Payment Institution licence in Germany — BaFin under the ZAG
A Zahlungsinstitut authorisation at BaFin covers the PSD2 payment services without e-money issuance. Same law as the German EMI track — the Zahlungsdiensteaufsichtsgesetz (ZAG) — with lower capital floors, the same German-language documentation culture and the same Bundesbank reporting expectations. This piece walks through the German PI file and flags what differs from the E-Geld-Institut route.
1. Who grants and who supervises
BaFin authorises and supervises; the Deutsche Bundesbank runs the reporting infrastructure and participates in ongoing prudential oversight. AML intelligence goes to FIU Germany under §43 GwG; AML framework supervision stays with BaFin.
2. Legal basis
- Directive (EU) 2015/2366 (PSD2)
- Zahlungsdiensteaufsichtsgesetz (ZAG) — the German transposition covering payment institutions (Zahlungsinstitute)
- Geldwäschegesetz (GwG) — AML framework incl. §7 Geldwäschebeauftragter
- BaFin Merkblätter on the ZAG authorisation procedure
- EBA Guidelines on authorisation under PSD2
3. The eight PSD2 services (Zahlungsdienste)
- Ein- und Auszahlungsgeschäft — cash deposit and withdrawal services on payment accounts
- Zahlungsgeschäft — execution of payment transactions (transfers, direct debits, card payments)
- Zahlungsgeschäft mit Kreditgewährung — the same with a credit line
- Akquisitionsgeschäft / Ausgabe von Zahlungsinstrumenten — acquiring and instrument issuing
- Finanztransfergeschäft — money remittance
- Zahlungsauslösedienste — payment initiation (PIS)
- Kontoinformationsdienste — account information (AIS)
(The German catalogue groups the Annex I PSD2 services into the ZAG’s own numbering; the substance is the EU list.)
4. Capital floors
- €20,000 — money remittance only
- €50,000 — payment initiation services
- €125,000 — the account-servicing / acquiring / issuing service set
- AIS-only: registration regime rather than full authorisation, with professional-indemnity coverage instead of capital
Ongoing own funds follow the PSD2 Method A/B/C calculation as implemented in the ZAG; BaFin reviews the chosen method against projections.
5. The file — same culture as the EMI track
The dossier mirrors the German EMI file: German-language, Merkblatt-structured, annex-traceable. PI-specific points:
- Safeguarding under the ZAG’s customer-funds provisions where the PI holds funds (services 1–5) — trust-account or insurance model, contractually evidenced
- PIS/AIS specifics — SCA and secure-communication compliance, professional-indemnity insurance for PIS/AIS, access-interface documentation
- Two Geschäftsleiter (four-eyes) and an internal Geldwäschebeauftragter with deputy — same strict outsourcing stance as for EMIs
- Agent networks — agents must be notified to BaFin and entered in the public register before acting
6. Realistic timing
Statutory three months from completeness; realistic end-to-end nine to twelve months for a first-time applicant, driven by the completeness bar and German-language feedback rounds. AIS-only registrations run materially faster.
7. What switches on at grant
- Bundesbank-routed returns via ExtraNet
- §43 GwG SAR reporting via goAML Germany, incl. the §46 freeze mechanics
- CESOP at the cross-border threshold
- IPR statistical reporting
- Passport notifications — see branch vs Freedom of Services
8. FAQ
PI or EMI in Germany — how do I choose?
Issuing stored value in the customer’s name = E-Geld-Institut. Pure payment services = Zahlungsinstitut. Both sit under the ZAG; the capital floors and the safeguarding trigger differ. The choice is not reversible without a fresh authorisation.
Is AIS-only really lighter?
Yes — registration instead of authorisation, professional-indemnity insurance instead of capital. Conduct, ICT and AML obligations still apply in full.
Can I run a German agent network?
Yes, with each agent notified to BaFin and listed in the public register before acting. The institution carries responsibility for agent conduct and AML compliance.
Does the Bundesbank interview applicants too?
BaFin leads the authorisation including interviews; the Bundesbank’s role concentrates on ongoing reporting and prudential data once you are live.
What about PSD3?
The proposed PSD3/PSR package merges the EMI and PI categories EU-wide with grandfathering for existing authorisations. Track our PSD3 tracker.
9. What to do, today
- Fix the service set first — it drives capital, safeguarding and insurance requirements.
- Take the BaFin pre-application meeting; draft to the Merkblatt in German.
- Line up two Geschäftsleiter and the internal AML officer early.
- Design for Bundesbank ExtraNet reporting from the build phase.
Related: EMI licence in Germany · German supervisory reporting · PSD3 tracker
