BaFin has published a general ruling on 7 September 2020, pursuant to which credit institutions are obliged to submit every virtual IBAN they have supplied directly or indirectly to a payment service provider to the data base pursuant Sec. 24c German Banking Act („KWG“), whereby the end customer of the payment service provider is deemed to have power of attorney over the account or to be an ultimate beneficiary owner.
Table of Contents
What’s this about? What is the data base pursuant to Sec. 24c KWG?
Credit institutions in Germany are obliged pursuant to Sec. 24 KWG to keep a current data base of accounts and depots in Germany allowing for an automated access by BaFin and other governmental bodies. The data base contains inter alia the account number, names, birth dates of the account owners, any persons with power of attorney over the account, and any ultimate beneficial owners. By making investigations easier, the data base serves to combat terrorism financing and anti-money laundering as well as the detection of illegal banking or financial services.
What are virtual IBAN?
Virtual IBAN look like real IBAN (i.e. International Bank Account Numbers) but there is not an account connected with each of them, but the number serves only to allocated payments. Usually, there is one “real” account, to which many virtual IBAN are connected. Like many different telephone numbers for one phone.
Virtual IBAN are offered by many credit institutes in Germany because they provide solutions for a variety of payment issues.
A few examples:
Example 1: automated booking of incoming payments
A company has many customers who are being invoiced for services. Instead of having to rely on the customers to submit the correct description when making payments to correctly allocate the incoming payment to the invoice, each customer is provided with a virtual IBAN on the invoice. When the customer makes the payment to „his“ virtual IBAN, the company is able to automatically book the incoming payment.
Many payment service providers use this system as well. For instance, a payment service provider may offer a payment upon invoice product to e-commerce merchants whereby end customers may pay upon invoice for goods and services and the merchant sells and assigns its purchase price claim against the customer to the payment service provider or financial service provider (factoring). The virtual IBAN is printed on the customer’s invoice and thus enables the payment service provider to automatically allocate the payment to the assigned claim.
Example 2: acceptance of payments in Germany for foreign merchants
Many e-commerce platforms request that foreign merchants provide them with a local payment account with an IBAN to make pay-outs for sales made via the platform. It is often more than difficult for smaller merchants from foreign countries to open a bank account in the EU. For this purpose, some payment service providers offer these merchants a money transfer service for which each merchant is provided with a virtual IBAN. The payment service provider receives the monies for the merchant and then transfers it for instance to a bank in the home country of the merchant where the pay-out is then made to the merchant in local currency.
Example 3: payment institutes offering SEPA account functionalities
There are payment service providers or e-money institutes that want to offer their customers in addition to their own services the possibility to make SEPA credit transfers and direct debits. While payment service providers and e-money institutes may offer payment accounts to their customers but not the deposit taking business, they are generally (in Germany) not direct participants of the SEPA scheme. To offer this service, the institutes offer virtual IBAN to their customers, which have been provided to them by a credit institute. The master account behind these virtual IBAN is an account in the name of the payment service provider who offers its end customers the possibility to submit payment orders for their IBAN via App or web portal.
What’s BaFin’s proposed general ruling all about?
The general ruling holds that all virtual IBAN are deemed to be accounts within the meaning of Sec. 154 German Fiscal Code („AO“) and that credit institutions are obliged to submit these to the data base pursuant to Sec. 24c KWG. In particular, end customers, i.e. the customers of the payment service provider are deemed to be person with power of attorney over the account or ultimate beneficial owners.
It turns out to be highly problematic that the general ruling does not distinguish between the different business models that virtual IBAN are used for. The general ruling simply states as a fact that all virtual IBAN are accounts within the meaning of Sec. 154 AO.
However, example No 1 shows that this may not hold true. Pursuant to Sec. 154 AO it is required that the account is held for a third person. The examples for automated booking of incoming payments show, though, that the virtual IBAN is not an account for the end customer, i.e. the payer but for the payment institute itself as the payee. To put it bluntly: only because I have shared my account number with someone to get paid, they do not have power of attorney over my account nor are they beneficial owners of the funds.
It is even more absurd in the typical factoring situations because only the end customers of payment institutes would be submitted to the data base but not those of financial service institutes. Accordingly, whether an end customer would end up in the data base would depend on which type of license the institute has chosen for the factoring business.
Example No. 2 raises some doubts as well. In the case at hand, the merchant would be submitted to the data base as having power of attorney over the account or as beneficial owner. However, the merchant may not have power of attorney over the „real“ account that is behind the virtual IBAN because it is likely that this is an escrow account set up by the payment institute to comply with the safeguarding requirements pursuant to Sec. 17 ZAG. It will not be possible that the merchant is granted any power of attorney over the customer funds and the merchant is not using a power of attorney either. In contrast, the merchant gives a payment order to the payment institute to remit the money to the merchant’s home country.
It is also very questionable whether the merchant can be deemed a beneficial owner because pursuant to Sec. 3 German Anti Money Laundering Act(“GwG”) this may only be a natural person. However, the general ruling provides that only the end customer, i.e. the merchant, shall be submitted to the data base which is unlikely to be a natural person but rather a company.
This has the effect that a company becomes the beneficial owner, which by the legal definition is not possible. Thus, credit institutions are asked to provide data in a way that is not compliant with the law.
Example No. 3 may be viewed a bit differently, though. The end customers in this case does have some power to over its funds kept at the payment institute at least indirectly and thus one may argue that the end customer does have some power of attorney via the virtual IBAN.
In short:
It should be clarified that
- not all virtual IBAN are accounts within the meaning of Sec. 154 AO and should only be submitted to the data base pursuant to Sec. 24c KWG if they meet the requirements of Sec. 154 AO;
- end customers should only be submitted to Sec. 24c KWG data base if they truly have power of attorney or meet the requirements of a beneficial owner and not only because they use a virtual IBAN.
The consultation period regarding the proposed general ruling runs until 2 October 2020. Thus, there is still some time for those affected by the ruling to make their voices heard. Hopefully, BaFin will clarify the general ruling in its final version.
PayTechLaw will report on the outcome.
Cover picture: Copyright © Adobe Stock / Argus
