Safeguarding in Germany: § 17 ZAG after the 2025 reform
Safeguarding in Germany sits in § 17 of the Payment Services Supervision Act (ZAG) for both payment and e-money institutions, with § 18 adding the timing rule for e-money paid by card or other payment instrument. The statute was rewritten with effect from 9 April 2025: the open trust account gave way to a segregated account, a central-bank account became possible, and a new sentence now says, in terms, that segregated funds belong to the customers as against the institution’s creditors. BaFin’s practice sits in module BTO 1 of its ZAG-MaRisk circular, and the auditor reports on it under the ZahlPrüfbV. This piece covers all four layers and works through three cases.
1. The texts
Four instruments carry the German rules:
- § 17 ZAG — the safeguarding duty, the two methods, mixed-purpose funds and BaFin’s powers. It applies to institutions providing the payment services in § 1(1) sentence 2 nos. 1 to 6 ZAG and to institutions running e-money business.
- § 18 ZAG — the timing rule for funds received for the issuance of e-money by means of a payment instrument.
- BaFin Circular 07/2024 (BA), ZAG-MaRisk — the minimum risk-management requirements for payment and e-money institutions, published on 27 May 2024. Module BTO 1 sets the process requirements for safeguarding and for liability cover.
- The ZahlPrüfbV — the regulation on audit reports for payment and e-money institutions. § 17(2) makes safeguarding a mandatory chapter of the annual audit report.
The current wording of § 17 comes from Article 11 of the Act on urgent amendments in the financial market and tax area of 28 February 2025 (BGBl. 2025 I No. 69). The amended section applies from 9 April 2025.
2. § 17(1) ZAG: method 1 and method 2
Funds received from payment service users, or through another payment service provider, for the execution of payment transactions or the issuance of e-money must be safeguarded by method 1 or method 2.
Method 1 — segregation. Two limbs remain in the current text:
- No commingling. The funds may never be mixed with the funds of any natural or legal person other than the users or e-money holders for whom they are held.
- Deposit or investment. Where the funds are still held at the end of the business day following receipt and have not been delivered to the payee or transferred to another provider, they go into a separate account at a credit institution, or into an account at the Deutsche Bundesbank or another EU central bank at that central bank’s discretion, or they are invested in secure, liquid, low-risk assets agreed with BaFin. BaFin may exclude individual assets where treating them as secure would not be objectively justified.
A third limb, letter c, which required the funds to be kept apart from the institution’s other assets so that they would not fall into the insolvency estate, was repealed in 2025. Its job is now done by the deeming sentence discussed in section 5.
Method 2 — insurance or a comparable guarantee. The cover must come from an insurer or credit institution that is entitled to do business in Germany and does not belong to the institution’s group. It must equal the amount that would otherwise be segregated and be payable if the institution becomes zahlungsunfähig — unable to pay. That trigger is narrower in wording than the directive’s “unable to meet its financial obligations”, and the policy should be drafted to the German text.
BaFin may, at its due discretion, prescribe one of the two methods to an institution. This power covers payment institutions and e-money institutions alike.
3. Mixed funds and BaFin’s enforcement path
§ 17(2) follows Article 10(2) of PSD2. Where part of the funds will be used for future payment transactions and the rest for non-payment services, the payment part is safeguarded. If that part is variable or unknown in advance, the institution may safeguard a representative share assumed to be used for payment services, provided it can be reliably estimated from historical data to BaFin’s satisfaction.
Under § 17(3), the institution must show BaFin on request that its measures are sufficient. If it cannot, BaFin may set a deadline for evidence or remediation, then act under § 21(2) ZAG.
4. E-money: § 18 ZAG
§ 18 is a single paragraph. Where funds for the issuance of e-money are received by payment through a payment instrument, they must be safeguarded once they have been credited to the e-money institution’s payment account or otherwise made available to it under § 675s of the Civil Code (BGB). In any event they must be safeguarded no later than five business days after the e-money is issued. § 17 applies accordingly.
