The Payment Services Directive implementation in Germany regulatory part (Zahlungsdiensteaufsichtsgesetz/ZAG)

MÜNCHEN Karl-Scharnagl-Ring 8 80539 München Tel. +49 (89) 28 81 74-0 Fax +49 (89) 28 81 74-44 muenchen@gsk.de The Payment Services Directive implementation in Germany regulatory part (Zahlungsdiensteaufsichtsgesetz/ZAG) Summary of the Government Draft of October 22, 2008 (see BR-Drs. 827/08) by Dr. Markus Escher and Daniela Eschenlohr, GSK Stockmann & Kollegen, 12/30/2008 1. The PSD provides for a harmonized, EU-wide legal framework for payment services. 2. If payment services are not provided by banks or e-money institutions, the provider qualifies as payment institution. 3. The status of a payment institution triggers licensing requirements, financial regulation, capital requirements, but also grants the chance to passport into EU, through cross-border, branches or agents (Title I and II). 4. In-scope entities are credit/payment card companies, card processors (if applicable), money remitters, ATM-operators or other payment service providers (internet payments) 5. For all payment service providers (payment institutions, banks and e-money institutions) the PSD also provides for a new, harmonized legal framework under civil law, effecting payment contracts and execution of payments, including provisions on liability, clearing and settlement of payment funds, access to payment systems etc. 6. EU-wide legal implementation not later than November 1, 2009. 7. Germany is one of the first EU Member States, which has already introduced two Government Drafts into the legislative procedure on November 7, 2008. Implementation in Germany The Payment Services Directive (Directive 2007/64/EC; hereinafter referred to as PSD ) will be implemented by two legislative acts: www.gsk.de GSK 2008 Page 1 of 15

- Any regulatory issue (primarily Title I and II) will be covered by a new Payment Services Regulation Act ( Zahlungsdiensteaufsichtsgesetz ; hereinafter referred to as ZAG ). The German Ministry of Finance published a first draft on June 4, 2008. During a hearing on July 16, 2008, the legislator collected comments and critical remarks on this draft from the relevant authorities (especially the BaFin as the competent supervisory authority in Germany) and interest groups. On October 22, 2008, the German Government adopted the draft of the ZAG (see BR-Drs. 827/08), introduced it into the legislative procedure and forwarded it on to the Deutscher Bundesrat (Federal Council of Germany). - The ZAG sets out regulatory requirements for an entity which provides payment services as a regular business activity, comprising authorisation requirements, continuous supervision, illegal business activities, administrative fines and penal provisions. - Contract law provisions will be implemented by amendments of the German Civil Code ( BGB ), initiated by the Ministry of Justice. The German government adopted the draft on November 05, 2008 (see BR-Drs. 848/08). 1. Scope of application of the ZAG a. General remarks aa. The ZAG applies to payment institutions, i.e. an entity that provides payment services on a professional basis without being either a credit institution or an electronic money institution. In accordance with the annex to the PSD, Payment Services are defined as: 1. services enabling cash to be placed on a payment account or enabling cash withdrawals from a payment account as well as all operations required for operating a payment account; 2. execution of payment transactions, including transfer of funds on a payment account through execution of direct debits, including one-off direct debits, execution of credit transfers, including standing orders, execution of payment transactions through a payment card or a similar device Page 2 of 15

