Fintech & Digital Payments Compliance in Germany

The German market is open to non-bank payment firms, e-money issuers, money transfer apps and lending products, either with a German licence or through the EU passport. Licensing, conduct and anti-money laundering (AML) supervision sit with one authority, the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), working with the Deutsche Bundesbank. Suspicious activity reports go to the Financial Intelligence Unit (FIU) at the Customs Directorate General.

The biggest practical obstacle for a digital entrant is identity verification. German AML law lists the documents and methods that may be used to verify a natural person, and BaFin accepts remote alternatives only where the law or its own video identification circular allows them. Products designed around generic remote identity checks used elsewhere in Europe often have to be redesigned for Germany.

1. Who regulates this sector

Federal law governs payment services in Germany; there is no separate state licensing layer for payment or e-money firms. Directly applicable EU regulations sit on top of the federal Acts.

2. Licensing and authorisation

The Zahlungsdiensteaufsichtsgesetz (ZAG, as last amended on 25 March 2026) sets out the routes. Anyone providing payment services in Germany commercially, or on a scale that needs a commercially organised business, needs written or electronic authorisation from BaFin (§ 10(1) ZAG). Issuing e-money needs a separate e-money licence, which also covers payment services and limited ancillary credit (§ 11(1) ZAG). Pure account information services need only registration (§ 34 ZAG).

BaFin decides within three months of a complete application (§ 10(3) ZAG). Applicants must be a legal person or commercial partnership with fit and proper managers and must describe their ICT arrangements under the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554), which § 10(2) ZAG references directly.

Passporting, agents and exemptions

An institution licensed elsewhere in the European Economic Area (EEA) may serve German customers cross-border, through a branch or through registered agents without BaFin authorisation (§ 39(1) ZAG). A German institution must notify BaFin and the Bundesbank of each agent, including its AML controls, and the agent may start only once registered (§ 25(1) ZAG). Limited-network operators whose payment volume exceeds EUR 1 million over twelve months must notify BaFin (§ 2(2) ZAG).

Lending and buy now, pay later

A payment or e-money institution may grant credit only as an ancillary activity tied to a payment, repayable within twelve months and not funded from customer funds (§ 3(4) ZAG); other lending needs a banking licence under the Kreditwesengesetz (KWG). From 20 November 2026 the new Absatzfinanzierungsaufsichtsgesetz (AbsFinAG) requires non-bank consumer creditors to register with BaFin [Adopted, applies 20 Nov 2026]. Small merchants offering only interest-free deferred payment for their own goods are exempt, and existing lenders may continue for twelve months (§§ 4 and 10 AbsFinAG).

Providing payment services or e-money without a licence is punishable by up to five years' imprisonment (§ 63(1) ZAG), and BaFin can order the business to be wound up (§ 7 ZAG).

3. AML, KYC and customer due diligence

Payment institutions and e-money institutions are obliged entities under § 2(1) No 3 of the Geldwäschegesetz (GwG, as last amended on 29 June 2026). Their agents and e-money agents, and EEA institutions operating in Germany through agents, are obliged entities under § 2(1) No 4. BaFin is the AML supervisor for all of them (§ 50 No 1 GwG). BaFin's interpretive guidance, the Auslegungs- und Anwendungshinweise (AuA, July 2025), applies to all of them.

When CDD applies

On establishing a business relationship; for occasional funds transfers of EUR 1,000 or more and other occasional transactions of EUR 15,000 or more; on suspicion; and on doubts about identity data (§ 10(3) GwG). Payment institutions that accept cash for payment services must identify the customer and beneficial owner whatever the amount (§ 10(4) GwG).

What CDD covers

Identify the customer and beneficial owner, establish the purpose of the relationship, check politically exposed person (PEP) status and monitor continuously (§ 10(1) GwG).

Enhanced due diligence

For PEPs, high-risk third countries and unusual transactions: senior management approval, source of funds and enhanced monitoring (§ 15 GwG).

Beneficial ownership

More than 25% of capital or votes, or comparable control (§ 3(2) GwG). The Transparenzregister (beneficial ownership register) alone does not satisfy the duty to collect beneficial owner data (§ 11(5) GwG).

If CDD cannot be completed, the relationship must not be established or must be terminated (§ 10(9) GwG).

E-money and simplified due diligence

For e-money, CDD applies even below the transaction thresholds. Identification may be skipped only if the instrument stores no more than EUR 150, is not reloadable (or reloadable, domestic only and capped at EUR 150 a month), buys only goods and services, cannot be funded with anonymous e-money, is monitored, and excludes cash redemption or remote payments above EUR 50 (§ 25i(2) KWG, applied by § 27(2) ZAG).

Reporting and records

Suspicious matters go to the FIU without delay and regardless of amount (§ 43(1) GwG); every obliged entity must register with the FIU electronically (goAML) whether or not it files (§ 45(1) GwG). Since 1 March 2026 the GwG-Meldeverordnung (GwGMeldV) requires reports in the FIU's electronic system, as structured XML or in its fields, with a selected reporting reason, the CDD data collected and relevant records attached (§§ 2 and 3 GwGMeldV). A reported transaction may proceed only with consent or after the third working day (§ 46(1) GwG). The GwG sets no general cash transaction reporting threshold for payment firms. CDD records, including ID copies and video and audio recordings, are kept for five years and destroyed after ten at the latest (§ 8 GwG).

