This country-specific Q&A provides an overview to Fintech law in Germany.
It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.
This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech/
What are the sources of payments law in your jurisdiction?
In Germany payment services are regulated in the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – “ZAG”), wherein the European Payment Services Directive II was transposed into national law. In addition to the ZAG an-ti-money laundering and data protection regulation are also to be complied with.
Can payment services be provided by non-banks, and if so on what conditions?
Yes, payment services can be provided by non-banks. It is not mandatory to ob-tain a banking license to provide payment services under German supervisory law. However, to offer payment services a license according to the ZAG is nec-essary for most businesses. It should be noted that the license application process is strictly regulated and entails considerable effort to comply with the legal re-quirements. The costs of a license range from EUR 5,000.00 to EUR 12,000.00 depending on which and how many kinds of payment services the license is sup-posed to cover. When providing a payment service, the institution has to be care-ful not to accept funds from others as deposits or other unconditionally repaya-ble funds from the public, because this is a deposit business and requires a li-cense according to the German Banking Act (Kreditwesengesetz - “KWG”).
What are the most popular payment methods and payment instruments in your jurisdiction?
Although there are already quite a few of payment services provided by FinTechs in Germany, Germans still like to pay in cash rather than electronically. A breakthrough with regard to cashless payment has not been achieved yet.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
The data management or analytic and research services are mainly supportive services to enable the banking industry to cope with their business and the grow-ing regulation. As such it is widely made use of. For providing data and risk management or analytic and research services there is no authorization require-ment in general, as long as it is just an ancillary service in order to provide bank-ing and business services.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The European General Data Protection Regulation (“GDPR”), which came into force this year and which especially regulates the collection, the storage, the modification and the transfer of personal data, has forced the financial services industry to put more attention to their handling of data, as non-compliance with the GDPR can lead to severe fines.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
The German supervisory authority is relatively restrained with regard to any kind of special regulatory standards for FinTechs by international comparison. Major simplifications different to the standard licensing or market entry process such as sandboxes are not part of the German regulation and are not planned for the foreseeable future.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
The FinTech market encompasses a large range of different services such as payment services, crowdinvesting services, bitcoin exchange services and many more. For any of these areas there are specific risks, which could hinder the es-tablishment of a flourishing business model, but for FinTechs in general the per-spective is promising.
What tax incentives exist in your jurisdiction to encourage fintech investment?
There are no specified tax incentives for FinTechs.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Data on investment trends are currently not readily available. With regard to the number of users, payment services are still the most used FinTech services in 2018, but InsurTech services are catching up and supposed to have the largest number of users in 2019 (https://de.statista.com/outlook/295/137/fintech/deutschland#market-revenue).
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
A FinTech entrepreneur should begin his operations in Germany for two reasons. First, once the business model is set, it can be exactly determined which require-ments have to be fulfilled and which duties have to be applied with, in order provide the envisioned FinTech service. Second, Germany is part of the Europe-an Union. Once the FinTech service is established in Germany, it is easy to ex-pand the service into the whole European market.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
In general there are no quotas systems on immigration. Citizens of a Member State of the European Union can enter Germany without a visa. This also applies for citizens from Australia, Israel, Japan, Canada, New Zealand, South Korea and United States. Citizens of those countries can work in Germany if they have a job offer and the Federal Agency of Employment (Bundesagentur für Arbeit) agreed to this (§ 41 I AufenthV). It is just necessary to apply for a residence permit with-in three months after the entry into Germany and before commencement of work.
If foreigners from other countries of origin wish to work in Germany, they re-quire a visa as a matter of principle. They need to apply for a visa in person from the German representation abroad in the territory of which you live whilst still in your home country. The fee for a visa is generally 60 Euro per person. The rep-resentations abroad need an average of between two and ten working days to de-cide on a visa application for a short stay of up to three months. If someone would like to apply for a visa for a longer stay, the processing may take several months.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
The immigration policy is hardly influenced by the FinTech industry in general. Im-migration policy in Germany is focused mainly on dealing with asylum seekers. Re-lated to this subject some changes in regulation are under discussion, also with re-gard to some facilitations to asylum seekers who are qualified for the labour market and already found a new employment.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
In Germany the law on intellectual property can be divided into three categories.
First, there is the copyright, which is conferred to the creator by completing the creation of his work. It protects intellectual creativity (e.g. source code of a soft-ware) and is not transferable as such. Only rights of use can be granted to third parties. The copyright is regulated by the German Copyright Act (Urheber-rechtsgesetz).
Second, there are rights, which come into existence through registration (Register-rechte). An example is trademarks, which are regulated by the German Trade-mark Act (Markengesetz). For trademarks the principle ‚first come first served‘ regarding the protection of trademarks is applied in general. A registered trade-mark protects the owner of the right against the identical or very similar use of it by a competitor. A trademark is often registered for a name and a brand logo.
