Payment institution licence in Germany — the ZAG file

BaFin has three months to decide a ZAG application — but the clock only starts when the file is complete, and there is a twelve-month long-stop after which an incomplete application must be rejected outright. A Zahlungsinstitut authorisation covers the PSD2 payment services without e-money issuance. The law is the Zahlungsdiensteaufsichtsgesetz (ZAG), and it is more prescriptive than the directive it transposes: seventeen enumerated application items, initial capital that must be available in Germany, quarterly own-funds data to two authorities, and a safeguarding regime where BaFin can tell you which method to use.

1. Who grants, who supervises, and what the licence covers

BaFin authorises and supervises. Under § 10(1) ZAG, anyone wanting to provide payment services in Germany commercially, or on a scale requiring a commercially organised business operation, needs BaFin’s written or electronic authorisation unless they already fall into a payment service provider category that does not need one. The Deutsche Bundesbank is not a bystander: it receives prudential data directly and is consulted on the implementing regulations.

Section 10(1) also settles a question that costs applicants time. The licence covers, beyond the payment services themselves, operational and closely related ancillary services — guaranteeing execution of payment transactions, foreign exchange, data protection services, data storage and processing, and safekeeping so far as it is not deposit-taking — plus the operation of payment systems under § 57. What it does not do is create a general exemption for side activities: BaFin’s Merkblatt: Hinweise zum Zahlungsdiensteaufsichtsgesetz (ZAG), in the version of July 2024 and last amended on 31 March 2026, is explicit that the ZAG contains no general ancillary-activity privilege. AML supervision stays with BaFin; AML intelligence goes to the FIU under § 43 GwG.

2. Initial capital — and the two German twists

The capital floors sit in § 12 ZAG, drafted as a list of grounds on which authorisation must be refused. Number 3 refuses the licence where the funds required for the business, in particular sufficient initial capital, are not available. The amounts are the PSD2 amounts:

• EUR 20,000 — payment institutions carrying on only money remittance (Finanztransfergeschäft)
• EUR 50,000 — payment institutions offering only payment initiation services
• EUR 125,000 — payment institutions offering the services in § 1(1) sentence 2 numbers 1 to 5
• EUR 350,000 — e-money institutions

Two things are added on top of the directive. First, § 12 number 3 requires the capital to be available im Inland — in Germany; a parent-level commitment sitting offshore does not satisfy the test as drafted. Second, where the institution is at the same time an institution within § 1(1b) of the Kreditwesengesetz or an investment firm under the Wertpapierinstitutsgesetz, the higher of the applicable amounts governs. Number 2 of the same section is the one applicants underestimate: the licence must be refused where the application lacks sufficient information or documents under § 10(2), or where the material submitted does not permit a positive overall assessment. Completeness and persuasiveness are separate tests, and the second is not curable by adding annexes.

3. The seventeen-item file, and where DORA now sits inside it

Section 10(2) ZAG enumerates seventeen items the application must contain. The familiar ones are there — business model, a three-year business plan with budget, proof of initial capital under § 12 number 3, the safeguarding measures under § 17, qualifying shareholders, managers, auditors, legal form and articles, head office address. Three repay attention:

• Numbers 5, 6 and 8 — governance and internal control, security-incident handling, business continuity — are now expressly tied to Regulation (EU) 2022/2554: arrangements for the use of ICT services under DORA, an incident mechanism taking account of the notification obligations in DORA Chapter III, and effective ICT continuity, response and recovery plans with a regular testing procedure. The German file now carries DORA artefacts, not a generic IT chapter — see our note on what replaced ZAIT in Germany.
• Number 9 requires the principles and definitions applied for collecting statistical data on performance, transactions and fraud — the licensing hook for the PSD2 fraud statistics, which have to exist at application stage rather than at first submission.
• Number 12 requires the organisational structure including any planned use of agents and branches, together with a commitment to check them on site or off site at least annually, plus outsourcing arrangements and payment system participation.

On management: § 10(2) sentence 5 requires at least two Geschäftsleiter, but expressly allows a single manager for undertakings of small size — a proportionality valve often missed by applicants planning a lean launch. Sentence 4 requires evidence that they are reliable and have adequate theoretical and practical knowledge and management experience; § 12 number 5 turns the absence of that evidence into a refusal ground.

Where a firm provides only account information services, § 34 ZAG applies instead: a registration rather than an authorisation, a shorter twelve-item list, no initial capital, and liability cover under § 36 evidenced by reference to the risk profile and client numbers. Notably, the § 34 list is not wired to DORA the way the § 10 list is — it points at § 54 for incident reporting and at ordinary contingency plans.

4. The three-month clock and the twelve-month long-stop

Section 10(3) sentence 1 gives BaFin three months from receipt of the application — or, where it is incomplete, three months from transmission of all information required for the decision — to say whether the licence is granted or refused. That second limb is the whole story: the clock resets to completeness, so the statutory period describes BaFin’s decision time, not the project timeline. Sentence 2 adds a hard stop with no PSD2 equivalent. Where, within twelve months of the application reaching BaFin, sufficient information is still not available — despite BaFin having required the applicant to complete the file within one month — the application must be rejected. Not deemed withdrawn; rejected.

Facts: an applicant files in January with a business plan, a draft safeguarding concept and outline ICT documentation, intending to firm up the DORA artefacts during the review. BaFin issues a completion request in September with a one-month deadline; the safeguarding contract is still unsigned in December.

What the rule says: the three-month period in sentence 1 never started, because it runs from transmission of all information required for the decision. The twelve-month period in sentence 2 did start in January, and runs against the applicant regardless of how constructive the dialogue has been.

