On 29 November 2017, BaFin issued a new guidance notice on the new Payment Services Supervisory Act (“ZAG”) that transposes PSD2 into German national law (PayTechLaw reported on the BaFin guidance notice). One of the trickiest questions in PSD2 is the distinction between a Technical Service Provider and Payment Initiation Service Providers. While questions remain, the guidance notice goes into quite some detail on this issue. Here’s an overview of what the new guidance notice has to say:
Who qualifies as a Technical Service Provider?
You have to meet the following three conditions:
- Render purely technical services, such as the processing and storing of data, services for privacy protection, the provision of IT and communication infrastructure. This may include the transmission of payment transaction data to the extent that this does not reach the threshold of becoming a Payment Initiation Service. This would be the case where a provider is able to access a payment account by means of the personal payment credentials of a payment service user.
- Do not enter into the possession of funds. This is not only to be understood as having the funds on an account owned by the Technical Service Provider. Rather, it is also the case where a Technical Service Provider has the power to dispose of the funds, e.g. where it is granted the power to control an account, even if only for a short moment. In essence, the Technical Service Provider may not have access or control over the funds at all.
- Don’t qualify as a Payment Initiation Service or Account Information Service Provider. Key for both of these services is that they have access to a payment account. Where a payment may be initiated with the help of a third party but this party does not have access to the account, it does not qualify as a Payment Initiation Service.
Who qualifies as a Payment Initiation Service?
A Payment Initiation Service
- transmits a payment order or initiates a payment order. Interestingly, the law and the legislative notes use different descriptions. However, key is that a payment order is transmitted or initiated. Where only transaction details or authorization requests are transmitted, this does not necessarily amount to a payment order.
- in relation to a payment account held at another payment service provider, and there needs to be a payment account, which excludes, for instance, shadow accounts, custody accounts, or pure savings accounts.
- has access to the payment account. Where a provider does not have access to the payment account from which the payment is initiated, it does not qualify as a Payment Initiation Service. BaFin provides as an example the electronic cash/girocard system. The network operator receives the personal credentials of the payment service user who puts the card into the terminal and types in the PIN. The network operator transmits this information. However, the payment transaction is not effected by accessing the online bank account of the payer in this system and thus the network operator is not deemed to be a Payment Initiation Service.
Further, the initiation of the payment transaction needs to be made from the account of the payer. This latter criterion is a bit surprising but BaFin does not deem ELV (electronic direct debits) to be a Payment Initiation Service. The argument is that ELV is a payment transaction that is not initiated by the payer (who only grants a mandate) but only by the payee who submits the direct debit mandate (with the help of a Technical Service Provider) to his payment service provider. It remains to be seen whether this excludes all pull transactions from the scope of payment initiation.
Comparison: Payment Initiation Service or Technical Service Provider
For the ones with only very little time, here’s a cheat sheet to distinguish the two:
