Germany BaFin ZAG License in 2026: PI and EMI Authorisation

BaFin and the ZAG framework

The Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG) is the German transposition of PSD2 and EMD2. It governs the authorisation and supervision of Payment Institutions and Electronic Money Institutions. The competent authority is the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin), supported by the Deutsche Bundesbank for prudential matters.

Germany is the largest economy in the EU and the single biggest end-market for payment services on the continent. A BaFin PI or EMI licence is a tier-1 stamp that carries weight with institutional clients, corporate customers and banking partners. The trade-off: BaFin is one of the slowest and most demanding EU supervisors.

Typical users of the German ZAG licence: corporate payment services, acquirers serving German retailers, card issuers for German cardholders, open-banking TPPs, and pan-European fintechs that need a German licence for B2B credibility.

Scope: PI, EMI and "financial service institution"

ZAG covers PSD2 Annex I services and EMD2 e-money. Several activities that sit under payment licences in other jurisdictions remain under the separate Banking Act (KWG) in Germany, including deposit-taking, lending, securities brokerage, custody of financial instruments, and crypto custody. The ZAG and KWG interaction is a regular source of misclassification; expect BaFin to confirm the right licence at pre-application.

Authorisation process and timeline

BaFin is the single point of contact. The authorisation file must be filed in writing, in German (most technical annexes accepted in English). The typical process has six phases.

1. Pre-application engagement. Essential. BaFin has an industry contacts desk and expects a pre-filing discussion on business model, licence scope and capital plan.
2. File preparation. Business plan (3-5 years), governance framework, organisational chart, AML/CFT manual aligned with German Geldwäschegesetz (GwG), risk and compliance manuals, ICT/DORA framework, outsourcing register, safeguarding plan, fit-and-proper files for directors and qualifying shareholders.
3. Submission. In German, filed with BaFin. BaFin charges a fee for the authorisation decision; check the current amount with BaFin before you budget.
4. Substantive assessment. 3 months statutory from complete file, 9 to 15 months real end-to-end.
5. Conditions precedent. Paid-up capital, safeguarding live, key staff on board, systems tested.
6. Passporting. Notifications to host NCAs; services start after BaFin transmits the file (typically within 1 month).

End-to-end for a credible PI: 9 to 15 months. EMI: 12 to 18 months. BaFin's pace is the trade-off for its reputation.

Substance and governance: the German bar

• Management board (Geschäftsführung). At least two executive directors, each subject to individual BaFin approval (Geschäftsleiter approval).
• Supervisory board (Aufsichtsrat). Required for AGs; strongly recommended for GmbHs above a threshold.
• MLRO. Geldwäschebeauftragter appointed and registered with BaFin. Cannot be fully outsourced.
• Local staff. Meaningful local headcount in risk, compliance and operations. German-speaking at least in compliance and customer-facing roles.
• Real office. Physical premises in Germany, BaFin site visits.
• Outsourcing. § 26 ZAG and DORA apply, with detailed outsourcing risk assessments and exit plans.

DORA and the end of ZAIT

From 17 January 2025 DORA applies directly to BaFin-supervised PIs and EMIs. Until then, BaFin's IT expectations for these firms sat in ZAIT (Zahlungsdiensteaufsichtliche Anforderungen an die IT), the payment-sector counterpart of the banks' BAIT. BaFin repealed ZAIT with effect from the end of 16 January 2025 to avoid double regulation, so DORA is now the IT rulebook. The general duty under § 27 ZAG to run a proper business organisation with effective, proportionate risk management still applies, and BaFin expects documentation depth above the PSD2 baseline.

ICT incident reporting within 4 hours of detection, full 72-hour follow-up, threat-led penetration testing scaled to firm size, and third-party ICT register covering every critical provider.

PSD3 for German PIs and EMIs

PSD3 and PSR reached provisional agreement on 27 November 2025, with applicability expected mid-to-late 2027. German PIs and EMIs migrate to the unified "payment institution authorised to issue e-money" regime. Verification of Payee (the IBAN-name check) does not wait for PSD3: under the Instant Payments Regulation (EU) 2024/886 it has applied since 9 October 2025 to all euro credit transfers, standard and instant, PIs and EMIs included. For PSD3 itself, plan for APP-fraud liability, safeguarding diversification and tighter substance expectations. See the PSD3 and PSR guide.

Ship a ZAG-licensed product with Crassula

Crassula Core keeps the ledger, client accounts with virtual IBANs, SEPA and SEPA Instant flows and the audit trail. Cards come through pre-integrated issuers you contract with directly, and identity checks run through connected verification providers. Transaction monitoring, sanctions screening, safeguarding sign-off and regulatory reporting to BaFin stay with you and your chosen providers; Crassula supplies the ledger balances, transaction exports and, as your ICT provider, the incident and outsourcing information you need for DORA. Useful for ZAG PI and ZAG EMI applicants, plus KWG credit institutions that add payment products.

FAQ