The “ZAG” Minefield: Why Payment Service Provider Licenses in Germany are the Hardest to Acquire and How to Prepare

For international fintechs, the German ZAG licence is not merely a compliance hurdle — it is an operational stress test that many firms fail long before they formally submit an application. Understanding why is the single most valuable piece of preparation a founder can undertake.

The Zahlungsdiensteaufsichtsgesetz (ZAG) — Germany's implementation of the EU Payment Services Directives — has earned a reputation as one of the most rigorous payment supervision regimes in Europe. While EU directives aim for harmonisation in principle, national implementations differ significantly in practice, and Germany's Federal Financial Supervisory Authority (BaFin) applies standards that frequently go well beyond the minimum EU baseline. The result is a regulatory environment in which a payment institution licence obtained in another EU member state cannot be assumed to pass muster in Germany without substantial reinforcement.

This article walks through the ZAG regime in the depth a serious applicant requires: its history and scope, its licence categories and capital requirements, the fit-and-proper expectations for management, the safeguarding and outsourcing rules, the IT governance framework, the interaction with anti-money laundering law, the realistic application timeline, the common pitfalls, and the strategic alternatives for founders who determine that a full ZAG licence is not yet the right choice. The objective is to equip founders with a clear-eyed understanding of what the ZAG perimeter actually looks like — and what it takes to cross it successfully.

A Short History: From PSD1 to the Current Regime

The original ZAG was enacted in 2009 as Germany's implementation of the First Payment Services Directive (PSD1, Directive 2007/64/EC). It established the category of payment institution, introduced the licensing and supervisory framework for non-bank payment service providers, and defined the activities that would henceforth require BaFin authorisation. A substantial revision followed in 2018 to transpose the Second Payment Services Directive (PSD2, Directive (EU) 2015/2366), which broadened the scope of regulated activity to include payment initiation services (PIS) and account information services (AIS), imposed strong customer authentication requirements, and established open banking obligations on account-servicing payment service providers.

The ZAG has since been supplemented by an expanding body of secondary rules, BaFin guidance notes, circulars, and European-level technical standards. A founder approaching the German payment services regime today is not engaging with a single statute but with a layered framework in which national law, EU regulations, BaFin supervisory circulars, and industry practice all interact. Getting this layering right is one of the most common preparation failures among international applicants. The next reform is under way: on 27 November 2025 Parliament and Council reached a political agreement on a third Payment Services Directive (PSD3) and a Payment Services Regulation (PSR); they have not yet been formally adopted (as of October 2026).

The Regulated Perimeter: What the ZAG Covers

Section 1 of the ZAG defines payment services by reference to a list of activities that can only be carried out commercially with BaFin authorisation. These include the placing of cash on a payment account and related cash-deposit and cash-withdrawal operations, the execution of payment transactions (including direct debits, card-based transactions, and credit transfers), the issuing of payment instruments such as cards, the acquiring of payment transactions on behalf of merchants, money remittance, payment initiation services (PIS), and account information services (AIS). A firm that provides account information services as its only payment service does not need a licence, however, but a registration with BaFin under Section 34 of the ZAG; no initial capital is prescribed for it, but cover for liability is (Section 36 of the ZAG).

The ZAG also regulates the issuance of electronic money as a separate activity conducted by electronic money institutions (EMIs). Although an EMI licence is in a formal sense a distinct category, it is applied for and supervised under the same ZAG framework as the payment institution licence, and many of the substantive requirements are shared.

A founder's first task when approaching the ZAG is to determine, with precision, whether the intended business model falls within one or more of these regulated activities. Germany does not operate a general exemption for small-volume payment services, and the perimeter is applied strictly. Business models that appear to be mere IT services may, on closer analysis, involve the execution of payment transactions and therefore require a licence. Models that combine payment services with other offerings (such as lending, card issuing, or data services) frequently trigger multiple regulatory frameworks simultaneously.

The ZAG contains a number of exemptions and exclusions that can in principle remove certain activities from the licensing requirement. These include activities carried out exclusively as an agent for goods or services, certain closed-loop payment instruments accepted only at defined merchants, and technical service providers that support payment services without themselves holding client funds or acquiring a position in the payment transaction. Each exemption has narrow boundaries, and founders should not assume that their business model fits within one without a documented legal analysis. Reliance on an exemption that BaFin subsequently rejects is among the most costly mistakes a fintech can make in Germany.

