FKAustG: CRS reporting to the BZSt for EMIs and PIs
The Finanzkonten-Informationsaustauschgesetz (FKAustG) is Germany’s CRS law, and since its DAC8 amendment it names e-money in terms for the first time. Every reporting German financial institution must send the Bundeszentralamt für Steuern (BZSt) its reportable accounts for a calendar year by 31 July of the next year, in the official XML data set, electronically. For payment and e-money institutions the questions are narrower than for banks: are we a financial institution, which accounts are reportable, which channel applies, and what changes with schema 3.0 in 2027.
1. The FKAustG and what it implements
The FKAustG has applied since the 2016 reporting period. It implements the OECD Common Reporting Standard as agreed in the Multilateral Competent Authority Agreement of 29 October 2014, and the EU version of the same standard in Directive 2011/16/EU (DAC2). Section 1 lists the exchange partners: EU member states, CRS partner jurisdictions, and since the latest amendment, jurisdictions that have signed the November 2024 addendum to the multilateral agreement.
- § 3 — process documentation and per-account records, kept for ten years.
- §§ 5, 6 and 27 — the BZSt’s role, residence collection, customer notice and the 31 July filing date.
- § 8 and §§ 9 to 18 — what to report and the due diligence procedures.
- § 19 — definitions; § 28 — administrative fines.
The practical guidance sits in the BMF application letter of 1 February 2017, which covers both CRS and the FATCA agreement, as amended by the BMF letter of 15 June 2022.
2. Is a ZAG institution a financial institution?
Under § 19 No. 3 FKAustG a financial institution is a custodial institution (Verwahrinstitut), a depository institution (Einlageninstitut), an investment entity or a specified insurance company. A payment or e-money institution licensed under the Zahlungsdiensteaufsichtsgesetz (ZAG) will normally only ever test against the first two.
- Custodial institution (§ 19 No. 4). Holding financial assets for others must produce at least 20% of gross income over the relevant three-year period. Most payment and e-money institutions do not hold financial assets in this sense.
- Depository institution (§ 19 No. 5). Since the DAC8 amendment, this covers an entity that accepts deposits in the ordinary course of a banking or similar business or holds e-money or central bank digital currency for the benefit of customers.
The second limb is new. The government’s explanatory memorandum says the wider definition is meant to catch providers of digital money products that the old wording did not clearly reach. An e-money institution holding e-money for its customers is therefore a depository institution by the letter of the law, and the account that represents a customer’s e-money is a depository account under § 19 No. 25(b).
A payment institution without an e-money licence neither issues e-money nor takes deposits, so the new limb does not reach it directly. Document your own analysis of what you hold rather than assuming the answer.
Branches. CRS attaches to establishment, not licence. Under § 19 No. 2 a German financial institution includes the German branch of a foreign one, but not the foreign branches of a German one. An EEA e-money institution with a German branch reports that branch’s accounts to the BZSt; customers served cross-border without a branch are reported in the home state.
3. The e-money definition and the USD 10,000 exclusion
Section 19 No. 9 defines e-money for CRS purposes by starting from the ZAG definition and adding e-money tokens under Article 3(1)(7) of Regulation (EU) 2023/1114 (MiCA). Either qualifies only if it is a digital representation of a single fiat currency, is a claim on the issuer in that currency, and is redeemable at par on demand. Value created solely to move funds on a customer’s instructions is not e-money; funds held more than 60 days are not treated as created solely for that purpose.
The relief for retail e-money sits in the excluded-account list at § 19 No. 40(f). A depository account representing all the e-money held for one customer is excluded if its rolling 90-day average aggregate balance or value never exceeds USD 10,000 on any day of the calendar year. The memorandum explains the method: sum the previous 90 end-of-day balances and divide by 90, for every day. An account loses the exclusion for the year in which the average first exceeds the threshold.
So a year-end balance test is not enough: you need a daily rolling calculation per customer, combining all of that customer’s wallets.
4. Due diligence that matters for payment firms
Four FKAustG rules do most of the work for a payment or e-money institution with a large, digitally onboarded customer base.
