Payment Services Act 2018 (ZaDiG 2018)

All English translation of the authentic German text is unofficial and serves merely information purposes. The official wording in German can be found in the Austrian Federal Law Gazette (Bundesgesetzblatt; BGBl.). All translations have been prepared with great care, but linguistic compromises had to be made. The reader should also bear in mind that some provisions of these laws will remain unclear without certain background knowledge of the Austrian legal and political system. Please note that these laws may be amended in the future and check occasionally for updates. Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) Full Title: Federal Act on the Provision of Payment Services 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) Original Version: published in Federal Law Gazette I 17/2018 Amendments: (in Federal Law Gazette I unless stated otherwise): 37/2018; 39/2020; 201/2021; 36/2022, 33/2023, 112/2024, 5/2026. Note about this translation: this consolidated version reflects the version of the Federal Act up to including the amendment published in Federal Law Gazette I 5/2026 as of the date below. Date: 01.03.2026

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 2 / 102 TABLE OF CONTENTS Chapter 1: General provisions Section 1: Scope and definitions Article 1 Subject matter Article 2 Scope Article 3 Exceptions Article 4 Definition of terms Section 2: Access to payment infrastructure Article 5 Access to payment systems Article 5a Conditions for applying for participation in designated payment systems Article 6 Access to accounts that are held at a credit institution Chapter 2: Payment service providers Section 1: Licence for payment institutions Article 7 Requirement and scope of licences Article 8 Requirement for payment initiation services to hold professional indemnity insurance Article 9 Application for a licence Article 10 Granting of a licence Article 11 Revocation of a licence Article 12 Lapsing of a licence Article 13 Commercial register and register of payment institutions Article 14 Changes to the requirements for a licence Article 15 Registration application for account information services Section 2: Requirements and regulations for orderly operations Article 16 Own funds Article 17 Calculation of own funds Article 18 Safeguarding of customer deposits Article 19 Checking of ownership interests Article 20 Organisational requirements, confidentiality and due diligence obligations Article 21 Outsourcing of tasks Article 22 Agents Article 23 Liability for persons attributable to the payment institution Article 24 Retention of records and receipts Article 25 Accounting and auditing of the annual financial statement Article 26 Reporting Section 3: Freedom of establishment and freedom to provide services as well as cross-border supervision Article 27 Payment institutions from other Member States in Austria

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 3 / 102 Article 28 Austrian payment institutions in other Member States Article 29 Supervision in the context of the freedom of establishment and the freedom to provide services Article 30 Measures in the event of legal infringements and precautionary measures Article 31 Competence of the EBA Chapter 3: Transparency of the conditions and information requirements for payment services Section 1: General regulations Article 32 Scope of application of the chapter Article 33 Charges for information Article 34 Burden of proof with regard to information requirements Article 35 Exceptions from information requirements for low-value payment instruments and electronic money Article 36 Currency and currency conversion Article 37 Information about additional charges or discounts Article 38 Obligation to inform the consumer about their rights Section 2: Single payment transactions Article 39 Scope Article 40 Prior general information Article 41 Information and conditions Article 42 Information for the payer and payee following the initiation of a payment order Article 43 Information for the account servicing payment service provider to be supplied by a payment initiation service Article 44 Information to the payer after receipt of the payment order Article 45 Information to the payee following execution of the payment transaction Section 3: Framework contracts Article 46 Scope Article 47 Prior general information Article 48 Information and conditions Article 49 Accessibility of information and conditions Article 50 Changes in the conditions Article 51 Orderly termination of the framework contract Article 52 Information prior to executing of individual payment transactions Article 53 Information to the payer for individual payment transactions Article 54 Information to the payee for individual payment transactions Chapter 4: Rights and obligations for the provision and usage of payment services Section 1: Joint provisions Article 55 Scope Article 56 Fees Article 57 Exceptions for low-value payment instruments and electronic money

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 4 / 102 Section 2: Authorisation of payment transactions Article 58 Consent and withdrawal of consent Article 59 Confirmation of availability of an amount of money Article 60 Payment initiation services Article 61 Account information services Article 62 Blocking of a payment instrument and limitation of access to payment accounts Article 63 Obligations of the payment service user in relation to payment instruments and personalised security credentials Article 64 Obligations of the payment service provider in relation to payment instruments Article 65 Notification and correction of unauthorised or defectively executed payment orders Article 66 Proof of authentication and execution of payment transactions Article 67 Payment service provider's liability for unauthorised payment transactions Article 68 Payer's liability for unauthorised payment transactions Article 69 Payment transactions for which the amount is not known in advance Article 70 Refunds for a payment transaction initiated by the payee Article 71 Procedure for refunds for a payment transaction initiated by the payee Section 3: Execution of payment transactions Article 72 Receipt of payment orders Article 73 Refusal of payment orders Article 74 Irrevocability of payment orders Article 75 Transfer of the full amount Section 4: Execution time and value date Article 76 Scope Article 77 Execution period and availability Article 78 Value date Section 5: Liability Article 79 Incorrect unique identifiers Article 80 Payment service providers’ liability for non-execution, defective or late execution of payment transactions Article 81 Payment initiation services' liability for non-execution, defective execution or delayed execution of payment transactions Article 82 Additional compensation Article 83 Recourse Article 84 Exclusion from liability for irregular and unforeseeable events Section 6: Operational and security risks Article 85 Management of operational and security risks Article 86 Incident reporting Article 87 Authentication Chapter 5: Supervision, penal provisions and other measures

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 5 / 102 Section 1: Supervision Article 88 Competent authority Article 89 Estimation of costs Article 90 Data protection Article 91 Professional secrecy Article 92 International exchanging of information Article 93 Investigations and inspections Article 94 Supervisory measures and disclosure Article 95 Reporting obligations of external auditors Section 2: Alternative dispute resolution procedure Article 96 Complaints Article 97 Complaints handling procedure at payment service providers Article 98 Alternative dispute resolution - arbitration body Section 3: Procedural and penal provisions Article 99 Penal provisions Article 100 Penal provisions for persons responsible (Article 9 VStG) Article 101 Penal provisions for payment service providers in conjunction with cross-border payment transactions Article 101a Penal provisions for payment service providers in conjunction with instant credit transfers and payee verification Article 102 Penal provision on the basis of Regulation (EU) No. 260/2012 Article 103 Special procedural provisions Article 104 Penal provision on the basis of a lack of a licence Article 105 Publication of administrative offences and fines Section 4: Receivership and insolvency provisions Article 106 General provisions Article 107 Application for opening of proceedings Article 108 Receiver Article 109 Legal effects Article 110 Special rules Article 111 Application for waiving of obligations Article 112 Orders by the receiver Article 113 Expiry of receivership Article 114 Public announcements Chapter 6: Transitional and final provisions Article 115 Transitional provisions Article 116 Gender-neutral use of language Article 117 References Article 117a Transposition Note

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 6 / 102 Article 118 Enforcement Article 119 Entry into force Article 120 Repeal CHAPTER I: GENERAL PROVISIONS Section 1: Scope and definitions Credit Institutions and Financial Institutions Subject matter Article 1. (1) This Federal Act shall define the conditions under which the persons may provide commercial payment services in Austria (payment service providers). It regulates the rights and obligations of payment service providers and payment service users in conjunction with payment services. (2) The following activities shall constitute payment services:

1. services enabling cash payments into a payment account, as well as all operations required for operating a payment account (incoming payment transactions);
2. services enabling cash withdrawals from a payment account, as well as all operations required for operating a payment account (outgoing payment transactions);
3. the execution of payment transactions including the transfer of funds into a payment account held by the payment service user's payment service provider or another payment service provider (payment transactions); a. the execution of direct debits including one-off direct debits (direct debit transactions); b. the execution of payment transactions using a payment card or a similar instrument (payment card transactions); c. the execution of credit transfers including standing orders (credit transfer transactions);
4. the execution of payment transactions, if the funds are covered by a payment service user (payment transaction including the granting of credit): a. the execution of direct debits including one-off direct debits; b. the execution of payment transactions using a payment card or a similar instrument; c. the execution of credit transfers including standing orders;
5. the issuance of payment instruments (issuing) or the acceptance and acquiring of payment instruments (acquiring);
6. services, in which the funds of a payer or a payee are accepted only for transferring the corresponding amount to the payee or to another payment service acting on behalf of the payee without setting up a payment account in the name of the payer or the payee, or in which the funds are accepted on the payee's behalf and made available to the payee (money remittance transactions);

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 7 / 102 7. services, which at the request of the payment service user trigger a payment order in relation to a payment account held at another payment service provider (payment initiation services); 8. online services for communicating consolidated information about a payment account or several payment accounts that a payment service user holds at another payment service provider or at more than one payment service providers (account information services). (3) Payment service providers are:

1. credit institutions pursuant to Article 1 of the Banking Act (BWG; Bankwesengesetz), published in Federal Law Gazette 532/1993 and CRR-credit institutions pursuant to Article 1a no. 1 BWG, as well as credit institutions that ate authorised in accordance with the law applicable in their home Member State for the provision of payment services, including their branches, as well as branches of foreign credit institutions as defined in Article 2 no. 13 BWG, provided that those branches are located within the EEA;
2. payment institutions pursuant to Article 4 no. 4;
3. electronic money institutions pursuant to Article 3 para. 2 of the Electronic Money Act (E￾Geldgesetz 2010), published in Federal Law Gazette I No. 107/2010 as well as electronic money institutions pursuant to Article 9 E-Geldgesetz 2010, which are authorised in accordance with the law of their home Member State to issue electronic money (Article 4 (1) (43) of Regulation (EU) No 575/2013), including branches of electronic money institutions located within the European Economic Area, whose place of incorporation is located outside the European Economic Area, provided that the European Union has concluded the necessary agreements or provided that they have been granted a licence pursuant to Article 4 para. 6 E￾Geldgesetz 2010;
4. Österreichische Post AG with regard to those payment services that are conducted pursuant to the Post Office Savings Bank Act 1969 (Postsparkassengesetz 1969), Federal Law Gazette No. 458/1969;
5. the European Central Bank, the Oesterreichische Nationalbank, as well as other central banks within the European Economic Area, provided that they are not acting in their capacity as monetary authority;
6. the government, the provinces and municipalities when providing payment services as part of their private sector administration;
7. for the purposes of access to payment systems (Article 5): natural or legal persons pursuant to Article 32 of Directive (EU) 2015/2366 that are authorised for the provision of payment services in their home Member State. Scope Article 2. (1) This Federal Act shall apply for payment services that are provided to payment service users domiciled in Austria or by payment service providers domiciled in Austria.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 8 / 102 (2) Chapters 3 and 4 shall apply for payment transactions in the currency of a Member State, where both the payment service provider of the payer as well as that of the payee are domiciled in the European Union. This shall also apply if there is only one payment service provider involved in the transaction that is domiciled in the European Union. (3) Chapters 3 and 4 shall apply for payment transactions in a currency that is not the currency of a Member State, in the event that both the payment service provider of the payer as well as that of the payee are domiciled in the European Union (for the elements of the payment transactions that are conducted in the European Union). This shall also apply if there is only one payment service provider involved in the transaction that is domiciled in the European Union. Excluded from this provision are Article 41 para. 1 no. 1, Article 48 para. 1 no. 2 lit. e and Article 52 no. 1 in Chapter 3 as well as Articles 75 to 77 in Chapter 4. (4) Chapters 3 and 4 shall apply for payment transactions in all currencies, where only one of the payment service providers is domiciled in the European Union (for the elements of the payment transactions that are conducted in the European Union). Excluded from this provision are Article 41 para. 1 no. 1, Article 48 para. 1 no. 2 lit. e, Article 48 para. 1 no. 5 lit. g and Article 52 no. 1 in Chapter 3 as well as Article 56 para. 2, Articles 70, 71 and 75, Article 77 para. 1 and Articles 80 and 83 in Chapter 4. Exceptions Article 3. (1) This Federal Act shall not be applicable to:

1. the European Central Bank, central banks of other Member States within the European Economic Area and the Oesterreichische Nationalbank, when acting in their capacity as monetary authority, or if the Oesterreichische Nationalbank is performing the tasks conferred upon it by this Federal Act, the BWG, the National Bank Act 1984 (NBG; Nationalbankgesetz 1984) published in Federal Law Gazette No. 50/1984, the Foreign Exchange Act 2004 (Devisengesetz 2004) as published in Federal Law Gazette I No. 123/2003, the Settlement Finality Act (Finalitätsgesetz), published in Federal Law Gazette I No. 123/1999, the Secondary Coinage Act 1988 (Scheidemünzengesetz 1988), published in Federal Law Gazette No. 597/1988, or the Financial Market Authority Act (FMABG; Finanzmarktaufsichtsbehördengesetz) published in Federal Law Gazette I No. 97/2001 and assuming the role of a payment service provider;
2. the Federal Government, regional governments and municipalities, if acting in their capacity as authorities, when acting as payment service providers; and
3. the Oesterreichische Kontrollbank Aktiengesellschaft (OeKB). (2) Chapter 2 of this Federal Act shall not apply to:
4. credit institutions pursuant to Article 1 BWG, CRR-credit institutions pursuant to Article 1a no. 1 BWG as well as credit institutions that are authorised to provide payment services in accordance with law of their home Member State, including their branches as well as branches

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 9 / 102 of foreign credit institutions as defined in Article 2 no. 13 BWG, provided that such branches are located within the EEA. 2. electronic money institutions as defined in Article 3 para. 2 E-Geldgesetz 2010 as well as electronic money institutions pursuant to Article 9 E-Geldgesetz 2010, which are authorised in accordance with the law of their home Member State to issue electronic money (Article 4 (1) (43) of Regulation (EU) No 575/2013), including branches of electronic money institutions located within the European Economic Area, whose place of incorporation is located outside the European Economic Area, provided that the European Union has concluded the necessary agreements or provided that they have been granted a licence pursuant to Article 4 para. 6 E￾Geldgesetz 2010; 3. the Austrian Post with regard to its money transaction services; 4. the European Central Bank, the Oesterreichische Nationalbank, as well as other central banks within the European Economic Area, provided that they are not acting as monetary authority pursuant to para. 1, or if the Oesterreichische Nationalbank is not acting in a capacity with regard to the tasks conferred upon it in the Federal Acts listed in para. 1 no. 1; and 5. the Federal Government, regional governments and municipalities providing they are acting as part of their private sector administration; (3) This Federal Act shall not apply to the following activities:

1. payment transactions made exclusively as a direct payment in cash from the payer to the payee without any intermediary;
2. payment transactions between the payer and the payee through a commercial agent authorised on the basis of an agreement to only negotiate or conclude the sale or purchase of goods or services on behalf of the payer or on behalf of the payee;
3. the physical transporting on a commercial basis of banknotes and coins including their collection, processing and delivery;
4. the non-commercial collection and delivery of cash as part of a not-for-profit or charitable activity;
5. services, for which the payee provides cash to the payer as part of a payment transaction, having been explicitly requested to do so by the payment service user shortly prior to the execution of a payment transaction for purchasing goods or services (cash back);
6. money exchange transactions pursuant to Article 1 para. 1 no. 22 BWG (exchange bureau business);
7. Payment transactions, conducted on the basis of the one of the following documents, drawn on the payment service provider, which prescribes funds being made available to a payee: a. a paper cheque as defined in the Geneva Convention of 19 March 1931 concerning the establishment of a uniform law for cheques; b. a paper cheque comparable to the cheque listed in lit a under the national law of a Member State that is not a party to the Geneva Convention of 19 March 1931 on the uniform law for cheques;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 10 / 102 c. a paper-based draft as defined in the Geneva Convention of 7 June 1930 concerning the establishment of a Uniform Law for Bills of Exchange and Promissory Notes; d. a paper-based draft comparable to the paper-based draft listed in lit c under the national law of a Member State that is not a party to the Geneva Convention of 7 June 1930 on the Uniform Law for Bills of Exchange and Promissory Notes; e. a paper-based voucher; f. a paper-based traveller's cheque; g. a paper-based postal money order as defined by the Universal Postal Union; 8. payment transactions, settled in a payment or securities settlement system between payment service providers and settlement agents, central counterparties, clearing houses or central banks and other participants in the system; Article 5 shall remain unaffected; 9. payment transactions in connection with the operation of securities settlement systems, such as dividends, income or other distributions, or as result of a redemption or sale, carried out by the persons named in no. 8 or by investment services, credit institutions, collective investment undertakings or asset management companies providing investment services or any other entity that is authorised to provide custody services for financial instruments; 10. services which are provided by technical service providers, which contribute towards the provision of payment services, but which at no time take possession of the funds to be transferred, such as the processing and storage of data, measures for ensuring confidentiality and services to protect privacy, data and entity authentication, the provision of information and communications technology (ICT) and communications networks as well as the provision and maintenance of the terminals and devices used for payment services with the exception of payment initiation services and account information services; 11. services that are based on specific payment instruments that can only be applied on a limited basis (limited networks) that fulfil one of the following conditions: a. the instruments permit their holder to only purchase goods or services at the business premises of the issuer or within a limited network of service providers in accordance with a commercial agreement with a professional client, or b. the instruments may only be used for purchasing a very restricted range of goods or services, or c. the instruments are only valid in Austria, are provided at the request of an entity or a public sector entity, are subject to the regulations of a national or regional public sector entity for defined social or tax purposes and are intended for acquiring specific goods or services from providers that have concluded a commercial agreement with the issuer; 12. payment transactions that are provided by a provider of electronic communications networks or services in addition to electronic communications services for a participant of the network or service:

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 11 / 102 a. payment transactions in conjunction with the acquisition of digital content and voice￾based services, regardless of the device used to purchase or consume digital content, provided that the payment transactions are billed on the corresponding bill, and that the value of an individual payment does not exceed EUR 50, and aa) the cumulative value of the payment transactions of an individual participant does not exceed EUR 300 per month, or bb) the cumulative value of the payment transactions does not exceed EUR 300 within a single month if a participant has made prepayments to his account held with a provider of electronic communications networks or services, or b. payment transactions that are conducted from an electronic device or through one and which are billed on the corresponding bill as part of a charitable activity, or to purchase tickets, provided that the value of an individual payment does not exceed EUR 50, and aa) the cumulative value of the payment transactions of an individual participant does not exceed EUR 300 per month, or bb) the cumulative value of the payment transactions does not exceed EUR 300 within a single month if a participant has made prepayments to his account held with a provider of electronic communications networks or services, or 13. payment transactions that are conducted between payment service providers, their agents or branches for their own account; 14. payment transactions between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking and associated services without the involvement of a payment service provider, unless the payment service provider is an undertaking within the same group; 15. services of service providers that have not concluded a framework contract with the customers withdrawing money from a payment account, in which cash is withdrawn from multifunctional automated teller machines for one or more card issuer, subject to the proviso that a. these service providers do not conduct any other of the payment services listed in Article 1 para. 2, and b. the customers are informed about all charges for cash withdrawals pursuant to Articles 36, 41, 44 and 45 both prior to the withdrawal as well as on the receipt having received the cash. (4) A service provider that conducts one of the activities pursuant to para. 3 no. 11 lit. a or b or both activities (limited network), shall notify the FMA, if the total value of the payment transactions in the preceding twelve months exceeds an amount of EUR 1 million. The notification shall contain a description of the services provided. It must be stated which exception pursuant to para. 3 no. 11 lit. a or b is being made use of to perform the activity. On the basis of the notification, the FMA shall review whether the criteria for such an exception are met. If this is the case, then the FMA shall inform the service provider about the findings of this review.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 12 / 102 (5) A service provider that performs an activity pursuant to para. 3 no. 12 (electronic communications networks or services) shall notify this to the FMA. The service provider shall submit an opinion of an external auditor to the FMA annually, from which it is attested that the activities is compliant with the upper limits set pursuant to para. 3 no. 12. Definition of terms Article 4. For the purposes of the present Federal Act, the following definitions shall apply:

1. home Member State a. the Member State, in which the place of incorporation of the payment service provider is situated; or, b. if the payment service provider has no place of incorporation in accordance with the national law applicable to it, the Member State in which its head office is situated;
2. host Member State: the Member State other than the home Member State in which a payment service provider has an agent or a branch or provides payment services;
3. payment service: an activity conducted on a commercial basis pursuant to Article 1 para. 2;
4. payment institution: a legal person, which a. pursuant to Article 10, or b. in its home Member State pursuant to Article 11 of Directive (EU) 2015/2366, is authorised for the commercial provision and execution of payment services throughout the European Economic Area;
5. payment transaction: the placement, transfer or withdrawal of funds prompted by the payer, on behalf of the payer, or by the payee, irrespective of any underlying obligations between the payer and the payee;
6. remote payment transaction: a payment transaction initiated via internet or through a device that can be used for distance communication;
7. payment system: a system for transferring funds with formal and standardised arrangements and common rules for the processing, clearing or settlement of payment transactions;
8. payer: a natural or legal person who is the holder of a payment account and issues or allows a payment order from that payment account, or, where no payment account exists, a person who gives the order for the payment transaction;
9. payee: a natural or legal person who is the intended recipient of funds which is the subject of a payment transaction;
10. payment service user: a natural or legal person who makes use of a payment service in the capacity of either payer or payee, or both;
11. payment service provider: a legal entity pursuant to Article 1 para. 3;
12. payment account: an account held in the name of one or several payment service users, which is used for the execution of payment transactions;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 13 / 102 13. payment order: an instruction by a payer or payee to their payment service provider requesting the execution of a payment transaction; 14. payment instrument: any personalised device(s) and/or set of procedures agreed between the payment service user and the payment service provider and used in order to initiate a payment order; 15. payment initiation service: service pursuant to Article 1 para. 2 no. 7; 16. account information service: online service pursuant to Article 1 para. 2 no. 8; 17. account servicing payment service provider: a payment service provider providing and maintaining a payment account for a payer; 18. payment initiation service provider: a payment service provider pursuing business activities pursuant to Article 1 para. 2 no. 7; 19. account information service provider: a payment service provider pursuing business activities pursuant to Article 1 para. 2 no. 8; 20. consumer: a natural person who, in payment service contracts covered by this Federal Act, is acting for purposes other than his or her trade, business or profession; 21. framework contract: a payment service contract which governs the future execution of individual and successive payment transactions and which may contain the obligation and conditions for setting up a payment account; 22. direct debit: a payment service for debiting a payer’s payment account, where a payment transaction is initiated by the payee on the basis of the consent given by the payer to the payee, to the payee’s payment service provider or to the payer’s own payment service provider; 23. credit transfer: a payment service for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the payment service provider which holds the payer’s payment account, triggered by an instruction given by the payer; 24. funds: banknotes and coins, scriptural money or electronic money pursuant to Article 1 para. 1 E-Geldgesetz 2010, published in Federal Law Gazette I No. 107/2010; 25. reference exchange rate: the exchange rate which is used as the basis to calculate any currency exchange and which is made available by the payment service provider or comes from a publicly available source; 26. reference interest rate: the interest rate which is used as the basis for calculating any interest to be applied and which comes from a publicly available source which can be verified by both parties to a payment service contract; 27. authentication: a procedure which allows the payment service provider to verify the identity of a payment service user or the validity of the use of a specific payment instrument, including the use of the user’s personalised security credentials; 28. strong customer authentication: an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 14 / 102 user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data; 29. personalised security credentials: personalised features provided by the payment service provider to a payment service user for the purposes of authentication; 30. sensitive access data: data, including personalised security credentials which can be used to carry out fraud. For the activities of payment initiation service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive access data; 31. unique identifier: a combination of letters, numbers or symbols specified to the payment service user by the payment service provider and which the payment service user must state, so that another payment service user, or the payment account of another payment service user, involved in the payment transaction can be unambiguously identified; 32. means of distance communication: a procedure which may be used for the conclusion of a contract for the provision of payment services, without the simultaneous physical presence of the payment service provider and the payment service user being required; 33. durable medium: any instrument which enables the payment service user to store information addressed personally to that payment service user in such a way that the information remains accessible for future reference for an appropriate period of time for the purposes of the information and which allows the unchanged reproduction of the information stored; 34. business day: a day on which the payer's relevant payment service provider or the payee's payment service provider involved in the execution of a payment transaction is open for business as required for the execution of a payment transaction; 35. agent: a natural or legal person who acts on behalf of a payment institution in providing payment services; 36. branch: a place of business other than the head office which is a part of a payment institution, which has no legal personality and which carries out directly some or all of the transactions inherent in the business of a payment institution; all the places of business set up in the same Member State by a credit institution or payment institution with its head office in another Member State shall be regarded as one single branch; 37. group: a group of undertakings that are linked to one another by means of a relationship listed in Article 244 UGB, or undertakings as defined in Articles 4, 5, 6 and 7 of Delegated Regulation (EU) No 241/2014, which are linked to each other by a relationship referred to in Article 10(1) or in Article 113(6) or (7) of Regulation (EU) No 575/2013; 38. electronic communications network: a communications network pursuant to Article 3 no. 11 of the Telecommunications Act of 2003 (TKG 2003; Telekommunikationsgesetz 2003), published in Federal Law Gazette I no. 70/2003; 39. electronic communications services: a communications service pursuant to Article 3 no. 9 TKG 2003;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 15 / 102 40. digital content: goods or services which are produced and supplied in digital form, the use or consumption of which is restricted to a technical device and which do not include in any way the use or consumption of physical goods or services; 41. acquiring of payment transactions: a payment service provided by a payment service provider contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee; 42. issuing of payment instruments: a payment service by a payment service provider contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions; 43. own funds: funds as defined in Article 4(1) (118) of Regulation (EU) No 575/2013 where at least 75 % of the Tier 1 capital is in the form of Common Equity Tier 1 capital in accordance with Article 50 of that Regulation and the Tier 2 capital shall be a maximum of one third of Tier 1 capital; 44. payment brand: any material or digital name, any material or digital term, any material or digital sign, any material or digital symbol or combination of them, capable of denoting under which payment card scheme card-based payment transactions are carried out; 45. co-badging: the inclusion of two or more payment brands or payment applications of the same payment brand on the same payment instrument; 46. out-of-court mediation body: the facility for alternative dispute resolution pursuant to Article 98; 47. secure communication: a communications procedure that conforms to the requirements of the Delegated Act that the European Commission shall be required to issue pursuant to Article 98 of Directive (EU) 2015/2366. Section 2: Access to payment infrastructure Access to payment systems Article 5. (1) The operator of a payment system shall, neither directly nor indirectly,

1. unfairly prevent payment service providers, payment service users or other payment systems from accessing its payment system or impose restrictive conditions on them with regard to the effective participation in other payment systems;
2. discriminate between authorised payment service providers or registered payment service providers in relation to their rights and obligations as participants in the payment system without objectively justifiable reason;
3. subject payment service providers, payment service users or other payment systems to restrictions on the basis of their institutional status. (2) In the interests of ensuring the stability of the financial market and the security of payment systems, payment system providers shall comply with the following criteria when granting access to payment systems to payment service providers that are legal persons:

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 16 / 102

1. to safeguard against specific risks such as settlement risk, operational risk and business risk, and
2. to protect the financial and operational stability of the payment system. Every payment service provider shall furnish proof to the operator of the payment system and the other participants that its internal arrangements are sufficiently robust against all kinds of risk within the meaning of nos. 1 and 2 prior to its admittance to a payment system. For the duration of its participation in a payment system, the payment service provider shall ensure that these requirements are fulfilled at all times. (3) The provisions pursuant to paras. 1 and 2 shall not apply to payment systems consisting solely of payment service providers belonging to a single group. A participant of a designated payment system system as defined in Article 2 of the Settlement Finality Act (Finalitätsgesetz) that permits a licensed or registered payment service provider, that is not a participant of the system, to issue transfer orders via the system, shall upon the latter's request grant licensed or registered payment service providers with the same opportunity in an objective, proportional and non-discriminatory manner. The participant shall notify the payment service provider making the application with a comprehensive explanation in the event that the latter is rejected. (4) Anyone breaching para. 1, shall be obliged by the affected party to eliminate the breach, to cease and desist if there is a risk of a repeated breach, and in the case of being at fault to pay damages. The tasks and responsibilities of the Austrian Competition Authority (BWB; Bundeswettbewerbsbehörde), the Federal Cartel Prosecutor (Bundeskartellanwalt) and the anti-trust jurisdiction in accordance with the Cartel Act of 2005 (KartellG 2005; Kartellgesetz 2005), as published in Federal Law Gazette I No. 61/2005, and of the Oesterreichische Nationalbank pursuant to Article 44a NBG shall remain unaffected. Conditions for applying for participation in designated payment systems Article 5a. (1) To ensure the stability and integrity of payment systems, payment institutions and electronic money institutions that apply to participate in systems designated in accordance with Directive 98/26/EC, or which participate in such systems, shall be required to hold
3. a description of the measures taken for safeguarding payment service user’s funds,
4. a description of the governance arrangements and internal control mechanisms for the payment services or electronic money services it intends to provide, including administrative, risk management and accounting procedures, of the payment institution or electronic money institution and a description of the arrangements for the use of information and communication technology services of the payment institution or electronic money institution, related to Articles 6 and 7 of Regulation (EU) 2022/2554, and
5. a winding-up plan in case of failure. (2) The following shall apply for the purposes of para. 1 no. 1:

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 17 / 102

1. where the payment institution or electronic money institution safeguards payment service users’ funds by depositing funds in a separate account in a credit institution or by means of an investment in secure, liquid, low-risk assets as defined by the competent authorities of the home Member State, the description of the measures taken for such safeguarding shall contain, as applicable: a. a description of the investment policy to ensure that the assets that are chosen are liquid, secure and low-risk; b. the number of persons that have access to the safeguarding account and their functions; c. a description of the administration and reconciliation process to ensure that payment service users’ funds are insulated in the interest of payment service users against the claims of other creditors of the payment institution or electronic money institution, in particular in the event of insolvency; d. a copy of the draft contract with the credit institution; as well as e. an explicit declaration by the payment institution or electronic money institution of compliance with Article 10 of Directive (EU) 2015/2366.
2. where the payment institution or electronic money institution safeguards payment service users’ funds through an insurance policy or comparable guarantee from an insurance company or a credit institution, the description of the measures taken for such safeguarding shall contain the following: a. a confirmation that the insurance policy or comparable guarantee from an insurance company or a credit institution is from an entity that is not part of the same group of firms as the payment institution or electronic money institution; b. details of the reconciliation process in place to ensure that the insurance policy or comparable guarantee is sufficient to meet the safeguarding obligations of the payment institution or electronic money institution at all times; c. the duration and the terms of renewal of the coverage; as well as d. a copy of the insurance agreement or comparable guarantee, or drafts thereof. (3) For the purposes of para. 1 no. 2, the description shall demonstrate that the governance arrangements, internal control mechanisms and arrangements for the use of information and communication technology are proportionate, appropriate, sound and adequate. In addition, governance arrangements and internal control mechanisms shall include:
3. a mapping of the risks identified by the payment institution or electronic money institution, including the type of risks and the procedures the payment institution or electronic money institution has in place or will put in place to assess and prevent such risks;
4. the different procedures to carry out periodical and permanent controls, including the frequency and the human resources allocated;
5. the accounting procedures by which the payment institution or electronic money institution records and reports its financial information;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 18 / 102 4. the identity of the person or persons responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae of that person or those persons; 5. the identity of any auditor that is not a statutory auditor as defined in Article 2 point 2 of Directive 2006/43/EC; 6. the composition of the management body and, if applicable, of any other oversight body or committee, 7. a description of the way outsourced functions are monitored and controlled so as to avoid impairment of the quality of the internal controls of the payment institution or electronic money institution; 8. a description of the way any agents and branches are monitored and controlled within the framework of the internal controls of the payment institution or electronic money institution; as well as 9. where the payment institution or electronic money institution is the subsidiary of a regulated entity in another Member State, a description of the group governance. (4) For the purposes of the para. 1 no. 3, the winding-up plan shall be adapted to the envisaged size and business model of the payment institution or electronic money institution. It shall include a description of the mitigation measures to be adopted by the payment institution or electronic money institution in the event of the termination of its payment services, which would ensure the execution of pending payment transactions and the termination of existing contracts. (5) The FMA shall monitor compliance with the requirements pursuant to paras. 1 to 4 by payment institutions and E-money institutions, where this did not already occur when checking details and documents pursuant to Article 9 para. 1 or Article 4 paras. 1 and 2 E Geld-Gesetz 2010 during the licensing procedure. Access to accounts that are held at a credit institution Article 6. (1) Credit institutions shall provide access to payment account services operated by credit institutions to payment institutions on an objective, non-discriminative and proportionate basis. Such access shall be sufficiently extensive as to allow payment institutions to provide payment services in an unhindered and efficient manner. (2) If a credit institution refuses to provide access, the managing directors shall notify this to the FMA without delay in writing. The notification shall be required to contain a justifiable explanation.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 19 / 102 CHAPTER 2: PAYMENT SERVICE PROVIDERS Section 1: Licences for payment institutions Requirement and scope of licence Article 7. (1) The commercial provision of one or more payment services pursuant to Article 1 para. 2 nos. 1 to 7 in Austria shall require, except in the case stipulated in Article 3 para. 1 a licence (Article 10) from the FMA to conduct business as a payment institution. A payment institution incorporated and with its head office in Austria shall be authorised to provide one or more payment services pursuant to Article 1 para. 2 as stipulated in the administrative decision granting the licence subject to compliance with the provisions of this Federal Act. (2) Furthermore, payment institutions may engage in the following activities:

1. the provision of operational and closely related ancillary services, such as ensuring the execution of payment transactions, foreign exchange transactions, the provision of custodian services, as well as the storage and processing of data;
2. the operation of payment systems, without prejudice to Article 5;
3. other business activities than the provision of payment services, provided that no legal provisions under Community law or provisions in other Federal Acts exist to the contrary. (3) When providing one or several of the payment services listed under Article 1 para. 2, payment institutions shall only be allowed to operate payment accounts that are used exclusively for payment transactions. (4) Funds received by payment institutions from payment service users with a view to the provision of payment services, as well as any credit balances on payment accounts, shall not constitute a deposit or other repayable funds as defined in Article 1 para. 1 no. 1 BWG or as e-money pursuant to Article 1 para. 1 E-Geldgesetz 2010 and shall not be allowed to be subject to interest. Where payment services are provided by investment firms or investment service providers, any funds held in the payment accounts or accepted for payment services from payment service users for the provision of investment services for this or any other payment service user shall not be permitted. (5) Payment institutions shall not be allowed to accept deposits or other repayable funds as defined in Article 1 para. 1 no. 1 BWG on a commercial basis, nor on the basis of issuing bearer and registered bonds. (6) Payment institutions shall only be allowed to grant credits in conjunction with the payment services listed in Article 1 para. 2 nos. 4 and 5, if
4. the granting of credit is an ancillary activity and is to be granted exclusively in connection with the execution of a payment transaction;
5. the term of the credit granted in connection with a payment does not exceed twelve months and this credit is repaid in full within this twelve month period at the latest; a subsequent extension of the term of the credit shall not be permitted;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 20 / 102 3. the credit shall not be granted against funds received or held for executing a payment transaction; and 4. the own funds position of the payment institution shall at all times, in the FMA's judgment, be commensurate to the overall amount of credits granted. Taking into consideration the methods available pursuant to Article 17 para. 1 and taking into account the scope and volume of credit transactions conducted as a proportion of total amount of transactions, the FMA may determine by means of a regulation what proportion of own funds pursuant to Article 16 must be available as a proportion of the total amount of credits granted. (7) Any credit granted pursuant to Article 6 no. 1 shall not constitute a credit transaction as defined in Article 1 para. 1 no. 3 BWG. Requirement for payment initiation services to hold professional indemnity insurance Article 8. An undertaking that applies for a licence to provide payment initiation services (Article 1 para. 2 no. 7) shall as a pre-condition for the licence hold professional indemnity insurance or another comparably guarantee that covers its liability in the locations in which it offers its services, to ensure that it may be able to fulfil its liability obligations pursuant to Articles 67, 80, 81 and 83. Application for a licence Article 9. (1) The applicant shall submit the following information and documentation along with their application to be granted a licence:

1. the business model, from which it is possible to determine the types of payment services that are envisaged to be performed, and whether the granting of credits pursuant to Article 7 para. 6 is also envisaged in conjunction with a payment service pursuant to Article 1 para. 2;
2. a business plan contained a planned budget for the first three financial years, from which it is possible to determine that the applicant has appropriate and proportionate systems, resources and procedures at their disposal in order to execute activities in an orderly manner.
3. evidence that the directors of the payment institution have the necessary initial capital pursuant to Article 10 para. 1 no. 7 freely available in Austria without restriction and unencumbered;
4. a description of the measures taken for safeguarding the funds of payment service users pursuant to Article 18;
5. a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures, as well as arrangements regarding the usage of ICT services in accordance with Regulation (EU) 2022/2554, which demonstrate that these governance arrangements and internal control mechanisms are proportionate, appropriate, reliable and adequate;
6. a description of the existing procedures for the monitoring, handling and follow-up measures in the event of security-related incidents and security-related complaints by customers,

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 21 / 102 including a mechanism for incident reporting that takes into according the reporting obligations of the payment institution pursuant to Chapter III of Regulation (EU) 2022/2554; 7. a description of the existing procedures for the capturing, monitoring, tracing back and restriction of access to sensitive payment data; 8. a description of the arrangements for the business continuity including clear details about the critical procedures, effective ICT business continuity guidelines and plans, ICT Response and Recovery plans as well as a procedure for the regular testing of the adequacy and effectiveness of such plans pursuant to Regulation (EU) 2022/2254; 9. a description of the principles and definitions for capturing statistical data about performance, transactions and cases of fraud; 10. a document about the security strategy, including a detailed risk evaluation for the payment services provided and a description of the security control measures and risk mitigation measures for guaranteeing as appropriate level of protection for payment service users against determined risks, including fraud and the illegal use of sensitive and personal data; 11. a description of the internal control system, which the applicant intends to introduce to comply to comply with the requirements of the Financial Markets Anti-Money Laundering Act (FM-GwG; Finanzmarkt-Geldwäschegesetz), published in Federal Law Gazette I No. 118/2016 and Regulation (EU) 2015/847; 12. a statement about the applicant's organisational structure, including, if relevant, a description of the intended use of agents and branches and inspections of them to be conducted on-site or inspections conducted off-site, which the applicant shall be obliged to conduct at least once a year, as well as a description of outsourcing arrangements, and a description about how it intends to participate in a national or international payment system; 13. the identity and amount of the holdings being held by the persons either directly or indirectly holding a qualifying holding pursuant to Article 4(1) (36) of Regulation (EU) 575/2013 in the payment institution, as well as all necessary information needed in the interests of ensuring the robust and prudent management of the payment institution, for assessing the reliable nature of these persons, of legal representatives and any personally liable shareholders, as well as information about the group structure, in the case that these persons belong to a group of companies; 14. the names of the directors, and in the case of Article 7 para. 2 no. 3 the names of the persons responsible for the management of payment service activities of the payment institution, as well as, pursuant to Article 10 para. 1 nos. 9 to 15, evidence with regard to their personal reliability and that they possess appropriate knowledge and abilities for the provision of payment services; 15. the name of the auditor, and in the event that the audit is conducted by an external auditing company, the names of the natural persons who ultimately conduct the auditing process, as defined in Articles 60 to 63b BWG in conjunction with Articles 270 to 271c of the Commercial

