A payment institution (Zahlungsinstitut) is the PSD2-derived authorisation issued by BaFin under section 10(1) of the Zahlungsdiensteaufsichtsgesetz (ZAG). It permits the institution to provide the seven payment services in section 1(1) ZAG: deposit and withdrawal transactions, direct debits and credit transfers, payment transactions involving credit, acquiring, money remittance, payment-initiation services, and account-information services. A German PI does not take deposits beyond the narrow technical window and does not issue electronic money; e-money issuance sits under the separate BaFin-issued electronic money institution authorisation. Standard PI authorisation under ZAG carries the EU/EEA passport on a notification basis through BaFin to the host competent authority. Germany has not transposed the PSD2 small-PI derogation; there is no simplified track in the ZAG.

Section 12 ZAG transposes the PSD2 Article 7 schedule without national variation. EUR 20,000 covers only money-remittance activity. EUR 50,000 covers only payment-initiation services. EUR 125,000 covers the full account-based payment-services menu including card acquiring and card issuing. An AISP-only entity carries no initial capital floor but must hold professional indemnity insurance sized to the EBA Guidelines under PSD2 Article 5(4). Most acquirers are working against the EUR 125,000 threshold because the post-close service mix typically reaches into card or account-execution services. Ongoing own funds under section 18 ZAG are calculated on a continuous basis under one of the three PSD2 methods (A, B, or C). BaFin sizes the operating buffer to the business plan; credible cross-border passport ambition typically calls for an operating capital base above the statutory floor.

Yes. A BaFin-authorised PI passports under PSD2 by notification through BaFin to the host competent authority. Both cross-border services and the establishment of branches, agents, and distributors are available across the EU 27 and the wider EEA. Common host markets for German PIs are Austria, Switzerland (via the EEA-equivalence track and bilateral arrangements where applicable), the Netherlands, Belgium, France, Italy, Spain, and the wider DACH corridor. The passporting notification is administrative; it is not a second authorisation file in the host country. Because Germany has no simplified-PI track, every German PI carries the passport from the day the BaFin authorisation is issued — there is no scope-cap to outgrow.

The PSD2 small-PI option is a Member-State derogation under PSD2 Article 32, available to each Member State to transpose or not. France transposed it as the simplified PI under L.522-11-1 of the Code monétaire et financier (EUR 3 million monthly transaction cap, no passport). The UK retained its FCA-administered SPI route post-Brexit (GBP 3 million cap, no passport). Germany did not transpose the derogation when implementing PSD2 through the ZAG in 2018 and has not added it since. The legislative posture has been that a single fully-supervised PI category produces clearer supervisory expectations and a more usable register for counterparties. For acquirers the practical effect is that every German PI is a full ZAG institution with the full passport, full prudential perimeter, and full supervisory file. There is no transition from small to full to manage post-close.

A qualifying-holding notification under the regime transposed from PSD2 Article 6 into ZAG section 2c (cross-referencing the Banking Act section 2c rules). Thresholds are 10%, 20%, 30%, and 50%, plus any move that hands the buyer control of the licensed entity. BaFin assesses fit-and-proper standing of beneficial owners and the proposed two-person management board, financial soundness and source of funds, group structure transparency, the strategic plan for the PI post-acquisition, and AML/CFT integration. The assessment clock under the EBA/ESMA/EIOPA Joint Guidelines on Prudential Assessment of Acquisitions is sixty working days from a complete file, extendable by thirty working days where supplementary information is sought. The file is read by both BaFin and Bundesbank in parallel; reconciling the two readings is where unprepared acquirers lose time. Closing on the SPA is conditional on BaFin non-objection.

The European Parliament and the Council of the EU reached provisional political agreement on PSD3 and the directly-applicable Payment Services Regulation on 27 November 2025. Publication in the Official Journal is expected in H1 2026; the PSR will apply 20 days after publication, while PSD3 requires national transposition through a ZAG amendment over an 18-month window with applicability targeted for Q2/Q3 2028. The reform tightens fraud-liability rules, expands strong-customer-authentication scope, and consolidates supervisory expectations on outsourcing and ICT risk. For an acquirer evaluating a BaFin-supervised PI today, the entity acquired in 2026 is being acquired into the tail-end of the ZAG-as-currently-written PSD2 regime; the integration plan must already account for PSR direct-effect obligations applying within months of completion, and the change-of-control file should anticipate BaFin’s reading of the target’s PSR-readiness as part of the substantive review. We screen targets on PSD3/PSR readiness as part of standing diligence.