without granting credit ( Payment Business ); 3. execution of payment transactions according to n 2, where the funds are covered by a credit line (see sec. 2 para 3 ZAG) for a payment service user ( Payment Business with granting of credit ); 4. issuing of Payment Authentication Instruments and/or Payment Authentication Business (i.e. acquiring); 5. execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, provided that the operator only acts as an intermediary between the payment service user and the supplier of the goods and services ( Digitized Payment Business ); 6. money remittance. Payment transactions effected to fulfil one s own obligations or to receive payments for one s own claims, however, shall not be deemed Payment Services. bb. In this context, it has to be stressed that the term Payment Institution is allocated to all entities effectively performing the above mentioned business activities regardless of whether they have a proper licence or not. In a hearing on July 16, 2008 the Ministry of Finance has also made clear that the Member States have reached a consensus that in contrast to recital 6 and 7 of the PSD the application of the PSD shall not confine to companies whose main activity consists in the provision of payment services. In other words: the status of an entity as payment institution is entailed by simply performing payment services. In contrast, neither the possession of the necessary licence to conduct payment business nor the total revenue from payment services performed shall be the decisive criteria. cc. As an example, an entity that has been assessing its activities solely as an issuing/acquiring processor (and thus would regularly not be deemed to be a payment institution) could qualify as a payment institution. This, for instance, could be the case if an entity regularly providing conventional processing services also receives or forwards or pays out money on behalf Page 3 of 15

and for the account of its principal (issuer or acquirer). In this case, the need of a licence as a payment institution could only be avoided by operating on the basis of the waiver clause in sec. 1 para. 10 n 7 and n 9 ZAG. N 7 presupposes that payment transactions are carried out within a payment or securities settlement system between settlement agents, central counterparties, clearing houses and/or central banks and other participants of the system, and service providers. N 9 refers to services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred. Nonetheless, lacking the status of a payment institution could entail other difficulties with regard to anti-money laundering provisions the relevant entity has to comply with as an outsourcer for its principal. dd. Remarkably, even credit institutions that do not qualify as deposit taking credit institutions (including the so called Pfandbriefbanken which are specialized credit institutions issuing special covered bonds according to the German Pfandbrief Act )) will need an additional licence as a payment institution in Germany. Thus, these credit institutions will be subject to an additional, separate supervision with regard to compliance with ZAG provisions (beside the supervision regarding compliance with the provisions of the German Banking Act ( KWG )). After all, the new ZAG gives rise to a lot of complex questions with relevance for numerous business models, especially for those that have not been affected by regulatory requirements so far. This makes it worthwhile to have a closer look at the changes and innovations which will be imposed by the ZAG on entities which provide payment services in Germany. b. Application to non-german payment institutions aa. In case a non-german payment institution regardless whether from an EU Member State or another country outside Germany conducts payment services in Germany, the ZAG generally applies (especially but not only the licensing requirements under sec. 8 ZAG). Such activities are considered to take place in Germany if they are performed either by a payment institution or by a branch of a payment institution located in Germany that provides payment services in Germany and abroad or if they are carried out via payment accounts set up in Germany. A payment institution also performs payment services in Germany if it directly addresses the German Page 4 of 15

market without being located in Germany and without being in possession of an EU-passport. The possibility to make use of an EU-passport remains unaffected by this. bb. cc. Pursuant to sec. 26 ZAG, payment institutions that are in possession of an EU-passport and branch out into Germany or provide cross-border payment services in Germany are subject only to a limited supervision by BaFin as the competent German supervisory authority. Regarding anti-money laundering provisions, however, BaFin as the competent German Financial Supervisory Authority will also supervise branches of non-german payment institutions performing payment services in Germany as defined above (see aa.). c. E-money institutions Remarkably, the ZAG does not yet really take a firm stand with regard to e-money a fact that is probably rooted in the superficial treatment of e-money in the PSD. According to Recital (9) of the PSD, the PSD should neither regulate issuance of electronic money nor amend the prudential regulation of electronic money institutions as provided for in Directive 2000/46/EC. Therefore payment institutions should not be allowed to issue electronic money. The European Commission confirmed this limited scope of activities of payment institutions in its recent proposal to the European Parliament and the Counsel regarding an amendment of the E- Money Directive (see COM(2008)627). The ZAG defines e-money institutions as payment service providers (see sec. 1 para. 1 n 2). Yet, the right to issue electronic money is reserved for deposit taking credit institutions (sec. 1 para. 1 sentence 2 n 1 KWG) and electronic money institutions (sec. 1 para. 1 sentence 2 n 11 KWG; see also BR-Drs. 827/08, p. 55); these credit institutions do not need a licence under the ZAG. 2. Content of the ZAG a. Authorisation and waivers aa. First, the ZAG establishes a single licence for all providers of payment services which are not connected to taking deposits or issuing electronic money (see Recital (10) PSD). Page 5 of 15

