#
Germany's payment-institution regime sits under ZAG with BaFin as supervisor; PSD3/PSR final texts (agreed 23 Apr 2026) and CRD VI's third-country-branch regime will reshape German market access once transposed/applicable; Consumer Credit Directive (EU) 2023/2225 must be transposed by 20 Nov 2025, applying from 20 Nov 2026.
Outlook
The licensing architecture is established and stable as standing knowledge. The live pressure on the regime comes less from authorisation mechanics than from the tightening supervisory posture downstream — enforcement intensity in resilience, AML and stablecoin oversight is reshaping the effective cost of holding a German licence rather than the route to obtaining one.
Licensing, Authorisation & Market Access
The PSD3/PSR transition remains in a holding pattern for German ZAG-licensed payment and e-money institutions. The Council of the EU published final PSD3/PSR compromise texts, ST-8221-2026-INIT and ST-8222-2026-INIT, on 23-24 April 2026, but as at this cycle those texts had not yet been published in the Official Journal of the EU, and consequently the Payment Services Regulation's 21-month applicability clock had not yet started. Because PSD3 is a directive requiring national transposition while the PSR is a regulation taking direct effect once its clock runs, German payment institutions and e-money institutions licensed under the Zahlungsdiensteaufsichtsgesetz currently continue to operate under the existing PSD2/EMD2-derived framework.
Once Official Journal publication occurs and the PSR applicability clock begins, ZAG-licensed institutions in Germany will face a re-confirmation obligation under the merged PSD3/PSR regime, which consolidates payment-services conduct requirements into a directly applicable regulation alongside a revised licensing directive. No German-specific licensing action, such as an authorisation grant, variation, or withdrawal, was evidenced this cycle; the development is entirely at the level of the supranational instrument's own legislative timetable.
Outlook
The key date to watch is Official Journal publication of the PSD3/PSR compromise texts, which will start the 21-month applicability clock and set a concrete countdown to the point at which German ZAG-licensed institutions must re-confirm their authorisation under the new regime. Until that publication occurs, no transition timetable for individual German institutions can be fixed.
5 earlier distinct update(s)
Licensing, Authorisation & Market Access
EU Parliament and Council negotiators reached political agreement on the PSD3/PSR package on 27 November 2025, with formal legislative texts expected in the third quarter of 2026. The two instruments follow different applicability tracks in Germany: the Payment Services Regulation (PSR) is directly applicable EU-wide and will take effect without German transposition once the formal text is published, while the Payment Services Directive (PSD3), which carries the authorisation and governance layer, requires national transposition estimated to take a further 18 to 24 months in Germany following formal adoption. This bifurcation matters for the bank-PSP versus non-bank payment-institution/e-money-institution distinction that structures Germany's licensing landscape: the PSR's directly-applicable rules on matters such as fraud prevention, open banking and API standardisation will land on a near-EU-wide timetable, while the licensing conditions, governance requirements and authorisation categories under PSD3 that determine how bank-affiliated versus non-bank payment institutions are treated will not bind in Germany until the national transposition process concludes.
A distinct development within the PSD3 package is a new optional safeguarding mechanism permitting payment and e-money institutions to hold client funds in an account directly with a central bank, as an addition to existing safeguarding methods such as segregated accounts with commercial banks or insurance-backed guarantees. For non-bank payment institutions and e-money institutions in Germany, a central-bank safeguarding option — once its operative conditions are settled through transposition — could offer a fund-protection standard closer to what bank-affiliated PSPs already benefit from via direct central-bank access, narrowing one dimension of the structural distinction between the two categories of licensed entity. The practical availability and conditions of this option in Germany, however, remain dependent on the pending transposition process and cannot yet be assessed in operative detail.
Outlook
The formal publication of the PSD3/PSR texts, expected in Q3 2026, is the key trigger to watch: it will start the clock on Germany's 18-to-24-month transposition estimate and will fix the precise scope of the new central-bank safeguarding mechanism as it applies to German-authorised payment and e-money institutions. Market participants assessing licensing strategy in Germany should treat the current period as a pre-transposition planning window rather than one in which PSD3's authorisation architecture is yet operative.