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 22 / 102 Code (UGB; Unternehmensgesetzbuch), as published in the German Imperial Law Gazette p. 219/1897; p. 219/1897. 16. the legal form and articles of association of the applicant; 17. the place of incorporation and the address of the applicant's head office. (2) For the purposes of the information and documentation to be supplied in para. 1 nos. 4 to 6 and no. 12, the applicant shall be required to provide a description of its audit arrangements and the organisational provisions that allow it to take all appropriate measures in order to protect the interests of its users and to guarantee continuity and reliability with regard to the provision of payment services. (3) In relation to the security control measures and risk mitigation measures listed in para. 1 no. 10, the applicant shall be required to state how such measures ensure a high level of digital operational resilience in accordance with Chapter II of Regulation (EU) 2022/2554, especially in relation to technical security and data protection. This shall also apply to the software and ICT systems that the applicant or the entities to which it outsources some or all of its activities use. Such measures also include security measures pursuant to Article 85 para. 1. (4) The FMA shall communicate to the applicant by means of an administrative decision within three months of receipt of an application, or in the event that the application is incomplete, within three months of receipt of all the information required for the administrative decision, either granting the licence or rejecting the application. Granting of a licence Article 10. (1) The licence shall be granted, if:

1. the undertaking is intended to be operated in the legal form of a joint stock company or a cooperative society;
2. the place of incorporation and the head office are located in Austria and at least part of the payment services are conducted there;
3. in the interest of guaranteeing the sound and prudent management of a payment institution that the payment institution has a robust governance structure in place for its payment service business, including a clear organisational structure with precisely defined, transparent and coherent areas of responsibility, effective procedures for the identification, management, monitoring and reporting of the risks to which it is or might be exposed, including risks in relation to the remuneration policy and the remuneration practices, as well as adequate internal control mechanisms, including sound administrative and accounting procedures; these rules, procedures and mechanisms shall be comprehensive and adequate for the nature, scope and complexity of the payment services provided by the payment institution;
4. the shareholders or members, who hold qualifying holdings (Article 4(1) (36) of Regulation (EU) No. 575/2013), satisfy the requirements needed to ensure the sound and prudent management of a payment institution and no facts are known to exist that give rise

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 23 / 102 to doubts as to the personal reliability of these persons; in the event that any such circumstances do apply, then the licence may only granted if these doubts have been proven to be unfounded; 5. existing close links between the payment institution and other natural or legal persons as defined as Article 4 (1) (38) of Regulation (EU) No. 575/2013, do not prevent orderly prudential supervision; 6. orderly proper prudential supervision shall not be impeded by the legal or administrative provisions of a third country, which govern one or more natural or legal persons with whom the payment institution has close links, or by difficulties in their application; 7. the initial capital pursuant to Article 16 para. 1, which consists of Common Equity Tier 1 pursuant to Chapter 2 of Title I of Part Two of Regulation (EU) No 575/2013 and which is freely available to the directors without restriction and encumbrance in Austria; 8. the measures taken for safeguarding the funds of payment service users in accordance with Article 18 are adequate; 9. no reasons for exclusion exist for any of the directors as defined in Article 13 paras. 1 to 3, 5 and 6 of the Trade Code 1994 (GewO 1994; Gewerbeordnung), as published in Federal Law Gazette No. 194/1994, and bankruptcy proceedings have not been initiated for the assets of other legal entities other than a natural person over whose business a director has or has had a decisive influence, unless a reorganisation plan was agreed upon and fulfilled in the bankruptcy proceedings; this also applies to comparable circumstances that have arisen in a foreign country; 10. the personal finances of the directors are in order and there are no facts giving rise to doubts as to the directors' personal good repute which is necessary for operating the business in accordance with Article 1 para. 2 and Article 7 para. 2; should any such circumstances apply, then the licence may be only granted if these doubt are proven to be unfounded; 11. the directors are, on the basis of their previous experience are professionally qualified and have the necessary experience required for operating the payment institution. The professional qualification of a director presupposes that they possess sufficient theoretical and practical knowledge of the business that is the subject of the application pursuant to Article 1 para. 2 as well as management experience; the professional qualification required to manage a payment institution can be assumed when proof is provided of at least three years in the management of a company of comparable size and a similar type of business; 12. there are no grounds to exclude a director who is not an Austrian citizen to act as director of a payment institution as defined in nos. 9, 10, 11 or 15 in the country whose citizenship this director holds; this shall be confirmed by the supervisor of the home country; if it not possible to obtain such a confirmation, the director concerned shall provide credible evidence of this, to convince that grounds for exclusion do not exist, and to submit a declaration stating whether any of the grounds given for exclusion apply; 13. the centre of at least one director's centre of vital interests lies in Austria;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 24 / 102 14. at least one director has a command of the German language; 15. at least one director exercises no other main profession outside the payment service industry, e-money industry or banking industry; 16. the articles of association do not contain any provisions which would place the safety of the funds entrusted to the payment institution and the proper execution of the transactions pursuant to Article 1 para. 2 in doubt; 17. the information and evidence accompanying the application comply with the provisions of Article 9, and the FMA's overall assessment, after having scrutinised the application, is a favourable one. (2) Before granting a licence, the FMA shall

1. consult the Oesterreichische Nationalbank;
2. consult the competent authority of the home Member State, if a shareholder or a partner, who holds a qualifying holding in the payment institution, is authorised to operation in that home Member State as a credit institution pursuant to Article (4) (1) (1) of Regulation (EU) No 575/2013, as an asset management company pursuant to Article 2 (5) of Directive 2002/87/EC, as an investment firm pursuant to Article 4 (1) (1) of Directive 2014/65/EU, as an electronic money institution as defined in Article 1 (1) (b) of Directive 2009/110/EC, as an insurance undertaking pursuant to Article 13 (1) of Directive 2009/138/EC or as a payment institution pursuant to Article 4 (4) of Directive (EU) 2015/2366;
3. consult the competent authority in the Member State concerned that is responsible for the prudential supervision of payment services if the documents submitted with the application for a licence reveal that a director had previously been active in another Member State;
4. consult the authorities responsible in Austria for the prudential supervision of activities pursuant to Article 7 para. 2 no. 3 if the payment institution also intends to perform these activities. (3) The licence shall be granted in writing, otherwise it shall be invalid; a licence may be issued subject to conditions and obligations, may cover one or several payment services pursuant to Article 1 para. 2 and may exclude parts of individual payment services from the scope of the licence. At the same time as granting the licence, the FMA shall also enter the payment institution in the register for payment institutions pursuant to Article 13 para. 2. (4) If a payment institution provides one of the payment services listed in Article 1 para. 2 nos. 1 to 7 while simultaneously conducting other business activities, the FMA shall be entitled to stipulate that a separate entity with its own legal personality must be created for carrying out the payment service business, if
5. the non-payment services-based business of the payment institution affects or could affect the financial soundness of the payment institution, or

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 25 / 102 2. the non-payment services-based business of the payment institution hinders, or could hinder, the FMA's ability to be able to check whether the payment institution complies with all requirements set out in this Federal Act. Revocation of a licence Article 11. (1) The FMA may revoke the licence granted to a payment institution, if

1. the business activity for which the licence was granted has not been commenced within twelve months of the date on which the licence was granted; or
2. the business activity for which the licence was granted has not been exercised for longer than six months. (2) The FMA shall revoke the licence, if
3. it was obtained on the basis of false information or in any other unlawful manner;
4. the necessary conditions for granting the licence no longer apply or have retroactively ceased to apply (Article 94 para. 7 of this Federal Act in conjunction with Article 70 para. 4 no. 3 BWG) or the payment institution no longer complies with its obligation to inform the FMA about important developments;
5. the payment institution's continued provision of the payment services would endanger the stability of the payment system or confidence in the payment system, or that the payment institution is unable to fulfil its obligations toward its creditors;
6. the payment institution exceeds the restrictions defined in Article 7 for the granting of credits or accepts deposits or issues electronic money;
7. bankruptcy proceedings have been initiated against the assets of the payment institution; or
8. a resolution has been passed by a body of the payment institution to dissolve the undertaking and all payment services have been wound down. (3) An administrative decision, in which the licence is revoked, shall have the effect of a resolution to dissolve the payment institution, unless the business conducted pursuant to Article 1 para. 2 is no longer the company's business purpose within three months of the administrative decision taking effect and the company changes its name without dropping the designation "payment institution". The FMA shall submit a copy of this administrative decision to the commercial register court; the revocation of a licence shall be entered in the commercial register. (4) The court shall appoint liquidators at the FMA's request, if the persons otherwise appointed for the purpose of liquidation are unable to ensure an orderly liquidation process. If the FMA considers that the persons appointed for the purpose of liquidation are unable to ensure orderly liquidation process, the FMA shall request the competent court of first instance in commercial matters with jurisdiction over the payment institution's place of incorporation to appoint suitable liquidators; this court shall rule on the case except in the case of disputes. (5) The revocation of the licence is to be communicated to the party concerned by means of an administrative decision.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 26 / 102 (6) The revocation of the licence shall be published by the FMA in the register of payment institutions pursuant to Article 13 para. 2 as well as on the FMA's website. The FMA shall also publish in the same way, about the suspensory effect is granted to a complaint against an administrative decision on the revocation of a licence. The publication of the revocation of the licence shall be retracted if the administrative decision is repealed. Lapsing of a licence Article 12. (1) The licence shall lapse:

1. upon expiry of its period of validity;
2. in the event that a condition for dissolution is met (Article 10 para. 3);
3. if the licence is surrendered;
4. when the merger or demerger of the payment institutions is entered in the Commercial Register (Firmenbuch) for the transferring payment institution(s) or when the universal succession is entered in the Commercial Register with regard to double or multiple circumstances for licences for a single institution;
5. upon being entered as a European Company (SE) or as a European Cooperative Society (SCE) in the register of the new country of incorporation. (2) The FMA shall determine the lapsing of the licence by issuing an administrative decision. Article 11 paras. 3 and 4 shall apply in this context. (3) The surrendering of a licence (para. 1 no. 3) may only be done in writing, and once all payment services have been liquidated. (4) Article 7a BWG shall apply with regard to the procedure to be applied by the director of the payment institution, the FMA and the liquidator. Commercial register and register of payment institutions Article 13. (1) Payment institutions may only be entered in the Commercial Register if the appropriate legally effective administrative decisions have been submitted in the original or as certified copies. The competent court shall also deliver decisions on such Commercial Register entries to the FMA. (2) The FMA shall set up a public register, in which all authorised payment institutions and account information service providers (AISPs) (Article 15) with their place of incorporation in Austria as well as their agents shall be entered. Branches in other Member States shall be entered, provided that they provide services there. The description of a service notified pursuant to Article 3 paras. 4 and 5 is also be entered. The register shall be published on the FMA's website. Amendments to the register shall be made without delay. (3) The entry in the register listed in para. 2 shall be made without undue delay following the administrative decision granting a licence becoming effective. In addition to the company name, the scope of the licence and place of incorporation of the payment institution, the Commercial Register

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 27 / 102 number shall also be entered, provided that this information has been communicated to the FMA. Where the payment institution provides its services through agents or branches, their name or company name, place of incorporation and Commercial Register number must also be stated, provided that this information has been communicated to the FMA. (4) The payment institution shall notify the FMA in writing of its Commercial Register number and any change to this number without undue delay. (5) The FMA shall enter every revocation and lapsing of the licence as well as any revocation of the registration into the register. In so doing it shall inform the EBA about the reasons for revoking or lapsing of the licence of for revoking the registration. (6) Upon individual request, the FMA shall provide information on the scope of the licence of payment institutions pursuant to lit a of Article 4 no. 4 within a reasonable period of time. (7) The FMA shall submit to the EBA without delay in a language commonly used in the finance sector about the details contained in the register listed in para. 2. The FMA shall ensure that these details are correct and that they are kept up-to-date. Changes to the requirements for a licence Article 14. (1) The payment institution shall notify the FMA in writing without undue delay of any changes relevant to the granting of a licence, in the event of a resolution being passed, it is not necessary to wait for the object of the resolution to become effective before making the notification, including:

1. any changes in the articles of association or resolutions to dissolve the undertaking;
2. any change to the conditions pursuant to Article 10 para. 1 nos. 9, 10, 13 and 15 in the case of existing directors;
3. any personnel changes among the directors and compliance with Article 10 para. 1 nos. 9 to 15;
4. the intended opening, as well as relocation, closing or temporary discontinuation of business operations at the principal place of business;
5. circumstances which make it clear to a prudent director that the ability to fulfil obligations is endangered;
6. the occurrence of insolvency or over indebtedness;
7. any intended expansion of the business purpose;
8. any reduction of paid-in capital pursuant to Article 16 para. 1;
9. any envisaged change regarding the protection of customer deposits pursuant to Article 18;
10. the names of the person(s) responsible for internal auditing as well as any change in that (those) person(s);
11. the reduction of eligible own funds below the amounts specified in Article 16 para. 1;
12. any intended change to the outsourcing of the operational tasks of payment services pursuant to Article 21;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 28 / 102 13. any intended change to the identity, including any change to the Commercial Register number or address or the place of incorporation of the agents pursuant to Article 22; 14. any non-compliance with benchmarks for a period of more than one month, as prescribed pursuant to Article 17 of this Federal Act or regulations or administrative decisions issued on the basis of this Federal Act. (2) In the case of the persons pursuant to Article 10 para. 1 no. 4 changing, then the procedure set out in Article 19 of this Federal Act as well as in Articles 20a and 20b BWG is to be applied. In the event that there is a change of legal form, a merger or a de-merger, the procedure pursuant to Article 21 paras. 1 to 3 BWG as well as Articles 7 to 9, 11 and 12 of this Federal Act are to be applied. Registration application for account information services Article 15.(1) An entity that applied to be entered into the register of payment institutions (Article 13 para. 2) for providing account information services (Article 1 para. 2 no. 8), shall attach the details and documentation pursuant to Article 9 para. 1 nos. 1, 2, 5 to 8, 10, 12, 14, 16 and 17 to the application. (2) Furthermore, as a condition for being entered, the applicant shall prove:

1. that professional indemnity insurance has been taken out for the locations in which it offers its services, or
2. another comparable form of guarantee exists, which covers its liability towards account servicing payment service providers (ASPSPs) and the payment service user for any unauthorised or fraudulent access to payment account information, or their unauthorised or fraudulent use. (3) Only Article 13, 27 to 31, 34, 41, 48, 48, 61, 63, 85 to 87, 88 and 90 to 95 shall apply to account information service providers (AISPs). (4) In the event that the applicant does not fulfil the conditions in accordance with para. 1 or 2, then the FMA shall refuse to enter the applicant in the register of payment institutions. Prior to entering the registration, the FMA must consult the Oesterreichische Nationalbank. (5) If the account information service provider breaches the provisions in accordance with para. 1, 2 or 3, the FMA shall delete their entry in the register of payment institutions. This shall also apply in the event that the FMA is aware of the account information service provider having permanently ceased its business operations. Section 2: Other requirements and regulatory provisions for ongoing operations Own funds Article 16. (1) The Common Equity Tier 1 capital pursuant to Chapter 2 of Part Two Title I Part Two of Regulation (EU) No 575/2013, shall not at any point be less than:
3. EUR 20 000, if the payment institution only conducts money remittance business (Article 1 para. 2 no. 6);

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 29 / 102 2. EUR 50 000, if the payment institution only conducts payment initiation services (Article 1 para. 2 no. 7); 3. EUR 125 000, if the payment institution only conducts one of the payment services listed in Article 1 para. 2 nos. 1 to 5. (2) The Common Equity Tier 1 capital pursuant to Chapter 2 of Part Two Title I of Regulation (EU) No 575/2013 shall not be allowed to fall below the amounts listed in para. 1 or the amounts calculated on the basis of a calculation pursuant to Article 17, with the respective higher amount being significant. Calculation of own funds Article 17. (1) Payment institutions shall hold adequate own funds at all times. Payment institutions that only offer payment initiation services (Article 1 para. 2 no. 7) or account information services (Article 1 para. 2 no. 8) or both. Notwithstanding the initial capital requirements set out in Article 10 para. 1 no. 7 in conjunction with Article 16 para. 1, payment institutions shall at all times hold a level of own funds, which is calculated in accordance with one of the following three methods:

1. Method A: payment institutions must hold an amount of own funds corresponding to at least 10 % of its fixed overheads for the preceding year. The FMA may adjust this requirement in the case of there being a material change in a payment institution's business activity in comparison with the preceding year. Payment institutions, which at the calculation date have been conducting business activities for less than one year, shall be required to hold own funds corresponding to at least 10 % of the fixed overheads as projected in its business plan, unless the FMA has requested an adjustment to that plan pursuant to para. 4.
2. Method B: payment institutions must hold own funds that correspond to at least the total of the following elements multiplied by the scaling factor k pursuant to para. 2, with the payment volume corresponding to one twelfth of the total amount or payment transactions conducted by the payment institution in the previous year: a. 4.0 % of the slice of payment volume up to EUR 5 million plus b. 2.5 % of the slice of payment volume from over EUR 5 million up to EUR 10 million plus c. 1 % of the slice of payment volume from over EUR 10 million up to EUR 100 million plus d. 0.5 % of the slice of payment volume from over EUR 100 million up to EUR 250 million plus e. 0.25% of the slice of payment volume over EUR 250 million.
3. Method C: payment institutions must hold own funds that at least correspond to the relevant indicator defined in lit a), multiplied by the multiplication factor defined in lit b) and multiplied by the scaling factor defined in para. 2.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 30 / 102 a. The relevant indicator is the sum total of the following components: aa) interest income, bb) interest expenses, cc) earnings from commission and fees, and dd) other operating income. Each amount shall be included in the sum total including whether the amount is positive or negative. Income from extraordinary or irregular items may not be included in the calculation of the relevant indicator. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator if the expenditure is incurred from an undertaking subject to supervision pursuant to this Federal Act or pursuant to Directive (EU) 2015/2366. The relevant indicator is calculated on the basis of the twelve￾month observation, at the end of the previous financial year. The relevant indicator shall be calculated for the previous financial year. Nevertheless, own funds requirements which have been calculated according to Method C shall not be allowed to form less than 80 % of the amount, which was calculated as the average value of the relevant indicator for the last three financial years. Estimates may only be applied where there are no audited figures available pursuant to Article 25. b. The multiplication factor corresponds to: aa) 10 % of the slice of the relevant indicator up to EUR 2.5 million, bb) 8 % of the slice of the relevant indicator over EUR 2.5 million up to EUR 5 million, cc) 6 % of the slice of the relevant indicator over EUR 5 million up to EUR 25 million, dd) 3 % of the slice of the relevant indicator over EUR 25 million up to EUR 50 million, ee) 1.5 % of the slice of the relevant indicator over EUR 50 million. (2) The scaling factor k to be used in methods B and C shall be:

1. 0.5 if the payment institution only provides the payment service listed in Article 1 para. 2 no. 6;
2. 1 if the payment institution provides one of the payment services listed in Article 1 para. 2 nos. 1 to 5. (3) The payment institution shall submit a proposal to the FMA regarding the method to be selected at the same time as submitting the application for the granting of a licence. The payment institution may also submit an application to the FMA while business operations are ongoing, for the next business year for the specification of another method. The FMA may also determine a different method on its own initiative. After consulting the payment institution, it shall determine by means of an administrative decision, in the case of a licence being granted in the form of an administrative decision granting a licence pursuant to Article 10 para. 3, which method the payment institution shall apply. It shall take into account the complexity of the business model, in particular whether the operation of payment accounts is associated with this business model, whether payment transactions are covered by a credit line for the payment services user as defined in Article 1 para. 2 no. 4, the payment volume as well as how long the entity has already existed for. The method must

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 31 / 102 adequately reflect the corporate governance, organisational structure and, in particular, the risk management pursuant to Article 20. (4) Furthermore, the FMA may, based on an assessment of the risk management processes, the loss database and the internal control system of the payment institution,

1. prescribe that the payment institution must hold own funds that are up to 20% higher than the amount which would be calculated when applying the method chosen in accordance with para. 1; or
2. permit the payment institution that its own funds correspond to an amount that is up to 20 % lower than the amount that would be calculated when applying the method chosen pursuant to para. 1. Safeguarding of customer deposits Article 18. (1) Payment institutions and electronic money institutions pursuant to Article 3 para. 2 no. 2 shall protect all funds that they received from payment service users or through another payment service provider for the execution of payment transactions by means of one of two following options:
3. Option A a. The funds may not at any time be commingled with funds of any other natural or legal person other than the payment service users on whose behalf the funds are held; b. The funds, where they are still held by the payment institution or the electronic money institution pursuantto Article 3 para. 2 no. 2 at the end of the business day following the day on which the funds were received and, aa) if the payment service provider of the payer is concerned, the funds have not yet been transferred to another payment service provider, or bb) if the payment service provider of the payee is concerned, the funds have not yet been transferred to the payee, must be transferred into a separate trust account held at a credit institution or a central bank at the discretion of that central bank, or invested separate from the assets of the payment institution in secure liquid assets with a low risk pursuant to para. 4, and c. the funds shall be held in a way that they remain identifiable, so that they may be allocated at any time to the individual payment service user, in accordance with the proportion of funds that the respective user holds. In the event of enforcement against their payment service provider, payment service users may file an objection (Article 37 of the Enforcement Code (EO; Exekutionsordnung)) if the enforcement relates to the funds protected in accordance with lit. c). In accordance with the same conditions, in the event of bankruptcy proceedings being initiated against the assets of their payment service provider, the payment service user shall have a right to separation

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 32 / 102 (Article 44 of the Insolvency Code (IO; Insolvenzordnung), published in Imperial Law Gazette 337/1914)). 2. Option B The funds shall be covered by an insurance policy or another comparable type of guarantee from an insurance undertaking or credit institution, which does not belong to the same group as the payment institution or the electronic money institution pursuant to Article 3 para. 2 no. 2 itself, in an amount that is equivalent to that which would have had to have been held separately in the absence of the insurance policy or another comparable guarantee, and which shall be paid out in the event that the payment institution or the electronic money institution pursuant to Article 3 para. 2 no. 2 is unable to meet its financial obligations. (2) If a payment institution is required to safeguard funds pursuant to para. 1 and a portion of these funds is to be used for future payment transactions while the remaining amount is to be used for non-payment services, then the obligations pursuant to para. 1 shall continue to apply for the proportion of the funds to be used for future payment transactions. Where the proportion for future payment transactions is variable or is not known in advance, a payment institution may apply a representative proportion that is typically used for payment services, provided that this representative proportion can, in the opinion of the FMA, be estimated on the basis of historical data with an adequate degree of certainty. (3) The payment institution, or where applicable the electronic money institution pursuant to Article 3 para. 2 no. 2 shall demonstrate and prove to the FMA upon request while business operations are ongoing that it has taken adequate measures to satisfy the requirements defined in paras. 1 and 2. If no proof is provided or if the measures are inadequate, the FMA shall request the payment institution to provide the necessary proof or take precautions, which are suitable and necessary for correcting the prevailing shortcomings. The FMA shall set an appropriate deadline for this purpose. If proof or precautions are not provided or taken, or not within the deadline, the FMA may take measures in accordance with Article 94 paras. 1 and 8. (4) Secure low-risk assets pursuant to para. 1 no. 1 lit b sublit bb are assets that fall under one of the categories pursuant to Article 336 (1) Table 1 of Regulation (EU) No 575/2013, for which the own funds requirement against specific risk is not higher than 1.6 %, with other qualifying items pursuant to Article 336 (4) of Regulation (EU) No 575/2013 being excluded. Furthermore, safe low-risk assets shall also be units in an undertaking for collective investment in transferable securities (UCITS) as defined in Directive 2009/65/EC, which only invests in assets as defined in the previous sentence. In exceptional circumstances, the FMA may determine by means of a Regulation which of the assets defined in the first and second sentence do not constitute safe liquid low-risk assets for the purposes of para. 1 no. 1 lit b sublit bb. To do so, the FMA must assess the safety, maturity, value or other risk factors of the assets defined in the first and second sentence and consider these factors in its regulation.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 33 / 102 Checking of ownership interests Article 19. (1) Any person who has decided to acquire or increase, whether directly or indirectly, a qualifying holding as defined in Article 4 (1) (36) of Regulation (EU) No 575/2013 in a payment institution, with the consequence that the equity holding or voting rights would reach or exceed 20 %, 30 % or 50 % or the payment institution would become its subsidiary, shall notify this in advance in writing to the FMA. The same shall also apply for any person who has decided to dispose of its qualifying holding or reduce its qualifying holding to an extent that its equity holding or voting rights would fall below 20 %, 30 % or 50 %, or so that the payment institution would no longer be its subsidiary. (2) With regard to the procedure and the criteria for the assessment of checking of holdings, Articles 20a and 20b BWG shall apply. (3) The proposed acquirer of a qualifying holding shall be required to submit details to the FMA about the scope of the proposed holding as well as information pursuant to Article 20b para. 3 BWG. (4) Where the risk exists that the influence that is exercised by the proposed acquirer named in para. 3 is anticipated have a detrimental effect on the prudent and sound management of the payment institution, then the FMA shall raise an objection to avert such a risk or take other appropriate measures to put an end to this situation. Such measures shall consist in particular of:

1. supervisory measures pursuant to Article 94 para 1,
2. sanctions against the directors pursuant to Article 94 para. 1 no. 3, or
3. the submission of a motion to a competent first-instance commercial court at the payment institution's registered office to order the suspension of voting rights associated with those shares or other holdings held by the shareholders or other partners in question, a. for the duration of such a threat existing, with the end of such a threat being determined by the court; or b. until such shares or other holdings have been purchased by third parties following the non-prohibition having occurred (Article 20a para. 2 BWG); this court is to rule in the process of alternative dispute resolution. The measures shall also apply to those persons, who do not comply with the obligation to make an ex ante notification to the FMA pursuant to para. 1. (5) If a holding was acquired despite being prohibited by the FMA (Article 20a para. 2 BWG), then the voting rights of the shares or other units held by the relevant shareholders or other members shall be suspended, until the FMA determines that the reason for the prohibition having been issued no longer exists. (6) If the court suspends voting rights pursuant to para. 4 no. 3, the court shall at the same time appoint a trustee who must satisfy the requirements defined in Article 10 para. 1 no. 4 BWG, and shall assign the exercising of the voting rights to the trustee. In the case of para. 5, the FMA shall apply for the appointment of a trustee at the competent court pursuant to para. 4 no. 3 without delay, where it becomes aware of voting rights having been suspended. The trustee shall be entitled

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 34 / 102 to be compensated for expenses incurred, as well as for remuneration of his/her activities; the amount of which is to be determined by the court. The payment institution as well as the shareholders and other members, whose voting rights are suspended, shall be jointly and severally liable. The obliged parties shall be entitled to appeal against decisions that determine the amount of remuneration for the trustee and the expenses to be reimbursed to them. No further appeal shall take place against the decision of the Oberlandesgericht (regional court of appeal). Organisational requirements, confidentiality and due diligence obligations Article 20. (1) Payment institutions shall be required to have sound internal governance and shall document this comprehensibly in writing. This shall include in particular:

1. an organisational structure with precisely defined, transparent and coherent areas of responsibility that avoid conflicts of interests and jurisdictions in business operations by means of appropriate structural and procedural delineations, as well as
2. for the purpose of identifying, appraising, managing and reporting risk related to the payment services business and the payment services operations as well as the risks arising from the remuneration policy and remuneration practices, payment institutions shall have administrative, accounting and control procedures in place that are appropriate to the nature, scale and complexity of the payment services provided and, if applicable, the activities performed in accordance with Article 7 para. 2. (2) The directors of a payment institution shall apply the due diligence and care of a prudent and conscientious director as defined in Article 84 para. 1 of the Stock Corporation Act of 1965 (AktG 1965; Aktiengesetz 1965), as published in Federal Law Gazette No. 98/1965. In so doing, they shall, in particular, inform themselves of the risks associated to payment services business and payment services operations as well as the risks arising from the remuneration policy and remuneration practices and manage, monitor and limit this risk through adequate strategies and procedures while also ensuring the solid and prudent management of the payment institution. Furthermore,the directors shall inform the chairperson of the supervisory body without delay about all FMA administrative decisions that have been issued on the basis of the provisions listed in Article 94. (3) The directors shall be responsible for ensuring that the payment institution has a proper business organisation as defined in para. 1, which in particular includes:
3. appropriate measures for governance arrangements, control mechanisms and procedures to ensure that the payment institution is able to fulfil its obligations;
4. full documentation of business activities, which allow the prudential supervision by the FMA for the scope of its competence;
5. data protection measures pursuant to Articles 24, 25 and 32 of Regulation (EU) 2016/679 as well as adequate business continuity plan for data processing systems;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 35 / 102 4. an adequate risk management and appropriate control mechanisms as well as procedures and data processing systems to ensure compliance with the requirements of the FM-GwG and Regulation (EU) No 2015/847; 5. in the case that the licence contains an option for granting of credit (Article 1 para. 2 nos. 4 or 5), as adequate risk management system with regard to credit risk (Article 107 of Regulation (EU) No 575/2013); 6. an adequate risk management procedure with regard to the risk of money laundering and terrorist financing. (4) The expediency of the procedures pursuant to paras. 1 and 3 as well as their application, shall be reviewed at least once a year by way of an internal audit pursuant to Article 42 paras. 1, 2, and 3, Article 42 nos. 1 and 3 and Article 42 paras. 5, 6 and 7 BWG, although Article 42 para. 3 BWG shall be applied subject to the proviso that the requirement of at least two directors shall only apply if the payment institution actually has at least two directors owing to its size and organisation. The areas inspected and the findings of the inspection shall be documented. (5) Payment institutions as well as any persons employed by them shall be bound to secrecy for secrets, which they have exclusively been a party to as a result of payment services (Article 1 para. 2) that they execute on behalf of their payment service users, unless

1. this obligation to professional secrecy is in conflict with a statutory disclosure obligation;
2. the payment service user gives their written consent to the disclosure of the secret;
3. disclosure of the secret is required to clarify legal issues resulting from the relationship between the payment service provider and its payment service user. (6) Article 36 BWG shall apply to payment institutions. Outsourcing of tasks Article 21. (1) The outsourcing of important operational tasks, including ICT systems, shall not to be allowed to materially impair the quality of the payment institution's internal control mechanisms as well as the payment institution's supervision by the FMA with regard to its compliance with the requirements set out in this Federal Act. An operational task shall be deemed to be important in this context, if it being conducted inadequately or its failing to be conducted would materially impair the continuing compliance of a payment institution with the requirements of its licence or its other obligations pursuant to this Federal Act, or if its financial ability to perform, or the soundness or continuity of its payment services are materially impaired. When concluding, implementing or terminating an agreement in relation to the outsourcing of important operational tasks, it shall be necessary to proceed with due required professionalism and diligence. In particular, a clear division of rights and obligations between the payment institution and the service provider shall be determined by means of a written agreement. (2) In this regard, the outsourcing of operational tasks shall not be allowed to
4. result in the delegation of the tasks of the directors;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 36 / 102 2. alter the relationship and obligations of the payment institution towards its payment service users pursuant to the terms of this Federal Act; 3. prevent or impede compliance with the requirements for the licence and the remaining provisions pursuant to Chapter 2 of this Federal Act; and 4. lead to the removal or modification of other requirements in accordance with which the payment institution's licence was granted. (3) The payment institution shall notify the FMA in advance in writing of any intended outsourcing of operational tasks of payment services, irrespective of whether these tasks qualify as important tasks as defined in para. 1. At the FMA's request, the payment institution shall provide the FMA with all the information required to monitor whether the requirements of this Federal Act in relation to the outsourcing of tasks are being complied with. Agents Article 22. (1) Where a payment institution intends to provide payment services through an agent, it shall notify the FMA in writing of this fact, and including the following information:

1. name and address of the agent;
2. a description of the internal control mechanisms that the agent uses to fulfil the requirements of the FM-GwG; the description must be updated without delay in that of there being substantial changes to the details submitted in the initial notification;
3. the name of the director of the agent, who is intended to be used in the provision of payment services, and in the case of agents that are not payment service providers, the proof that they are persons of good repute (Article 10 para. 1 nos. 9, 10 and 12) and have the required professional qualification and experience (Article 10 para. 1 no. 11);
4. the payment services of the payment institution, which the agent has been entrusted;
5. as applicable the agent's identification code or identification number. (2) the FMA shall check the accuracy of the details provided, and in any case notify the payment institution within two months of receipt of the details pursue to para. 1, whether the agent is entered into the register of payment institutions pursuant to Article 13 para. 2. (3) If the FMA has any doubt over the correctness of the information, it make take additional measures to check the information received, and may in particular demand further information concerning the agent's organisational structure. The FMA shall prohibit the provision of payment services by agents by means of an administrative decision, if the requirements pursuant to para. 1 nos. 1 to 5 have not been fulfilled. (4) If the FMA has no doubts regarding the correcting of the details supplied, then it shall enter the name and the address of the agent in the register of payment institutions pursuant to Article 13 para. 2. Once the entry has been made, the agent may commence its activities for the payment institution.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 37 / 102 (5) If the payment institution intends to provide payment services in another Member State by making use of agents located in that Member State or by establishing a branch, then the procedure pursuant to Articles 27 and 28 shall apply. (6) The payment institution shall notify the FMA about any changes regarding the making use of agents, including using additional agents, without delay. (7) Performing activities as an agent does not constitute an employment relationship within the meaning of provisions contained in Federal Acts governing employment, social or tax law. Liability for persons attributable to the payment institution Article 23. (1) Payment institutions are fully liable without exception for the conduct of their employees, agents, branches or persons to which or whom their activities have been outsourced. (2) A payment institution, which has assigned operational tasks to a third party, shall take appropriate precautions to guarantee the fulfilment of the requirements of this Federal Act in relation to the outsourcing of operational tasks, in particular those set for in Article 21 para. 1. (3) The payment institution shall ensure that agents or branches active on its behalf inform the payment service users prior to signing of such an agreement about the capacity in which they will be active and which payment institution they will be representing. Retention of records and receipts Article 24. For the purpose of Chapter 2 of this Federal Act, payment institutions shall retain all relevant records and receipts for a period of at least five years. The usage of the data processed for the purposes of Chapter 2 shall be permitted for the purposes of prevention, investigation or identification of instances of fraud in payment transactions in accordance with the Data Protection Act (DSG; Datenschutzgesetz), as published in Federal Law Gazette I No. 165/1999, Regulation (EU) 2016/679 and Regulation (EC) No 45/2001, as well as in accordance with statutory competences. Payment service providers shall only be allowed to process the personal data necessary for the provision of their payment services with the explicit approval of the payment service user. Accounting and auditing of the annual financial statement Article 25. (1) Payment institutions, which are financial institutions as defined in Article 4 (1) (26) of Regulation (EU) No 575/2013, must apply Article 43 paras. 1, 2 and 3, Articles 45 to 59a, Article 64 and Article 65 para. 2 BWG. All other payment institutions shall apply only the provisions in Book III of the UGB and the provisions that apply to their respective legal form. All payment institutions shall disclose their own funds, own funds requirements and compliance with own funds requirements. With regard to disclosure, Article 65 para. 1 BWG shall be applicable with the proviso that references to Article 63 para. 5 BWG shall be replaced by references to Article 25 para. 3 of this Federal Act.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 38 / 102 (2) In the case that payment institutions also conduct other activities as defined in Article 7 para. 2 no. 2 or 3 to a significant extent, then special segment statements about the payment services pursuant to Article 1 para. 2 as well as ancillary activities as defined in Article 7 para. 2 no. 1 shall be disclosed in the notes to their annual financial statement and consolidated financial statement, which cover the compulsory information included the notes. The segment statements shall give a true and fair view of the assets, financial and earnings situation of the "payment services and associated ancillary services" segment in the appropriate depth of detail and provide a reconciliation to the respective disclosures of the entire entity or group. The information for this segment shall be drawn up based on the capture, valuation and layout provisions in Article 43 and Articles 45 to 59a BWG or, where applicable, the international accounting standards pursuant to Article 245a UGB. (3) The annual financial statement and, where necessary, the management report or the consolidated financial statement and the consolidated management report of payment institutions as well as the compliance with Article 6 paras. 2 to 4 and 6, Article 9 para. 1 no. 11, Article 10 para. 1 no. 3, Article 14 para. 2, Articles 16 to 18, Articles 20 to 22, Article 23 para. 2 and Article 25 para. 1 as well as the other provisions of this Federal Act, of Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, Article 29 and Article 40 para. 1 FM-GwG as well as the obligations of the payment institution pursuant to Regulation (EU) No 2015/847 are to be audited by an external auditor. This audit covers the organisational structure as well as the administrative, accounting and control mechanisms (Article 20 para. 1) which the directors have put in place in view of the provisions set forth. The outcome of this audit opinion shall be presented in an annex to the audit report on the annual financial statement (prudential report for payment institutions). The outcome of the audit of compliance with Article 7 para. 6, Articles 16 to 18 and Article 25 para. 1 of the Federal Act must contain a positive assurance, outcome of the audit of compliance with Article 7 paras. 2 to 4, Article 9 para. 1 no. 11, Article 10 para. 1 no. 3, Article 14 para. 2, Articles 20 to 22, Article 23 para. 2 and Article 24 of this Federal Act, of Articles 4 to 17, Article 19 para. 2, Articles 20 to 24, 29 and Article 40 para. 1 FM-GwG as well as the obligations of the payment institution pursuant to Regulation (EU) 2015/847 shall at least have a negative assurance. With regard to the audit relating to compliance with other regulations in this Federal Act, the auditor shall report significant findings about which they become aware during they activities, even where such findings do not lead to a reporting obligation pursuant to Article 95 para. 1 or 2. The audited annual financial statement plus notes and management report and, if applicable, the consolidated financial statements plus notes and consolidated management report, the report of the auditor and the annex to the audit report shall be transmitted to the FMA and the Oesterreichische Nationalbank in accordance with the deadlines stipulated in Article 44 para. 1 BWG. This audit report and annex shall be transmitted promptly to the directors and the supervisory bodies of the payment institution specified by the law or articles of association, to ensure that the deadline for submission to the FMA and Oesterreichische Nationalbank may be observed. The FMA may specify the mode of transmission, form and layout of the annex to the audit report by way of a Regulation. The FMA may, after consulting with the