4. Identity verification and onboarding

Before the relationship starts, the firm collects first and last name, place and date of birth, nationality and address (§§ 11(1) and (4) GwG). Verification is limited to the means listed in § 12(1) GwG:

• a valid official photo ID meeting German passport and ID rules;
• the electronic proof of identity (eID) of the German ID card, EU citizen eID card or electronic residence permit;
• a qualified electronic signature (QES), validated under Article 32 eIDAS, plus a payment from an account in the customer's name at an EU or EEA institution (a "reference transfer");
• an eID scheme notified under eIDAS; and
• for payment accounts, documents under the Zahlungskonto-Identitätsprüfungsverordnung (for example a birth certificate for under-16s).

The check must be an adequate examination of the document presented on site, or a procedure with an equivalent security level (§ 13(1) GwG). BaFin's AuA (section 5.1.3.2) treats eID, QES and notified eID as equivalent, keeps video identification under circular 3/2017 available, and states that further remote procedures need an ordinance under § 13(2) GwG, none of which has been issued. Documents must be presented in the original. The eID route works with an NFC-enabled smartphone as card reader, but data flow only to a provider holding a state authorisation certificate and after the holder enters a PIN (§ 18(2) and (4) PAuswG). In person, the ID card chip can also be read on site after a photo comparison (§ 18a PAuswG), and the firm then records the card identifier (§ 8(2) GwG). Remote reading of a passport or ID card chip outside the eID function is not among the procedures BaFin recognises. Legal persons are verified from a register extract, founding documents or a documented register search (§ 12(2) GwG).

Firms may rely on another obliged entity or outsource identification to a vetted provider under contract, but stay responsible (§ 17(1) and (5) GwG; AuA, section 8.2).

5. Digital channels: what's different

Bottom line: remote onboarding is allowed only via eID, QES with a reference transfer, notified eID or BaFin-compliant video identification.

Video identification counts as "in person"

BaFin circular 3/2017 (GW) of 10 April 2017 treats video identification as identification among persons present and applies to payment and e-money institutions and their agents. Its cumulative conditions include trained staff, recorded consent, an encrypted live session, checks of at least three document security features, automated machine-readable-zone verification, a one-time code (TAN) and full recording. Sub-outsourcing is not permitted, and it cannot identify a legal person. BaFin's evaluation of 9 May 2022 keeps the procedure as a "bridge technology" under continued review.

Non-face-to-face as a risk factor

Annex 2 to the GwG lists relationships without personal contact and without safeguards such as electronic identification or recognised remote procedures as a potentially higher-risk factor. BaFin has notified the EBA that it complies with the EBA guidelines on remote customer onboarding (notification of 14 March 2024). They govern how a permitted remote solution is run, for example liveness detection in unattended processes and, where technically feasible, using chip data to cross-check identity data (paragraphs 35 and 41).

Strong customer authentication

Strong customer authentication is required for online account access, electronic payments and risky remote actions; remote payments must be dynamically linked to amount and payee (§ 55 ZAG). Exemptions, such as remote payments up to EUR 30, are set by Delegated Regulation (EU) 2018/389. Euro-area providers had to offer verification of the payee for credit transfers by 9 October 2025 (Regulation (EU) 2024/886).

What is changing for remote onboarding

The Federal Ministry of Finance's draft video identification ordinance (GwVideoIdentV) of 18 April 2024 has not been promulgated [Draft, not adopted]. The Digitale Identitätengesetz (DIdG), passed by the Bundestag on 15 October 2026, would add the EU Digital Identity Wallet to § 12(1) GwG, require the wallet's authentication and validation data to be recorded, and delete the reference-transfer condition for QES (Article 6 of the bill) [Bill, awaiting Bundesrat consent]. According to the Bundestag, the German state wallet is to be available nationwide from January 2027. Under the amended eIDAS Regulation, Member States must offer a wallet within 24 months, and payment providers obliged to use strong customer authentication (except micro and small enterprises) must accept it on request within 36 months, of the wallet implementing acts entering into force; the first took effect on 24 December 2024 (Articles 5a(1) and 5f(2)). From 10 July 2027 the EU AML Regulation (AMLR) accepts an identity document plus reliable independent sources, or eIDAS electronic identification at "substantial" or "high" level (Article 22(6)). AMLA's final draft due diligence standards of 1 October 2026 allow other remote document-based tools only where neither route can be used, with safeguards and a recorded justification [Draft RTS, not adopted].

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) applies throughout. Obliged entities, and third parties they use for CDD, may process personal data as far as the GwG requires for AML purposes (§ 11a GwG). Data needed to provide the payment service itself require the user's explicit consent (§ 59 ZAG).

