Limits of PSD2: Is the ECJ paving the way for an ancillary services exemption?

Key Takeaways:

1. Regulation as a payment service provider under PSD2 is not justified where funds transfers are carried out solely for the purpose of providing another service that does not fall within the scope of PSD2.
2. That said, the judgment does not establish a broad and generally applicable ancillary services exemption. The decisive factor continues to be the specific design and operation of the business model in each individual case.
3. It remains to be seen to what extent BaFin will reflect this development in its administrative practice.

Background

If an activity qualifies as a payment service, authorisation under the German Payment Services Oversight Act (Zahlungsdiensteaufsichtsgesetz, ZAG) may be required. In cases where such authorisation is required, the affected businesses become subject to a regulatory regime comparable in many respects to banking supervision. Compliance with these requirements may entail significant financial and organisational burdens. Conversely, businesses that fail to recognise an existing authorisation requirement and provide payment services without the necessary authorisation expose themselves to regulatory enforcement measures and, in certain circumstances, even criminal liability.

The ZAG implements the European Union's second Payment Services Directive (PSD2) in Germany. When interpreting the ZAG, the German Federal Financial Supervisory Authority (BaFin), as the competent national supervisory authority, is therefore bound by the rulings of the ECJ concerning PSD2.

While BaFin generally excludes the receipt and transfer of funds by members of the liberal professions like notaries or lawyers acting within the scope of their professional activities from the scope of the ZAG, it has expressly rejected the existence of a general ancillary services exemption in its published guidance on the ZAG. As a result, business models in which the transfer of funds merely constitutes a secondary and ancillary element may nevertheless be classified by BaFin as regulated payment services requiring authorisation, even though their primary focus lies within the real economy rather than the financial sector.

The ECJ's Decision

In its judgment of 16 July 2026 regarding Betaal Garant (C-51/25), the ECJ examined a security arrangement used in connection with works contracts.

Under a tripartite agreement concluded with the parties to a works contract, the Dutch company Betaal Garant Nederland CV provides security for construction projects as an alternative to depositing the relevant amount with a civil law notary.

To implement this security arrangement, the customer pays the agreed amount into a payment account held by a foundation affiliated with Betaal Garant. Following proper completion and acceptance of the construction project, and subject to the customer's consent, the funds are transferred from that account to the contractor.

The Dutch Central Bank (De Nederlandsche Bank, DNB) considered this business model to constitute the provision of a regulated payment service requiring authorisation. According to DNB, the receipt of customer funds and their subsequent transfer to contractors amounted to the execution of credit transfers and therefore to the provision of payment services. On that basis, DNB ordered Betaal Garant to cease offering these security arrangements and imposed periodic penalty payments. Betaal Garant challenged that order before the national courts, resulting in a request for a preliminary ruling to the ECJ. The Court ultimately held that the receipt and forwarding of funds carried out by Betaal Garant did not constitute a payment service and, more specifically, did not qualify as credit transfers within the meaning of PSD2.

The Court's analysis began with an interpretation based on the wording of Articles 4(8) and 4(24) PSD2. According to the ECJ, the execution of a credit transfer presupposes that the payment service provider holds the payer's payment account. Neither Betaal Garant nor the affiliated foundation, however, held payment accounts in the name of customers. Instead, the relevant payment transactions and credit transfers were executed by the participants' respective banks. The Court therefore concluded that the defining characteristics of a payment service in the form of the execution of credit transfers, namely the existence of a payment account in the payer's name and the holding of that account by the payment service provider, were absent.

From the perspective of future legal developments, however, the Court's contextual considerations may prove even more significant. Referring to recital 24 PSD2, the ECJ emphasised that the Directive's stringent regulatory framework is intended to apply only to service providers that provide payment services as a regular occupation or business activity. The classification of a transaction as a payment service carries substantial legal consequences, since the rules governing authorisation, supervision, own funds requirements and civil liability form a comprehensive regulatory regime characterised by demanding compliance obligations. The rationale for such regulation lies, in particular, in the payment service provider's direct involvement in the transfer of funds.

By contrast, the ECJ noted that this rationale is lacking where the transfer of funds merely serves the provision of another service offered as the primary service, which itself falls outside the scope of PSD2 and relies only incidentally on payment services provided by third parties.

