Knowledge Hub

The DACHGlossary.

Over 50 terms from regulation, payments, and market entry — explained concisely, sorted alphabetically, with deep-dive analyses from our Insights.

AI Act: The EU's AI Regulation (Regulation (EU) 2024/1689): the world's first horizontal legal framework for artificial intelligence, tiered by risk. Central for finance because credit scoring of natural persons and risk assessment/pricing in life and health insurance count as high-risk uses — with duties on data governance, human oversight, and documentation, applicable from 2 December 2027 following the Digital Omnibus.Deep DiveAI Act Countdown: What Applies When, Translated for Financial Firms The EU AI Act and Its Implications for DACH Financial Services
AMLA: The EU's new Anti-Money Laundering Authority, headquartered in Frankfurt am Main. From 2025/2026 it coordinates national AML supervision and harmonises methodologies; from 2028 it directly supervises a first cohort of high-risk, cross-border financial institutions.Deep DiveAMLA in Frankfurt: What the EU's New AML Authority Means for DACH Market Entrants
AMLR: The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624): for the first time a directly applicable, uniform AML rulebook for the whole Union — with harmonised due-diligence duties, a 25 percent beneficial-ownership threshold, and a €10,000 cash cap. Core obligations apply from 10 July 2027; national laws such as Germany's GwG recede in the harmonised areas.Deep DiveAMLA in Frankfurt: What the EU's New AML Authority Means for DACH Market Entrants AMLR 2027: What the EU's Single Anti-Money Laundering Rulebook Changes for Obliged Entities
APP Fraud (Authorised Push Payment Fraud): Fraud in which the victim initiates the payment personally — deceived by fake invoices, bank impersonation, or investment scams. Because the transaction is authorised, classic refund rules do not apply; verification of payee (since October 2025) and the planned PSR liability shift are the regulatory answers.Deep DiveAuthorised Push Payment Fraud: The DACH Playbook After Verification of Payee

BaFin: The Federal Financial Supervisory Authority — Germany's integrated supervisor for banks, insurers, investment firms, and payment providers, based in Bonn and Frankfurt. Known for demanding substance and documentation depth: passing BaFin authorisation is read across Europe as a quality signal.Deep DiveThe BaFin Paradox: Strict Regulation as Competitive Advantage
Beneficial Owner: The natural person ultimately controlling a company — under current AML law above 25 percent ownership or control, under the AMLR from July 2027 at 25 percent or more. Must be identified, verified, and recorded in the transparency register; the AMLR harmonises the definition and register duties Union-wide.Deep DiveAMLA in Frankfurt: What the EU's New AML Authority Means for DACH Market Entrants AMLR 2027: What the EU's Single Anti-Money Laundering Rulebook Changes for Obliged Entities
BNPL (Buy Now, Pay Later): Deferred payment at checkout — historically built outside consumer-credit regulation because short-term interest-free credit was exempt. The second Consumer Credit Directive (CCD2) closes that gap: from November 2026, creditworthiness checks, information duties, and withdrawal rights also apply to third-party-financed BNPL models.Deep DiveCCD2 and the End of the BNPL Grey Zone: What the New Consumer Credit Rules Mean for Fintechs

CASP: Crypto-Asset Service Provider — the licensed crypto services firm under MiCA. A CASP authorisation covers custody, trading, exchange, and further services and passports across the entire EU. Since late 2024 it replaces national crypto regimes, in Germany the former KWG crypto-custody licence.Deep DiveMiCA in Practice: Lessons From the First CASP Licensing Wave MiCA: The New Paradigm for Crypto-Asset Regulation in Europe
CCD2: The second EU Consumer Credit Directive (Directive (EU) 2023/2225). It replaces the 2008 directive, extends scope to BNPL and small loans, hardens the creditworthiness assessment into a genuine lending duty, and regulates advertising and automated decisions. Applies from 20 November 2026.Deep DiveCCD2 and the End of the BNPL Grey Zone: What the New Consumer Credit Rules Mean for Fintechs
CRR3 / Output Floor: The EU banking package implementing final Basel III, applicable since January 2025. Its centrepiece is the output floor: internal models may not push risk-weighted assets below 72.5 percent of the standardised approach — phased in toward the end of the decade. It adds new operational-risk rules and a transitional treatment for crypto exposures.Deep DiveCRR3 and the Final Basel Round: What the New Capital Rules Mean Beyond the Big Banks
CSRD: The EU's Corporate Sustainability Reporting Directive. Large listed companies already report under the ESRS standards; for the later waves, the 2025 stop-the-clock directive postponed the deadlines, and the Omnibus Directive (EU) 2026/470 limits reporting to undertakings with more than 1,000 employees and net turnover above €450 million. Its core concept is double materiality: sustainability's impact on the company and the company's impact on environment and society.Deep DiveCSRD After the Omnibus: What Actually Applies Now — and for Whom ESG Reporting Requirements for Fintech Companies in the DACH Region

