German payment institutions and e-money institutions hold permissions under sections 10 and 11 of the Payment Services Supervision Act (ZAG). PSD3 will merge them. Every existing ZAG institution will have to evidence compliance with PSD3 to BaFin within 27 months of entry into force. BaFin has not yet published its procedure, and the German implementing law is still to come. This checklist sets out the controls German institutions can prepare now. The EU-wide process is in our PSD3 re-authorisation guide.
The German market
At 30 October 2026 the EBA Central Register listed 80 authorised payment institutions and 12 EMIs with a German home licence, 50 of them passporting. The sector is led by acquirers, e-commerce payment service providers, payment initiation and account information businesses, and remitters.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
The PSR applies directly in Germany. The PSD3 parts reach German institutions through amendments to the ZAG, which must be in place within 21 months of entry into force.
What changes for ZAG institutions
| Topic | Today | Under PSD3 |
|---|---|---|
| Permission | Section 10 or section 11 ZAG | One payment institution permission listing each service |
| Initial capital | EUR 125,000 core services; EUR 350,000 e-money | EUR 150,000 core services; EUR 250,000 e-money; added together |
| Safeguarding | Section 17; e-money within five business days | Next business day; concentration; user information |
| Winding-up plan | Not in the licence file | Required for core services and e-money |
Checklist 1: permission and services
- Map every activity to the PSD3 service list, including e-money issuance.
- Confirm institutions authorised only for e-money issuance list any related payment services they provide.
- Align passport notifications and agent registrations with the new service list.
- Confirm head office and part of the payment business are in Germany.
Checklist 2: section 17 safeguarding
- Move e-money safeguarding to the end of the business day after receipt.
- Review trust account documentation with each bank, including set-off and insolvency protection.
- Where funds sit with one bank, add a second and set allocation limits.
- Draft user information on the safeguarding method and German insolvency position.
- Keep daily reconciliations with breaks and fixes.
Detailed controls are in our PSD3 safeguarding checklist, and our safeguarding team reviews German arrangements.
Checklist 3: audit evidence
The annual audit of a ZAG institution includes the auditor's review of compliance areas such as safeguarding.
- Collect the last two audit reports and the management letter.
- Close each finding and keep evidence of closure.
- Ask the auditor to cover PSD3 readiness points in the next audit plan where possible.
- Use audit conclusions as evidence in the PSD3 file, cross-referenced by topic.
Checklist 4: AML and virtual IBANs
BaFin published a supervisory notice on virtual IBANs on 27 July 2026. It applies until the EU AML Regulation applies on 10 July 2027.
- Describe each virtual IBAN model clearly, including who holds the customer relationship.
- Show transparency about end customers, beneficial owners and payment flows.
- Strengthen monitoring where the model reduces transparency.
- Align customer due diligence with the AML Regulation; see our EU AML Regulation readiness plan.
Our financial crime team reviews virtual IBAN controls.
Checklist 5: open banking under the PSR
- For account information providers, check professional indemnity cover against PSR liabilities.
- For payment initiation providers, confirm EUR 50,000 initial capital and liability cover.
- For account providers, prepare the dedicated interface and permission dashboard.
- Remove obstacles to third-party access that the PSR prohibits.
Checklist 6: capital and the winding-up plan
- Recalculate initial capital by service and ongoing own funds; see our own funds calculation guide.
- Project three years ahead with a buffer.
- Draft a winding-up plan covering return of safeguarded funds, merchant settlement, reserves and chargebacks.
- Test customer repayment and cost the plan.
Our winding-up plan guide sets out what regulators look for.
Checklist 7: governance and DORA
- Map governance and internal controls to PSD3 requirements.
- Keep the DORA register of information current.
- Test incident reporting and business continuity plans.
Acquirers and payment service providers
Many German institutions are acquirers or payment service providers for merchants. Their safeguarding and winding-up questions differ from those of a consumer e-money business. Map each settlement model: where funds arrive, how long they stay, when they are paid to merchants, and which reserves and rolling holds apply. The PSD3 recitals address acquiring through international card schemes, so check how scheme settlement is treated. In the winding-up plan, show how merchants would be paid out, how chargebacks would be handled after services stop, and how reserves would be released.
German businesses relying on a passported institution
German account, card and wallet businesses often operate under an institution licensed in another member state. Their PSD3 checklist is shorter but just as important: obtain the provider's PSD3 plan and timetable, confirm each service offered in Germany will be on the provider's PSD3 authorisation and passport, check the provider's safeguarding arrangements under next business day timing, and keep a contingency plan in case the provider narrows its services.
What a BaFin file is likely to contain
Until BaFin publishes its procedure, prepare the content PSD3 lists for authorisation: programme of operations and service list, three-year business plan, evidence of initial capital, safeguarding description, governance and internal control arrangements including ICT, incident and continuity procedures, AML controls, details of managers and qualifying holders, agents and branches, and the winding-up plan. German institutions already hold much of this for their ZAG permission; the task is to update it for PSD3 and close the gaps.
Questions for the management board
A German management board should be able to answer: which PSD3 services will we list; does our section 17 arrangement meet next business day timing and avoid a single bank; are all audit findings closed; how do our virtual IBAN models meet BaFin's July 2026 expectations; what is our PSD3 capital requirement over three years; and who owns the file. Record the answers in a board paper and update it as the ZAG amendment and any BaFin guidance are published.
Order of work
Start with services and capital, since they may need shareholder decisions. Run safeguarding, audit closure and AML in parallel. Draft the winding-up plan last. Our compliance support team supports German institutions through each step. See also our Germany payment institutions and Germany EMI pages.