Payment Services Licensing Under the ZAG

When payment services licensing applies in Germany

Payment services licensing in Germany is governed by the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG), which implements the second Payment Services Directive (PSD2) and the E-Money Directive. Anyone who wants to provide payment services in Germany on a commercial basis, or to an extent that requires a commercially organised business, needs a written licence from BaFin unless it is already a bank, an e-money institution or another listed payment service provider (§ 10(1) ZAG). Issuing e-money requires a separate e-money licence (§ 11 ZAG). Providing payment services without a licence is a criminal offence punishable by up to five years' imprisonment (§ 63(1) no. 4 ZAG).

The question arises far beyond classic payment companies. Marketplaces, platforms collecting money for sellers, software providers handling customer funds, loyalty and voucher schemes, fleet card providers and embedded finance offerings regularly need to check whether they provide payment services, and whether an exemption applies.

Which activities are payment services

The ZAG lists eight payment services (§ 1(1) sentence 2 ZAG):

1. services enabling cash to be placed on a payment account and operations required for operating the account;
2. services enabling cash withdrawals from a payment account;
3. executing payment transactions, including direct debits, card payments and credit transfers, without a credit line;
4. executing such payment transactions where the funds are covered by a credit line;
5. issuing payment instruments and acquiring payment transactions (acquiring business);
6. money remittance, where funds are received from a payer without a payment account solely to transfer a corresponding amount to a payee or another payment service provider;
7. payment initiation services;
8. account information services.

Platforms that receive funds from buyers and pass them on to sellers often perform money remittance or execute payment transactions, depending on how accounts are structured. The analysis turns on who has control over the funds, in whose name they are received and whether the platform acts for both sides.

The limited network exemption

Services based on payment instruments that can be used only in the issuer's premises or within a limited network of service providers under a commercial agreement with a professional issuer, or only to acquire a very limited range of goods or services, are not payment services (§ 2(1) no. 10(a) and (b) ZAG). Store cards, closed-loop gift cards, fuel cards, canteen cards and certain city cards may qualify. A third variant covers instruments limited to Germany and provided for specific social or tax purposes, such as meal vouchers under public-law rules (§ 2(1) no. 10(c) ZAG).

The exemption is construed narrowly. A network that keeps growing, accepts merchants without restriction or covers a broad range of goods quickly loses the "limited" character. Where the total value of payment transactions under the (a) or (b) variants in the previous twelve months exceeds EUR 1 million, the provider must notify BaFin with a description of the service and the exemption relied on; BaFin then decides whether the exemption applies (§ 2(2) ZAG). Providers should monitor volumes, document the network's limits from the outset and keep acceptance agreements consistent with the exemption they rely on.

The commercial agent exemption and platforms

Payment transactions from payer to payee through a commercial agent who is authorised by agreement to negotiate or conclude the sale or purchase of goods or services only on behalf of the payer or only on behalf of the payee are also excluded (§ 2(1) no. 2 ZAG). The words "only on behalf of" are decisive: since PSD2, the exemption no longer covers platforms that act for both buyers and sellers. A marketplace that collects money from buyers and pays sellers usually cannot rely on it.

Platforms therefore choose between several models: obtaining their own licence, working with a licensed payment service provider that collects funds directly on its own licence while the platform provides only the technical interface, structuring the platform as a genuine commercial agent for one side only, or using an agent arrangement under another institution's licence. Each model has commercial, contractual and data protection consequences. The technical service provider exemption covers providers that support payment services without ever possessing the funds (§ 2(1) no. 9 ZAG), which is often the right fit for software companies.

Other exemptions and group structures

The ZAG contains further exclusions, among them direct cash payments without intermediaries, commercial cash transport, payment transactions within a group or between members of a cooperative banking group, transactions between payment service providers for their own account, certain transactions by telecoms operators where single payments do not exceed EUR 50 and monthly totals per subscriber do not exceed EUR 300, and services of technical providers that never hold the funds (§ 2(1) ZAG). The intra-group exemption is frequently relevant for treasury functions and in-house banks, but it does not cover payments for third parties outside the group.