Third, there are barely protectable rights, like the Know-How of a company.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
In Germany a bitcoin is deemed to be a financial instrument, which is regulated according to the German Banking Act (Kreditwesengesetz – “KWG”). With regard to banking business and financial services anti-money laundering and data protection regulation are also to be complied with. Whether a license is needed in this context depends on the business model. According to the leaflet on virtual currencies (VC) by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – “BaFin”) the following applies in general: (i) Just using VCs as a substitute for cash or deposit money to participate in ex-change transactions as part of the economic cycle does not require authorization; (ii) Those FinTechs that are buying and selling VCs commercially in their own name for the account of others carry out principal broking services which are subject to authorisation; (iii) Providers that act as "currency exchanges" offering to exchange legal tenders against VCs or VCs against legal tenders carry out trad-ing for own account and are subject to authorization, when VCs are not only mined, purchased or sold in order to participate in an existing market, but when a special contribution is made to create or maintain that market. Due to the addi-tional service element, this then constitutes trading for own account that requires authorization, too.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
ICO’s are not a subject of a special legislative regulation. The general banking supervision laws as well as anti-money laundering provisions have to be taken in-to consideration in order to conduct an ICO. The relevant legal provisions depend on how the ICO is structured and which legal nature the token has. BaFin assess-es on a case based approach whether a token constitutes a financial instrument within the meaning of the German Securities Trading Act (Wertpapierhan-delsgesetz - “WpHG”) or the Markets in Financial Instruments Directive (MiFID II), a security within the meaning of the German Securities Prospectus Act (Wertpapierprospektgesetz - “WpPG”) or a capital investment within the mean-ing of the German Capital Investment Act (Vermögensanlagegesetz – “Ver-mAnlG”). The classification of a token as a security or a financial instrument de-termines which of the relevant capital markets laws and EU regulations apply.
Regulatory outlook: BaFin issued an official consumer warning at the end of 2017 regarding the purchase of coins or tokens within the scope of ICO’s be-cause of their highly speculative character and total loss risk. Since then the mar-ket developments are under the watch of the BaFin, especially with a focus on possible future regulation following the principles of consumer protection and equal standards for equal businesses cases. As for now, we don’t see any change on regulatory standards with regard to ICOs in the next 12-24 months.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
There are many small projects in Germany using the blockchain technology. An interesting project is the establishment of a Clearing service by the German Bourse (Deutsche Börse) based on the blockchain technology.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
More and more companies are aware of the advantageous use of artificial intelli-gence and are already partially using the technology like Chatbots for first level customer services or for fraud detection in case of falsified damage declarations to insurers. Another use of AI is robo-advisory. A robo-advice is usually catego-rized as investment advice subject to an authorization requirement in Germany if the customers, on the basis of the details they provide, receive investment sug-gestions relating to specific financial instruments. If the customer, based on the data they provided, receives a suggestion on the structuring of their portfolio which lists different asset classes or industries, given in percentages, without naming any specific financial instruments, the robo-advisor is generally not providing investment advice subject to an authorisation requirement in Germany. However, whether or not an authorisation requirement applies depends very much on the individual case.
At this time there is no indication for any kind of regulatory impediment to the further use of AI. Furthermore, it is noteworthy that the BaFin has started a study on the use of Big Data and artificial intelligence, the facts and findings of which you can find here:
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
InsurTechs are getting more and more popular in Germany. The political and so-cial climate is positive as customers are getting more and more familiar with technology based offerings and the convenience of it. A famous InsurTech is clark: https://www.clark.de/de/start4
Are there any areas of fintech that are particularly strong in your jurisdiction?
Data on this matter are not readily available.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
Whether a FinTech aims for a more collaborative or a more disruptive approach depends on its business strategy. It turns out, that not the most disruptive, but the most cost-effective strategy is oftentimes the way to go. In this regard the busi-ness model of FinTechs depends on collaboration with established financial insti-tutions, when the regulatory framework forces them to avoid the oftentimes strenuous license and application process and to rather cooperate with a fronting bank, in order to save money and profit of the bank’s knowhow.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
There is no general answer to this question and can only be assessed on a bank by bank basis. The largest German Bank Deutsche Bank has focused its re-sources with regard to FinTech on Digital Banking, in order to provide all its ser-vices digitally. Furthermore Deutsche Bank just recently bought 10 % of the FinTech ModoPayments, a digital payment service provider. The second largest German bank Commerzbank founds, invests und cooperates with FinTechs through its subsidiary the “main incubator”.
Are there any strong examples of disruption through fintech in your jurisdiction?
A real disruption has not yet happened.