DE v13.3.0

Germany (DE) · Module Detail

Germany: Consumer Protection & APP Fraud

#

Germany enacted the Act implementing Directive (EU) 2023/2225 on consumer credit (BGBl. I 2026 Nr. 139, 18 May 2026); most provisions, including extension to BNPL, microcredit and interest-free financing, apply from 20 November 2026.

Horizon · 2026-H2 (± a year)PSR/PSD3 entry into force (spoofing-only APP reimbursement)Adopted · Tier 2 source
Horizon · 2026-11-20 (± a quarter)Consumer Credit Directive implementation act: main commencementAdopted · Tier 1 source
Standing sub-brief · as of 27 June 2026157 words · last cycle 2026-10-06

Consumer Protection & APP Fraud

German consumer protection rests on PSD2 (via ZAG and BGB §§675c ff.) and the UWG: unauthorised payments are refundable within one bank working day, and payer card liability is capped at EUR 50. APP/authorised-push-payment fraud has no general mandatory reimbursement regime, unlike the UK PSR model; the PSR/PSD3 deal concluded 27 November 2025 introduces only a narrow reimbursement duty limited to PSP-impersonation (spoofing) fraud, leaving most investment and pig-butchering scams outside mandatory reimbursement. The BGH 2024 ruling places the SCA burden of proof on the bank. The narrow spoofing-only scope leaves German PSPs with materially less APP-fraud liability than UK peers — a key cross-jurisdiction divergence for both bank and non-bank operators.

Periodic update · new data 2026-10-06

Consumer Protection & APP Fraud

Germany has enacted the Act implementing Directive (EU) 2023/2225, the recast EU Consumer Credit Directive, extending the scope of general consumer-credit law to forms of credit that have historically sat outside mainstream consumer-credit regulation: microcredit, interest-free financing and Buy-Now-Pay-Later models. The Act was adopted and published as BGBl. 2026 I Nr. 139 on 18 May 2026. Its commencement clause provides that the Act enters into force, subject to a paragraph 2 exception, on 20 November 2026, which is when most of its substantive provisions take effect.

The practical consequence for BNPL and microcredit providers active in the German market is that products which previously operated outside the general consumer-credit regime - precisely because they were structured as short-term, interest-free, or small-value credit - now fall within it. This is a scope extension rather than a wholesale rewrite of consumer-credit law: the existing general consumer-credit framework, with its established obligations around pre-contractual disclosure and creditworthiness assessment, is being applied to a wider set of credit products rather than a new, separate regime being built for BNPL specifically. Firms offering BNPL or microcredit to German consumers that have not previously treated themselves as subject to consumer-credit law will need to assess, ahead of 20 November 2026, whether their products now sit inside that scope.

Outlook

The operative date to track is 20 November 2026, when most provisions of the implementing Act become applicable. The paragraph 2 exceptions referenced in the commencement clause were not detailed in the material reviewed and should be treated as a residual area requiring separate confirmation before that date. No supervisory enforcement record yet exists under the extended scope, since the regime has not yet reached its main commencement date.

1 earlier update recorded under a different module label

An early cycle filed this entry under this module code with a heading naming another subject. Kept for the record; not this module's latest position.

Periodic update · new data 2026-07-08

Digital Assets, Stablecoins & CBDC

No material signal was identified for Germany under W10 (Digital Assets, Stablecoins and CBDC) this cycle. The MiCA framework continues to govern stablecoin and crypto-asset service provider activity in Germany, but no DE-specific W10 development was resolved this cycle.

Outlook

This module will be updated when DE-specific digital-assets, stablecoin, or CBDC regulatory material is available.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and findings (4)
  1. T1https://www.bundesbank.de/en/tasks/payment-systems/psd2/psd2-775954retrieved
  2. T3https://www.biocatch.com/blog/psd3-proposal-fraud-risk-controlsretrieved
  3. T2EU PSR/PSD3 proposal — impersonation-fraud reimbursement; EP trilogue
  4. T3https://efri.io/phishing-in-germany-what-upper-courts-say/retrieved