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 39 / 102 Oesterreichische Nationalbank, prescribe by means of a Regulation that an electronic submission must comply with specific layouts and minimum technical requirements. The FMA is empowered to prescribe by means of a Regulation that electronic submissions are exclusively to be submitted to the Oesterreichische Nationalbank, if this is appropriate for reasons of economy, provided that data remains available in electronic form to the FMA at all times, and where doing so does not compromise supervisory interests. (4) The auditor's information, submission and inspection rights (Article 272 UGB) shall apply to all documents and data storage media, also if conducted or stored by a third party or when conducted or stored in a foreign country. If documentation that is the subject to the audit, especially accounting documents, are drawn up or stored abroad, the payment institution shall ensure, without prejudice to the aforementioned inspection rights of the auditor, the immediate availability of documentation concerning the current business year as well as at least the three preceding business years are available in Austria at all times. The payment institution shall make the inspection plans reports by the internal audit unit available to the auditor. (5) Auditors of payment institutions may be certified public auditors or audit firms as well as auditing bodies of statutory audit institutions. (6) Persons for whom reasons of exclusion exist as defined in Article 62 BWG or pursuant to Articles 271 and 271a UGB or in accordance with the provisions of other Federal Acts shall not be allowed to be appointed as auditors. The reason for exclusion as defined in Article 62 no. 1a BWG shall apply with the proviso that the reference to Article 63 paras. 4 to 6a BWG shall be replaced by a reference to Article 25 para. 3 first sentence of this Federal Act, while Article 62 no. 17 BWG shall apply subject to the proviso that the reference to Article 63 para. 3 BWG is replaced by a reference to Article 95 of this Federal Act. The provisions pursuant to Article 62a BWG in conjunction with Article 275 UGB regarding the responsibility of external auditors shall also apply to payment institutions. (7) The auditors must be appointed prior to the start of the business year that is the subject of the audit and must be notified in writing to the FMA without delay; in the event that an external auditing company is appointed as the auditor, then the natural persons named for the audit engagement pursuant to Article 77 para. 9 of the Tax Advising and Related Professions Act (WTBG; Wirtschaftstreuhandberufsgesetz) as published in Federal Law Gazette I No. 137/2017 must be indicated in this notification. Any changes in the persons named must be notified to the FMA without delay. The FMA may raise an objection as defined in Article 270 para. 3 UGB to the appointment of an external auditor or any natural person named pursuant to Article 77 para. 9 WTBG, if justified reasons exist with regard to the existence of a reason for exclusion or any other bias; in the case of appointments requiring a notification, the objection must be filed within one month. The court shall rule on any objection taking into account the reasons for exclusion; until the legally enforceable court decision exists, the external auditor or the natural person named pursuant to Article 77 para. 9 WTBG shall neither be allowed to undertake auditing activities nor may they be provided with any

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 40 / 102 information by the payment institution that is to be treated as being confidential pursuant to Article 20 para. 5 of this Federal Act. (8) The auditor shall certify to the FMA that reasons for exclusion do not exist, within two weeks of their appointment. At the FMA's request, the external auditor must also provide all additional certifications and evidence necessary for the purpose of assessment. If such a request is not fulfilled, the FMA may proceed in accordance with para. 7. Reporting Article 26. (1) Payment institutions shall submit reports immediately following the end of each calendar quarter to the FMA corresponding to the specific format prescribed in the regulation pursuant to para. 5. These reports shall in particular contain information about the balance sheet, off-balance sheet items, the income statement as well mandatory disclosures in the notes to the financial statements as well as any information that permit the evaluation and monitoring of Article 7 para. 6, and Articles 18 and 20. (2) Payment institutions shall submit reports immediately following the end of each calendar month to the FMA with regard to their compliance with Articles 16 and 17. These reports shall contain both information about the monitoring of compliance with these regulatory standards as well as material information necessary about how this information was derived. (3) Payment institutions shall submit reports immediately following the end of each calendar half￾year to the FMA on company-related master data. Notwithstanding these requirements, payment institutions shall also report any changes to the master data without undue delay. The report regarding employee headcount must only be reported at the end of each year, to be received by 31 January of the following year at the latest. (4) The Oesterreichische Nationalbank shall provide expert opinions on the reports pursuant to para. 2 and the associated FMA Regulations issued in this regard. (5) The FMA shall define the specific format of the reports pursuant to paras. 1 to 3 by means of a Regulation. The FMA, in doing so, shall take into account the need for meaningful reporting as a requirement for the ongoing supervision of payment institutions. The FMA may determine by means of a Regulation that individual items stated in para. 2 only need to be provided on a quarterly basis. In issuing this regulation, the FMA shall also take the national economic interest in maintaining a viable financial market and ensuring financial stability. The FMA may, insofar as it is not prevented from performing its duties in accordance with this or other Federal Acts, stipulate by means of a Regulation that the reports pursuant to paras. 1 to 3 shall be submitted exclusively to Oesterreichische Nationalbank. Regulations issued by the FMA in accordance with this paragraph shall require the consent of the Federal Minister of Finance. (6) The reports pursuant to paras. 1 to 3 shall be submitted electronically in a standardised format. The submissions must meet certain minimum requirements to be announced by the FMA after consultation with the Oesterreichische Nationalbank.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 41 / 102 Section 3: Freedom of establishment and freedom to provide services as well as cross-border supervision Payment institutions from other Member States in Austria Article 27. (1) Payment services pursuant to Article 4 (3) of Directive (EU) 2015/2366 may be provided by a payment institution pursuant to Article 4 (4) of Directive (EU) 2015/2366 that has been authorised in another Member State, within the meaning of Directive (EU) 2015/2366 in Austria through a branch or by means of the freedom to provide services, provided that their authorisation pursuant to Article 5 of Directive (EU) 2015/2366 authorises them to do so. Ancillary services pursuant to Article 7 para. 2 nos. 1 and 2, and paras. 3 to 6 may only be provided in connection with the provision of payment services. Ancillary services as defined in Article 7 para. 2 no. 3 are not covered by the freedom to provide services and the freedom of establishment under this Federal Act. (2) The FMA shall check the information pursuant to Article 28 (1) of Directive (EU) 2015/2366 within one month of receipt, and shall communicate the relevant information about the payment services to the competent authority of the home member state, which the payment institution in question intends to provide in exercising the freedom of establishment or the right to provide services. The FMA shall in particular notify any justified ground for concern with regard to money laundering or terrorist financing as defined in Directive (EU) 2015/849 in conjunction with the planned making use of an agent or the establishment of a branch. (3) The provision of payment services in exercising the freedom of establishment or the right of freedom to provide services in Austria shall be permissible, once an entry exists in a register pursuant to Article 14 of Directive (EU) 2015/2366 that has been established in the home Member State. (4) Payment institutions that provide payment services by exercising the freedom of establishment or the right of freedom to provide services in Austria, shall comply with the provisions contained in Chapters 3 and 4 of this Federal Act and Article 36 BWG as well as any Regulations and administrative decisions issued on the basis of these provisions. Payment institutions that provide payment services in exercising the freedom of establishment in Austria, shall in addition also comply with the provisions of the FM-GwG. The procedure pursuant to Article 30 shall be applied. (5) The competent authorities in the home Member State of a payment institution pursuant to Article 4 (4) of Directive (EU) 2015/2366 may, having notified the FMA in advance, conduct on-site investigations at this branch themselves, in exercising their obligations to do so. Austrian payment institutions in other Member States Article 28. (1) Any payment institution pursuant to Article 4 no 4 that wishes to provide payment services in the territory of another Member State by exercising the freedom of establishment or the right of freedom to provide services, shall notify the FMA in writing of this intention and submit the following information:

1. the company, Commercial Register number, and the address of the payment institution;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 42 / 102 2. the Member State in whose territory the branch is planned to be established; 3. the types of payment services that the payment institution would like to provide there; 4. the information pursuant to Article 22, if the payment institution intends to make use of an agent; 5. the information about the business plan (Article 9 para. 1 no. 2) and the internal control system (Article 9 para. 1 no. 5) in relation to the payment services business in the Host Member State; 6. a statement about the organisational structure of the branch; 7. the name of the directors of the branch. (2) If the payment institution intends to outsource operational tasks from payment services to other organisations in the Host Member State, then it shall inform the FMA about this. (3) The FMA shall, within one month of receiving the information listed in para. 1, pass it on to the competent authority of the Host Member State named pursuant to Article 22 (1) of Directive (EU) 2015/2366. (4) If the FMA does not agree with the assessment pursuant to Article 28 (2) Directive (EU) 2015/2366 by the competent authority in the Host Member State named pursuant to Article 22 (1) of Directive (EU) 2015/2366, it shall be required to communicate the reasons for their decision. (5) In the event that the FMA's assessment returns a negative verdict in particular on the basis of the information submitted by the designated competent authority of the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366, then the FMA shall reject the entry of the agent or of the branch, or shall delete the entry in the case that one has already been made. (6) The FMA shall communicate its decision within three months of receiving the information listed in para 1 to both the designated competent authority in the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 as well as the payment institution. (7) Agents or branches shall only be allowed to commence their activities in the Host Member State concerned following their entry into the FMA's register of payment institutions pursuant to Article 13 para. 2. (8) The payment institution shall inform the FMA about the point in time, from when it shall be commencing its activities using agents or by means of a branch in the Host Member State concerned. The FMA in turn shall inform the designated competent authority in the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 about this. (9) The payment institution shall inform the FMA about any relevant change to the information submitted in accordance with para. 1 without delay. The FMA shall pass on this information to the designated competent authority in the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 without delay.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 43 / 102 Supervision in the context of the freedom of establishment and the freedom to provide services Article 29. (1) The FMA may request the cooperation of the competent authority of another Member State in an on-site inspection or in an investigation. Where the FMA receives a request with respect to an on-site inspection or an investigation, it shall be active within the scope of its powers, by

1. conducting the inspections or investigations itself or by conferring this task to Oesterreichische Nationalbank; or
2. permitting the requesting authority to carry out the inspection or investigation; or
3. permitting external auditors or experts to conduct the inspection or investigation on behalf of the authority. (2) The FMA may prescribe that payment institutions that are active in Austria through agents or branches are required to report to the FMA at regular intervals about the activities performed in Austria. These reports are to be prescribed for informative or statistical purposes as well as for monitoring compliance with the rules set forth in Chapters 3 and 4 of this Federal Act. (3) The FMA shall supply other competent authorities with the information specified in this Federal Act that is required for the purposes of carrying out the tasks of the designated competent authority pursuant to Article 22 (1) of Directive (EU) 2015/2366, in particular in the case of infringements or suspected infringements by an agent or a branch where they occurred in conjunction with the exercising of the right of the freedom to provide services. In so doing the FMA shall, if requested to do so, pass on all relevant information and on its own initiative shall supply all material information, including such information regarding the compliance with requirement pursuant to Article 10 para. 1 no. 2 by the payment institution. The FMA may advise when exchanging information with other competent authorities when transmitting such information that it may only be published with the FMA's express consent. In this case, information may only be exchanged for the purposes for which consent was given. (4) Payment institutions with their registered office in another Member State that are active in Austria by means of agents by way of the freedom of establishment, shall name a central point of contact in Austria. This central point of contact should ensure adequate communication and reporting about the compliance with the rules set out in Chapters 3 and 4 of this Federal Act, as well as also simplifying supervision by the FMA and the competent authority of the Home Member State, in particular by submitting documentation and information when requested to. Measures in the event of legal infringements and precautionary measures Article 30. (1) If the FMA determines that a payment institution that is active in Austria through agents, branches or under the right of the freedom to provide services, is not complying with the regulations in Chapters 3 and 4 of this Federal Act, it shall inform the designated competent authority of the Home Member State pursuant to Article 22 (1) of Directive 2015/2366 of this without delay.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 44 / 102 (2) If the FMA for its part receives a notification pursuant to para. 1 from the designated competent authority of the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366, the FMA shall take all suitable measures without delay, so that the payment institution concerned rectifies its irregular situation. It shall notify these measures to the designated competent authority in the Host Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 as well as the competent authorities of all other affected Member States without delay. (3) In emergency situations, where immediate measures are necessary to avert a severe threat of the collective interests of payment service users in Austria, the FMA may, in parallel to the cross-border cooperation between the competent authorities and provided that the designated competent authority of the Home Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 has not yet taken any measures pursuant to Article 29 of Directive (EU) 2015/2366, take precautionary measures, in particular measures pursuant to Article 94 para. 1. (4) Precautionary measures pursuant to para. 3 must be appropriate and expedient for their intended purpose of averting a severe threat of the collective interests of payment services users in Austria. These precautionary measures shall not be allowed to lead to a preferential treatment of the payment service users of an Austrian payment institution compared to the payment service users of payment institutions in other Member States. Precautionary measures are to be set on a temporary basis and are to be ended as soon as the severed threat that has been determined has been averted. (5) The FMA shall inform the designated competent authority pursuant to Article 22 (1) of Directive (EU) 2015/2366 and those of any other Member State concerned as well as the European Commission and the EBA, where so doing is compatible with the crisis situation in advance, but in any case without delay about the precautionary measures taken pursuant to para. 3 and the underlying reasons. Competence of the EBA Article 31. (1) If the FMA considers, in cross-border cooperation with a designated competent authority of another Member State pursuant to Article 22 (1) of Directive (EU) 2015/2366 that the relevant conditions of Articles 26, 28, 29, 30 and 31 of Directive (EU) 2015/2366 are not being complied with, if may address the issue to the EBA pursuant to Article 19 of Regulation (EU) No 1093/2010 and request assistance in the matter from the EBA. (2) If the EBA has been active pursuant to Article 27 (2) of Directive (EU) 2015/2366, then the FMA shall defer from giving its decision until a settlement has been reached pursuant to Article 19 of Regulation (EU) No 1093/2010.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 45 / 102 CHAPTER 3: TRANSPARENCY OF THE CONDITIONS AND INFORMATION REQUIREMENTS FOR PAYMENT SERVICES Section 1: General provisions Scope of application of the chapter Article 32. (1) This chapter applied for single payment transactions as well as for framework contracts and the payment transactions covered by them. The parties may agree that this Chapter should not apply either partially or fully, in the case that the payment service user is not a consumer. (2) Where a derogation to the detriment of a consumer arises from the transparency and information requirements in agreements, then such derogating provisions shall be ineffective. (3) Article 5 para. 1 no. 1, no. 2 lits a and b, no. 3 lits b, c, f and g as well as no. 4 lit. a of the Distance Financial Services Act (FernFinG; Fern-Finanzdienstleistungs-Gesetz), as published in Federal Law Gazette I No. 62/2004, about certain sales information regarding the operator, the financial service, the distance contract and redress shall not apply to payment services. Other provisions remain unaffected by this Federal Act, in particular:

1. the other provisions in the FernFinG regarding pre-contractual information requirements,
2. the provisions of the General Civil Code (ABGB; Allgemeines Bürgerliches Gesetzbuch), published in the Collection of Juridical Texts (JGS; Justizgesetzsammlung) no. 946/1811 and the Consumer Protection Act (KSchG; Konsumentenschutzgesetz) published in Federal Law Gazette No. 140/1979, regarding pre-contractual information requirements as well as regarding consumer credit, and
3. the provisions of the Consumer Credit Act (VKrG; Verbraucherkreditgesetz) published in Federal Law Gazette I No. 28/2010. Charges for information Article 33. (1) A payment service provider shall not be allowed to charge any fee to the payment service user for making information available in accordance with this Chapter. (2) The payment service provider and the payment service user may agree charges for information extending beyond this scope and for its more frequent provision or transmission of this information by communications means other than those stipulated in the framework contract, provided that the services concerned are performed at the payment service user's request. (3) If a payment service provider is allowed to charge for the provision of information pursuant to para. 2, then the charge must be appropriate and in line with the actual costs of the payment service provider.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 46 / 102 Burden of proof with regard to information requirements Article 34. Proof of compliance with the information requirements contained in this chapter are the responsibility of the payment service provider. Exceptions from information requirements for low-value payment instruments and electronic money Article 35. (1) Exceptions from information requirements shall be valid for certain payment instruments. The exceptions pursuant to paras. 2 to 4 shall apply in the case that in the corresponding framework contract

1. only individual payment transactions of up to a maximum of EUR 30 are permitted, or
2. a spending limit of EUR 150 is defined, or
3. where funds are intended to be stored on the payment instrument (prepaid payment instruments) that do not exceed EUR 150 at any time. (2) By way of derogation from Articles 47, 48 or 52, the payment service provider shall provide the payer only with information about the main characteristics of the payment service, including the manner in which the payment instrument can be used, as well as information regarding liability, fees charged and other material information that are necessary for taking an informed decision; moreover, it must also be indicated where any other information and conditions are available in an easily accessible manner pursuant to Article 48. (3) It may be agreed that the payment service provider by way of derogation from Article 50 must propose changes to the conditions of the framework contract in a manner other than that stipulated in Article 47 para. 1. (4) It may be agreed, by way of derogation from Articles 53 and 54 that the payment service provider after executing a payment transaction:
4. shall only provide or make available a reference to the payment service user to enable him/her to identify the payment transaction, the amount of the payment transaction, any charges or, in the case of several payment transactions of the same kind being made to the same payee, to only communicate information about the total amount and corresponding charges for those payment transactions;
5. information referred to in no. 1 shall not be required to be communicated or made available if the payment instrument is used anonymously or if the payment service provider is not otherwise technically in a position to communicate such information. However, the payment service provider shall offer the payer an opportunity to verify the amount of funds stored. (5) For payment transactions in Austria the amounts listed in para. 1 are increased
6. in the case of individual payment transactions to a maximum of EUR 60;
7. in the case of payment instruments with a spending limit to EUR 300;
8. for payment instruments which store funds (prepaid payment instruments) up to EUR 400.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 47 / 102 Currency and currency conversion Article 36. (1) Payments shall be made in the currency agreed between the parties. (2) An offer to conduct a currency conversion prior to the initiation of the payment of the payment transaction at an auto-teller machine (ATM), at the point of sale or by the payee shall require the payer's consent. As part of such an offer, the provider of this currency conversion service shall be required to disclose all charges as well as the exchange rate to be used for converting the currency to the payer. Information about additional charges or discounts Article 37. (1) If a payee demands a fee for using a specific payment instrument or offers a discount, then it shall inform the payer about this prior to initiating the payment transaction. (2) The payment service provider or another party involved in the payment transaction shall also inform the payer prior to initiating the payment transaction about any charge incurred for using a specific payment instrument. (3) If the payer is not informed about the full amount of a charge pursuant to paras. 1 and 2, then the charging agreement shall not be effective. Obligation to inform the consumer about their rights Article 38. (1) Payment service providers shall make the leaflet that the European Commission shall produce pursuant to Article 106 (1) of Directive (EU) 2015/2366 easily accessible. They shall publish it on their websites as well as making it available in paper form in their branches, in the premises of their agents and in the premises of bodies to which they have outsourced their activities. The FMA shall make the leaflet easily accessible on its website. (2) Payment service providers shall not be allowed to pass on any costs to their customers for making the leaflet accessible to them. (3) The information shall be made accessible to persons with disabilities in a barrier-free manner using alternative means in a suitable format. Section 2: Single payment transactions Scope Article 39. (1) This section shall apply for individual payments that are not the subject of a framework contract. (2) If a payment order for a single payment transaction is submitted via a payment instrument governed by a framework contract, then the payment service provider shall not be obliged to communicate or make available information that the payment service user has already received or will subsequently receive on the basis of a framework contract with another payment service provider.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 48 / 102 Prior general information Article 40. (1) Payment service providers shall make the information and conditions pursuant to Article 41 for its own services available in an easily accessible format, before the payment service user is bound by a single payment service contract or offer. At the payment service user’s request, the payment service provider shall provide the information and conditions on paper or on another durable medium. (2) The information and conditions shall be given in a clear and comprehensible form, i.e.