Data Act: EU Regulation (EU) 2023/2854, applicable since September 2025. Central for software vendors because of its cloud-switching regime: SaaS, PaaS, and IaaS customers gain enforceable switching rights with maximum transition periods and exportable data formats; switching charges disappear for standard cases from January 2027.Deep DiveThe EU Data Act for SaaS: Cloud Switching Becomes a Customer Right Data Processing Agreements and US Transfers: How DACH Customers Negotiate — and Where the Data Privacy Framework Stands
Digital Euro: The Eurosystem's central bank digital currency project: distributed by banks and PSPs, with holding limits against deposit flight, offline capability, and free basic use. Issuance requires the EU legal framework (under negotiation between Parliament and Council since mid-2026) plus a separate Governing Council decision; the ECB plans a pilot from 2027 and a first issuance around 2029.Deep DiveThe Digital Euro: What a Central Bank Currency Would Actually Change in the DACH Region Tokenised Money: Deposit Tokens, Stablecoins, and the ECB's Pontes
DORA: The Digital Operational Resilience Act (Regulation (EU) 2022/2554), applicable since January 2025: the uniform ICT-risk rulebook for financial entities. Five pillars — risk management, incident reporting, resilience testing, third-party management (including registers of information and exit strategies), and information sharing. As lex specialis, DORA takes precedence over NIS2 for financial entities.Deep DiveDORA Is Here: What Financial Entities in the DACH Region Must Do Now Cloud and Outsourcing Under DORA: What DACH Supervisors Now Expect Selling SaaS to Banks: Passing DORA Vendor Due Diligence — From Article 30 Clauses to the Exit Plan

E-Invoicing (Germany): Germany's structured e-invoicing mandate for domestic B2B: since January 2025 every business must be able to receive e-invoices conforming to EN 16931; the issuing duty starts in 2027 (turnover above €800,000) and 2028 (everyone). A PDF is not an e-invoice — the common formats are XRechnung and ZUGFeRD.Deep DiveGermany's E-Invoicing Mandate: The Operational Detail That Hits Every Market Entrant on Day One
E-Money Institution (EMI): Licence category for issuing e-money — electronically stored monetary value accepted as payment by third parties. Supervised in Germany under the ZAG, passportable EU-wide. The coming PSD3/PSR framework merges the e-money regime into the payment-institution regime as one rulebook.Deep DiveThe EMI Licence: Your Gateway to European Payment Services from Germany PSD3 and the PSR: How the EU's Next Payments Framework Reshapes DACH Market Entry Stablecoins Under MiCA: E-Money Tokens, Issuer Duties, and the Payments Licence Question
eIDAS 2.0 / EUDI Wallet: The revised EU digital-identity regulation (Regulation (EU) 2024/1183). Every member state must offer a European Digital Identity Wallet by end-2026 — free for natural persons, certified, providing identification at assurance level high and qualified signatures that are in principle free of charge for natural persons. Regulated firms must accept the wallet at the user's request by the end of 2027 at the latest where strong user authentication is required.Deep DiveeIDAS 2.0 and the EUDI Wallet: The Beginning of the End for KYC as We Know It
eWpG (Electronic Securities Act): Germany's Electronic Securities Act (2021): abolished the paper-certificate requirement and established two forms — central-register securities and crypto securities on DLT registers. Operating a crypto securities register is a licensed financial service; the Future Financing Act extended the framework to registered shares.Deep DiveElectronic Securities in Germany: eWpG, Crypto Securities, and the Quiet Tokenisation of Capital Markets Tokenised Money: Deposit Tokens, Stablecoins, and the ECB's Pontes