Licensing, Authorisation & Market Access
Two distinct market-access threads define this module for Germany this cycle. First, CRD VI is characterised by market counsel as introducing a new third-country-branch authorisation requirement: third-country institutions providing core banking services in Germany will be required to establish an authorised branch or subsidiary, curtailing existing KWG cross-border exemptions that have previously allowed certain activity without local authorisation. This is assessed at elevated impact and applies at the supranational regulatory layer, oriented toward bank-PSP entities rather than nonbank payment or e-money institutions, and it represents a genuine new barrier rather than a restatement of existing practice. The distinction between bank-PSP and nonbank-PI/EMI treatment matters here: the CRD VI change targets institutions providing core banking services, and its market-access consequences fall most directly on banks and bank-like third-country entities rather than on payment institutions or e-money institutions operating under the ZAG framework.
Second, and running in the opposite direction on compliance burden if not on formal market access, market commentary on the incoming PSD3/PSR package notes that Section 17 of the German ZAG already permits safeguarding of customer funds via an account with the Deutsche Bundesbank or another EU central bank. This means the central-bank-safeguarding-account mechanism that PSD3/PSR introduces as a new option across the EU is not a novel concept for German nonbank payment institutions and e-money institutions, which have had access to an equivalent mechanism under existing national law. The practical implication is that Germanys nonbank-PI/EMI safeguarding compliance lift from PSD3/PSR implementation is likely to be more limited than in member states lacking an equivalent existing provision, even as the wider EU payments rulebook consolidates around the same central-bank-account concept.
Outlook
Watch for the formal transposition timeline and effective date of the CRD VI third-country-branch requirement, expected around 2026-Q4, and for whether affected third-country institutions begin establishing authorised branches or subsidiaries ahead of that deadline rather than waiting for enforcement pressure. On the PSD3/PSR side, the practical question is whether German authorities issue any implementing guidance that formally aligns the existing ZAG Section 17 mechanism with the new EU-wide safeguarding framework, which would further reduce the compliance-lift gap for nonbank payment institutions.
Licensing, Authorisation & Market Access
Germany's payment and e-money institution licensing regime, administered by BaFin under the ZAG, is entering its most significant reform window in years. The European Union agreed final texts of the Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) on 23 April 2026, replacing the existing PSD2/EMD2 framework, and these instruments will apply to German payment and e-money institutions operating under the ZAG once transposed. The reform separates directive-level conduct and authorisation provisions (PSD3) from directly applicable regulation (PSR), a structural change from the PSD2-only architecture. Distinct from the payment-institution track, Germany's third-country institutions offering core banking services face a CRD VI requirement to establish an authorised branch or subsidiary absent an exemption, with BaFin and the Bundesbank preparing guidance aligned with forthcoming EBA technical standards; this is a bank-side market-access control that sits alongside, rather than replaces, the non-bank payment-institution licensing track. A third instrument reshapes the adjacent consumer-credit perimeter: Germany must transpose the EU Consumer Credit Directive (EU) 2023/2225 by 20 November 2025, with application from 20 November 2026, extending consumer-credit scope to buy-now-pay-later and short-term digital lending products that have historically operated outside traditional credit licensing. For non-bank payment and e-money institutions, this widens the range of product lines that may trigger consumer-credit obligations alongside existing ZAG payment-licensing duties. All three developments rest on Tier-2 legal-commentary sourcing rather than a directly retrieved Tier-1 primary text this cycle.
Outlook
The near-term calendar is dominated by transposition mechanics rather than new instrument announcements. Watch for BaFin's domestic implementing measures for PSD3/PSR, for EBA technical standards operationalising the CRD VI third-country-branch regime, and for the Consumer Credit Directive's application date of 20 November 2026, which will bring BNPL and short-term digital lending under consumer-credit obligations. Firms should expect the bank-side (CRD VI) and non-bank (ZAG/PSD3) tracks to continue developing in parallel rather than converging into a single licensing gateway.