What the practitioner does: treats the filing date as the start of a twelve-month budget, and files only once safeguarding, ICT documentation and manager evidence are final. Filing early to “start the clock” starts the wrong clock.

Section 10(4) then shapes what a grant looks like: BaFin may attach conditions, may limit the licence to individual payment services, and, where other business activities impair or could impair the institution’s financial soundness or auditability, may require them to be hived off into a separate company. Grants are published in the Bundesanzeiger (§ 10(6)), and public register entries require the licence to be evidenced to the register court (§ 10(7)). Under § 10(5) the institution must notify BaFin without delay of any materially and structurally significant change affecting the accuracy of what was submitted.

5. Safeguarding under § 17 — where BaFin picks the method

Section 17 applies to institutions providing the services in § 1(1) sentence 2 numbers 1 to 6, and to e-money issuance. Funds received must be secured under Method 1 or Method 2. Method 1 has the three familiar limbs — no commingling at any time with the funds of anyone other than the users for whom they are held; deposit or investment where the funds are still held at the end of the business day following receipt; and segregation such that they do not fall into the insolvency estate and creditors cannot reach them by individual enforcement. The German drafting adds detail the directive leaves open. The deposit may be made at a credit institution or at an account with the Deutsche Bundesbank or another EU central bank, at that central bank’s discretion. Investment in secure, liquid, low-risk assets is permitted only nach Abstimmung mit der Bundesanstalt — in coordination with BaFin — and BaFin may exclude, case by case, assets that would otherwise qualify. Sentence 4 gives the arrangement statutory effect: deposited amounts and qualifying assets are deemed, as against the institution’s creditors, to belong to the customers. Method 2 is insurance or a comparable guarantee for the amount that would otherwise be held separately, payable on insolvency, from an insurer or credit institution authorised to do business in Germany and outside the group.

The provision that matters most is sentence 3: BaFin may, in its discretion, prescribe which of the two methods the institution must use — the national determination power that makes safeguarding the least harmonised part of a passported business, discussed generally in our note on safeguarding compared across the EU. Section 17(2) allows a representative portion for mixed-purpose funds, estimated from historical data to BaFin’s satisfaction; § 17(3) lets BaFin demand evidence at any time and escalate to supervisory measures.

6. Own funds and the quarterly return

Section 15(1) requires own funds never to fall below the § 12 number 3 initial capital or the amount produced by the calculation regulation, whichever is higher, and sentence 4 adds a distinctly German power: BaFin may impose a Korrekturposten — a corrective item — where the calculated figure does not adequately reflect the actual own-funds base, lifting it once the grounds fall away. The general EU methods behind that calculation are set out in our note on own funds and initial capital.

The operational consequence is in § 15(2): institutions must submit the data needed to verify own-funds adequacy to BaFin and the Deutsche Bundesbank quarterly. BaFin may require own funds to deviate by up to 20% from the solvency principles, based on business organisation, risk management, the loss database within the meaning of Article 324 of Regulation (EU) No 575/2013, internal controls and actual risks. Where the institution also holds a banking licence under § 32(1) KWG, § 15(4) requires CRR own funds to be computed in parallel and any higher ZAG requirement to be covered.

7. Agents and the register

Section 25 ZAG governs the use of agents, and the sequencing is the point: an agent may only begin providing payment services once entered in the payment institutions register. BaFin informs the institution within two months of complete submission whether the agent will be entered. The institution must ensure the agent is reliable and professionally qualified, complies with the legal requirements, and informs the user of its status — and tells the user promptly if that status ends. Where selection or monitoring has been inadequate, BaFin can prohibit the use of individual agents or of agents altogether. Agents in another member state go through the passporting procedure in § 38(1). The register under §§ 43 and 44 ZAG is public and records the start and end date of each agent’s activity.

Facts: a distributor is signed in October with a commercial launch date of 1 November; the agent notification goes to BaFin in mid-October.

What the rule says: BaFin has two months from complete submission to decide entry, and the agent may not act before it. A November launch is not available on those dates.

What the practitioner does: treats agent entry as a critical-path item and writes the go-live condition into the distribution contract rather than the launch plan. The EU framework for agent notification and liability is in our note on PSD2 agents and the Article 14 register.

8. What switches on at grant

• Quarterly own-funds data to BaFin and the Bundesbank (§ 15(2)), alongside Bundesbank-routed returns
• § 43 GwG reporting via goAML Germany, and Transparenzregister maintenance
• PSD2 fraud statistics on the six-month cycle, against the definitions filed under item 9
• DORA obligations continuously, on the arrangements described in items 5, 6 and 8
• Passport notifications — see branch vs freedom of services

9. FAQ

10. What to do, today

• Fix the service set first. It drives the capital floor, whether § 17 applies at all, and whether you are on the § 10 or the § 34 track.
• Budget twelve months from filing, not three, and file only once safeguarding, DORA artefacts and manager evidence are final.
• Show the capital in Germany. Section 12 number 3 says im Inland, and an offshore commitment is a refusal ground.
• Write the fraud and transaction statistics definitions into the application — item 9 asks for them before you have any data.
• Open the safeguarding conversation with BaFin early; the method can be prescribed and secure-asset investment needs coordination.
• Put agent register entry on the critical path with a two-month lead time from a complete notification.
• Build the quarterly own-funds return for two recipients — BaFin and the Bundesbank.

Related: EMI licence in Germany · Which BaFin licence do you need? · Own funds and initial capital · German supervisory reporting · BaFin video identification — remote onboarding in Germany · The German reporting calendar · Buying an EMI or PI licence — change of control