Unlike Spain, Germany does not make segregation the default for e-money institutions. Both types of institution choose between the same two methods, and BaFin’s power to prescribe a method applies to both.
5. Insolvency: the 2025 deeming rule
Before April 2025 the German model rested on the open trust account. Its protection in insolvency depended on civil-law trust doctrine developed by the Federal Court of Justice, under which the strength of the right of separation turns on how funds reach the account and how the account is held. Protection depended on facts, not on the statute.
The amended § 17(1) now provides that, under method 1, the deposited funds or the assets invested are deemed to belong to the customers as against the institution’s creditors. The practical aim is a right of separation for users in the institution’s insolvency, of the kind § 47 of the Insolvency Code (InsO) grants to anyone who can show that an asset is not part of the estate. The statute does not say how shortfalls are shared among customers if the account is short; that remains a matter for the insolvency administrator and, ultimately, the courts.
6. BaFin practice: ZAG-MaRisk BTO 1
BTO 1 of Circular 07/2024 sets the process expectations. Its main points:
- Standardised account set-up and restricted access. Safeguarding accounts follow fixed handling principles and standardised agreements, and the number and roles of people with access are kept to what is necessary.
- Reconciliation outside operations. Administrative and reconciliation processes must show, and allow anyone to trace at any time, that customer funds are protected against other creditors on insolvency. Reconciliation sits outside the operational business, and breaks and anomalies must be investigated and resolved.
- From the moment of receipt. BaFin reads the three requirements — no commingling, safeguarding, segregation — as cumulative from receipt of the funds, not only from the end of the next business day. Incoming funds are therefore received directly into the safeguarding account, and the institution’s own money must never reach it.
- Fees. Where the institution is contractually entitled to take its fees from the account, it debits them on the due date, the same day.
- Direct-debit returns. Allowed only on individual customer accounts, not on pooled ones.
- Bank account terms. The account agreement must exclude the bank’s lien and set-off rights, including for account charges, and oblige the bank to give a garnishee statement.
- Assets and insurance. Investment in assets requires procedures that confirm the assets are secure and liquid, with the no-commingling rule still applying. Under method 2, the covered amount is monitored and peak balances must be covered at all times; an average is not enough.
BTO 1 predates the 2025 amendment and still speaks of trust accounts. Its operational expectations do not depend on that label; read them as applying to the segregated account until BaFin revises the circular.
7. The annual audit: ZahlPrüfbV
§ 17(2) of the ZahlPrüfbV requires the auditor to describe how customer funds are safeguarded under §§ 17 and 18 ZAG, to assess the effectiveness of the arrangement, and to address the method used. The summary conclusion required by § 6 then names compliance with the safeguarding requirements expressly. Expect the auditor to test what BTO 1 asks for: account terms, reconciliations, breaks, fee debits and peak-balance cover.
8. Germany, Spain and Luxembourg side by side
| Point | Germany | Spain | Luxembourg |
|---|---|---|---|
| Statute | §§ 17, 18 ZAG (PIs and EMIs in one section) | Art. 21 RDL 19/2018 (PIs); art. 9 Ley 21/2011 (EMIs) | Arts. 14 and 24-10 LPS |
| Method choice | Institution chooses; BaFin may prescribe a method to PIs and EMIs | PIs choose; EMIs segregate unless the Banco de España authorises insurance | Both methods available to PIs and EMIs |
| Account | Separate account at a credit institution, or Bundesbank / EU central bank at its discretion | Demand deposit titled as customer balances | Distinct account at a credit institution or central bank, at its discretion |
| Assets | Secure, liquid, low-risk assets agreed with BaFin | Zero-risk-weight assets under art. 114 CRR | As defined by the CSSF in Circular 26/906 |
| Insolvency | Funds deemed to belong to customers as against creditors | Absolute right of separation | Funds outside the estate and shielded from other creditors |
| Supervisory overlay | ZAG-MaRisk BTO 1 | RD 736/2019 and RD 778/2012 | Circular CSSF 26/906, Chapter 8 |
| Insurance trigger | Institution’s inability to pay | Court declaration of concurso | Inability to meet financial obligations |
9. Worked case: fees netted at month-end
Facts: a German payment institution charges merchants a monthly fee. Finance books the fee as earned on the due date but sweeps it out of the safeguarding account in one batch at month-end.