A further complication arises where the ZAG perimeter interacts with other German financial services legislation. The Banking Act (Kreditwesengesetz, KWG) regulates deposit-taking and credit business, with a minimum capital requirement of EUR 5,000,000 for a full credit institution licence. The Securities Institutions Act (Wertpapierinstitutsgesetz, WpIG), enacted in 2021, governs firms providing investment services and sets its own initial capital, which depends on the service applied for (Section 17 WpIG): EUR 75,000 for investment broking, contract broking, portfolio management, investment advice or placement without access to client money or client securities, EUR 750,000 among others for dealing on own account and custody business, and EUR 150,000 in the remaining cases. Business models that touch payment services, lending, and investment services simultaneously must be scoped against all three statutes, and the regulatory strategy should reflect the full set of authorisations required rather than only the ZAG dimension.

Licence Categories and Capital Requirements under ZAG §12

Section 12 of the ZAG sets out the initial capital requirements for different categories of payment service. The structure is deliberately scaled to reflect the risk profile of each activity:

• Money remittance only: Initial capital of EUR 20,000.
• Payment initiation services (PIS) only: Initial capital of EUR 50,000.
• Other payment services under Section 1(1) sentence 2 nos. 1 to 5 of the ZAG: Initial capital of EUR 125,000.
• Electronic money institutions (EMIs): Initial capital of EUR 350,000.

These figures represent the statutory minima, not realistic operating budgets. In practice, BaFin expects applicants to demonstrate that their initial capital, together with their planned ongoing funding, is sufficient to sustain the business through authorisation, build-out, and initial operations without requiring emergency capital injections. Applicants who arrive at the statutory minimum without a credible cushion are frequently asked to demonstrate additional financial backing before authorisation proceeds.

Beyond initial capital, licensed institutions must maintain ongoing own funds calculated in accordance with the ZAG and the underlying EU requirements. The calculation methodology depends on the specific activity and, for EMIs, on the average outstanding electronic money. Founders should model these ongoing requirements carefully as part of their business planning — both the statutory minimum under the ZAG and the additional buffers that BaFin effectively expects from credible licence holders.

The Fit-and-Proper Test for Managing Directors

BaFin's fit-and-proper expectations for managing directors (Geschäftsleiter) of payment institutions are anchored in the ZAG and in the authority's supervisory practice. The central requirement is that the applicant appoints at least two managing directors (Section 10(2) of the ZAG lets a single one suffice only for undertakings of small size), that they possess the professional qualifications and personal reliability required for the role, and that they dedicate sufficient time to the management of the institution. These expectations are not perfunctory: BaFin reviews the professional histories on the basis of the documents submitted, asks follow-up questions, may invite proposed managing directors to a meeting, and forms a substantive judgement about their suitability.

In practice, the expectation crystallises around three qualities that founders must evidence:

• Relevant experience: Candidates must demonstrate a track record in payment services, financial services, or directly relevant regulatory compliance. General technology or commercial backgrounds, however distinguished, are insufficient on their own. BaFin looks for concrete evidence of exposure to payment services operations, compliance frameworks, and supervisory engagement.
• Availability and presence: Managing directors must dedicate sufficient time to the institution and must be genuinely present in Germany. Arrangements in which a director commutes from another jurisdiction and attends board meetings remotely are viewed with significant scepticism. BaFin expects substantial physical presence in Germany consistent with the institution’s decision-making centre being in Germany.
• German language capability: Although the ability to conduct supervisory business in German is not codified as a formal statutory requirement, in practice BaFin expects effective communication in German, particularly in areas where regulatory terminology is specialised. Candidates who are unable to engage with German regulatory material in German encounter practical friction.

The fit-and-proper assessment extends beyond the managing directors to include significant shareholders and, depending on structure, members of the supervisory board. A shareholder with a qualifying holding must also satisfy reliability criteria, and BaFin will decline to approve the entry of shareholders whose backgrounds raise prudential concerns.

Preparing the managing directors for follow-up questions and possible meetings with BaFin is a workstream of its own and often underestimated. Suitability is assessed first on the documents submitted (CV, declarations on criminal and other proceedings, certificate of good conduct, extract from the central trade register); BaFin may ask for further information and may invite the proposed managing directors to a meeting. A director who then cannot give concrete, coherent answers on the regulatory requirements, the business model, the risks and the planned controls raises doubts about his or her professional suitability. Preparation typically includes working through the ZAG provisions relevant to the business model, reviewing BaFin's guidance notes and rehearsing likely questions in advance.

Safeguarding of Client Funds

Section 17 of the ZAG imposes safeguarding obligations on payment institutions and EMIs that hold client funds. The statute permits two principal safeguarding methods: segregation of client funds in separate accounts at authorised credit institutions, or coverage of the funds through an insurance policy or guarantee from an authorised institution. The choice between these methods has significant operational and commercial implications, and founders should consider it carefully at the design stage of their licensing strategy.

Segregation is the more common approach. It requires that client funds be held in identifiable accounts separate from the institution’s own funds, such that in the event of insolvency, client assets can be distinguished from the estate. The mechanics of segregation — including how funds are routed into segregated accounts, how they are tracked, and how reconciliation is performed — must be documented to BaFin’s satisfaction. Sloppy segregation is a classic cause of supervisory concern, even where the institution is otherwise compliant.

Insurance-based safeguarding is permitted but carries its own operational burdens, including the need to obtain and maintain adequate coverage, to ensure that the coverage is genuinely available in insolvency scenarios, and to satisfy BaFin that the arrangement provides equivalent protection to segregation. In practice, insurance-based safeguarding is more common as a complement to segregation than as a full substitute.

The practical reality is that institutions must be able to demonstrate at any moment that the aggregate balance of safeguarded funds equals or exceeds the aggregate outstanding liability to payment service users. Reconciliation failures — however technical their cause — are treated by BaFin as potentially serious. Applicants should design their safeguarding operations with automated reconciliation, clear escalation procedures when discrepancies arise, and regular management reporting that confirms the integrity of the arrangement. The quality of this operational discipline is frequently probed during BaFin examinations.

The Anti-Money Laundering Framework

Payment institutions and EMIs are obliged entities under the German Anti-Money Laundering Act (Geldwäschegesetz, GwG), which transposes the EU Anti-Money Laundering Directives and will in due course interact with the new EU AML Regulation and the supervision of the EU Anti-Money Laundering Authority (AMLA) in Frankfurt. The GwG framework imposes a comprehensive set of obligations that BaFin assesses rigorously as part of the licensing process and in ongoing supervision.

Key GwG obligations include the following:

• Risk assessment (§5): The institution must conduct and document a comprehensive risk assessment covering the customer types, products, services, geographies, and delivery channels relevant to its business. This risk assessment is the foundational document for the entire AML framework and must be substantive, specific, and regularly updated.
• Money Laundering Reporting Officer (§7): The institution must appoint a Money Laundering Reporting Officer (Geldwäschebeauftragter) with clearly defined responsibilities, direct access to senior management, and adequate resources and authority to fulfil the role.
• Customer due diligence (§10): The institution must identify and verify customers, understand the nature of the business relationship, and conduct ongoing monitoring. The specific obligations vary depending on the customer type and risk profile.
• Enhanced due diligence (§15): Higher-risk customers and relationships — including politically exposed persons and customers in higher-risk geographies — require enhanced due diligence, including additional identification, verification, and ongoing scrutiny.
• Suspicious activity reporting (§43): The institution must file suspicious transaction reports with the German Financial Intelligence Unit (FIU) where there are indications of money laundering or terrorism financing.

An AML policy written for another member state's supervisor cannot be assumed to satisfy BaFin without rework. German AML supervision expects specific risk assessments, concrete transaction monitoring logic, and documented procedures that reflect the institution’s actual business model rather than generic templates. Automated transaction monitoring systems are effectively expected for any institution processing meaningful transaction volume.

The interaction with the EU Anti-Money Laundering Authority (AMLA) is a further dimension that forward-looking applicants should consider. AMLA, headquartered in Frankfurt am Main, began operations on 1 July 2025 and will assume direct supervision of certain high-risk and cross-border obliged entities from 2028 onwards. While the vast majority of ZAG-licensed institutions will continue to be supervised primarily by BaFin, institutions that grow to the scale and risk profile that attracts AMLA attention should design their AML frameworks with the future supervisory relationship in mind. Building a framework that only satisfies current BaFin expectations risks the need for material rework as AMLA becomes an additional supervisory counterpart.

Sanctions screening is a further practical area where German supervisors expect institutions to demonstrate operational readiness. The EU sanctions regime has expanded considerably in recent years, and BaFin expects payment institutions to have in place real-time screening against sanctions lists, documented procedures for responding to potential matches, and clear escalation paths when a transaction or customer relationship raises sanctions concerns. Manual screening processes are tolerated only for the smallest of institutions; any institution with meaningful transaction volume is expected to have automated screening integrated into its onboarding and payment processing workflows.

IT Governance: From ZAIT to DORA

IT governance is one of the most scrutinised areas in BaFin's supervision of payment institutions and EMIs. Since 17 January 2025 the reference point is the directly applicable DORA regulation (Regulation (EU) 2022/2554) with its technical standards; payment institutions and electronic money institutions are expressly listed there as financial entities (Article 2(1)(b) and (d)). Alongside it stand the organisational duties in Section 27 of the ZAG and the outsourcing rules in Section 26 of the ZAG.

Until then, payment and e-money institutions had their own BaFin circular, the supervisory requirements for IT in payment and e-money institutions (ZAIT, Circular 11/2021 (BA)). BaFin repealed the ZAIT, together with the VAIT for insurance undertakings and the KAIT for capital management companies, with effect from the end of 16 January 2025, to avoid double regulation next to DORA. The banking circular BAIT (Circular 10/2017 (BA)) is addressed to institutions under the German Banking Act (KWG), now applies only to those that do not yet have to apply DORA, and will be repealed in full at the end of 31 December 2026. An applicant that still aligns its documentation with the ZAIT or the BAIT is working with a rulebook that does not apply to payment and e-money institutions.

The practical consequence is that a payment institution applicant must design its IT governance framework directly against DORA and its technical standards. The substantive expectations include clear allocation of responsibility for IT strategy, documented information-security management, structured change management, rigorous outsourcing controls, incident management processes aligned with DORA, and operational resilience testing. BaFin will examine the design and the documentation of each of these elements during the licensing process and in subsequent supervision.

Information security management deserves specific attention. BaFin expects applicants to have designed their information security framework against recognised standards, with explicit coverage of access management, encryption of data at rest and in transit, network segmentation, endpoint protection, logging and monitoring, vulnerability management, and incident detection. The documentation must reflect the actual technology estate, not a templated description of an ideal-world architecture. Applicants who rely heavily on cloud infrastructure must be particularly rigorous in documenting how the shared-responsibility model works in practice and how the applicant retains control over security-critical configurations.

Business continuity and disaster recovery arrangements are also examined closely. Applicants must demonstrate that they have identified their critical business functions, defined recovery time objectives and recovery point objectives for each, and established arrangements — including backup infrastructure, alternative processing locations where appropriate, and documented recovery procedures — that can realistically meet those objectives. Business continuity plans that have never been tested in practice are treated with scepticism; BaFin expects evidence of exercises and lessons learned.

The Outsourcing Paradox

Fintechs often rely heavily on outsourcing to remain operationally lean. The ZAG does not prohibit outsourcing, but it treats outsourcing as a substantive risk that must be managed by the institution itself. The operative rule is simple: outsourcing does not transfer liability. The institution remains fully responsible to BaFin and to its customers for any function or activity it chooses to outsource, and it must have the ability to monitor, supervise, and if necessary unwind any outsourcing arrangement.

Section 26 of the ZAG and, where ICT services are concerned, DORA's rules on ICT third-party risk (Articles 28 to 30) require a structured outsourcing management framework. This includes a formal risk assessment for each outsourcing, a written contract containing minimum provisions on audit rights, service levels, data handling, sub-outsourcing, and exit arrangements, ongoing monitoring of the provider’s performance and solvency, and clear allocation of internal responsibility for managing the relationship. Cloud outsourcing to major hyperscalers is permitted but must satisfy these requirements, and BaFin examines the outsourcing arrangements of applicants with significant cloud dependencies in detail.

A common failure mode is the assumption that a standard vendor contract is sufficient to meet BaFin’s expectations. It is not. Contracts must be supplemented by active monitoring, periodic review, and documented escalation procedures. Founders should assume that every material outsourcing relationship will be examined by BaFin during the licensing process and that deficiencies will generate supplementary questions at best and application delays at worst.

The interplay between the ZAG outsourcing framework and DORA's requirements on ICT third-party risk management also deserves particular attention. Since 17 January 2025, payment institutions have had to comply with DORA's provisions on ICT third-party providers, which means keeping a register of information, using the mandatory contractual provisions and assessing concentration risk. BaFin expects applicants to show how their outsourcing and ICT third-party frameworks work together to satisfy both the ZAG outsourcing requirements and the DORA third-party obligations. A fragmented approach that treats these frameworks in isolation creates gaps that tend to surface in BaFin's supplementary questions.

