Proper business organisation for ZAG institutions

The BaFin's requirements for proper business organisation pursuant to Section 25a (1) KWG, which are relevant for credit and financial services institutions, have now been specified in the 7th amendment to the Minimum Requirements for Risk Management (MaRisk) of 29 June 2023. BaFin has now published the Minimum Requirements for Risk Management of Payment and Electronic Money Institutions (ZAG-MaRisk) in Circular 01/2024 (BA) on 27 May 2024. BaFin expects the requirements to be implemented by 1 January 2025.

With the final version of the circular, the supervisory authority has finally clarified its understanding of proper business organisation in accordance with Section 27 (1) ZAG. The ZAG-MaRisk addresses 

• domestic payment and e-money institutions,
• domestic branches of companies based outside the European Union or the European Economic Area and
• branches of German institutions abroad that provide payment services or e-money transactions for their customers.

Although the circular provides this group of addressees with a flexible and practical framework for structuring their proper business organisation, it also formulates very extensive requirements within this framework, on the basis of which those affected must critically review their existing procedures. In addition, the circular specifies requirements for the secure receipt of funds (Sections 17 and 18 ZAG) and outsourcing (Section 26 ZAG). Compared to the draft of 27 September 2023, the final version contains only minor changes that either emphasise the objective of a regulation more strongly or accommodate the interests of ZAG institutions with less complex business models.

The structure of the ZAG MaRisk is strikingly modelled on the MaRisk for credit and financial services institutions. The requirements for the overall responsibility of the management, the organisational guidelines and documentation as well as the adjustment processes and outsourcing management of ZAG institutions largely correspond to the banking standard from MaRisk. This significantly raises the bar compared to before.

Similar to MaRisk for credit institutions and financial services institutions, ZAG-MaRisk provides for the fundamental principle of double proportionality. The integration of opening clauses enables a simplified implementation of the requirements, depending on the complexity of the business activities and the specific risk situation.

In this way, the ZAG-MaRisk ensures that payment and e-money institutions can implement the requirements in a customised manner while at the same time complying with the regulatory requirements. However, experience has shown that the exercise of discretionary powers must be justified to the supervisory authority on the basis of the institution's own business and risk profile.

As expected, the circular contains both clarifications of existing administrative practice and innovations. If they have not already done so, ZAG institutions should plan their implementation promptly and have implemented the requirements by the end of 2024.

We support you and your institution in the customised implementation of the new regulatory requirements. This begins with understanding the individual requirements for your institution. We contribute our expertise from credit institutions and financial services institutions as well as ZAG-specific market standards.

We support you in the deviation analysis to be carried out as well as in the joint implementation of the resulting measures to fulfil the relevant requirements. In doing so, we always take into account the principle of double proportionality and the specific circumstances of your institution.