FiDA: The EU's proposed Financial Data Access framework (open finance): data sharing beyond the payment account — savings, investments, insurance, pensions — organised through schemes with compensation and a new licence category (FISP). Politically contested; direction confirmed, timetable open.Deep DiveFrom Open Banking to Open Finance: What FiDA Would Change — and Why It Keeps Slipping
FINMA: Switzerland's Financial Market Supervisory Authority. Works principles-based and dialogue-oriented, with its own instruments such as the fintech licence and the 'Gewähr' concept of proper business conduct. Important: Switzerland sits outside EU passporting — market access is always a separate project.Deep DiveWhy Switzerland Remains a Premier Fintech Hub in Continental Europe
Fit & Proper: The supervisory suitability assessment for managing directors and board members: professional qualification (knowledge plus practical leadership experience), personal reliability, and sufficient time commitment. In Germany this includes the four-eyes principle — as a rule at least two managing directors with complementary profiles.Deep DiveFit and Proper: Building a Management Team That Survives the DACH Licensing Test
FMA (Austria): Austria's Financial Market Authority: integrated supervision of banks, insurers, investment firms, and payment providers. Considered pragmatic with short communication paths — making Vienna an attractive EU licensing venue with full passporting for some business models.Deep DiveFMA Austria: A Pragmatic Regulator in a Complex European Landscape
Four-Eyes Principle: The supervisory requirement that licensed institutions be run, as a rule, by at least two managing directors (for small payment and e-money institutions one can suffice) — as a control against unilateral decision-making. It is substantively satisfied only by complementary profiles, not by two identical CVs.Deep DiveFit and Proper: Building a Management Team That Survives the DACH Licensing Test
Future Financing Act: Germany's capital-markets modernisation act (in force since late 2023): substantially improved employee-participation taxation, electronic shares under the eWpG, a minimum market capitalisation for IPOs lowered to one million euros, and dual-class shares. The follow-up act, the Standortfördergesetz, was promulgated in February 2026.Deep DiveGermany's Future Financing Agenda: Stock Options, Electronic Shares, and the Startup Capital Question

Geschäftsleiter (Managing Director): The supervisory-law designated leaders of an institution, on whom the licence personally rests. They pass the fit-and-proper assessment, carry personal responsibility toward the supervisor, and must genuinely run the business — mind and management belong where the licence is.Deep DiveFit and Proper: Building a Management Team That Survives the DACH Licensing Test The BaFin Paradox: Strict Regulation as Competitive Advantage
girocard: The German banking industry's domestic debit scheme — roughly 100 million cards and dominant at the physical point of sale, with traditionally low merchant fees. After Maestro's retirement, new cards carry Debit Mastercard or Visa co-badges, bringing e-commerce capability and raising routing questions at the terminal.Deep Divegirocard vs. International Debit: The German Card Peculiarity Every Payments Entrant Underestimates
GwG (German AML Act): Germany's Anti-Money Laundering Act: obliges institutions and other covered entities to risk analysis, customer due diligence, suspicious-activity reports to the FIU, and internal safeguards. With the AMLR applying from July 2027, it recedes behind the EU rulebook in the harmonised areas.Deep DiveAMLA in Frankfurt: What the EU's New AML Authority Means for DACH Market Entrants The BaFin Paradox: Strict Regulation as Competitive Advantage AMLR 2027: What the EU's Single Anti-Money Laundering Rulebook Changes for Obliged Entities

Hausbank Principle: The structural principle of German public finance: promotional loans from KfW and the regional development banks are channelled through the company's commercial bank rather than granted directly. A local banking relationship is therefore a prerequisite for accessing much of public funding.Deep DiveThe DACH Public Funding Landscape: KfW, aws, Innosuisse — and How Entrants Actually Use It

Instant Payments: Euro credit transfers in seconds, around the clock — mandatory since the Instant Payments Regulation (EU) 2024/886: receiving since January 2025, sending since October 2025 for euro-area banks, with payment and e-money institutions following in April 2027. Pricing may not exceed standard transfers.Deep DiveThe Instant Payments Regulation: What Mandatory Real-Time Rails Mean for the DACH Market

KfW: Germany's development bank and one of the world's largest. Relevant to companies through founder and growth loans (via the house bank), equity programmes such as KfW Capital, and its role in the startup financing architecture up to the Future Fund.Deep DiveThe DACH Public Funding Landscape: KfW, aws, Innosuisse — and How Entrants Actually Use It
KWG (German Banking Act): The German Banking Act — the constitution of German banking supervision. It defines licensable banking business and financial services, sets requirements for managing directors and own funds, and together with EU law (CRR) forms the framework under which BaFin and the Bundesbank supervise institutions.Deep DiveThe BaFin Paradox: Strict Regulation as Competitive Advantage