The Application Process: From Pre-Filing to Authorisation

The licensing procedure is governed by Sections 10 to 12 of the ZAG (Section 10 for payment services, Section 11 for e-money business, Section 12 for the grounds for refusal) and follows a broadly predictable structure, although the details vary by licence category and by the complexity of the business model. The process begins with preparation and, ideally, pre-filing engagement with BaFin. It proceeds through formal application, supplementary questions (Nachforderungen), substantive review, and ultimately authorisation.

A complete application package typically includes the following:

• Business plan: A detailed document covering at least a three-year horizon, including operational strategy, financial projections, customer segments, transaction volumes, technology architecture, risk management, and governance.
• Organisational documentation: Organigrams, job descriptions, reporting lines, and internal policies covering all material functions.
• Fit-and-proper documentation: Complete dossiers for each managing director and significant shareholder, including CVs, professional references, regulatory disclosures, and supporting documentation.
• Risk management framework: A comprehensive description of the risk categories relevant to the business, the controls in place, the monitoring arrangements, and the reporting structure.
• IT governance documentation: Documentation of the information security framework, operational resilience measures, incident management procedures, and compliance with DORA.
• AML policies: The full suite of GwG-compliant documentation, including risk assessment, customer due diligence procedures, transaction monitoring logic, and suspicious activity reporting workflows.
• Outsourcing register and contracts: A complete register of material outsourcing arrangements together with the relevant contracts and control documentation.
• Safeguarding arrangements: Documentation of the safeguarding method, the accounts or insurance arrangements in place, and the operational controls ensuring client funds are protected.
• Audited or projected financials: Either audited financial statements (for existing entities) or credible financial projections supporting the capital adequacy of the applicant.

By statute, BaFin decides within three months of having the complete application (Section 10(3) of the ZAG). Most of the time passes before that point, because BaFin issues iterative sets of supplementary questions. A common rule of thumb for a well-prepared ZAG application is nine to fifteen months from initial submission to authorisation; this is an estimate, not an official figure. Slow applicant responses do not simply stretch the process: if sufficient documents are still missing twelve months after the application was received, despite BaFin's request to complete it, the application must be rejected, and the process starts again with a new application.

Founders should also understand that the active application timeline does not include the substantive preparation phase that precedes submission. A well-prepared applicant typically invests several months before submission in building out governance structures, drafting policies, establishing IT architecture, documenting outsourcing arrangements, and preparing fit-and-proper dossiers for managing directors. The total elapsed time from initial decision to pursue a ZAG licence to operational launch is therefore often two years or longer when all phases are accounted for. Budgeting and capital planning should reflect this reality, and founders who attempt to compress the timeline by rushing preparation typically produce inferior applications that take longer overall.

The “Complete Application” Standard and Supplementary Questions

BaFin applies a strict standard for what constitutes a complete application. The statutory three-month period for the decision only starts once the application is complete. This creates a strong incentive for applicants to submit applications that genuinely anticipate and answer the authority’s likely concerns, rather than submitting early and expecting to fill in gaps during the process.

Supplementary question sets (Nachforderungen) are a standard feature of every application. Even well-prepared submissions will receive some set of follow-up questions, and the authority expects these to be answered promptly, comprehensively, and in German. The quality of the applicant’s responses to Nachforderungen is itself an input to BaFin’s assessment: responsive, substantive, and well-evidenced responses accelerate the process, while evasive or superficial responses generate further questions and delay.

A dedicated internal log of Nachforderungen is a sensible tool. Every individual question from BaFin should be documented in a traceable way, assigned to an internal owner, given a deadline, and closed only when a substantive answer has been delivered. Applicants who manage this process with discipline avoid the contradictory answers and delays that arise when Nachforderungen are handled ad hoc and without coordination. BaFin notices when answers are contradictory or when different parts of the applicant's team provide different statements.

Alternatives to a Full ZAG Licence

For firms that determine a full ZAG licence is premature, several alternative structures can provide regulated market access while the business model is validated. These alternatives are not a substitute for an eventual licence in most cases, but they can provide a faster path to initial revenue and supervisory engagement.