What the rule says: § 17(1) prohibits commingling at any time. BTO 1 requires fees that may be taken from the account to be debited on the due date, the same day, and says the institution’s own money must never be in the account.
What the practitioner does: changes the sweep to run daily against fees falling due that day, adds a reconciliation check that flags any earned but unswept fee, and documents the change in the safeguarding policy.
Outcome: the account holds only customer money on every day of the month, and the auditor’s § 17(2) ZahlPrüfbV test has nothing to report.
10. Worked case: a collection account in front of the safeguarding account
Facts: an e-money institution receives all customer top-ups into a general operating account, then moves them to the safeguarding account the next morning — well inside the D+1 window in the statute.
What the rule says: the statute’s timing test is end of the next business day, and § 18 gives up to five business days for funds received by payment instrument. BaFin, however, expects the three requirements to apply from receipt and incoming funds to land directly in the safeguarding account.
What the practitioner does: re-points customer-facing IBANs and acquirer settlement to the safeguarding account; where a technical processing account is unavoidable, it is used for customer funds only, reconciled daily and described in the policy with the reason.
Outcome: the funds are protected from the moment they arrive, and the institution is not left arguing for the statutory minimum against the supervisor’s reading.
11. Worked case: insurance sized on the average
Facts: an institution using method 2 bought a guarantee sized to its average daily customer balance. Payroll-driven peaks exceed that figure for three days each month.
What the rule says: § 17(1) method 2 requires cover equal to the amount that would otherwise be segregated. BTO 1 states that peak amounts must be covered at all times and an average is not sufficient.
What the practitioner does: resizes the guarantee to the highest observed balance plus a growth margin, sets up daily monitoring against the cover limit with an escalation trigger, and checks the payout wording against the German insolvency trigger and the non-group condition.
Outcome: the cover matches the exposure on the worst day, not the typical one.
FAQ
Which provision governs safeguarding in Germany?
§ 17 ZAG for payment and e-money institutions, with § 18 ZAG adding the timing rule for e-money funded through a payment instrument.
Do German institutions still need an open trust account?
No. Since 9 April 2025, § 17(1) requires a separate account at a credit institution, or an account at the Bundesbank or another EU central bank at that bank’s discretion.
Can BaFin decide which method we use?
Yes. § 17(1) lets BaFin prescribe one of the two methods to an institution, at its due discretion, for payment and e-money institutions alike.
When must card-funded e-money be safeguarded?
Once the funds are credited to the institution’s payment account or otherwise made available to it under § 675s BGB, and no later than five business days after the e-money is issued.
What happens to segregated funds if the institution fails?
The statute deems them to belong to the customers as against the institution’s creditors, which is designed to give customers a right of separation in insolvency.
Does the auditor review safeguarding?
Yes. § 17(2) ZahlPrüfbV requires the audit report to describe the safeguarding arrangement and assess its effectiveness, and § 6 brings the conclusion into the summary.
12. What to do, today
- Legal: update the safeguarding policy, customer terms and account documentation from “trust account” to the post-April 2025 wording, and check the bank agreement still excludes lien and set-off.
- Treasury: map every inbound flow and confirm that customer funds land directly in the safeguarding account, not in an operating account first.
- Finance: move fee debits to the due date and keep reconciliation with a team outside operations, with a documented break log.
- Method 2 users: size cover to peak balances and confirm the payout trigger matches the German insolvency wording.
- Audit liaison: walk the auditor through the arrangement before year-end, using the § 17(2) ZahlPrüfbV headings.
Related: Safeguarding compared across the EU · Safeguarding in Luxembourg · ZahlPrüfbV audit report