- Residence for everyone. § 6(1) requires tax residence to be collected and recorded for every account, whether or not the holder is reportable, including foreign tax identification numbers.
- Self-certification at opening. § 13(2) for individuals and § 16 for entities require a self-certification at account opening and a reasonableness check against KYC data.
- The 90-day exception. § 13(2a) and § 16(2a) allow the self-certification to follow opening only where obtaining it at opening is legally or factually impossible, or checking it is unreasonable in justified exceptional cases. Until it is obtained, no funds may be paid out, and refunds go only to the payer. If it is still missing after 90 days, the institution must notify the BZSt through the prescribed electronic channel.
- Controlling persons from AML data. § 13(3) lets the institution rely on beneficial-owner information collected under the Geldwäschegesetz.
The BZSt’s March 2026 newsletter adds two points: the missing self-certification notice is for new accounts only (sending one for a pre-existing account may itself breach data protection rules), and placeholder dates of birth or tax numbers are not permitted.
5. Registration and transmission channel
The FKAustG requires electronic transmission in the officially prescribed data set (§ 5(1), § 27(2)). The BZSt runs the channels:
- Access. The BZSt online.portal (BOP) requires a valid certificate: an ELSTER certificate, a BZSt certificate or a BundID login. A BZSt certificate is requested through the registration form, which issues a BZSt number.
- Single reports. An online CRS form in the BOP for manual entry, account by account.
- Mass data. The DIP interface (Digitaler Posteingang), which replaced the older ELMA interface for CRS, requires one-time activation in the BOP. A customer test environment exists for DIP.
- Mass data upload. An XML upload in the BOP, opened for CRS in March 2026, production-only.
A service provider may transmit for the institution. Only the sender needs registration and a BZSt number, but each delivery may contain one financial institution’s accounts only.
6. Deadlines, nil returns and corrections
| Item | Rule | Source |
|---|---|---|
| Annual report | By 31 July for the previous calendar year | § 6(3), § 27(2) FKAustG |
| BZSt onward exchange | By 30 September | § 27(1) FKAustG |
| Extension | Not available | BZSt FAQ |
| Deadline met | Only when the data have been successfully received; an attempt is not enough | BZSt FAQ and newsletter 02/2026 |
| Nil report | Not currently required where there is nothing to report | BZSt FAQ |
| Corrections and deletions | Possible after 31 July and in later years, for accepted data only | BZSt FAQ |
| Missing self-certification notice | After 90 days, new accounts only | § 13(2a), § 16(2a) FKAustG |
| Schema 3.0 | Mandatory for all transmissions from 1 January 2027 | BMF letter of 14 January 2026 |
The processing report is the evidence that data were accepted, so read it. If a whole first delivery is rejected, fix and resend it as a new first delivery with fresh MessageRefId and DocRefId values; a correction file cannot repair a rejected file.
7. Amended CRS and schema 3.0
The DAC8 transposition act, the Act implementing Directive (EU) 2023/2226 of 22 December 2025, amended the FKAustG in Article 3. Its first article is the new Kryptowerte-Steuertransparenz-Gesetz, which governs crypto-asset reporting separately. For financial accounts, the changes bring e-money and central bank digital currency into scope and add data points to § 8, such as the role of each controlling person.
The BMF published the new data set on 14 January 2026. Transmissions up to 31 December 2026 use schema 2.0; from 1 January 2027 only schema 3.0 is accepted, including corrections to data first sent in 2.0. The BZSt has said it expects to stop accepting 2.0 files on 1 December 2026, so any outstanding corrections in the old schema should be in before then. For the new role fields, § 27(2) gives relief: for accounts held at 31 December 2025, the roles need only be reported for periods ending by 31 December 2027 if they are in electronically searchable data.
8. Fines, audits and the separate FATCA route
The BZSt audits compliance with the FKAustG (§ 5(6)) through its automatic-exchange audit unit, and it is also the fining authority. Under § 28(1a), failures to report correctly, completely and on time, and most due diligence failures, can be fined up to EUR 50,000; record-keeping failures and the remaining offences up to EUR 10,000. Under § 28(3), the BZSt tells BaFin when it fines a financial institution that it has fined before. Late first deliveries can be followed up by the audit unit even though the portal still accepts them.