Nor, in the Court's view, can the objective of ensuring a high level of consumer protection under PSD2 justify a broader interpretation. The ECJ emphasised that consumer protection must be balanced against the Directive's other objectives, including legal certainty and the uniform application of the regulatory framework throughout the European Union. Extending the scope of PSD2 beyond its wording in the name of consumer protection would undermine legal certainty. The Court further pointed out that the service provided by Betaal Garant constituted a form of personal security serving as an alternative to the service of depositing a security deposit with a notary, an activity that is neither defined nor regulated by PSD2.

Scope of the Decision

The ECJ's judgment provides an important basis for interpreting the German ZAG through a functional assessment of the business model concerned. In doing so, it may lay the groundwork for the development of a general ancillary services exemption. To the extent that the Court addressed the application of PSD2 to activities that merely play an ancillary role, its reasoning was not limited to specific categories of payment services but concerned payment services generally.

Against this background, classifying comparable activities as money remittance is also likely to present considerable difficulties, even though the ECJ, unlike the Advocate General, did not expressly address that issue. In his Opinion of 26 February 2026, the Advocate General argued that money remittance is characterised by the immediate and unconditional transfer of money to the payee. According to that analysis, Betaal Garant's model lacked such automaticity because the customer could prevent the transfer by withholding consent if the property had not been completed to the customer's satisfaction.

The Advocate General further noted that an activity can only qualify as money remittance where it is not merely ancillary to or instrumental in the provision of another service, in this case the security arrangement itself. An express statement by the ECJ on this issue would have been welcome, particularly because German administrative practice tends to regard money remittance, which covers the transfer of funds received from a payer to a payee by the payment service provider, as a residual category capable of capturing activities not falling within other payment service classifications. Nevertheless, the Court was not required to address the issue, as the referring court's question was confined to credit transfers.

The ECJ also refrained from establishing specific criteria by which supervisory authorities are to determine whether the transfer of funds constitutes merely an ancillary service in relation to the underlying primary service. In this regard, the Advocate General emphasised that the strict requirements imposed by PSD2 only make sense if they are applied to professional payment service providers and become disproportionate when extended to providers of other services that conduct money transfers merely as an ancillary component of their principal business activity.

Accordingly, despite its obligation to interpret the ZAG in conformity with EU law, BaFin retains a considerable degree of discretion in applying the judgment. When developing appropriate criteria, however, the authority should be guided by the question whether a business assumes an independent payment function that creates, in a market-relevant manner, user protection, safeguarding, security or competition risks of the kind that PSD2 is specifically intended to address.

Practical implications

Businesses operating outside the traditional financial sector may wish to revisit existing business models that have historically been treated as requiring authorisation out of regulatory caution and assess whether that classification remains appropriate in light of the judgment.

Even after the ECJ's decision, however, the assessment will continue to depend on the specific design and operation of the individual business model.

The judgment may have an impact, in particular, on the regulatory treatment of escrow and security structures, claims administration models, franchise networks and platform-based business models. It may also provide new arguments for intra-group cash management systems, which BaFin has previously regarded as subject to authorisation requirements where payments involve third parties outside the group.

Outlook

Whether this judgment will ultimately lead to the emergence of a distinct and firmly established ancillary services exemption remains uncertain. Nevertheless, in Betaal Garant, the ECJ indicated that such an exemption may be available where transfers of funds are made only in order to carry out another primary service.

For that reason in particular, BaFin will now need to consider how this ruling should be reflected in its guidance on the ZAG.

At the same time, it should be borne in mind that the European regulatory framework for payment services is currently undergoing substantial reform. On 28 June 2023, the European Commission published legislative proposals for a Payment Services Regulation (PSR) and a Third Payment Services Directive (PSD3). According to the current legislative timetable, adoption of the final texts is expected in the near future. The PSR is expected to become applicable 18 months after its publication in the Official Journal of the European Union, which would suggest application during the first half of 2028.

The forthcoming reform of the payment services framework may also provide an opportunity for the European legislature to address, and clarify, the questions raised by the ECJ regarding the distinction between regulated payment services and ancillary services.