Licensing, Authorisation & Market Access
German bank payment-service providers became subject this cycle to two binding provisions of the Instant Payments Regulation, Regulation (EU) 2024/886: a cost-parity mandate requiring that instant transfers cost no more than a standard SEPA credit transfer, and the abolition of the prior EUR100,000 per-transaction cap on SEPA Instant Credit Transfers, effective from 9 October 2025. The cost-parity mandate directly removes a monetisation line German bank PSPs had used: surcharges of EUR0.50 to EUR1.50 per instant transfer, layered on top of standard transfer pricing, are no longer permitted. The cap abolition removes a size-based friction that had constrained SCT Inst's use for larger corporate and treasury payments, subject now only to each individual bank's own anti-fraud limits rather than a regulatory ceiling.
Running in parallel, Verification of Payee became a mandatory anti-fraud control under the same Instant Payments Regulation framework and the 2025 SEPA Rulebook, adding payee-name matching to the instant-transfer flow at the same time that size and cost friction were removed. The sequencing is notable: the regulation removes friction on the payment side while simultaneously adding a new, mandatory verification control, a pairing that reflects the regulation's dual objective of adoption and fraud mitigation operating together rather than in tension.
The market-access picture bifurcates by entity type. Bank PSPs faced the 9 October 2025 deadline for both the receive-mandate, which had applied from 9 January 2025, and the send-mandate obligations, and are now operating under the full binding regime described above. Electronic money institutions and payment institutions, by contrast, have a materially later compliance deadline of 9 April 2027 for their own send and receive instant-transfer obligations under the same regulation. This eighteen-month-plus gap between the bank-PSP and non-bank-PI/EMI compliance timelines is a structural feature of the Instant Payments Regulation's German rollout, not an incidental delay, and it means that for roughly the next two years, bank PSPs and non-bank PIs/EMIs in Germany operate under materially different instant-payments obligations even though both categories are licensed payment-services providers under the same broader framework.
Confidence in the core cost-parity and cap-abolition findings is High, reflecting consistent reporting on provisions that are themselves unambiguous statutory text under Regulation (EU) 2024/886; the impact rating attached to these findings is HIGH, reflecting the direct compression of bank-PSP fee revenue and the removal of a longstanding transactional ceiling. The Verification of Payee finding carries an ELEVATED impact rating and Tier 2 sourcing, reflecting its status as a newly mandatory control rather than a discretionary fraud-prevention measure banks had previously been free to calibrate themselves.
For a payment institution or e-money institution considering market entry into Germany, the immediate licensing and market-access picture is more favourable than it will be from April 2027: an entrant licensed as a non-bank PI or EMI today has a compliance runway of close to two years before its own send/receive instant-transfer obligations bind, even as it can already observe how bank PSPs are adapting to the fully binding regime.
Sourcing for this cycle's findings rests on Tier 2 and Tier 3 secondary reporting, KPMG Germany, SMBC Group, adesso, and Bankdaten.de, rather than a located Tier 1 primary anchor from the European Central Bank, Bundesbank, or BaFin; the underlying legal provisions of Regulation (EU) 2024/886 are not themselves in dispute, but this monitor flags the absence of a Tier 1 anchor as a sourcing gap for this cycle rather than treating the finding as any less binding.
Outlook
The EMI/PI compliance deadline of 9 April 2027 is the next hard date in this module, and it will close the current bank-versus-non-bank timing asymmetry in instant-payments obligations. Whether German bank PSPs seek to recover the lost surcharge revenue through other fee structures, and whether non-bank PIs and EMIs begin early voluntary compliance ahead of the 2027 deadline to compete on instant-transfer availability, are the two clearest market-access signals to watch over the coming cycles.
Licensing, Authorisation & Market Access
The German licensing and market-access environment is in a period of structured transition driven by the advancing PSD3 and Payment Services Regulation legislative package at the EU level and the continuing operation of the Zahlungsdiensteaufsichtsgesetz at the national level.
