Regulatory Archives | PAYMENT.TECHNOLOGY.LAW.

5 minute read

The WpI MaRisk is final: What will apply to investment firms in future

byDr. Jörg Streißle,Nadja Reiß
26. August 2026

BaFin has published the final version of the WpI MaRisk. From 1 January 2027, new requirements for the business organisation and risk management of small and medium-sized investment firms will apply. We explain what affected firms should now prepare for.

PPayment

4 minute read

Am I a credit intermediary under section 34k GewO?

byNiklas Olschewski
25. August 2026

From 20 November 2026, new rules will apply to the intermediation of consumer credit in Germany. Retailers will therefore need to determine whether they qualify as credit intermediaries under section 34k GewO and require authorisation. This article explains when BNPL, instalment payments and other financing solutions may constitute regulated credit intermediation.

FFinTech

5 minute read

The PFOF ban comes into force: What the new BaFin supervisory statement means for brokers and neobrokers

byNiklas Olschewski
24. July 2026

Since 1 July 2026, the ban on Payment for Order Flow (“PFOF”) has also been in force for purely domestic business relationships in Germany. On 22 July 2026, BaFin published a supervisory statement on this matter, in which it sets out in concrete terms for the first time which business models it considers to be compliant with the rules - and which are not.

RRegulatory

6 minute read

FIU Annual Report 2025 – Key Developments at a Glance

bySebastian Glaab,Christopher Gretsch,Tianqiao Pan
23. July 2026

Germany's FIU recorded a historic number of suspicious activity reports in 2025, while the number of analytical reports declined significantly. Alongside new regulatory requirements and a stronger international focus, neobanks have emerged as a key pillar of reporting activity. This article analyses the most important developments and highlights the questions that remain unanswered in the annual report.

BBanking

EuGH schafft Klarheit: Nicht jede Weiterleitung von Geldern Dritter ist ein Zahlungsdienst im Sinne der PSD2 ECJ Clarifies the Scope of PSD2: Not Every Transfer of Third-Party Funds Constitutes a Payment Service

3 minute read

ECJ Clarifies the Scope of PSD2: Not Every Transfer of Third-Party Funds Constitutes a Payment Service

byPeter Frey
23. July 2026

The ECJ has further clarified the distinction between payment services and other business models. The judgment confirms that merely receiving and forwarding third-party funds does not automatically trigger licensing requirements under PSD2. The decision provides greater legal certainty for FinTechs, platform operators and other businesses handling payment flows, while emphasising that the specific business model remains decisive.

RRegulatory

2 minute read

Turbo Certificates on a Leash

byDr. Jörg Streißle
16. June 2026

On 16 June 2026, BaFin’s general administrative order restricting the marketing, distribution and sale of turbo certificates enters into force. It establishes strict requirements for all distribution activities relating to turbo certificates directed at retail investors.

RRegulatory

5 minute read

Cybersecurity: The implementation of NIS2 in Luxembourg

byCharles Krier,Tancrede Montagne
10. June 2026

Luxembourg has implemented the NIS2 Directive, significantly expanding the scope of entities subject to cybersecurity obligations. With new requirements for governance, risk management and incident reporting, potentially affected organisations have until 10 July 2026 to fulfil their registration and notification obligations.

AAnti Money Laundering & Sanctions

AMLA konsultiert Leitlinien zur laufenden Überwachung von Geschäftsbeziehungen – Was auf Verpflichtete zukommt AMLA Consults on Guidelines for the Ongoing Monitoring of Business Relationships – What You Should Expect

5 minute read

AMLA Consults on Guidelines for the Ongoing Monitoring of Business Relationships – What You Should Expect

bySebastian Glaab,Ariane Lunderstedt
5. June 2026

Continuous monitoring is already one of the core obligations in anti-money laundering compliance today. However, the AMLR elevates this principle to a new level. Obliged entities must not only review individual transactions but continuously analyse and assess the entire business relationship throughout its lifecycle.