bb. However, sec. 1 para. 10 ZAG stipulates numerous waivers. The following services are, amongst others, not deemed to be payment services: services where cash is provided by the payee to the payer as part of a payment transaction following an explicit request by the payment service user just before the execution of the payment transaction through a payment for the purchase of goods or services (n 4); payment transactions carried out within a payment or securities settlement system between settlement agents, central counterparties, clearing houses and/or central banks and other participants of the system, and service providers (n 7); services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred, including processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services (n 9); payment transactions executed by means of any telecommunication, digital or IT device, where the goods or services purchased are delivered to and are to be used through telecommunication, digital or IT device, provided that the telecommunication, digital or IT operator does not only act as an intermediary between the payment service user and the supplier of the goods and services (n 11); payment transactions carried out between payment service providers, their agents or branches for their own account (n 12); payment transactions within the framework of a corporate group (n 13); services by providers to withdraw cash by means of automated teller machines ( ATM ) acting on behalf of one or more card issuers provided that no other payment services are conducted (n 14). According to the legislator, n 14 shall only clarify that technical service providers (as outsourcing companies of credit institutions) shall not be considered as payment institutions on condition that they only (technically) operate those ATMs. As soon as a com- Page 6 of 15

pany acts on its own behalf and for its own account, it is subject to the licensing requirements under the ZAG regardless if it provides other payment services. The treatment of bank-independent ATM-business under the Government Draft is still unclear to a certain extend, since the official legislative intent ( Gesetzesbegründung ) of the Government Draft stipulates the requirement of a banking license to perform the lending business, if an entity only provides independent ATM-business on its own behalf and for its own account and does not provide any other payment services (see BR-Drs. 827/08, p. 67). cc. Entities providing payment services in Germany that are not credit institutions or electronic money institutions and do not benefit from a waiver under sec. 1 para. 10 ZAG have to apply for a written authorisation as a payment institution before commencing the provision of payment services. The application has to be submitted to the German Financial Supervisory Authority ( BaFin ), together with information and evidence as stated in sec. 8 para. 3 ZAG (which transposes art. 5 PSD). Inter alia, the application has to be accompanied by the following information and evidence: a programme of operations, setting out in particular the type of payment services envisaged; a business plan including a forecast budget calculation for the first three financial years which demonstrates that the applicant is able to employ the appropriate and proportionate systems, resources and procedures to operate soundly; evidence that the payment institution holds sufficient initial capital according to the provisions of the ZAG; a description of the measures taken for safeguarding payment users funds (see also below), a description of the internal control mechanisms which the applicant has established in order to comply with obligations in relation to anti-money laundering and terrorist financing provisions; a description of the applicant s structural organisation, including, where applicable, a description of the intended use of agents and branches and a description of outsourcing arrangements, and of its participation in a national or international payment system; the identity of persons holding in the applicant, directly or indirectly, qualifying holdings, the size of their holdings and evidence Page 7 of 15

