passes register data to the EBA.

What the practitioner does: confirms the notice was filed, checks the ZAG register, the Unternehmensdatenbank and the EBA register, and raises any stale entry with BaFin quoting the notice.

Outcome: all three sources show the new name.

10. FAQ

11. What to do, today

• Head of compliance: pull your own ZAG register and Unternehmensdatenbank entries and check every permission line, agent and branch against your records.
• Agent network owner: build the two-month entry period into every agent launch plan, and allow three months for agents in other member states.
• MLRO: keep the GwG controls description for each agent up to date; § 25(1) no. 2 requires an update after any material change.
• Onboarding team: write the register check, including home and EBA registers for EEA firms, into the counterparty procedure.
• Company secretary: follow every § 28 notice with a check of the published entry.

Related: REGAFI, the French register · ZAGAnzV notifications · PSD2 agents, distributors and liability · PSP registers compared across the EU