ZAGAnzV — notifications for German PIs and EMIs

The ZAG lists what a German payment or e-money institution must notify; the ZAGAnzV says what each notification must contain. The ZAG-Anzeigenverordnung — in full, the Verordnung über die Anzeigen und die Vorlage von Unterlagen nach dem Zahlungsdiensteaufsichtsgesetz — has applied since 31 October 2009 and was last amended by Article 41 of the Act of 4 February 2026 (BGBl. 2026 I Nr. 33). It turns the one-line duties in § 28 ZAG into forms, attachments and deadlines: a reliability declaration for every new managing director, a 20-field outsourcing notice, an annual holdings return due 15 June. This guide maps each event to its paragraph, form and recipient, and walks through the cases that most often go wrong.

1. Two layers: § 28 ZAG and the ordinance

§ 28(1) ZAG requires an institution to notify BaFin and the Deutsche Bundesbank without undue delay (unverzüglich) of a defined list of events. § 28(2) requires advance notice of any material change to the safeguarding arrangements under § 17 or to the liability cover under § 16 or § 36. § 28(3) puts a personal duty on managing directors to report their own outside mandates and holdings. § 28(4) empowers the Federal Ministry of Finance to set the detail by ordinance — which is the ZAGAnzV.

The general rules sit in § 1 ZAGAnzV. Unless another rule applies, every notification and document goes in a single copy to both BaFin and the competent Hauptverwaltung of the Bundesbank. Documents not in German need an officially certified translation, which BaFin may waive in an individual case. And at the request of BaFin or the Bundesbank, an electronic submission route must be used, with details published on their websites — in practice BaFin’s MVP-Portal for many procedures.

2. The event map

The table below links each § 28 ZAG event to the ordinance paragraph and form that governs its content. Events with no paragraph in the ordinance — change of legal form or name, a loss of 25% of own funds, a move of registered office, cessation of business — are still notifiable under § 28(1) ZAG, just without a prescribed form.

3. Management changes: the § 10 file

The intention to appoint a managing director must be notified before the appointment takes effect, with the facts relevant to reliability, professional suitability — including management experience — and time commitment, and the institution’s own assessment of those criteria. New facts that materially affect that assessment must be notified as soon as they become known. § 28(1) no. 1a extends the duty to members of a supervisory or administrative body.

§ 10 ZAGAnzV sets the attachments:

• Anlage 4 declaration, signed by hand, covering pending or past criminal proceedings, administrative-offence proceedings linked to business activity, insolvency, supervisory proceedings, and refused or revoked authorisations or registrations — each explained, with officially certified copies of the decisions. Some criminal proceedings may be omitted, for example those discontinued for lack of sufficient suspicion or ended in acquittal; proceedings discontinued under §§ 153 and 153a StPO must still be listed. For points 2, 4 and 5, matters closed more than five years before the start of the filing year may be left out.
• A complete CV, signed by hand, in reverse chronological order, naming every employer with its seat, the role, its duration, powers of representation, internal decision rights and the business areas reporting to the person.
• Anlage 5 for outside activities and Anlage 6 for direct holdings of at least 25% of a company’s capital.
• A certificate of good conduct for submission to an authority, filed directly with BaFin and not older than three months on the date of the notice.

The departure notice under § 10a is short — effective date and reason — but it is the one that is most often forgotten when a director leaves abruptly.

4. Ownership and close links: individual and annual notices

§ 11 ZAGAnzV uses one form, the Passivische Beteiligungsanzeige in Anlage 7, for two kinds of filing. Individual notices are due when a change makes a holder reach, exceed or fall below 20%, 30% or 50% of capital or voting rights; when the institution becomes or ceases to be a subsidiary or sister company; when directly held shares move to an intermediate company; or when the number or identity of intermediate companies changes. Under § 28(1) no. 4 ZAG the duty arises as soon as the institution learns of the forthcoming change — not when it closes.

The collective notice (Sammelanzeige) reports holdings as at 31 December of the previous year and is due by 15 June, on the same Anlage 7. Indirect holdings are attributed in full to each intermediate company. One form covers one holding relationship even if it triggers several events; trusts and similar complex structures add Anlage 2.

These are the institution’s own notices. A buyer’s acquisition of a qualifying holding is a separate procedure on the acquirer’s side — see the article on qualifying holdings and change of control.

5. Material outsourcing: the 20 data points

§ 26(1) ZAG covers outsourcing of activities and processes material to payment services or e-money business, including ICT systems, and requires an outsourcing register listing all material and non-material arrangements. Intended material outsourcing must be notified under § 26(2), completion under § 28(1) no. 10, and material changes or serious incidents in existing material arrangements as well.