of their suitability taking into account the need to ensure the sound and prudent management of a payment institution; identity of directors and persons responsible for the management of the payment institution and, where relevant, persons responsible for the management of the payment services activities of the payment institution, as well as evidence that they are of good repute and possess appropriate knowledge and experience to perform payment services. A Payment Institution has to appoint at least two directors, save Payment Institutions of small size; etc. According to sec. 9 n 1 ZAG a licence as a payment institution is only granted to legal persons and commercial partnerships. In contrast, sole proprietorship is not deemed to be an adequate legal basis to become a licensed payment institution. b. Activities Sec. 2 ZAG sets out which services a payment institution is allowed to conduct and which it is not allowed to conduct. aa. Taking deposits or other repayable funds Payment institutions are not allowed to conduct the business of taking deposits or other repayable funds. Any funds received by payment institutions from payment service users with a view to the provision of payment services, however, shall not constitute a deposit or other repayable funds. In contrast to the first draft of the Ministry of Finance, sec. 2 para. 1 ZAG now clearly states, that it is not forbidden for payment institutions to refinance its business by means of issuing bonds on the capital market. bb. Granting credit Pursuant to sec. 2 para. 3 ZAG, payment institutions may grant credit related to payment services if the following conditions are met: the credit shall be ancillary and granted exclusively in connection with the execution of a payment transaction; the original maturity of the credit granted shall not exceed twelve months, the credit granted shall not be prolonged beyond twelve months time and the credit shall be repaid within twelve months; Page 8 of 15

such credit shall not be granted from the funds received or held for the purpose of executing a payment transaction. The Ministry of Finance has made clear that any forms of current credit as granted, e.g., to sweep account holders shall not be covered by sec. 2 para. 3 ZAG. Therefore, sec. 2 para. 3 ZAG will presumably be only of relevance for credit card companies. These conditions fulfilled, providing such credits is not deemed to be banking business within the meaning of sec. 1 para. 1 sentence 2 n 2 of the German Banking Act. However, according to information from the Ministry of Finance, credits granted by payment institutions in compliance with sec. 2 para. 3 ZAG will be subject to provisions under the Consumer Credit Directive that stipulate a number of information duties. c. Initial capital and own funds aa. Initial capital Payment institutions shall hold, at the time of authorisation, initial capital as follows: where the payment institution provides only money remittance services, its capital shall not be less than 20.000,00. where the payment institution conducts Digitized Payment Business within the meaning of sec. 1 para. 2 n 5 (see above), its capital shall not be less than 50.000,00. where the payment institution provides other payment services (i.e. payment services according to sec. 1 para. 2 n 1 to 4; see above 1. a) aa) n 1 to 4), its capital shall not be less than 125.000,00. These requirements correspond to those set out in art. 6 PSD. bb. Own funds Payment institutions must hold, at all times, a reasonable amount of own funds. The German Financial Supervisory Authority ( BaFin ) shall take necessary measures to prevent the multiple use of elements eligible for own funds where the Page 9 of 15

payment institution belongs to the same group as another payment institution, credit institution, investment firm, asset management company or insurance undertaking. This shall also apply where a payment institution has a hybrid character and carries out other activities other than providing payment services. Holding of a reasonable amount of own funds According to sec. 12 para. 1 ZAG a payment institution must in the interest of proper fulfilment of its obligations under the ZAG hold a reasonable amount of own funds. The definition of what is deemed to be a reasonable amount of own funds shall be subject to an ordinance of the Federal Ministry of Finance in consultation with Deutsche Bundesbank (Federal Bank of Germany), i.e. the Payment Institutions Own Funds Ordinance ( Zahlungsinstituts - Eigenkapitalverordnung (ZIEV) ). The draft ordinance states that the amount of own funds held by a payment institution is considered as reasonable if it is calculated in accordance with one of the three methods set out in art. 8 PSD. Sec. 3 para. 1 of the ZIEV provides that, in a first step, the payment institution itself shall choose one of the three methods as set out in art. 8 PSD to calculate its own funds. From the outset, this constitutes an advantage for a payment institution, as it thus has a right of first choice which is not mandatory under the provisions of art. 8 PSD. Only in a second step, BaFin as the competent financial supervisory authority can force the payment institution to use another calculation method in case the method chosen does not properly reflect the payment institution s business risks. Sec. 7 of the ZIEV implements art. 8 n 3 PSD. The provision stipulates that, on the one hand, based on evaluation of the risk-management processes of the payment institution, BaFin may require the payment institution to hold an amount of own funds which is up to 20 % higher than the amount which would result from the application of the method chosen by the payment institution. On the other hand, BaFin may also permit the payment institution to hold an amount of own funds which is up to 20 % lower than the amount which would result from the application of the method chosen by the payment institution. Special requirements for payment institutions that are included in the consolidated supervision of the parent credit institution In accordance with art. 7 n 3 PSD, sec. 12 para. 3 ZAG stipulates that BaFin may waive to apply the aforementioned provisions regarding the payment institution s own funds to payment institutions included in the consolidated supervision of the Page 10 of 15

