PSD3 in Germany: what BaFin licensed payment and e-money institutions must do

By Harry Khan, Founder · Published 8 November 2026 · Last reviewed 8 November 2026

The short answer

In Germany, payment institutions hold a permission under section 10 of the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG) and e-money institutions under section 11. PSD3 replaces the EU directives behind both, so the ZAG will be amended and the two permissions will become one: a payment institution authorised for the payment services it lists, which may include e-money issuance. Every existing ZAG institution will need to show BaFin that it meets the new requirements within 27 months of PSD3 entering into force. Those that do are treated as authorised under PSD3. Those that do not must stop the services concerned.

BaFin has not yet published a process for existing institutions. The detail of the German implementing law will shape it. What institutions can do now is the substance: a gap analysis against PSD3, a review of safeguarding under section 17 ZAG, a capital recalculation and a winding-up plan. Our PSD3 re-authorisation guide explains the EU-wide process.

Germany's sector in numbers

The table counts firms with a current German home licence on the EBA Central Register at 30 October 2026, from the Buckingham register of licensed EU payment and e-money firms.

Germany's profile differs from Lithuania, Malta or Cyprus. Payment institutions outnumber EMIs by more than six to one, and the sector is led by card acquirers, payment service providers for e-commerce, payment initiation and account information businesses and money remitters. Many German fintechs offering accounts or cards rely on e-money institutions licensed in other member states and passported into Germany, rather than holding a German e-money permission themselves. For them, PSD3 matters through their provider's re-authorisation as much as their own.

The timeline

Germany must amend the ZAG within 21 months of entry into force. German advisers have pointed out that the Payment Services Regulation applies directly, so its rules on fraud prevention, open banking, transparency and liability do not wait for German legislation. The PSD3 parts, including authorisation, capital, safeguarding and the winding-up plan, will reach German institutions through the amended ZAG.

What changes in the ZAG

The capital change matters most for e-money institutions that also provide payment services: their initial capital rises from EUR 350,000 to EUR 400,000. Institutions providing only e-money issuance see their floor fall to EUR 250,000, but ongoing own funds of 2% of average outstanding e-money usually decide the real requirement. Our PSD3 capital requirements guide has worked examples.

Safeguarding under section 17 ZAG

German institutions safeguard under section 17 ZAG, most often through trust accounts at a credit institution, with insurance or a guarantee as the alternative. PSD3 keeps these methods but changes the rule around them. E-money funds must be safeguarded by the end of the business day after receipt rather than within five business days. Institutions must try to avoid holding all customer funds with one bank and manage concentration risk under EBA standards still to come. And users must be told before the contract, and before any material change, how their funds are protected and which insolvency law applies.

German institutions have one advantage: the annual audit of a ZAG institution includes the auditor's review of safeguarding. A clean recent audit report is good evidence for the PSD3 file. Where the auditor raised findings, they should be closed and documented before the file is filed. Our PSD3 safeguarding rules guide sets out the PSD3 rule in full.

Virtual IBANs and AML

On 27 July 2026 BaFin published a supervisory notice on virtual IBANs. BaFin did not question virtual IBANs as such, but said that some complex models reduce transparency about end customers, beneficial owners and payment flows, and that where transparency is reduced, stronger AML controls are needed. The notice applies immediately and remains in place until the EU Anti-Money Laundering Regulation applies on 10 July 2027. Payment institutions, e-money institutions and Banking-as-a-Service providers are among those affected.

The notice is not part of PSD3, but it bears on the PSD3 file in two ways. The file includes the institution's internal controls for money laundering and terrorist financing, so any institution issuing virtual IBANs should show how its controls meet BaFin's expectations. And PSD3 asks for a description of the institution's business model and services; virtual IBAN models should be described clearly, including which entity holds the customer relationship.

The winding-up plan for German institutions

PSD3 makes a winding-up plan part of the authorisation file for institutions providing the core payment services or issuing e-money. It must suit the institution's size and business model and must provide for the return of safeguarded funds in a disorderly wind-down. For German acquirers and payment service providers, the plan should cover merchant settlement, reserves and chargebacks as well as consumer balances. For institutions with agents, it should cover how funds collected by agents reach safeguarded accounts and how customers are told what to do. Our PSD3 winding-up plan guide covers the contents.

German fintechs that rely on a passported licence

Many German account, card and wallet providers operate under an e-money or payment licence from another member state, as agents or distributors of that institution, or through their own passported subsidiary. For them, the PSD3 question is whether the licensed institution will be re-authorised on time with a service list that covers the German business. Ask the provider for its PSD3 plan and timetable, confirm that each service offered in Germany will appear on its PSD3 authorisation and passport, and check how customer funds will be safeguarded under next business day timing. Where the German business is the larger part of the group's activity, the real presence test in the provider's home country may also prompt questions about where the business is really run.

A contingency plan is sensible. If the provider decides to narrow its services or exit a market, a German programme may need to move to another licensed institution, which takes months to arrange.

Payment initiation and account information providers

Germany has a large group of payment initiation and account information businesses. Under PSD3, payment initiation keeps initial capital of EUR 50,000 and account information providers continue to hold professional indemnity insurance instead of capital. The Payment Services Regulation adds open banking rules that apply directly: dedicated interfaces from account providers, limits on obstacles to access, and a permission dashboard that lets users see and withdraw the access they have granted. German providers should check their insurance cover against the new liabilities and plan for the changes in how they connect to banks.

Questions for the management board

Before the ZAG is amended, a German management board should be able to say which PSD3 services the institution will list, whether its section 17 arrangements meet next business day timing and avoid a single bank, what the PSD3 capital requirement will be over the next three years, what the winding-up plan assumes, and who owns the re-authorisation file. Where the answers are not yet clear, the gap analysis is the place to find them.

What to do now

1. Run a documented gap analysis against PSD3 Title II, the authorisation file contents and the PSR, and take it to the management board.
2. Map services to the PSD3 list, including e-money issuance where relevant, and align passports.
3. Review section 17 safeguarding for next business day timing, a second bank and user information.
4. Recalculate capital under the PSD3 methods with a three-year projection.
5. Draft the winding-up plan and test customer repayment.
6. Close audit and supervisory findings, including any on AML or virtual IBANs.
7. Track the ZAG amendment and any BaFin guidance on how evidence must be submitted.

How Buckingham Capital Consulting helps

Buckingham Capital Consulting has advised payment and e-money firms since 2013 on licensing, compliance and banking, including Own Solutions' EMI licence from the Central Bank of Ireland and FCA authorisations for Nexpay, Orbital and Hryze. We prepare PSD3 gap analyses, safeguarding reviews, capital projections and winding-up plans for German ZAG institutions and for groups whose German business relies on a passported licence. See our Germany payment institution licence and Germany EMI licence guides, or contact us to discuss your institution.

Questions

Get in touch: +44 7563 115980 (phone and WhatsApp) or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.