§ 8 ZAGAnzV prescribes the content. The intention notice describes the planned arrangements and attaches the draft contract; the completion notice attaches the signed contract. Both carry a list of 20 items, including:

• an institution-assigned reference number per contract, start and end dates, renewal and notice periods;
• the activities and data involved, whether personal data is transferred and whether the provider processes it;
• the provider’s name, commercial register number, legal entity identifier where available, and parent company;
• the country of service and the data storage location — and for cloud, the service and deployment models;
• the date of the last materiality assessment and why the arrangement is material, the date and summary of the last risk analysis;
• who approved the contract and when, the governing law, the last and next audit dates;
• material sub-outsourcing with each subcontractor’s country, service location and data location;
• substitutability rated “easy”, “difficult” or “impossible”, whether the function could be brought back in-house, the impact of discontinuation, whether alternatives exist, whether the function is time-critical, and the estimated annual budget.

This national notice is separate from the DORA register of information. The fields overlap heavily, so firms that keep one master record per contract and generate both outputs from it avoid two inconsistent versions of the same facts.

6. Safeguarding and passporting

A change to safeguarding — a new safeguarding bank, a move from segregation to an insurance policy or guarantee, a change to the custody account structure — must be notified before it takes effect under § 28(2) ZAG. § 14 ZAGAnzV asks for a description of the material changes, the draft future contracts and the intended effective date. The same applies to changes in the professional indemnity cover that AISPs and PISPs must hold.

For passporting, § 9 ZAGAnzV requires a separate notice for each EEA state, with a translation into a language the host state accepts unless it takes German, and the same applies to changes. The content follows Delegated Regulation (EU) 2017/2055: Annex II for branches, Annex III for agents, Annex IV for e-money distributors, Annex V for cross-border services, and Annex VI for the notice of the date activity starts. Under § 38 ZAG, BaFin passes complete notices to the host authority within one month and decides on entry in the institution register within three months — see PSD2 passporting and the real clock.

7. Four scenarios

Scenario one — a new CFO joins the management board. Facts: a German EMI hires a CFO with a start date in eight weeks. Rule: § 28(1) no. 1 ZAG, § 10 ZAGAnzV. What the compliance officer does: files the intention notice now with the Anlage 4 declaration, signed CV, Anlage 5 and 6, and the institution’s own fit-and-proper assessment; asks the candidate to apply for the certificate of good conduct so it is under three months old on the filing date; sends the file to BaFin and the Bundesbank Hauptverwaltung. Outcome: the supervisors can review before the start date, and the completion notice follows on appointment.

Scenario two — the parent group restructures. Facts: the shareholder inserts a new intermediate holding company between itself and the PI; percentages do not change. Rule: § 11(1) no. 4 ZAGAnzV — a change in the number of intermediate companies requires an individual notice. What the officer does: files Anlage 7, adds Anlage 2 if the structure counts as complex, and updates the next 15 June collective notice. Outcome: a common miss avoided; “nothing changed in percentages” is not the test.

Scenario three — switching the safeguarding bank. Facts: the institution plans to move client funds to a new credit institution on 1 March. Rule: § 28(2) ZAG, § 14 ZAGAnzV — advance notice. What the officer does: files the description, the draft account agreement and the intended date well before migration, and aligns the timing with the auditor’s safeguarding review under the ZahlPrüfbV. Outcome: no undisclosed change to the client-money arrangement.

Scenario four — moving core processing to a cloud provider. Facts: the ledger moves to a hyperscale cloud region with a sub-processor in a third country. Rule: § 26(2) and § 28(1) no. 10 ZAG, § 8 ZAGAnzV. What the officer does: files the intention notice with the draft contract and all 20 data points, including the cloud models, data locations, sub-outsourcing chain and the substitutability rating; files the signed contract at completion; updates the outsourcing register and the DORA register of information from the same record. Outcome: one dataset, three outputs, no contradictions.

8. Controls that keep the file clean

• A trigger list owned by legal and compliance, mapped to the table above, embedded in board, HR, procurement and corporate-secretarial processes.
• A calendar entry for 15 June for the collective holdings notice, fed by the 31 December share register.
• A dual-recipient check on every filing: BaFin and the Bundesbank Hauptverwaltung.
• A translation step for foreign-language attachments, budgeted in the timeline.

FAQ

What to do, today

• Map your corporate events to the § 28 ZAG list and assign an owner to each.
• Check that the last 15 June collective notice matches the 31 December share register.
• Rebuild the outsourcing record so it carries all 20 § 8 data points.
• Pre-collect Anlage 4, 5 and 6 material for every director so a fast appointment does not stall.

Related: MVP-Portal — registering and filing with BaFin · The German reporting calendar for a payment firm · ZahlPrüfbV — the audit report