parent credit institution pursuant to sec. 2a para. 1 to 5 KWG (German Banking Act). d. Safeguarding requirements A payment institution is required to safeguard funds which have been received from the payment service user or through another payment service provider for the execution of payment transactions as follows: either: they shall not be commingled at any time with the funds of any natural or legal person other than the payment service user on whose behalf the funds are held and, where they are still held by the payment institution and not yet delivered to the payee or transferred to another payment service provider by the end of the business day when the funds have been received, they shall be o deposited in an open escrow account in a credit institution or o invested in secure, liquid low-risk assets, as defined by BaFin as the competent German supervisory authority and or: they shall be segregated from the other assets of the payment institution in such way as to make sure that, in the event of insolvency of the payment institution, they are insulated in the interest of the payment service user against the claims of other creditors of the payment institution they shall be covered by an insurance policy or some other comparable guarantee from an insurance company or a credit institution, which does not belong to the same group as the payment institution itself, for an amount equivalent to that which would have been segregated in the absence of the insurance policy or other comparable guarantee, payable in the event that the payment institution is unable to meet its financial obligations. With regard to these safeguarding requirements, it is irrelevant if a payment account is kept for the payment service user by the payment institution or not. Page 11 of 15

e. Access to payment services According to art. 28 PSD, the Member States shall ensure that the rules on access of authorised or registered payment service providers to payment systems shall be objective, non-discriminatory and proportionate and that those rules do not inhibit access more than is necessary to safeguard against specific risks such as settlement risk, operational risk and to protect the financial and operational stability of the payment system. The German transposition of art. 28 PSD in sec. 7 ZAG, however, gives reason to criticism in some respects. Whereas art. 28 PSD stipulates that, in order to prevent restraints of competition, payment systems must not impose on payment service providers any discriminating or restrictive rules, the provisions under sec. 7 para. 3 ZAG bring about a contrarian effect: The payment service provider applying for access shall provide evidence (to the payment system provider as well as all participants in the payment system!) that it provides sufficient precautions as set out by the payment system provider s objective entry requirements to safeguard against risks for the financial and operational stability of the payment system related to its participation in the payment system. In contrast to the European legislator s objectives, this involves significant restraints of competition. The aforementioned stipulations might result in a discrimination against payment institutions vis-à-vis credit institutions that are already allowed to accede to certain payment systems on grounds of an association membership of the Central Loan Committee ( Zentraler Kreditausschuss / ZKA ). In addition to that, the German legislator waived an efficient supervision of competitive access requirements by the Federal Cartel Office ( Bundeskartellamt ). f. Use of agents, branches or entities to which activities are outsourced Sec. 20 ZAG stipulates a duty to inform BaFin and Deutsche Bundesbank (Federal Bank of Germany) where a payment institution intends to outsource operational functions of payment services. Outsourcing of important operational functions may not be undertaken in such way as to materially impair the quality of the payment institution s internal control Page 12 of 15