1. if the payment service is offered in Austria, in German or in any other language agreed between the parties;
2. if the payment service is offered in another Member State, in the official language of that Member State or in any other language agreed upon between the parties. (2) If the single payment service contract has been concluded at the request of the payment service user using a means of distance communication which does not enable the payment service provider to comply with para. 1, the payment service provider shall fulfil these obligations immediately after the execution of the payment transaction. (3) The obligations pursuant to para. 1 may also be discharged by supplying a copy of the draft single payment service contract or the draft payment order including the information and conditions set out in Article 41. Information and conditions Article 41. (1) A payment service provider shall provide, or make the following information and conditions accessible to, the payment service user:
3. the information or unique identifier to be provided by the payment service user which are required for the orderly initiation or execution of a payment order;
4. the maximum execution time for the payment service to be provided;
5. all fees, which the payment service user has to pay to the payment service provider and where applicable a breakdown of them; and
6. where applicable the actual underlying exchange rate for the payment transaction or the reference exchange rate. (2) A payment initiation service provider shall inform the payer or make the following clear and comprehensive information available prior to initiation:
7. the name of or the company name of the payment initiation service provider , the address of its head office and where applicable the address of its agent or its branch in Austria, as well as all other contract details including the e-mail address that are relevant for communication with the payment initiation service provider; and
8. the contact details of the competent authority for the payment initiation service provider. (3) The relevant information and conditions pursuant to Article 48 must be made accessible to the payment service user in an easily accessible format.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 49 / 102 Information for the payer and payee following the initiation of a payment order Article 42. If a payment order is initiated through a payment initiation service provider, then the payment initiation service provider in addition to the information and conditions pursuant to Article 41 shall inform or make accessible the following information to the payer and where applicable the payee directly after initiation of the payment order:

1. a confirmation of the successful initiation of payment order at the payer's account servicing payment service provider;
2. a reference number that allows the payer and the payee to identify the payment transaction, and where applicable the payee to identify the payer, as well as all other information transferred with the payment transaction;
3. the amount of the payment transaction;
4. where charges are collected: the amount of all charges payable to the payment initiation service provider for the payment transaction, and where applicable a breakdown of the amounts of such charges. Information for the account servicing payment service provider to be supplied by a payment initiation service Article 43. Where the initiation of a payment order is performed by a payment initiation service provider, then the payment initiation service provider shall make the reference of the payment transaction accessible to the payer's account servicing payment service provider. Information to the payer after receipt of the payment order Article 44. Immediately after receipt of the payment order, the payer’s payment service provider shall provide the payer with or make available to the payer, in the same way as provided for in Article 44 para. 1, all of the following data with regard to its own services:
5. a reference enabling the payer to identify the payment transaction concerned and, where appropriate, information relating to the payee;
6. the amount of the payment transaction in the currency used in the payment order;
7. where charges are collected: the amount of all charges for the payment transaction and, where applicable, a breakdown of the amounts of such charges;
8. where applicable, the exchange rate used in the payment transaction by the payer's payment service provider or a reference to that rate, where this exchange rate deviates from the rate listed pursuant to Article 41 para. 1 no. 4, and the amount of the payment transaction following this currency conversion;
9. the date of receipt of the payment order.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 50 / 102 Information to the payee following execution of the payment transaction Article 45. Immediately after the execution of the payment order, the payee’s payment service provider shall provide the payee with or make available to the payee, in the same way as provided for in Article 40 para. 1, all of the following data with regard to its own services:

1. a reference, which enables the payee to identify the payment transaction and, where appropriate, the payer and any further information transferred with the payment transaction;
2. the amount of the payment transaction in the currency in which the amount is at the payee's disposal;
3. the amount of all charges payable by the payee as well as, where applicable, a breakdown of the amounts of these charges;
4. where applicable, the exchange rate used by the payee's payment service provider in the payment transaction, and the amount of the payment transaction prior to that currency conversion;
5. the credit value date (Article 78 para. 1). Section 3: Framework contracts Scope Article 46. This section shall apply for payment transactions that are covered by a framework contract. Prior general information Article 47. (1) A payment service provider shall provide the payment service user with the information and conditions pursuant to Article 48 on paper or on another durable medium in a timely manner, prior to the payment service user being bound by a framework contract or a contract offer. The information and conditions shall be given in a clear and comprehensible form, namely
6. if the payment service is offered in Austria, in the German language or in any other language agreed between the parties;
7. if the payment service is offered in another Member State, in the official language of that Member State or in any other language agreed upon between the parties. (2) If the framework contract has been concluded at the request of the payment service user using a means of distance communication which does not enable the payment service provider to comply with the obligations set out in para. 1, then the payment service provider shall fulfil these obligations immediately after the conclusion of the framework contract. (3) The obligations pursuant to para. 1 may also be discharged by supplying a copy of the draft framework contract that contains the necessary information and conditions set out in Article 48.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 51 / 102 Information and conditions Article 48. (1) The payment service provider shall provide the payment service user with the following information and contractual conditions:

1. about the payment service provider: a. the name of or company name of the payment service provider, the address of its head office and as applicable the address of its agent or its branch in the Member State in which the payment service is offered, as well as all other addresses including the e-mail address that are relevant for communication with the payment service provider; and b. the details of the competent supervisory authorities and of the register of payment institutions pursuant to Article 13 para. 2 and any other relevant public register in which the payment service provider is registered as being authorised as well as its registration number, or equivalent means of identification used in that register.
2. about the use of the payment service: a. a description of the main features of the payment service to be provided; b. the information or unique identifier to be provided by the payment service user which are required for the orderly initiation or execution of a payment order; c. the form and procedure for giving consent to initiate a payment order or to execute a payment transaction and withdrawing such consent in accordance with Articles 58 and 74, whereby it may also be explicitly agreed that the payment service user may provide consent for the payment transaction even after it has been executed (Article 58 para. 1) and may also revoke the payment order even after the periods specified in Article 74 paras. 1 and 2 have expired; however, in cases pursuant to Article 74 para. 2 consent shall also be required from the payee for revocation to be effective pursuant to Article 74 para. 3; d. the point in time, from when a payment order is deemed to have been received pursuant to Article 72 and where applicable the cut-off time determined by the payment service provider; e. the maximum execution time (Article 77) for the payment services to be provided; f. where the consent for the payment (Article 58) is granted by means of a specific payment instrument, options exist to arrange a spending limit for payment services executed using this payment instrument; and g. in the case of card-based payment instruments, which bear several payment brands due to co-branding, the rights of the payment service user pursuant to Article 8 of Regulation (EU) 2015/751.
3. about fees, interest and exchange rates: a. all fees that the payment service user has to pay to the payment service provider, including such fees that are based on how and how often the information required in

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 52 / 102 accordance with this Federal Act was communicated or made accessible, as well as where applicable the breakdown of the amounts of such fees; b. where applicable, the underlying interest rates and exchange rates or, in the event that reference interest rates or exchange rates are used, the calculation method for the actually accrued interest as well as the relevant qualifying date and the index or the basis for determining the reference interest rate or exchange rate; and, c. where explicitly agreed, the immediate application of amendments to the reference interest rate or the exchange rate and the information requirements with regard to these amendments pursuant to Article 50 para. 2. 4. About communications: a. where applicable the means of communication, agreed between the parties for the transmission of information or notifications based on this Federal Act, including the requirements for the payment service user's technical equipment and software; b. details about the manner and frequency with which information in accordance with this Federal Act must be notified or made available; c. the language or languages, in which the framework contract is to be concluded and in which communication shall be conducted during this contractual relationship and d. a note about the right of the payment service user to receive information and the contractual terms of the framework contract in accordance with Article 49. 5. About safeguards and necessary measures: a. where applicable, a description of the provisions to be taken by the payment service user for the safe storage of a payment instrument, and how the payment service user shall comply with notification obligations towards the payment service provider in accordance with Article 63 para. 2; b. a description of the secure procedure via which the payment service provider informs the payment service user in the event of suspected or actual fraud or in the case of security risks; c. if agreed, the conditions under which the payment service provider reserves the right to block a payment instrument in accordance with Article 62; d. information about the liability of the payer pursuant to Article 68, including information on the relevant amount; e. information about how and within what period of time the payment service user must notify the payment service provider of any unauthorised or defectively initiated or executed payment transactions in accordance with Article 65, as well as the payment service provider's liability for unauthorised payment transactions in accordance with Article 67; f. information about the payment service provider's liability when initiating or executing payment transactions in accordance with Article 80; and g. the conditions for refunds pursuant to Articles 70 and 71.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 53 / 102 6. About amendments to and the termination of the framework contract: a. if agreed, information that the payment service user will be deemed to have accepted changes to the conditions pursuant to Article 50, unless the payment service user notifies the payment service provider that they do not accept them before the date of their proposed date of entry into force, with the payment service user having been notified of the change within the deadline specified under Article 50 para. 1 no. 1; b. the duration of the contract; and c. information about the right of the payment service user to terminate the framework contract, as well as any other agreements relevant for terminating the framework contract pursuant to Article 50 para. 1 and Article 51. 7. About redress: a. the contractual clauses about the law applicable to the framework contract and/or the competent courts; and b. a note about the existence of the payment service user's right pursuant to Article 13 AVG to report an issue to the FMA and the possibility of asserting their rights before an ordinary courts of law, including information about the effective jurisdiction, and before the redress body, indicating its registered office and address. (2) Furthermore; it must be stated in the framework contract whether an agreement was concluded pursuant to Article 70 para. 3, in accordance with which no right of refund exists in the case of certain payment transaction initiated by a payee. Accessibility of information and conditions Article 49. The payment service user may request a copy of the conditions and information pursuant to Article 48 in paper form or on another durable medium at any time during the term of the contract. Changes in the conditions Article 50. (1) The payment service provider shall

1. propose changes to the framework contract to the payment service user no later than two months prior to the proposed date of their application in the manner prescribed in Article 47 para. 1, and
2. if an agreement pursuant to Article 48 para. 1 no. 6 lit. a has been concluded, point out, a. that the payment service user's approval shall be deemed to have been granted for accepting these changes, if the payment service user does not notify the payment service provider of non-acceptance of the chances prior to the proposed date of their entry into force; and b. that the payment service user has the right to terminate the framework contract with immediate effect and without charge before the date of the proposed application of the changes.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 54 / 102 (2) Changes to interest rates or exchange rates may be applied immediately and without notice, provided that such a right is agreed upon in the framework contract and that the changes are based on the reference interest rate or reference exchange rate agreed on pursuant to Article 48 para. 1 no. 3 lits. b and c. The payment service user shall be informed of any change to the interest rate at the earliest opportunity in the same way as prescribed in Article 47 para. 1, unless the parties have agreed by way of derogation to these provisions on a specific frequency or manner in which the information is to be provided or made available. No notification shall be required in the case of interest rates or exchange rates which are more favourable for the payment service user. (3) The changed interest rates or exchange rates to be used in payment transactions shall be applied in a neutral manner and shall be calculated in such a way that payment service users are not placed at a disadvantage. Article 6 para. 1 no. 5 of the Consumer Protection Act (KSchG; Konsumentenschutzgesetz) shall remain unaffected. Orderly termination of the framework contract Article 51. (1) The payment service user may terminate the framework contract at any time provided that the parties have not previously agreed on a notice period for termination. Such a period shall not exceed 1 month. The right to terminate with immediate effect pursuant to para. 2 no. 1 shall remain unaffected (2) The payment service user may terminate the framework contract at no cost:

1. without observing a period of notice for termination prior to changes to the framework contract taking effect pursuant to Article 50 para. 1;
2. in the event of the duration of the framework being for at least six months, or in the case of it having been concluded for an indefinite period in accordance with the notice period for termination. Fees may be collected in all other cases, if they have been agreed in the framework contract in accordance with Article 48 para. 1 no. 3 lit. a, which are appropriate and in line with costs. (3) The payment service provider may terminate a framework contract concluded for an indefinite period, provided that this has been agreed upon in the framework contract, by giving at least two months' notice in the form stipulated in Article 47 para. 1. (4) Regularly collected fees for payment services shall be payable by the payment service user on a pro rata basis until the contract is terminated. Fees that are paid in advance are to be refunded accordingly on a pro rata basis. (5) The general rules relating to the nullifying or voiding of contracts or the early termination of continuing obligations for important reasons shall remain unaffected by this Federal Act.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 55 / 102 Information prior to executing of individual payment transactions Article 52. Before executing individual payment transactions initiated by the payer within a framework contract, the payment service provider shall, at the payer's request, provide information about the following:

1. the maximum execution time for this specific payment transaction,
2. the fees that the payer will be billed, and
3. where applicable a breakdown of them. Information to the payer for individual payment transactions Article 53. (1) After the amount of an individual payment transaction has been debited from the payer's account or, in the case that the payer does not use a payment account, following receipt of the payment order, the payer's payment service provider shall provide the payer with the following information without undue delay in the manner set out in Article 47 para. 1:
4. a reference enabling the payer to identify the payment transaction concerned and, where appropriate, information relating to the payee;
5. the funds involved in the payment transaction, in the currency in which the payer's payment account is debited, or in the currency used for the payment order;
6. the amount of any fees for the payment transaction and where applicable a breakdown thereof, or the interest payable by the payer;
7. where applicable, the exchange rate that the payer's payment service provider used in the payment transaction, and the funds involved in the payment transaction following this currency conversion; and
8. the debit value date (Article 78 para. 2) or the date of receipt of the payment order. (2) The framework contract must contact a clause, in accordance with which the payer may demand that the information pursuant to para. 1 are communicated or made accessible free of charge and in accordance with a agreed procedure so that the payer is able to store and reproduce this information in an unmodified form. (3) The payment service user may however demand that the payment service provider communicates the information pursuant to para. 1 once a month for an appropriate fee. Information to the payee for individual payment transactions Article 54. (1) Having executed an individual payment transaction, the payee's payment service provider shall provide the payee with the following information without delay in the manner set out in Article 47 para. 1:
9. a reference, which enables the payee to identify the payment transaction and the payer and additional information transferred with the payment transaction;
10. the funds that are involved in the payment transaction in the currency in which the amount is credited to the payee's payment account;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 56 / 102 3. the amount of any fees for the payment transaction and where applicable a breakdown thereof, or the interest payable by the payee; 4. where applicable, the exchange rate used by the payee's payment service provider in the payment transaction, and the funds involved in the payment transaction prior to the currency conversion; and 5. the credit value date (Article 78 para. 1). (2) The framework contract may stipulate that the information referred to in para. 1 shall be provided or made accessible in such a way at least once a month and following an agreed procedure so that the payee is able to store and reproduce this information in an unmodified form. (3) The payment service user may however demand that the information pursuant to para. 1 is communicated once a month for an appropriate fee. CHAPTER 4: RIGHTS AND OBLIGATIONS FOR THE PROVISION AND USAGE OF PAYMENT SERVICES Section 1: Common provisions Scope Article 55. (1) In the case that the payment service user is not a consumer, the payment service user and the payment service provider may agree that Article 56 para. 1, Article 58 para. 3 as well as Articles 66, 68, 70, 71, 74 and 80 may be waived either partially or fully. The payment service user and the payment service provider may also agree upon other timeframes than those stipulated in Article 65 (obligation to notify any lack of conformity). (2) Where a derogation to the detriment of a consumer from the rights and obligations for the provision and usage of payment services pursuant to this chapter, then such derogating provisions shall be ineffective. Fees Article 56. (1) A payment service provider shall not be allowed to charge fees to a payment service user to fulfil the information requirements or for corrective and safeguarding measures in accordance with this chapter. Fees may only be demanded from the payment service provider for the following services:

1. Information about the refusal of a payment order pursuant to Article 73 para. 1;
2. Revocation of a payment order after the point at which it becomes irrevocable pursuant to Article 74 para. 3, and
3. Recovery of an amount as a result of defective execution of a payment transaction as a result of an incorrect unique identifier by the payment service user (Article 79 para. 2).

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 57 / 102 Fees pursuant to nos. 1 to 3 shall only be permissible, if they have been agreed upon between the payment service user and the payment service provider; such fees must be appropriate and in line with the payment service provider's actual costs. (2) In the case of payment transactions within the European Union, in which both the payer's payment service provider as well as the payee's payment service provider are established in the European Union, then the payee and payer shall have to bear the fees collected by their respective payment service providers. This shall also apply in the case that there is only a single payment service provider involved in the payment transaction and that payment service provider is established in the European Union. (3) The payment service provider shall not be allowed to prevent the payee from offering a discount to the payer for using a specific payment instrument or to provide it with another kind of incentive for using this payment instrument. The payee is not permitted to charge fees for the use of a specific payment instrument. (4) Fees shall only be allowed to be charged for the provision of payment services or in connection with the framework contract, if they have been agreed upon and having taken effect in advance pursuant to Article 41 para. 1 no. 3 or Article 48 para. 1 no. 3 lit. a. Exceptions for low-value payment instruments and electronic money Article 57. (1) In the case of payment instruments that, according to the framework contract, may only be used for individual payment transactions of up to a maximum of EUR 30 or that either have a spending limit of EUR 150 or store funds (prepaid payment instruments) that do not exceed EUR 150 at any time, the payment service providers may agree with their payment service users that:

1. Article 63 para. 2, Article 64 para. 1 nos. 2 and 4 as well as Article 68 paras. 4 and 5 shall not be applied, if it is not possible to block the payment instrument, or if a further use cannot be prevented,
2. Articles 66 and 67 as well as Article 68 paras. 1, 2, 4 and 5 shall not apply if the payment instrument is used anonymously or the payment service provider is unable to prove that a payment transaction was authorised for other reasons that are intrinsic to the payment instrument,
3. by way of derogation from Article 73 para. 2, the payment service provider shall not be obliged to notify the payment service user of the refusal of a payment order, if the non-execution is apparent from the context;
4. by way of derogation from Article 74, the payer may not revoke the payment order after transmitting it or after having given its consent to execute the payment transaction to the payee; or
5. by way of derogation from Article 77 paras. 1 and 3 other execution periods apply. (2) For payment transactions in Austria the amounts listed in para. 1 are increased
6. in the case of individual payment transactions to a maximum of EUR 60;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 58 / 102 2. in the case of payment instruments with a spending limit to EUR 300; 3. for payment instruments which store funds (prepaid payment instruments) up to EUR 400. (3) The liability provisions pursuant to Articles 67 and 68 shall apply to electronic money pursuant to Article 1 para. 1 E-Geldgesetz 2010, unless

1. payment accounts with a credit balance or payment instruments with a value of up to EUR 400 are involved, and
2. the payer's payment service provider does not have the possibility to block the payment account or the payment instrument. Section 2: Authorisation of payment transactions Consent and withdrawal of consent Article 58. (1) A payment transaction shall only be deemed to be authorised if the payer has given consent to the execution of the payment transaction. The consent must be given prior to execution. If arranged to do so (Article 48 para. 1 no. 2 lit. c), the approval may also be granted following execution. Orders by courts or administrative authorities shall replace the payer's consent. (2) The consent for the execution of a single payment transaction or several payment transactions shall be granted in the form agreed between payer and its payment service and using the agreed procedure (Article 48 para. 1 no. 2 lit. c). The consent for the execution of a payment transaction may also be granted by the payee of a payment initiation service. Where consent does not exist for the execution of a payment transaction, then then payment transaction shall be deemed to be unauthorised. (3) Consent may be withdrawn by the payer at any time, until the moment of irrevocability in accordance with Article 74. If consent for the execution of several payment transactions is revoked, then every subsequent payment transaction shall be deemed to be unauthorised. Confirmation of availability of an amount of money Article 59. (1) An account servicing payment service provider shall confirm without delay upon request by a payment service provider that issues card-based payment instruments, whether a necessary amount for executing a card-based payment transaction is available on the payment account of the payer, provided that all of the following conditions are met:
3. the payment account of the payer is accessible online at the point in time that the request is made,
4. the payer has granted its explicit approval to the account servicing payment service provider, to agree to request a specific payment service provider to confirm the availability of the amount on the payment account of the payer, and
5. the approval pursuant to no. 2 is granted, before the first request for confirmation is issued. (2) The payment service provider may request the confirmation pursuant to para. 1, if all of the following conditions are met:

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 59 / 102

1. the payer has granted its explicit approval to the payment service provider to request the confirmation pursuant to para. 1,
2. the payer has triggered the card-based payment transaction for the amount in question using a card-based payment instrument issued by the payment service provider, and
3. the payment service provider authenticates itself towards the account servicing payment service provider prior to every individual request for confirmation and communicates in a secure manner with the account servicing payment service provider (Article 4 no. 47). (3) The confirmation pursuant to para. 1 shall compromise exclusively of “Yes” or “No”, but shall not however communicate the account balance. The response shall not be allowed to be stored or used for other purposes that for the execution of the card-based payment transaction. (4) The account servicing payment service provider shall not be permitted to block an amount on the payment account of the pay, because a confirmation was granted pursuant to para. 1. (5) The account servicing payment service provider shall communication to the payer upon request the identification details of the payment service provider and the response given. (6) This provision shall not apply for payment transactions that were initiated by card-based payment instruments, upon which electronic money pursuant to Article 1 para. 1 E-Geldgesetz 2010 is stored. Payment initiation services Article 60. (1) A payer has the right to use payment initiation services through a payment initiation service provider. The right to use a payment initiation service provider does not exist, if the payment account is not accessible online. (2) If the payer grants its explicit approval to execute a payment pursuant to Article 58, the account servicing payment service provider shall undertake the steps listed pursuant to para. 4 to guarantee that right of the payer to use the payment initiation service. (3) The following requirements shall apply for payment initiation service providers:
4. the payment initiation services provider shall not be allowed at any time to hold funds belonging to the payer in conjunction with the providing of the payment initiation service.
5. the payment initiation service provider must ensure that the personalised security credentials of the payment service user are not accessible to any other party than the user and the issuer of the personalised security credentials and that they are transmitted by the payment initiation service provider via secure and efficient channels.
6. the payment initiation service provider must ensure that all other information about the payment service user that it receives by providing payment initiation services, may only be communicated to the payee and only with the explicit approval of the payment service user.
7. the payment initiation service provider must identify itself to the payer's account servicing payment service provider every time, if a payment is triggered, and must communicate with

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 60 / 102 the account servicing payment service provider, the payer and the payee in a secure manner (Article 4 no. 47). 5. the payment initiation service provider shall not be allowed to store any of the payment service user's sensitive payment data. 6. the payment initiation service provider shall not be allowed to demand any other data than that which is necessary for the provision of the payment initiation service. 7. the payment initiation service provider shall not be allowed to use collected data for any other purpose than for the provision of the payment initiation service explicitly requested by the payer, nor to access or store it. 8. the payment initiation service provider shall not be allowed to modify the amount, payee or any other characteristic of the payment transaction. (4) The account servicing payment service provider must:

1. communicate with payment initiation service providers in a secure manner (Article 4 no. 47),
2. make all information about the initiation of the payment order available to the payment initiation service provider immediately after receipt of the payment order from a payment initiation service provider and to transmit or make available all information that are available to the account servicing payment service provider itself regarding the execution of the payment order available to the payment initiation service provider, and
3. treat payment orders that are transmitted via the services of a payment initiation service provider in particular with regard to their timing, priority or charges in the same manner as payment orders that the payer has transmitted directly, unless objective grounds exist for an alternative treatment. (5) The provision of payment initiation service provider shall not be allowed to be made dependent on the existence of a contractual relationship between the payment initiation service providers and the account servicing payment service providers for that purpose. Account information services Article 61. (1) A payment service user shall have the right to use services that enable access to payment account information (Article 1 para. 2 no. 8). This right shall not exist in the case that the payment account is not accessible online. (2) The following requirements shall apply for account information service providers:
4. the account information service provider shall only be allowed to provide its services only with the explicit approval of the payment service user.
5. the account information service provider shall ensure that the personalised security credentials of the payment service user are not accessible to any other party than the user and the issuer of the personalised security credentials, and that the transmission by the account information service provider shall be conducted over secure and efficient channels.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 61 / 102 3. the account information service provider must identify itself to the payment service user's account servicing payment service provider for every communication session and must communicate with the account servicing payment service provider and the payment service user in a secure manner (Article 4 no. 47). 4. the account information service provider shall only be allowed to access information from designated payment accounts and associated payment transactions. 5. the account information service provider shall not be allowed to request sensitive payment data linked to the payment accounts. 6. the account information service provider shall not be allowed, in accordance with data protection rules, to use access or store data for purposes other than for the account information service explicitly requested by the payment service user. (3) In relation to payment accounts, the account servicing payment service provider shall:

1. communicate securely with the account information service provider (Article 4 no. 47), and
2. treat data requests that are transmitted through the services of an account information service provider without discrimination, unless objective grounds exist for an alternative treatment. (4) The provision of account information services shall not be allowed to be dependent on the existence of a contractual relationship between the account information service providers and the account servicing payment service providers for that purpose. Blocking of a payment instrument and limitation of access to payment accounts Article 62. (1) The payment service provider may, provided that it has been agreed in the framework contract (Article 48 para. 1 no. 5 lit. c), block a payment instrument, if
3. objective reasons relating to the security of the payment instrument justify blocking;
4. suspicion exists that the payment instrument is being used in an unauthorised or fraudulent manner; or
5. in the case of a payment instrument with a credit line, there is a significantly increased risk that the payer may be unable to fulfil its liability to pay. (2) Obligations to block a payment instrument or account in accordance with other Federal Acts or pursuant to orders imposed by the court, public prosecutor or administrative authorities shall remain unaffected by para. 1. (3) The payment service provider shall, where possible, inform the payer of the blocking of the payment instrument and the reasons for its blocking in the agreed manner (Article 48), where possible, before the payment instrument is blocked, and at the latest immediately thereafter. The notification of the blocking or the reasons for the blocking may be omitted, if it
6. would compromise objectively justified security reasons;
7. would compromise an arrangement under union law or national law; or
8. would breach an instruction by a court or an administrative authority.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 62 / 102 (4) Once the reasons for blocking the payment instrument no longer apply, the payment service provider shall unblock the payment instrument or shall replace it with a new payment instrument. (5) An account servicing payment service provider may deny an account information service provider or a payment initiation service provider access to a payment account for objectively justified and duly evidenced reasons relating to unauthorised or fraudulent access to the payment account by that account information service provider or that payment initiation service provider, including the unauthorised or fraudulent initiation of a payment transaction. In such cases the account servicing payment service provider shall inform the payer that access to the payment account is denied and the reasons therefor in the form agreed. That information shall, where possible, be given to the payer before access is denied and at the latest immediately after access to the payment account is denied, unless providing such information would compromise objectively justified security reasons or is prohibited by other relevant Union or national law. As soon as the reasons for denying access no longer exist, the account servicing payment service provider shall grant access to the payment account. (6) In the case of access being denied pursuant to para. 5 the account servicing payment service provider shall report the incident relating to the account information service provider or the payment initiation service provider to the FMA without delay. The report shall contain the following information:

1. the relevant details of the incident, and
2. the reasons for taking action. The FMA shall assess the case and shall take appropriate measures if necessary. Obligations of the payment service user in relation to payment instruments and personalised security credentials Article 63. (1) The authorised payment service user shall observe the conditions for the issuance and use of a payment instrument when using one. The conditions for the issuance and use of a payment instrument must be objective, non-discriminatory and proportionate. (2) The payment service user shall notify the payment service provider or the body designated by the payment service provider without undue delay on becoming aware of loss, theft, misappropriation or any other unauthorised use of the payment instrument. (3) Directly after being in receipt of a payment instrument the authorised payment service shall take all reasonable steps to protect its personalised security credentials against unauthorised access. Obligations of the payment service provider in relation to payment instruments Article 64. (1) The payment service provider issuing a payment instrument shall ensure, irrespective of the duty of care of the payment service user (Article 63) that:
3. the personalised security features of the payment instrument shall not be accessible to parties other than the payment service user entitled to use the payment instrument;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 63 / 102 2. appropriate means shall be available at all times to enable the payment service user to make a notification pursuant to Article 63 para. 2 free of charge or to request its unblocking pursuant to Article 62 para. 4; 3. any use of the payment instrument shall be prevented once a notification pursuant to Article 63 para. 2 has been made; and 4. the payment service user has the possibility to make a notification pursuant to Article 63 para. 2 free of charge, and in any case the payment service user shall only be charged the costs directly associated with the replacement of the payment instrument. (2) In the event that a payment instrument or any personalised security features of the payment instrument are sent to the payer, the payment service provider shall bear the risk of sending and for any misuse or any unauthorised use. The unsolicited or unarranged sending of any payment instrument shall not be permitted. (3) The payment service provider shall, upon request, provide the payment service users with evidence by which the payment service user is able to prove, for a period of up to 18 months after notification that they fulfilled their notification obligation pursuant to Article 63 para. 2. Notification and correction of unauthorised or defectively executed payment orders Article 65. (1) To obtain rectification from the payment service provider, the payment service user shall notify the payment service provider without undue delay upon becoming aware of any unauthorised or incorrectly executed payment transactions, which have led to a claim arising, including such in accordance with Article 80 (obligation to notify any lack of conformity). If the payment service provider has communicated or made available the information pursuant to Chapter 3, the deadline for the payment service user to notify the payment service provider for the purpose of obtaining rectification shall end no later than 13 months after the date on which the debit or credit was executed. The limitation periods applying for unsettled claims for the payment service user following timely notification shall be determined by the general provisions. Other claims between payment service providers and payment service users remain unaffected. (2) Where a payment initiation service is involved in the payment transaction, then the payment service user shall obtain the rectification pursuant to para. 1 from the account servicing payment service provider. Article 67 para. 2 and Article 80 para. 1 remain unaffected. Proof of authentication and execution of payment transactions Article 66. (1) If a payment service user contests having authorised an executed payment transaction or asserts a claim that the payment transaction was not executed in an orderly manner, their payment service provider shall have to prove that:

1. the payment transaction was authenticated,
2. it was accurately recorded and entered in the accounts, and

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 64 / 102 3. the service provided by the payment service provider was not affected by a technical error or another fault. (2) If the payment transaction is initiated by a payment initiation service provider, then the payment initiation service provider shall be required to prove that payment transaction was authenticated within its scope of competence, was accurately recorded and was not affected by a technical error or another fault linked to the payment service of which it is in charge. (3) Proof of use of a payment instrument in itself is not alone necessarily sufficient to prove the payer's authorisation of the payment transaction, of an intentional or grossly negligent violation of duty of care pursuant to Article 63 or fraudulent actions on the part of the payer. The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user. Payment service provider's liability for unauthorised payment transactions Article 67. (1) In the event of an unauthorised payment transaction the payer's payment service provider shall refund, irrespective of Article 65, the payer the amount of the unauthorised payment transaction without delay, in any event at latest by the end of the following business day, after it became aware of the payment transaction or the payer notified it. The payer's payment service provider shall restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place, with the credit value date in the payer's payment account to be no later than the date that amount had been debited. (2) The payment service provider shall not be required to make a refund pursuant to para. 1, where reasonable grounds exist to support a suspicion of fraud. In this case the payment service provider shall notify the FMA in writing without delay about the suspicion of fraud. (3) If the payment transaction is initiated by a payment initiation service provider, then the account servicing payment service provider shall refund the amount of the unauthorised payment transaction without delay. The refund shall take place in accordance with the rules set out in para. 1. If the payment initiation service provider is liable for the unauthorised payment transaction, then it shall compensate the account servicing payment service provider at the latter's request without delay for the losses incurred as a result of the refunding of the payer or amounts paid, including the amount of the unauthorised payment transaction. The payment initiation service provider shall provide proof whether the payment transaction corresponds to the standards pursuant to Article 66 para. 2. (4) Claims by the payer of either a contractual or legal basis that extend beyond the rules pursuant to paras. 1 to 3, shall not be excluded as a result. Payer's liability for unauthorised payment transactions Article 68. (1) Where unauthorised payment transactions are based on the usage of a lost or stolen payment instrument or the misappropriation of a payment instrument, then the payer's payment

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 65 / 102 service provider may demand that the payer repays damages arising up to the amount of EUR 50, if the payer caused the damaged by slight negligence of a duty of care pursuant to Article 63. (2) The payer shall in any case not be liable in accordance with para. 1, if

1. the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, or
2. the loss was caused by acts or lack of action of an employee, agent or branch of a payment service provider or of an entity to which its activities were outsourced. (3) By way of derogation from paras. 1 and 2 the payer shall be obliged to repay the total damage in full to its payment service provider that occurred as a result of an unauthorised payment transaction, if the payer caused the damage by acting fraudulently or as a result of intent or gross negligence of the duty of care pursuant to Article 63. (4) Where the payer has neither acted fraudulently nor intentionally failed to fulfil its duty of care pursuant to Article 63, in any other apportionment of blame, particularly the nature of the personalised security credentials and the specific circumstances under which the payment instrument was lost, stolen or misappropriated shall be taken into account. (5) By way of derogation from paras. 1 and 3 the payer shall not be obliged to pay damages to its payment service provider, if the payer's payment service provider does not demand strong customer authentication, unless the payer was acting fraudulently. Ifthe payee or the payee's payment service provider does not accept strong customer authentication, then is shall refund the damages to the payer's payment service provider. (6) By way of derogation from paras. 1 and 3 the payer shall not be obliged to repay damages that arise from the use of a payment instrument used following the notification pursuant to Article 63 para. 2 (loss, theft, misuse), unless the payer acted fraudulently. Except in the case of such fraudulent intent, the pay shall also not be obliged to repay damages, if the payment service provider has not fulfilled its obligations pursuant to Article 64 para. 1 no. 2 or 3. Payment transactions for which the amount is not known in advance Article 69. (1) If a payment transaction is initiated in relation to a card-based payment transaction by or via the payee and the precise amount is not known at the point in time at which the payer grants the approval for executing the payment transaction, the payer's payment service provider shall only be allowed to block funds on the payer's payment account, when the payer has approved the precise amount of the funds to be blocked. (2) The payer's payment service provider shall release the funds that are blocked in the payer's payment account pursuant to para. 1 without delay following receipt of the information about the precise amount of the payment transaction, at latest however without delay following receipt of the payment order.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 66 / 102 Refunds for a payment transaction initiated by the payee Article 70. (1) A payer shall be entitled to a refund of the full amount from its payment service provider in the event of an authorised payment transaction initiated by or through a payee which has already been executed, if:

1. the exact amount was not specified when the authorisation was made, and
2. the amount of the payment transaction exceeds the amount the payer could reasonably have expected taking into account their previous spending pattern, the conditions in the framework contract and relevant circumstances of the case in hand. At the payment service provider's request, the payer shall be required to provide factual elements relating to such conditions. The amount that is to be refunded must be credited to the payer's payment account at latest on the date of the debiting of the account. In the case of direct debits pursuant to Article 1 of Regulation (EU) No 260/2012 there also exists, in addition to a claim in accordance with this paragraph, a claim for the unconditional refund within the timeframes pursuant to Article 71, provided that this has not been waived pursuant to para. 3. (2) If the reference exchange rate agreed pursuant to Article 41 para. 1 no. 4 or pursuant to Article 48 para. 1 no. 3 lit. b forms the basis of the transaction, then the payer may not assert any claims against its payment service provider with regard to para. 1 no. 2 in relation to reasons relating to the currency exchange. (3) It may be arranged in a framework contract between the payer and the payment service that the payer shall have no claim to reimbursement, when
3. the payer directly granted approval to the payment service provider for executing the payment transaction, and
4. where applicable information has been communicated or made available to the payer by the payment service provider or the payee about the payment transaction to be conducted in an agreed form at least four weeks before the date upon which the payment becomes due. (4) The relationship between the payer and payee shall not be affected by the payer's right to a refund. (5) The payer's right to revocation until the point in time of revocation specified under Article 74 shall remain unaffected. Procedure for refunds for a payment transaction initiated by the payee Article 71. (1) The payer shall assert its right to a refund pursuant to Article 70 against its payment service provider within eight weeks from the date on which the funds in question were debited from the payment account. Within ten business days of receiving a request for a refund, the payment service provider shall either refund the full amount of the payment transaction or provide the payer with a justification for refusing the refund. In the event that the refund is refused, the payment service provider shall inform the payer of the possibility in accordance with Article 13 General Administrative Procedures Act (AVG; Allgemeines

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 67 / 102 Verwaltungsverfahrensgesetz), to file a complaint with the FMA, as well as the possibility to assert its rights before an ordinary court of law, including information about the effective jurisdiction, and before the dispute settlement body, indicating its registered office and address. Section 3: Execution of payment transactions Receipt of payment orders Article 72. (1) The point in time, at which a payment order transmitted directly by the payer or indirectly by or through a payee is received by the payer's payment service provider, shall be deemed to be the point in time of receipt. The payer's account shall not be allowed to be debited prior to the point in time of receipt. (2) If the point in time of receipt does not fall on a business day for the payer's payment service provider, the payment order shall be handled as if it had been received on the following business day. (3) The payment service provider may, by way of derogation from para. 1, establish that payment orders received after a cut-off point towards the end of the business day may be handled as if they had been received on the following business day. (4) If the payment service user initiating the payment order and its payment service provider have agreed that the execution of the payment order should be started on a specific day or at the end of a certain period or on the day on which the payer has placed funds at the payment service provider's disposal, then the agreed date shall be deemed to be the point in time of receipt for the purposes of Article 77. If the agreed date does not fall on a business day for the payment service provider, then para. 2 shall apply. Refusal of payment orders Article 73. (1) The payment service provider shall not be allowed to refuse the execution of an authorised payment order, irrespective of whether the payment order was initiated by a payer, or by a payment initiation service provider or by or through a payee, unless

1. not all the conditions set out in the framework contract pursuant to Article 48 are met; or
2. execution would breach an arrangement under Union or national law or an order of a court or administrative authority; or
3. reasonable suspicion exists that the execution of the payment would constitute a punishable act. (2) If a payment service provider refuses the execution of the payment order, then the payment service provider shall inform the payment service user of this circumstance as quickly as possible, in any case within the deadlines pursuant to Article 77 in the form agreed upon pursuant to Article 48 para. 1 no. 4, stating the reasons and the possibilities of improvement. The citing of reasons for the refusal shall be waived, if doing so would constitute a violate of an arrangement under Union or national law or breach a court or administrative order.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 68 / 102 (3) For the purposes of Articles 77 and 82, a payment order for which execution has been refused shall be deemed not to have been received. Irrevocability of payment orders Article 74. (1) A payment service user may no longer revoke a payment order,

1. when the payment order has been received by the payer's payment service provider;
2. in the case of Article 72 para. 4 (agreement of a future execution date) after the end of the business day preceding the agreed date. (2) When the payment transaction was initiated by or through the payee, the payer may no longer revoke the payment order once the payer has communicated its approval for executing the payment transaction to the payee. When the payment transaction was initiated by a payment initiation service, then revocation of the payment order is not permissible, once the payer has granted its approval for initiation. Notwithstanding the above, the payer may, however, in the case of a direct debit revoke the payment order, at latest by the end of the business day preceding the agreed debit date for the payment order. (3) After the point in time of irrevocability pursuant to para. 1 and 2 has been reached, a payment order may only be revoked, if this has been agreed upon between the payment service user and the payment service provider in question (Article 48 para. 1 no. 2 lit. c). In the case of para. 2 the consent of the payee continues to be necessary. Transfer for the full amount Article 75. (1) The payer's payment service provider, the payee's payment service provider and any intermediaries of the payment service provider shall transfer the full amount of the payment order and may not deduct charges from the amount transferred. (2) The payee and its payment service provider may however agree that the payment service provider shall be allowed to deduct its charges from the amount transferred, before the payment service provider credits the payee. In this case, the full amount of the payment transaction and charges must be itemised in the information given to the payee. (3) If the payment transaction is initiated by the payer, the payer's payment service provider shall ensure that the payee receives the full amount of the payment transaction less the charges pursuant to para. 2. If the payment transaction is initiated by or through the payee, the payee's payment service provider shall ensure that the payee receives the full amount of the payment transaction. Section 4: Execution time and value date Scope Article 76. (1) This section shall apply for
3. payment transactions in Euro,