MGA (Managing General Agent): Insurance structural model: the MGA designs products, underwrites risks, and manages portfolios under delegated authority from a licensed carrier — product control without carrier capital, at the price of dependency on capacity agreements. Supervisorily an outsourcing arrangement for which the carrier remains responsible.Deep DiveInsurTech in the DACH Region: Carrier, MGA, or Broker — the Structural Decision That Defines Everything
MiCA: The Markets in Crypto-Assets Regulation (EU) 2023/1114: the uniform EU framework for crypto-assets. Stablecoin regime since June 2024, CASP authorisation since December 2024 — with white-paper duties, a dedicated market-abuse regime, and EU-wide passporting. National transition periods ended by 1 July 2026 at the latest.Deep DiveMiCA: The New Paradigm for Crypto-Asset Regulation in Europe MiCA in Practice: Lessons From the First CASP Licensing Wave Stablecoins Under MiCA: E-Money Tokens, Issuer Duties, and the Payments Licence Question
Mittelstand: The often owner-managed small and mid-sized companies forming the backbone of the German economy. Distinctive as a B2B audience: risk-averse, quality- and stability-oriented, with long decision paths — but loyal and reference-strong once trust is established.Deep DiveThe Art of Enterprise Sales in Germany: A Strategic Guide The Cultural Gap That Kills DACH Deals

Nachforderung (Follow-up Request): The supervisor's follow-up request on a licence application — each round suspends the procedural clock and extends licensing by weeks to months in practice. The most effective countermeasure is an application file that is complete and consistent from the start.Deep DiveThe BaFin Paradox: Strict Regulation as Competitive Advantage
NIS2: The EU cybersecurity directive (EU) 2022/2555 for essential and important entities across 18 sectors: registration, risk measures, reporting duties (early warning within 24 hours), and management accountability. For financial entities DORA prevails as special law; SaaS vendors meet NIS2 directly or through their customers' supply chains.Deep DiveNIS2 or DORA? Sorting Out Which Cyber Regime Actually Applies to You Cyber Resilience Act: The Reporting Clock Starts on 11 September — What Software Vendors Must Do Now

Open Banking: Regulated third-party access to payment accounts, introduced by PSD2: account-information and payment-initiation services via bank interfaces. The coming PSR framework hardens the interface duties; FiDA would extend the logic to further financial data (open finance).Deep DiveOpen Banking in the DACH Region: Beyond PSD2 Compliance From Open Banking to Open Finance: What FiDA Would Change — and Why It Keeps Slipping
Ownership Control Procedure: The supervisory assessment when acquiring qualifying holdings in licensed institutions (from 10 percent of capital or voting rights): the authority examines the acquirer's reliability, financial soundness, and strategy before completion is permitted. The critical path in fintech M&A timelines.Deep DiveFintech M&A in the DACH Region: Where Deals Die, and How the Good Ones Are Built

Passporting: The EU's single-authorisation principle: a firm licensed in one member state can provide its services across the Union after notification — cross-border or via branches and agents. The passport covers the permission, but not local conduct rules, language, AML registrations, or tax. Switzerland sits outside.Deep DiveEU Passporting in Practice: From Notification to Operations
PFOF (Payment for Order Flow): Payments from market makers to brokers for routing client orders — the original neo-broker revenue model. Banned EU-wide by the MiFIR review (EU) 2024/791; Germany used the transitional option for domestic clients until 30 June 2026.Deep DiveThe PFOF Ban Arrives: How Neo-Brokers Rebuild Their Economics
PSD2: The second EU Payment Services Directive — the current framework for payment services: licensing duties, strong customer authentication (SCA), liability rules, and open-banking account access. Implemented in Germany through the ZAG; being replaced by the PSD3/PSR package.Deep DiveThe ZAG Minefield: Why Many Fintechs Fail German Licensing Open Banking in the DACH Region: Beyond PSD2 Compliance
PSD3 / PSR: The new EU payments package (political agreement in November 2025, endorsed by Parliament's economic committee in May 2026; formal adoption still pending): PSD3 as the directive for authorisation and supervision, the Payment Services Regulation as directly applicable conduct rules. Key points: merger of the e-money regime, hardened fraud and SCA rules, better open-banking enforcement, and non-bank access to payment systems. Under the agreed text both acts apply only 21 months after their entry into force, so the core obligations are not expected before the second half of 2028.Deep DivePSD3 and the PSR: How the EU's Next Payments Framework Reshapes DACH Market Entry