and the ability of the competent authorities to monitor the payment institution s compliance with its obligations. Thus, a payment institution has to comply with the following conditions when outsourcing important operational functions (see sec. 20 para. 1 ZAG): particularly, it has to be ensured that a reasonable and efficient risk management system which also includes those operational functions that are outsourced is established; furthermore, the outsourcing shall not result in the delegation by senior management of its responsibilities; the conditions with which the payment institution has to comply in order to be authorised and remain so shall not be undermined; The Payment Institution s responsibility for compliance with ZAG provisions remains unaffected; the insourcer s duties and the rights of the outsourcing Payment Institution shall be set out in a written agreement securing that the above stated requirements are met. g. Transitional provision/grandfathering aa. bb. Credit institutions being in possession of a banking licence for the giro business (according to sec. 32 para. 1, sec. 1 para. 1 sentence 2 n 9 KWG in the version valid at the time the ZAG comes into force) on October 31, 2008 are deemed to have a licence according to sec. 8 ZAG for all payment services from the time the ZAG comes into force. Entities with a licence under sec. 32 KWG (German Banking Act) that either have been providing money remittance services according to sec. 1 para. 1a sentence 2 n 6 KWG in the version valid at the time the ZAG comes into force or have been conducting credit card business according to sec. 1 para. 1a sentence 2 n 8 KWG in the version valid at the time the ZAG comes into force before December 25, 2007, may continue their activities without a licence until April 30, 2011. The KWG provisions will partly remain applicable to those entities. The Working-Group of the competent authorities in the EU Member States which are in charge of fostering the implementation process have agreed with regard to art. 88 of the PSD that the notification date mentioned in art. 88 para. 2 PSD should be the December 25, 2009 Page 13 of 15

instead of December 25, 2007. This typo should be corrected by the EU- Counsel. Consequently, it can be expected that the relevant due date shall be December 25, 2009 instead of 2007 in this paragraph of the grandfathering clause. cc. Payment services provided before December 25, 2007 without violation of the licensing requirements under sec. 32 KWG may be continued without an authorisation under the ZAG until April 30, 2011 (sec. 35 para. 3 ZAG). Anti-money laundering provisions, including those stipulated by the ZAG, will be applicable to these entities as well, however. In this context, a precise understanding of which payment services have been provided prior to the due date is required, as the transitional provision exclusively applies to those payment services. We assume that the catalogue of payment services as set out in sec. 1 para. 2 ZAG will serve as a standard for this question. E.g., a payment institution that has been executing payment transactions through execution of direct debits, credit transfers and/or payment transactions through a payment card or a similar device will only be permitted to continue its services without a licence until April 30, 2011, if these services have already been performed prior to December 25, 2007. It must be stressed, however, that those entities, which shall fall for the first time under a payment services regulation and which have been legally providing their commercial services so far yet with no regulation should also benefit from a grandfathering clause if those services are legally provided prior to November 1, 2009. Yet, the Working Group of the European implementation authorities has not solved this problem equally to regulated financial services providers according to art. 88 para. 2 PSD (see above). dd. ee. Entities using an EU-passport according to sec. 53b KWG will be allowed to continue to provide such payment services without an authorisation under sec. 8 ZAG on condition that these activities have been announced to the competent supervisory authority of the Home State before December 25, 2007. According to information from the EU Working Group, even those entities will need to announce these activities to the competent supervisory authority prior to December 25, 2009, as art. 88 para. 2 PSD is now understood as a typo by the Working Group (see above). Regarding sec. 27 ZAG which applies to branches of entities located outside the EU, in contrast, no grandfathering rule applies. Page 14 of 15

ff. The right of access to payment systems (sec. 7 ZAG) will remain unaffected by these transitional provisions. GSK, 30 December 2008 contact Banking team Munich for payment issues: Dr. Markus Escher escher@gsk.de Dr. Oliver Glueck glueck@gsk.de Daniela Eschenlohr eschenlohr@gsk.de +49 (89) 28 81 74 31 +49 (89) 28 81 74 0 GSK s Banking team provides legal advice for national and international financial services providers, both for regulated and unregulated products and services and is focussed on regulatory matters, contractual issues and business conditions for financial services as well as M&A transactions targeting at financial services providers. Page 15 of 15