The principal alternatives include the following:

• Agent arrangements (Sections 1(9) and 25 ZAG): An agent carries out payment services in the name of an authorised institution, and its acts are attributed to that institution. The agent does not need its own licence. The institution notifies the agent to BaFin and the Bundesbank and must ensure that the agent is reliable and professionally suitable; the agent may only start once it has been entered in the payment institutions register. This arrangement suits firms that want to distribute payment services without building their own licensed infrastructure.
• Banking-as-a-Service (BaaS) partnerships: BaaS providers offer licensed infrastructure to fintechs through commercial arrangements under which the BaaS provider holds the relevant authorisation and the fintech operates within its commercial wrapper. This is a common first step for early-stage firms, particularly those offering card products or digital wallets.
• Passporting from another EU member state: A firm licensed in another EU or EEA country can passport its payment services into Germany under the freedom to provide services or by establishing a branch. The ease and quality of passporting depends heavily on the sending-state supervisor and on the specific product; passporting does not insulate the firm from German conduct rules or AML expectations.

Each of these alternatives has trade-offs in terms of commercial control, margin capture, regulatory exposure, and long-term strategic fit. None is a permanent solution for a firm whose ambition is to build a substantial German presence, but each can provide a runway for initial market validation.

Post-Licence Obligations

Authorisation is the beginning, not the end, of the regulatory engagement. Licensed payment institutions and EMIs are subject to continuous supervisory obligations that include regular reporting to BaFin, ongoing compliance with own funds requirements, maintenance of the safeguarding arrangements, cooperation with BaFin examinations and audits, notification of material changes to the business, and ongoing AML supervision.

Founders should model the cost of ongoing compliance into their post-authorisation business plan. The cost is not trivial: regulatory reporting, internal audit, external audit, compliance staffing, and supervisory interaction collectively represent a material component of the operating budget for any licensed institution. Firms that approach authorisation as a one-off project and then under-resource ongoing compliance create supervisory risks that can lead to enforcement action in the most serious cases.

Ongoing supervisory dialogue is also a feature that founders should prepare for. BaFin conducts periodic supervisory meetings with supervised institutions, sends ad hoc information requests, and reserves the right to conduct on-site examinations. The quality of the institution's response to these interactions shapes the supervisory relationship over time. Institutions that communicate proactively about material issues, respond promptly to information requests, and self-report weaknesses before they become supervisory concerns tend to experience constructive supervision. Institutions that are defensive, evasive, or slow to engage face escalating supervisory attention that can eventually translate into enforcement action.

Common Pitfalls in ZAG Applications

Certain mistakes are regarded as typical of ZAG applications. Founders who recognise and avoid them materially improve their chances of a smooth process:

• Underestimating preparation time: Applications submitted before the internal governance, policies, and controls are genuinely in place generate extensive Nachforderungen and rework.
• Generic policies: AML policies, IT policies, and risk management documentation copied from templates or other jurisdictions rarely satisfy BaFin’s expectations for specificity to the applicant’s actual business.
• Weak fit-and-proper dossiers: CVs that do not clearly evidence payment services experience, or managing directors who cannot credibly commit to Germany, generate immediate supervisory concern.
• Insufficient capital buffer: Capital at the statutory minimum with no credible cushion raises prudential questions and invites requests for additional funding before authorisation.
• Unstructured outsourcing: Vendor relationships without formal risk assessment, contract review, and ongoing monitoring are a frequent source of Nachforderungen.
• Passive applicant posture: Founders who wait for BaFin to drive the process, rather than actively managing the application timeline and engagement, experience longer and more frustrating processes.

Practical Preparation Guidance

Serious preparation for a ZAG application begins months before the formal submission. Founders should expect to invest in several distinct workstreams in parallel: regulatory scoping to confirm the correct licence category, governance design to establish policies and controls that will withstand supervisory examination, IT architecture documentation that satisfies DORA requirements, AML framework construction rooted in a substantive risk assessment, fit-and-proper preparation for managing directors (including preparation for follow-up questions and possible meetings with the supervisor), capital and financial planning, and engagement with legal counsel for the formal interaction with BaFin.

The firms that navigate the ZAG process successfully are those that approach it as a substantive operational preparation exercise rather than a paperwork exercise. The authorisation that emerges from such a preparation carries genuine regulatory weight with German banks, enterprise clients, and institutional partners, and it forms the foundation for a durable licensed business.

Conclusion

The ZAG is demanding by design, and BaFin's supervisory standards exceed the EU baseline in ways that frequently surprise international applicants. But the demandingness is not capricious: it reflects a supervisory philosophy that prizes substance, documentation, and genuine operational capability over surface compliance. Firms that invest the time and effort to meet these expectations receive not only a licence, but a commercially valuable institutional credential in the German market. Aegiron Capital Group runs the preparation for the ZAG licensing procedure as a project for founders, alongside the German law firm you engage. The preparation is rigorous, but so is the reward.