Duty to Register; Authorisation to Issue Statutory Instruments

(1) A person who intends to provide, in Germany, on a commercial basis or on a scale requiring a commercially organised business undertaking, exclusively account information services as a payment service, requires only the written or electronic registration by BaFin. The registration application must contain the following particulars and evidence: 1. a description of the business model, from which the nature of the intended account information service in particular is apparent; 2. a business plan comprising a budget forecast for the first three financial years, demonstrating that the account information service provider has adequate and proportionate systems, resources and procedures to operate soundly; 3. a description of the governance arrangements and internal control mechanisms of the account information service, including administrative, risk-management and accounting procedures, demonstrating that these governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate; 4. a description of the procedures in place to monitor, handle and follow up security incidents and security-related customer complaints, including an incident-reporting mechanism which has regard to the account information service provider's reporting obligations under section 54; 5. a description of the process in place to file, monitor, track and restrict access to sensitive payment data; 6. a description of business continuity arrangements, including a clear statement of the relevant procedures, effective contingency plans, and a procedure for regularly reviewing the adequacy and effectiveness of such plans; 7. a description of the security policy, including a detailed risk assessment of the account information service provided and a description of the security control and mitigation measures taken to protect payment service users adequately against the risks identified, including fraud and the unlawful use of sensitive and personal data; 8. a description of the account information service's organisational structure, where applicable including a description of the intended establishment of branches and of the on-site and off-site checks that the account information service provider undertakes to carry out on them at least annually, together with a description of outsourcing arrangements and a description of the manner of its participation in a national or international payment system; 9. the names of managers, of the persons responsible for the management of the account information service provider, and, insofar as the undertaking pursues, in addition to the provision of the account information service, other business activities, of the persons responsible for the conduct of the account information service provider's payment services business; 10. the legal form and the articles of association or partnership agreement of the account information service; 11. the address of the head office or registered office of the account information service; 12. a description of the safeguarding of professional liability under section 36, including an explanation of the account information service's risk profile, of any provision of payment services other than the account information service or of the pursuit of business activities other than payment services business, of the number of customers using the account information service, and of the particular features of the professional indemnity insurance or other comparable guarantee. Together with the documents under the second sentence, nos. 3, 4 and 8, the account information service provider must submit a description of its audit arrangements and organisational arrangements for taking all reasonable measures to protect the interests of its customers and to ensure continuity and reliability in the account information service it provides. The description of the security policy under the second sentence, no. 7 must state how a high degree of technical security and data protection is ensured by those measures; this also applies to any software and IT systems used by the account information service provider or by the undertakings to which the account information service provider outsources all or part of its activities. The application must contain evidence that the persons named in the second sentence, no. 9, are reliable and have adequate theoretical and practical knowledge and experience for providing the account information service. The account information service provider must appoint at least two managers; for undertakings of small size, one manager is sufficient. BaFin may, in an individual case, require further particulars and evidence in relation to the information under the second to sixth sentences, insofar as this appears necessary for it to perform its statutory tasks.
(2) BaFin informs the applicant, within three months of receipt of the application or, where the application is incomplete, within three months of the submission of all the particulars necessary for the decision, whether the registration is granted or refused. Where, within twelve months of receipt of the application by BaFin, notwithstanding BaFin's request to complete the application within one month, sufficient particulars or documents enabling BaFin to decide on the application are still not available, the application must be refused.
(3) BaFin may grant the registration subject to conditions that must remain within the scope of the purpose pursued by this Act.
(4) The registration covers, beyond the provision of the account information service, only the provision of operational and closely related ancillary services; ancillary services are the services for ensuring data protection and data storage and processing.
(5) The account information service provider must notify BaFin without delay of every materially and structurally significant change in the factual or legal circumstances, insofar as it affects the accuracy of the particulars and evidence submitted under subsection (1).
(5a) BaFin must publish the registration in the Federal Gazette.
(6) Insofar as a registration under subsection (1) is required for providing account information services, entries may be made in public registers only once the registration has been proven to the registration court.
(7) The Federal Ministry of Finance is authorised to issue, by statutory instrument not requiring the consent of the Bundesrat, in agreement with the Deutsche Bundesbank, more detailed provisions on the type, scope and form of the application documents provided for under this provision. The Federal Ministry of Finance may transfer the authorisation, by statutory instrument, to BaFin, on condition that the statutory instrument is issued in agreement with the Deutsche Bundesbank. The leading associations of the institutions must be heard before the statutory instrument is issued. The Federal Office for Information Security must be heard insofar as the security of information technology systems is concerned.
(8) Subsections (1) to (6) also apply where, in the course of a conversion under section 305, section 320 or section 333 of the Conversion Act, a legal person carrying on business subject to registration under subsection (1) transfers its legal seat from abroad to Germany.