Face matching and liveness checks process biometric data for unique identification, a special category under Article 9 GDPR. The German data protection authorities' position paper on biometric analysis (3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg) holds that it needs an Article 9(2) exception, typically freely given explicit consent referring expressly to the biometric data. Where a biometric step is not legally required, offer an alternative so that consent stays voluntary.

7. Sector-specific obligations

Automated monitoring and organisation

Institutions need data processing systems that ensure GwG compliance (§ 27(1) ZAG), and BaFin has stated that manual monitoring is not sufficient for payment service providers. Its ZAG-MaRisk circular 07/2024 (BA) covers governance and outsourcing.

Agents, distributors and partner oversight

Institutions must ensure agents are reliable and compliant (§ 25(2) ZAG). Since 31 March 2026, BaFin's and the Bundesbank's inspection and search powers extend to agents, e-money agents and outsourcing providers (§ 19 ZAG as amended by the BRUBEG).

Consumer credit and buy now, pay later

From 20 November 2026 the Civil Code (BGB) applies consumer credit rules, including creditworthiness checks, to deferred payment (§ 506 BGB as amended). Free payment terms of up to 50 days granted by the seller itself (14 days for large online sellers) are excluded. Creditworthiness checks may not use social network data (§ 505b(3) BGB as amended).

Sanctions screening and high-risk countries

EU financial sanctions apply directly; the Bundesbank implements them in Germany. Providers of instant credit transfers must screen all users against EU targeted sanctions at least daily and on each new listing, instead of screening each transfer (Article 5d, Regulation (EU) No 260/2012 as amended).

8. Risk indicators and red flags

Payment and e-money typologies (FIU and BaFin)

• Transaction laundering: card payments for illicit goods or subscription traps routed through apparently legitimate merchant accounts.
• Shell merchants: merchants at private addresses or virtual offices, often sharing formation addresses.
• Insider access: payment provider staff selling criminal networks access to payment infrastructure.
• Cash bill payment by QR code: cash paid at retail tills for invoices from fake shops or high-risk sectors, with no identification of the payer.
• Structuring: repeated similar transactions just below the EUR 1,000 or EUR 15,000 thresholds within a short period.

The FIU's 2025 annual report (21 July 2026) records 9,217 reports from payment and e-money institutions, out of 374,693.

9. Enforcement and penalties

Under § 56 GwG, base fines reach EUR 150,000 (intent) or EUR 100,000. For serious, repeated or systematic breaches the cap is EUR 1 million or twice the economic benefit, and for payment and e-money institutions the higher of EUR 5 million or 10% of prior-year turnover. BaFin publishes final measures.

Under the ZAG, unauthorised payment or e-money business carries up to five years' imprisonment, or three years if negligent (§ 63 ZAG). Fines reach EUR 1 million for breaching enforceable orders and EUR 100,000 to EUR 300,000 otherwise (§ 64(4) ZAG); unregistered consumer lending, up to EUR 500,000 (§ 8 AbsFinAG).

Recent actions target monitoring: BaFin fined Payone GmbH EUR 95,000 (22 December 2025) for an inadequate data processing system, and Nexi Germany GmbH EUR 30,000 (3 April 2025) for impaired IT monitoring.

10. Recent changes and what to watch

• 10 July 2027[Adopted, applies 10 Jul 2027]: the EU AML Regulation applies directly to payment and e-money institutions. The revised Payment Services Directive and new Payment Services Regulation remain in the EU legislative procedure (October 2026) [Proposed].
• 9 April 2027[Adopted, applies 9 Apr 2027]: euro-area payment and e-money institutions must offer instant euro transfers (Regulation (EU) 2024/886).
• January 2027[Planned, from Jan 2027]: the German state EU Digital Identity Wallet is due to be available nationwide, according to the Bundestag.
• 20 November 2026[Adopted, applies 20 Nov 2026]: consumer credit rules cover most deferred payment products; non-bank lenders register with BaFin.
• 15 October 2026[Bill, not enacted]: the Bundestag passed the DIdG, which would accept the EU Digital Identity Wallet for GwG verification; Bundesrat consent and promulgation are pending.
• 1 October 2026[Draft RTS, not adopted]: AMLA submitted final draft due diligence standards to the Commission, including the fallback rules for remote document-based tools.
• 31 March 2026[In force]: BaFin's inspection powers extended to agents and outsourcing providers.
• 1 March 2026[In force]: the GwGMeldV set the form and content of suspicious activity reports.
• 1 January 2026[In force]: EBA AML mandates moved to AMLA; EBA guidelines stay in force until replaced.

11. What this means for identity verification

• Route design: German-licensed firms need at least one listed remote route (eID, QES plus reference transfer, notified eID) or circular-compliant video identification; automated document and selfie checks alone are not recognised under current German law.
• Data set: capture place of birth and nationality as well as name, date of birth and address.
• Evidence: store ID copies, video and audio recordings and QES validation results for five years, and delete them after ten at the latest.
• Biometrics: obtain explicit, specific consent for face matching where it is not legally required, and keep an alternative path.
• 2027 planning: add the EU Digital Identity Wallet as a route: the DIdG would allow it for GwG verification once enacted, and eIDAS requires regulated payment providers to accept it at the user's request.