Regulatory Sandbox: A supervised testing framework for innovative business models with relaxed or staged requirements. The DACH picture is mixed: Austria has had a statutory regulatory sandbox at the FMA since 2020, Germany relies on dialogue formats rather than a formal sandbox, and Switzerland on its licence-free innovation space and the fintech licence.Deep DiveRegulatory Sandboxes in the DACH Region: Opportunities and Limitations
Reverse Solicitation: The narrow exemption for serving EU clients without EU authorisation where the client demonstrably requested the service on their own initiative. ESMA reads it strictly: any form of solicitation — advertising, apps, EU-directed websites — disqualifies. Unsuitable as a market-entry strategy.Deep DiveMiCA in Practice: Lessons From the First CASP Licensing Wave

Safeguarding: The duty of payment and e-money institutions to protect customer funds — via segregation on trust accounts with credit institutions or via insurance/guarantee. Customer funds are not working capital; the quality of the safeguarding concept is a core chapter of every licence application.Deep DiveThe EMI Licence: Your Gateway to European Payment Services from Germany PSD3 and the PSR: How the EU's Next Payments Framework Reshapes DACH Market Entry
Scheinselbstständigkeit (False Self-Employment): Misclassifying de-facto employees as freelancers — with retroactive social contributions, liability, and criminal exposure. The classic mistake of international startups in Germany; the status-determination procedure provides clarity upfront.Deep DiveBuilding a Team in the DACH Region: The Employment Basics That Surprise International Founders
SEPA Direct Debit: Pulling funds from the payer's account based on a mandate — Germany's default for recurring payments. SEPA Core gives consumers an eight-week unconditional refund right (13 months without a valid mandate); SEPA B2B excludes refunds between businesses but requires mandate verification by the debtor's bank.Deep DiveThe German Love of Direct Debit: SEPA Lastschrift as a SaaS Superpower — and Its Sharp Edges
Skonto (Cash Discount): The institutionalised German cash discount: a price reduction (classically 2–3 percent) for payment within a short window. A firm expectation in B2B that must be planned into pricing and payment-term strategy — sellers who don't know Skonto negotiate with a soft price.Deep DivePricing for the German B2B Market: Discounts, Skonto, and the Procurement Culture Nobody Warns You About
Solvency II: The EU supervisory regime for insurers: risk-based own funds, a governance system with key functions (risk, compliance, actuarial, audit), the own-risk assessment ORSA, and extensive reporting. The 2024 amendment recalibrates proportionality for smaller undertakings, among other changes.Deep DiveInsurTech in the DACH Region: Carrier, MGA, or Broker — the Structural Decision That Defines Everything

Verification of Payee (VoP): The mandatory IBAN-name check before executing a credit transfer: the payer is warned when the entered payee name does not match the account holder. Mandatory in the euro area since October 2025 — effective against invoice manipulation, supporting against impersonation fraud.Deep DiveThe Instant Payments Regulation: What Mandatory Real-Time Rails Mean for the DACH Market Authorised Push Payment Fraud: The DACH Playbook After Verification of Payee

Works Council (Betriebsrat): The elected employee representation in German workplaces — electable from five permanent employees entitled to vote, with genuine co-determination rights on working time and monitoring software and the right to be heard before every dismissal. For international employers a governance institution, not an adversary: plan for it early and you negotiate better.Deep DiveBuilding a Team in the DACH Region: The Employment Basics That Surprise International Founders The Works Council Has a Say: Why Software Rollouts in Germany Stall — and How Vendors Prepare
WpIG (Investment Firm Act): Germany's Investment Firm Act: since 2021 the dedicated supervisory regime for investment firms outside the KWG — with capital, governance, and remuneration requirements scaled by size and risk, based on the EU investment-firms package (IFR/IFD).Deep DiveThe WpIG Framework: Navigating Securities Institution Regulation in Germany

XRechnung / ZUGFeRD: The two common German e-invoicing formats under EN 16931: XRechnung as pure structured XML (the public-sector standard), ZUGFeRD as a hybrid of human-readable PDF with embedded XML — the pragmatic favourite for B2B rollouts.Deep DiveGermany's E-Invoicing Mandate: The Operational Detail That Hits Every Market Entrant on Day One

ZAG (Payment Services Supervision Act): The Payment Services Supervision Act — Germany's implementation of PSD2 and the E-Money Directive: defines licensable payment services and governs safeguarding, agents, and ongoing duties of payment and e-money institutions under BaFin supervision.Deep DiveThe ZAG Minefield: Why Many Fintechs Fail German Licensing

Missing a term? Need it applied?

The glossary provides orientation — applying it to your business model takes a conversation.

Schedule a Consultation