PSD3/PSR Legislative Progression
On 17 April 2026, the Council of the EU issued a formal 'I' Item Note circulating the final compromise texts of PSD3 and the PSR to COREPER for approval. This followed provisional political agreement between the Council and the European Parliament reached in November 2025. The issuance of the 'I' Item Note is a procedural signal of imminent formal adoption: 'I' Items are placed on the Council agenda for approval without debate, indicating that the text is considered settled at the political level. Formal adoption by both institutions is the next step before the package enters the Official Journal and the transposition clock begins for member states.
For Germany, the significance of this progression is immediate and operational. BaFin has flagged that PSD3 expectations will be reflected in new authorisation files from 2026 onward, meaning that firms currently in the authorisation pipeline — or planning to enter it — are already being assessed against a forward-looking standard that anticipates the PSD3 framework, even before formal transposition.
EMI Reauthorisation: The End of the EMD2 Regime
The most structurally significant licensing change embedded in PSD3 for the German non-bank payment sector is the elimination of the separate Electronic Money Directive 2 regime. Under PSD3, EMIs are reclassified as a sub-category of payment institutions, and existing EMIs are required to seek reauthorisation as PIs. This is not a grandfathering arrangement: it is a mandatory reauthorisation process that will require affected firms to demonstrate compliance with the PI authorisation standard, which carries different — and in several respects more demanding — requirements than the EMD2 track.
For Germany, where EMIs are currently authorised under the ZAG's EMI provisions, this creates a defined transition task. The ZAG transposes both PSD2 and EMD2 and governs BaFin's authorisation of both PIs and EMIs. The reauthorisation requirement means that the ZAG's EMI track will effectively be wound down as a standalone licensing category once PSD3 is transposed into German law. Firms that have built their operating models around the EMI licence — including those using the EMI framework for e-money issuance in conjunction with payment account services — will need to assess whether their current authorisation scope maps cleanly onto the PI sub-category structure or whether material changes to their regulatory perimeter are required.
The bank versus non-bank distinction is directly relevant here. Credit institutions authorised under the KWG are not affected by the EMI reauthorisation requirement; the structural change falls entirely on non-bank PIs and EMIs. This asymmetry reinforces the existing market-access differential between bank and non-bank payment service providers in Germany, at least during the transition period.
BaFin Authorisation Practice
BaFin's forward-signalling on PSD3 expectations in new authorisation files is assessed as a practical anticipatory measure rather than a formal regulatory instrument. The ZAG remains the operative licensing statute until PSD3 is transposed. However, the signal that BaFin is already calibrating its authorisation assessments to PSD3 expectations means that firms seeking new PI or EMI authorisations in Germany in 2026 are effectively operating in a dual-standard environment: formally assessed under ZAG, but with BaFin applying forward-looking PSD3 criteria in its substantive review. This creates planning complexity for applicants, particularly on substance requirements, governance standards, and the safeguarding architecture that PSD3 will mandate.
Outlook
The near-term outlook for W1a in Germany is one of accelerating transition. Formal PSD3/PSR adoption is expected to follow the COREPER approval process, after which the transposition period will begin. BaFin's anticipatory posture on authorisation files means the practical impact of PSD3 on German licensing is already being felt. The EMI reauthorisation requirement is the single most operationally significant change for the non-bank sector and will require affected firms to initiate transition planning well in advance of the transposition deadline. The coverage gap on DE-specific insolvency-law primary sources for PSD3 safeguarding ring-fencing provisions is noted; that gap is carried forward to the next cycle.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (5)
- T1https://www.bafin.de/EN/Aufsicht/ZahlungsdienstePSD2/ZahlungsdienstePSD2_node_en.htmlretrieved
- T1https://www.bundesbank.de/en/tasks/banking-supervision/individual-aspects/payment-institutions-and-e-money-institutions-622962retrieved
- T3https://crassula.io/guides/licenses/germany-bafin-zag/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
- T1https://www.bafin.de/EN/PublikationenDaten/Datenbanken/ZahlungsinstituteRegister/register_zahlungsinstitute_node_en.htmlretrieved
- T3https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/germany/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]