DData Protection

Datenschutz im Zahlungsverkehr – Rechtliche Grundlagen und Besonderheiten Data Protection in Payment Services – Legal Framework and Key Particularities

10 minute read

Data Protection in Payment Services – Legal Framework and Key Particularities

byNataša Adzic,Josefine Spengler,Svetlana Ulrici
21. May 2026

Data protection in payment services operates within the complex interplay of the GDPR, PSD2 and the German ZAG. A key challenge lies in the legal classification of payment data, as transaction data may reveal highly sensitive insights into individuals’ private lives. This article analyses the principal legal bases for data processing as well as the allocation of data protection responsibilities among payment service providers, PISPs and AISPs.

RRegulatory

Der Bafin-Jahresbericht 2025: Zwischen Cyber-Resilienz, Geldwäscheprävention und dem Blick nach Europa The BaFin Annual Report 2025: Between Cyber Resilience, Anti-Money Laundering and a European Perspective

5 minute read

The BaFin Annual Report 2025: Between Cyber Resilience, Anti-Money Laundering and a European Perspective

byRenate Prinz,Nadja Reiß
18. May 2026

The BaFin Annual Report 2025 highlights a profound transformation of financial supervision. Alongside cyber resilience, DORA and ESG regulation, data-driven supervision, anti-money laundering and stronger European harmonisation are moving centre stage. At the same time, requirements for governance, IT structures and management accountability are increasing significantly.

PPayment

Ist bei E-Geld ein Vertrag zwischen dem E-Geld-Herausgeber und der Akzeptanzstelle erforderlich? Is a contract between the e-money issuer and the merchant required for e-money?

9 minute read

Is a contract between the e-money issuer and the merchant required for e-money?

byDr. Hugo Godschalk
6. May 2026

This article examines the European Commission’s controversial interpretation of Article 11(7) EMD2 regarding the definition of electronic money. It focuses on whether a contractual relationship between the e-money issuer and the accepting merchant is required for electronic money acceptance. The article concludes that Article 11(7) EMD2 does not establish a general contractual requirement for the acceptance of e-money.

BBanking

CCD2 im Checkout: Was sich für BNPL und Rechnungskauf ändert | ALLES LEGAL #134 CCD2 in the Checkout: What Changes for BNPL and Purchase on Invoice | ALLES LEGAL #134

2 minute read

CCD2 in the Checkout: What Changes for BNPL and Purchase on Invoice | ALLES LEGAL #134

byDr. Florian Lörsch
29. April 2026

CCD2 tightens requirements for BNPL, purchase on invoice and instalment payments in the checkout. Even displaying these options may qualify as credit advertising and trigger additional obligations, including price disclosures, SECCI and credit checks. Overall, providers need to adjust processes across the entire customer journey.

BBanking

4 minute read

Governance under the 9th MaRisk Amendment

bySebastian Glaab,Sophie Eiles,Nadja Reiß
23. April 2026

Mit der 9. MaRisk-Novelle rückt das Thema Governance erneut in den Fokus der Aufsicht. Im Vordergrund steht jedoch keine grundlegende Neuregulierung, sondern eine gezielte Weiterentwicklung des bestehenden Rahmens. Die BaFin reduziert punktuell Detailtiefe und verlagert den Schwerpunkt auf Prinzipienorientierung, tatsächliche Wirksamkeit und institutsspezifische Ausgestaltung.

BBanking

2 minute read

CCD2 Implementation Finalised: New Rules for the Credit Industry in Germany | ALLES LEGAL #133

byDr. Florian Lörsch
22. April 2026

Germany has finally implemented the EU Consumer Credit Directive (CCD2), with several noteworthy adjustments. In this episode of “Alles Legal”, Dana Wondra speaks with Dr Florian Lörsch about the key differences between the final law and the original draft – and what companies need to do now.