Companies that are not exempt can also act as agents of a licensed payment institution. An agent provides payment services in the name of the institution, which must register the agent with BaFin and remains fully responsible for it. For e-money, distribution through persons acting on the institution's behalf is possible, but e-money institutions may not issue e-money through such persons (§ 31 ZAG).

Payment services licensing: the application and ongoing duties

A licence application must include a description of the business model and the payment services intended, a business plan with a budget forecast for the first three financial years, evidence of initial capital, a description of the measures to safeguard customer funds, governance arrangements and internal controls, procedures for security incidents and complaints, business continuity arrangements, a security policy, anti-money laundering measures, and information on managers and holders of qualifying holdings (§ 10(2) ZAG).

BaFin refuses the licence if the applicant is not a legal person or commercial partnership, if the application is incomplete or does not allow a positive overall assessment, or if the initial capital is not available in Germany (§ 12 ZAG).

Once licensed, payment and e-money institutions must safeguard funds received from customers, either by segregation on trust accounts or by insurance or a comparable guarantee (§ 17 ZAG), maintain own funds, comply with strong customer authentication and the conduct rules of the Civil Code on payment services, report major operational and security incidents, and meet the requirements of DORA and the Money Laundering Act. Acquirers of qualifying holdings must pass an owner control procedure, discussed in our insight on BaFin owner control procedures. Licensed institutions can passport their services across the EEA.

Payment services licensing for embedded finance and software providers

Embedded finance has made payment services licensing a board-level topic for companies that never saw themselves as financial institutions. Software providers that let their customers collect payments, enterprise resource planning vendors that offer payment runs, travel and mobility platforms that split payments between several providers, and retailers offering wallets or stored-value accounts all need a clear position on the ZAG. The answer usually lies in one of three structures.

• Technical service provider: the company provides software, interfaces and data processing but never holds customer funds. The licensed partner opens the accounts, receives the money and executes the transactions. This keeps the company outside the ZAG, but the contracts and the user journey must reflect the partner's role.
• Agent or distributor: the company acts as a registered agent of a licensed payment institution, or distributes e-money on its behalf, and the institution remains responsible to BaFin.
• Own licence: the company obtains its own payment institution or e-money licence, which provides control over the product and revenue but brings capital, governance, safeguarding, reporting and audit obligations.

The choice depends on volumes, margins, the importance of the payment flow to the core product and the company's appetite for regulatory supervision. Payment services licensing also interacts with other regimes: credit features such as buy-now-pay-later may trigger consumer credit rules and lending licences, and crypto-related features fall under MiCAR. A product review at the design stage is far cheaper than restructuring after BaFin has raised questions.

PSD3 and the Payment Services Regulation

EU payment services law is being reformed. The Commission proposed a third Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation (PSR) in 2023. On 27 November 2025, negotiators of the European Parliament and the Council reached a provisional agreement (European Parliament press release). According to the Parliament, the package makes payment service providers liable where they fail to implement appropriate fraud prevention, treats fraudster-initiated or altered transactions as unauthorised, requires payee name verification, increases fee transparency, simplifies authorisation for payment institutions with risk-based capital requirements and streamlines authorisation for crypto-asset service providers already authorised under MiCAR.

The agreement still had to be formally adopted by Parliament and Council and published in the Official Journal; application dates will follow from the final texts, and PSD3 will require changes to the ZAG and the Civil Code. Firms should monitor the final texts and plan for transitional periods, re-authorisation steps and new fraud-related liability, rather than assume that today's ZAG structure will remain unchanged. For the wider fintech picture, see our page on fintech, payments and crypto assets and our insight on MiCAR CASP authorisation.

How TRW & Co helps

We advise platforms, fintechs, retailers, software providers, banks and investors on payment services licensing in Germany. We analyse flows of funds, assess whether a limited network, commercial agent, technical provider or group exemption applies, prepare limited network notifications and licence applications, and structure cooperation with licensed payment service providers. For licensed institutions we support safeguarding, outsourcing, agent and passporting arrangements, DORA and AML compliance, and preparation for PSD3 and the PSR, together with our financial regulation team. This is general information, not legal advice. To discuss your model, please contact us.