US accounts are not reported through CRS at all. Germany implements FATCA through the FATCA-USA-Umsetzungsverordnung, with its own BZSt procedure, the same 31 July date and onward transmission to the IRS by 30 September. The BZSt’s 2026 newsletter is explicit that reporting a US country code in a CRS file does not satisfy FATCA.
9. Worked cases
Facts: a German e-money institution has 400,000 retail wallets. About 2% of holders self-certified residence in another EU state. Almost all balances are small, but a few hundred customers park larger sums for weeks.
What the rule says: the institution holds e-money for customers, so it is a depository institution under § 19 No. 5. Each customer’s e-money account is excluded under § 19 No. 40(f) unless the rolling 90-day average exceeded USD 10,000 on any day of the year.
What the practitioner does: runs the daily rolling-average test per customer across all wallets, flags those that crossed the line, and reports only the crossed accounts held by reportable persons. The calculation and its inputs are kept as § 3(3) records.
Outcome: a small file and an exclusion the institution can prove.
Facts: a Dutch-licensed e-money institution opens a German branch and moves German customers to it in March.
What the rule says: under § 19 No. 2 the branch is a German financial institution, so the accounts it maintains are reported to the BZSt; accounts kept at head office stay in the Dutch return.
What the practitioner does: registers a sender in the BZSt online.portal, decides between the CRS form, the BOP upload and DIP, and reconciles the year-end allocation so no account is reported in both countries or left out.
Outcome: one German return by 31 July and a clean split from the home-state report.
Facts: an app-based institution opens accounts instantly and asks for the self-certification in a later screen; 3% of new customers never complete it.
What the rule says: deferral is allowed only where self-certification at opening is impossible or verification unreasonable in justified exceptional cases. Funds cannot be paid out until it is obtained, and a BZSt notice is due after 90 days.
What the practitioner does: moves the self-certification into onboarding, blocks payouts on incomplete accounts, and files the 90-day notices for new accounts only.
Outcome: the fine exposure under § 28(1) shrinks to cases the institution can justify.
10. FAQ
When is the German CRS report due?
By 31 July of the year after the reporting period, under § 6(3) and § 27(2) FKAustG. The deadline cannot be extended and is met only when the BZSt has received the data.
Does Germany require nil reports?
Not at present. The BZSt’s FAQ says no nil report is needed when there is nothing reportable.
Is ELMA still the channel?
No. For CRS the BZSt has replaced ELMA with the DIP interface. Institutions can also use the online CRS form or the XML upload in the BZSt online.portal.
Do we need a BZSt number?
The data sender does. It is issued when registering for the BZSt online.portal. A service provider sending for you needs its own registration, but each file covers one institution.
Is every e-money wallet reportable now?
No. A customer’s e-money account is excluded unless its rolling 90-day average balance went above USD 10,000 on any day of the year, and only reportable persons’ accounts are reported.
What are the fines?
Up to EUR 50,000 for reporting failures and most due diligence failures, and up to EUR 10,000 for the other offences, under § 28(1a) FKAustG.
11. What to do, today
- COO: write a short memo on financial institution status under § 19 FKAustG, separately for each licence and branch, and file it with the § 3(3) process documentation.
- Head of reporting: confirm the sender registration, BZSt number and channel; send any remaining schema 2.0 corrections before 1 December 2026; test schema 3.0 in the DIP test environment.
- Data team: build the daily rolling 90-day e-money balance per customer, aggregated across wallets, with USD conversion.
- MLRO and onboarding: collect self-certification at opening, block payouts where it is deferred, and run the 90-day notice process for new accounts only.
- Compliance: keep FATCA as a separate filing under the FATCA-USA-Umsetzungsverordnung, from the same due diligence.
Related: CRS for EMIs: reportable financial institution · FATCA for EU e-money institutions · Germany reporting calendar · CRS reporting compared across six EU states
