Germany: Conduct, Safeguarding & Promotions

Conduct, Safeguarding & Financial Promotions

Germany's non-bank payment institutions safeguard client funds under ZAG section 17, which permits a segregated account at the Bundesbank or another EU central bank as a compliant safeguarding mechanism distinct from the commercial-bank segregation route available to bank-affiliated providers. PSD3 is expected to standardise and tighten EU-wide safeguarding requirements once transposed, narrowing the divergence between member states on acceptable safeguarding structures. However, the ECB has voiced scepticism about central-bank-held safeguarding accounts under the incoming framework, a tension that leaves open how Germany's existing Bundesbank-account option will sit alongside a harmonised PSD3 safeguarding standard. No German-specific conduct or promotions rule change was identified this cycle beyond this safeguarding question; the item remains a standing watch point pending PSD3 transposition detail.

Outlook

Safeguarding is the live conduct-side item to track as PSD3 transposition progresses. Firms relying on the ZAG section 17 central-bank-account route should watch for signals on whether that option survives harmonisation, particularly given the ECB's stated reservations about central-bank-held accounts under the incoming EU framework.

Conduct, Safeguarding & Financial Promotions

The German conduct environment this cycle is shaped by two distinct but reinforcing developments: an imminent hard deadline on payment-for-order-flow and a substantive expansion of PSP obligations under the incoming PSR framework. A third, dashboard-tier item — BaFin's consumer fraud warning — illustrates the active enforcement-vector environment in which these structural changes are landing.

PFOF Grandfathering Expiry: Germany's Compliance Cliff-Edge

Germany is the only EU member state that has continued to exercise the domestic PFOF grandfathering exemption under Article 39a(2) of MiFIR. The EU-wide ban on payment for order flow took effect in March 2024; every other member state is already operating under the prohibition. Germany's exemption — the last one standing across the EU — expires on 30 June 2026. At the time of this cycle's synthesis date of 7 July 2026, that deadline has passed. German brokers and investment firms that were dependent on PFOF revenue are now operating under the EU-wide ban without any domestic carve-out.

The conduct implications are material. PFOF arrangements — under which brokers receive payments from trading venues or market makers in exchange for routing client orders — have been a significant revenue component for German retail-facing investment platforms. The removal of the exemption does not merely eliminate a revenue stream; it requires affected firms to restructure their order-routing arrangements, their best-execution frameworks, and their client-disclosure obligations. The compliance cliff-edge character of this transition — a hard expiry date rather than a phased wind-down — means that firms that delayed restructuring face immediate exposure.

This is a non-bank-sector-dominant issue. The PFOF arrangements at issue are primarily operated by non-bank investment firms and broker-dealers rather than credit institutions, though the distinction between bank and non-bank actors in the German retail-investment platform space is not always clean, particularly for neobanks that offer both payment accounts and investment products.

PSR: Payee-Name Verification and APP-Fraud Reimbursement

The Payment Services Regulation introduces two conduct obligations of direct relevance to German PSPs. First, PSPs will be required to verify payee names against IBANs or unique identifiers for credit payments not already covered by the instant-payments rules. This extends verification-of-payee-style checks — already required for euro instant credit transfers under the Amended SEPA Regulation — to the broader credit-transfer universe. The practical effect is that the VoP infrastructure and operational processes that PSPs have built for instant payments will need to be extended to cover standard credit transfers as well.

Second, the PSR introduces expanded APP-fraud reimbursement obligations. PSPs will bear expanded liability for authorised push-payment fraud losses, building on the payee-name verification obligation as a fraud-prevention mechanism. The reimbursement framework under PSR is designed to create stronger incentives for PSPs to invest in fraud-detection and prevention, since the cost of reimbursement falls on the PSP where the verification obligation was not met or where the fraud was not flagged.

Both obligations apply to bank and non-bank PSPs. The bank versus non-bank distinction matters here primarily in terms of operational capacity: credit institutions typically have more developed fraud-detection infrastructure than smaller non-bank PIs and EMIs, meaning the compliance burden of the VoP extension and the reimbursement obligation may fall disproportionately on the non-bank sector in terms of implementation cost relative to scale.

BaFin Consumer Fraud Warning (Dashboard)

On 7 April 2026, BaFin issued a consumer warning against a fraudulent identity-fraud application circulating under the name 'FPM MIN' via WhatsApp groups. This is a dashboard-tier item — a discrete enforcement-vector signal rather than a rulemaking or supervisory-policy development. It is noted here because it illustrates the active fraud-vector environment in which PSD3's expanded APP-fraud reimbursement obligations will operate. The Telekommunikationsgesetz section 120 requires telecom providers to block or anonymise spoofed numbers used in such schemes, providing a parallel enforcement mechanism at the network layer.

Outlook

The PFOF deadline has passed; the immediate compliance question for affected German firms is now one of post-deadline posture rather than preparation. The PSR conduct obligations — VoP extension and APP-fraud reimbursement — will become operative upon PSD3/PSR transposition, with BaFin's anticipatory authorisation posture suggesting that the supervisory expectation is already moving ahead of the formal transposition date. The active fraud-vector environment reinforces the operational urgency of the APP-fraud reimbursement framework.