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 69 / 102 2. national payment transactions in the currency of the non-euro area Member State, 3. payment transactions, where there is only one currency conversion between the Euro and the currency of a non-euro area Member State, provided that the currency conversion required is carried out in the non-euro area Member State and - in the case of cross-border payment transactions - the cross-border transfer is denominated in Euro. (2) This section shall not apply to payment transactions that are not listed in para. 1, provided something else has not been agreed between the payment service user and the payment service provider. The party may not contractually waive Article 77 para. 2 and Article 78. If, however, the payment service user and the payment service provider however agree a longer timeframe for payment transactions within the Union than those pursuant to Article 77 paras. 1, 3 or 4, then this longer timeframe shall not exceed four business days from the point in time of the receipt of the payment order (Article 72). Execution period and availability Article 77. (1) The payer's payment service provider shall ensure that the funds involved in the payment transaction are credited to the account of the payee's payment service provider at latest at the end of the following business day after the day of the point in time of receipt (Article 72). For payment transactions initiated in paper form, this time limit shall be extended by an additional business day. (2) The payee's payment service provider shall make the funds involved in the payment transaction available on the payee's payment account of the payee without delay once this amount has been credited to the payee's payment service provider or its account and value date it pursuant to Article 78, when from the side of the payee's payment service provider

1. there is no currency conversion; or
2. a currency conversion takes place between the euro and a currency of a Member State or between the currencies of two Member States. This obligation shall also apply for payments within a payment service provider. (3) Provided that no payment account is held at the payee's payment service provider, then the payee's payment service provider shall make funds available within the time limit pursuant to para. 1 that has received the funds for the payee. (4) In the event that the payment order has been initiated by or through the payee to the payer's payment service provider, the payee's payment service provider shall transmit this payment transaction to the payer's payment service provider within the time limits agreed between the payee and its payment service provider. In the case of direct debits, the payment order shall be executed to the payer's payment service provider promptly to ensure settlement on the agreed due date. (5) In the case of cash being deposited into a payment account with a payment service provider in the currency of that payment account, the payment service provider shall ensure that:

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 70 / 102

1. in the case that the account is held by a consumer, the amount shall be made available and value dated immediately after the point of time of the receipt of the funds;
2. in the case that the account is not held by a consumer, the amount shall be made available and value dated at the latest on the next business day after receipt of the funds. Value date Article 78. (1) The value date of an amount credited to the payee's payment account shall be at latest the business day on which the funds involved in the payment transaction are credited to the payee's payment service provider's account. This point in time shall serve as the basis for the calculation of interest on the payee's payment account, provided the paying or charging of interest is legally permitted. (2) The debit value date for amounts debited to the payer's payment account shall be no earlier than the point in time at which the funds involved in the payment transaction are debited to that payment account. This point in time shall serve as the basis for the calculation of interest on the payer's payment account, provided the paying or charging of interest is legally permitted. Section 5: Liability Incorrect unique identifiers Article 79. (1) If a payment order is executed in accordance with the unique identifier, then the payment shall be deemed to have been executed correctly with regard to the payee specified by the unique identifier. The payment service provider shall act with necessary case and where technically possible without requiring manual intervention check whether the unique identifier is coherent. In the case that the unique identifier is found not to be coherent, then the payment service provider shall refuse the payment order and inform the payer thereof. (2) If the unique identifier provided by the payment service user is incorrect, the payment service provider shall not be liable pursuant to Article 80 for non-execution or defective execution of the payment transaction. (3) However, the payer’s payment service provider shall make reasonable efforts to recover the funds involved in the payment transaction. The payee's payment service provider shall also cooperate in such efforts by communicating all relevant information to the payer's payment service provider that is required for the collection of the funds. (4) In the event that it is not possible to collect the funds pursuant to para. 3, the payer's payment service provider shall provide to the payer, upon written request, all information available to the payer's payment service provider that are relevant for the payer, so that the payment may exert a legal claim to recover the funds. (5) The payment service provider may charge the payment service user a fee for recovery, if that was agreed upon in the framework contract.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 71 / 102 (6) In the event that the payment service user provides further information over and above that listed in accordance with Article 41 para. 1 no. 1 or Article 48 para. 1 no. 2 lit. b, then the payment service provider shall be liable only for the execution of payment transactions in accordance with the unique identifier provided by the payment service user. Payment service providers’ liability for non-execution, defective or late execution of payment transactions Article 80. (1) If a payment order is directly initiated by the payer, the following shall apply:

1. the payer's payment service provider shall be liable towards the payer for the orderly execution of the payment transaction, unless the payer's payment service provider is able to prove to the payer and as applicable the payee's payment service provider that the funds involved in the payment transaction have been received by the payee's payment service provider pursuant to Article 77 para. 1. In that case, the payee’s payment service provider shall be liable to the payee for the correct execution of the payment transaction.
2. if the payer's payment service provider is liable pursuant to no. 1, then it shall refund the payer the funds involved in the non-executed or defectively executed payment transaction without delay and shall restore the debited payment account to the state in which it would have been in had the defectively executed payment not taken place. The funds are to be credited to the payer's payment account at latest on the date of the account being debited.
3. if the payee's payment service provider is liable pursuant to no. 1, then it shall make the amount of the payment transaction available to the payee without delay, and credit the corresponding amount to the payee's payment account. The amount is to be value dated in the payee's payment account at latest on the date on which the credit value date would have been in the case of correct execution pursuant to Article 78.
4. if a payment transaction is executed with delay, then the payee's payment service provider shall ensure at the request of the payment service provider acting for the payer that the amount on the payee's payment service provider shall be value dated at the latest on the date on which the credit value date would have been in the case of correct execution.
5. in the case of non-execution or defective execution of a payment transaction the payer's payment service provider shall - irrespective of the liability in accordance with this paragraph

• make efforts to trace the payment transaction. The payer must be informed about the outcome. No fee shall be allowed to be charged to the payer for this. (2) If a payment order is initiated by or through the payee, then the following shall apply:

1. the payee's payment service provider shall be liable towards the payee for the orderly execution of the payment transaction to the payer's payment service provider pursuant to Article 77 para. 3. In this case the payee's payment service provider shall re-transmit the questionable payment to the payer's payment service provider without delay.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 72 / 102 2. in the event that the payment order is transmitted with delay, then the funds are to be value dated to the payee's payment account at latest on the funds would have be credit value dated in the case of a correct execution. 3. in addition, the payee's payment service provider shall also be liable towards the payee for the processing of the payment transaction in accordance with its obligations pursuant to Article 78. The payee's payment service provider shall ensure that the funds involved in the payment transaction are available to the payee without delay, once the payment account of the payee's payment service provider has been credited. The amount is to be value dated in the payee's payment account at latest on the date on which the credit value date would have been in the case of correct execution. 4. in the case of a non-executed or defective payment transaction, for which the payee's payment service provider is not liable in accordance with no. 1 and no. 2, the payer's payment service provider shall be liable towards the payer. If the payer's payment service provider is liable, it shall refund the payer where applicable, the amount of the non-executed or incorrectly executed payment transaction without undue delay and, where applicable, restore the debited payment account to the state in which it would have been had the defectively executed payment transaction not taken place. The funds are to be credited to the payer's payment account at latest on the date of the account being debited. 5. the obligation of the payer's payment service provider in accordance with no. 4 shall not exist, if the payer's payment service provider proves that the payee's payment service provider has received the amount of the payment transaction, even if the payment was only executed with a slight delay. In this case, the funds are to be value dated by the payee's payment service provider on the payee's payment account at latest on the funds would have been credit valued in the case of correct execution. 6. in the case of non-execution or defective execution of a payment transaction the payee's payment service provider shall at the payee's request - irrespective of the liability in accordance with this paragraph - make efforts to trace the payment transaction. The payee must be informed about the outcome. No shall be allowed to be charged to the payee for this. (3) Furthermore, the payment service provider shall be liable to their respective payment service users for any charges and interest incurred by the payment service users, for which they are responsible, as a consequence of non-execution or defective or delayed execution of the payment transaction. Payment initiation services' liability for non-execution, defective execution or delayed execution of payment transactions Article 81. (1) If a payment order is initiated by the payer through a payment initiation service provider, then the account servicing payment service provider shall refund the payer the funds involved in the non-executed or defectively executed payment transaction, and to return the debited payment account to the state in which it would have been had the defectively executed

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 73 / 102 payment transaction not have taken place. This shall apply irrespective of the provisions pursuant to Article 65 and Article 79 paras. 1 and 3. (2) The payment initiation service provider shall have to prove that the payment order pursuant to Article 72 has been received by the payer's account servicing payment service provider and that the payment transaction was authenticated within its scope of competence, was accurately recorded and was not affected by a technical error or another shortcoming in relation to the non-execution, defective execution of delayed execution of the transaction. (3) If the payment initiation service provider is liable for the non-execution, defective execution or delayed execution of the payment transaction, then it shall compensate the account servicing payment service provider at the latter's request without delay for the losses incurred or amounts paid as a result of the refund to the payer. Additional compensation Article 82. The making good of any damage that extends over and beyond the rules pursuant to Articles 80 and 81, shall take place in accordance with the general provisions. Redress Article 83. The provisions on liability pursuant to Articles 67 and 80 shall not affect statutory or contractual claims for redress between payment service providers or intermediate entities. Claims for redress shall at least include all losses suffered and amounts paid by a payment service provider pursuant to Articles 67 and 80. They shall also include reimbursements in conjunction with cases where the payment service provider does not demand strong customer authentication. Exclusion from liability for irregular and unforeseeable events Article 84. Liability pursuant to sections 2 to 5 (Articles 58 to 83) shall not extend to cover cases of irregular and unforeseeable circumstances, over which the party pleading for the application of these circumstances has no influence, and the consequences of which would have been unavoidable despite all due care having been taken, and shall not apply in cases in which a payment service provider is bound by orders under Union law or national law, or orders issued by a court or administrative authority. Section 6: Operational and security risks Management of operational and security risks Article 85. (1) Payment service providers shall establish a framework with appropriate risk mitigation measures and control mechanisms to manage the operational and security risks in relation to the payment services that they provide. As part of that framework the payment service

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 74 / 102 provider shall establish and manage effective incident management procedures. The detection and classification of major operational and security incidents shall also be addressed. (1a) Para. 1 shall apply irrespective of the application of Chapter II of Regulation (EU) 2022/2554 for:

1. payment service providers pursuant to Article 1 para. 3 nos. 1 to 3;
2. account information service providers pursuant to Article 4 no. 19;
3. payment institutions that are excluded from Directive (EU) 2015/2366 pursuant to Article 31 para. 1;
4. e-money institutions for which an exception pursuant to Directive 2009/110/EC applies. (2) The payment service provider shall provide the FMA with an updated and comprehensive assessment of the operational and security risks in relation to the payment services provided on an annual basis. The assessment shall in particular evaluate whether the risk mitigation measures and control mechanisms that have been taken for managing risks are appropriate. The FMA may determine that the updating of the assessment must be taken at shorter intervals. Incident reporting Article 86. (1) In the case of a major operational or security incident, payment service providers shall notify the FMA about this without delay. Where the incident has or may have an impact on the financial interests of its payment service users, the payment service provider shall inform its payment service users without delay about the incident. This communication shall explain all measures that payment service users may take to mitigate the adverse effects of the incident. (2) Upon receipt of a notification pursuant to para. 1 the FMA shall inform the EBA and the ECB about the relevant details of the incident. In cooperation with these authorities, the FMA shall assess the relevance of the incident for other relevant authorities in the European Union, and shall inform them accordingly. Once the FMA has checked the relevance of the incident for the relevant authorities, including the law enforcement authorities, it shall also inform them accordingly. Where appropriate the FMA shall take all necessary measures for protecting the immediate safety of the financial system. (3) Payment service providers shall submit statistical data to the FMA once a year on fraud in relation to the different instruments of payment. The FMA shall ensure that these data are made available to the EBA and the ECB in aggregated from, and may, provided that the reporting of these data occurs pursuant to para. 4 no. 2 to the Oesterreichische Nationalbank, instruct the Oesterreichische Nationalbank to make these data available. (4) The FMA may, with the consent of the Federal Minister of Finance determine by means of a Regulation, the content, format, reporting dates and reporting deadlines for reporting pursuant to para. 3. In so doing, the FMA may stipulate:
5. a reporting frequency that is more frequent than annually;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 75 / 102 2. the submission of reports pursuant to this this paragraph exclusively to the Oesterreichische Nationalbank, provided that this does not interfere with the performance of the FMA’s duties in accordance with this Act or with other Federal Acts; (5) The Oesterreichische Nationalbank shall be consulted prior to the issuing of the Regulations stipulated in para. 4. (6) The reports pursuant to paras. 4 must be submitted in a standardised format by electronic means. The submissions shall be required to meet certain minimum requirements to be announced by the FMA after consultation with the Oesterreichische Nationalbank. (7) Paras. 1 and 2 shall not apply to:

1. payment service providers pursuant to Article 1 para. 3 nos. 1 to 3;
2. account information service providers pursuant to Article 4 no. 19;
3. payment institutions that are excluded from Directive (EU) 2015/2366 pursuant to Article 32 para. 1;
4. e-money institutions for which an exception pursuant to Directive 2009/110/EU applies. Authentication Article 87. (1) A payment service provider shall demand strong customer authentication, when the payer
5. accesses its payment account online,
6. initiates an electronic payment transaction, or
7. carries out any action through a remote channel that implies the risk of payment fraud or another kind of abuse. (2) In the case of initiation of electronic payment transactions pursuant to para. 1 no. 2 the payment service provider shall demand strong customer authentication for electronic remote payment transactions that includes elements that dynamically link the payment transaction to a specific amount and a specific payee. (3) In the case of para. 1 the payment service provider shall have in place adequate security measures to protect the confidentiality and the integrity of the personalised security credentials of the payment service user. (4) Paras. 2 and 3 shall also apply in the case that payments are initiated through a payment initiation service provider. Paras. 1 and 3 shall also apply if the information is requested through an account information service provider. (5) The account servicing payment service provider shall permit a payment initiation service provider and an account information service provider to rely on the authentication procedures that they make available to the payment service user pursuant to paras. 1 and 3, and in cases where a payment initiation service provider is involved also those authentication procedures pursuant to para. 2.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 76 / 102 CHAPTER 5: SUPERVISION, PENAL PROVISIONS AND OTHER MEASURES Section 1: Supervision Competent authority Article 88. (1) The FMA shall monitor the compliance with Articles 5 and 6 as well as Chapter 2 of this Federal Act, and in so doing shall take into account the national economic interest in a functioning financial market as well as financial stability. The same applies to the compliance with Article 36 BWG by payment institutions from Member States in Austria pursuant to Article 4 no. 4 lit. b within the scope of the freedom of establishment and the freedom to provide services and with regard to compliance with Article 36 BWG by payment institutions pursuant to Article 4 no. 4 lit. a of this Federal Act in Austria. (2) Furthermore, the FMA shall also be responsible for imposing of administrative penalties in the case of breaches against:

1. Chapters 2, 3 and 4 of this Federal Act that are to be sanctioned pursuant to Articles 99 to 102
2. Regulation (EU) 2021/1230, and
3. Regulation (EU) No 260/2012, that are committed by payment service provider pursuant to Article 1 para. 3 nos. 1 to 6 as well as by branches pursuant to Article 27. (3) The FMA and Oesterreichische Nationalbank shall cooperate closely to effectively fulfil their respective tasks in accordance with this Federal Act. Article 79 BWG shall apply with the proviso that the tasks defined therein in relation to banking supervision performed by the Oesterreichische Nationalbank shall apply for the purposes of this Federal Act for the area of payment institution supervision:
4. Article 14 of this Federal Act shall replace the reference to Article 73 BWG in Article 79 para. 2 BWG;
5. Article 25 of this Federal Act shall replace the reference to Article 44 BWG in Article 79 para. 2 BWG;
6. Article 26 and Article 86 para. 4 of this Federal Act shall replace the reference to Article 74 BWG in Article 79 para. 2 BWG; (4) Article 72 BWG shall apply in relation to cooperation with other authorities. (5) The FMA shall publish and regularly update the following information on its website:
7. the texts of the laws and regulations that apply to the field of payment institution supervision;
8. the FMA minimum standards and circulars relating to payment institution supervision;
9. the exercising of the discretions contained in Directive (EU) 2015/2366.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 77 / 102 (6) The tasks, rights and obligations of the Oesterreichische Nationalbank with regard to the supervision of payment institutions in accordance with Article 44a NBG shall remain unaffected by the provisions of this Federal Act. (7) An application pursuant to Article 4 (4) of Regulation (EU) No 260/2012 for a temporary exemption from the conditions set out in Article 4 (1) (b) of Regulation (EU) No 260/2012 for new entrant payment schemes must be filed with the FMA if the applicant has its registered office in Austria. (8) In carrying out the procedure pursuant to Article 4 (4) of Regulation (EU) No 260/2012, the FMA shall obtain an expert opinion from the Oesterreichische Nationalbank on the fulfilment of the conditions for a new entrant payment scheme pursuant to Article 4 (4) of Regulation (EU) No. 260/2012. (8) The FMA shall, in the enforcement of the provisions of this Federal Act, including the issuing and enforcement of Regulations under national law and EU law on the basis of this Federal Act and on the basis of Regulation (EU) 2015/2366 take into account European convergence in respect of supervisory tools and supervisory procedures. For this purpose the FMA shall participate in the activities of the EBA, as well as to take into consideration the Guidelines, Recommendations and other measures decided upon by the EBA. The FMA may deviate from those guidelines and recommendations provided that justified grounds exist, in particular in the event of a conflict with provisions under federal law. (9) The FMA is the competent authority for the purposes of Article 15 (3) and (4) of Regulation (EU) No 260/2012. The reports are to be submitted electronically in a standardised format to the Oesterreichische Nationalbank. Estimation of costs Article 89. (1) The costs of payment institution supervision within Accounting Group 1 pursuant to Article 19 para. 1 no. 1 FMABG must be allocated to the payment institutions subject to contribution requirements in accordance with paras. 2 and 3. Payment institutions pursuant to Article 4 no. 4 lit. a and branches in accordance with Article 27 shall be subject to the payment of costs. The costs for payment service supervision of credit institutions shall be classified as banking supervision costs. (2) For every payment institution that is subject to the payment of costs, the cost figure shall first be determined. The cost figure for payment institutions subject to the payment of costs shall be the minimum own funds requirement reported for the preceding December pursuant to Article 26. (3) A ratio shall be calculated for each payment institution based on the proportion of the cost figure of each payment institution pursuant to para. 1 to the sum of all cost figures. All costs in accounting group 1 which are to be refunded to the individual institutions subject to payment of costs after deduction of any income according to para. 5 shall be distributed in accordance with their respective ratios. (4) Where the calculation carried out in accordance with para. 3 for a payment institution results in an amount of less than EUR 2 000, the payment institutions shall be required to pay supervisory costs for the amount of EUR 2 000 (minimum amount); the FMA shall allocate the difference between

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 78 / 102 the arithmetical cost share and the minimum amount to a provision which must be posted in the following annual financial statement. (5) The provision established in a financial year pursuant to para. 4 shall be reversed in the following annual financial statement; the resulting amount shall be deducted only from the costs of accounting group 1 in derogation of Article 19 para. 4 FMABG. (6) Where the calculation carried out pursuant to para. 3 for a payment institution results in an amount greater than 0.15% of its cost figure (para. 2), the payment institution shall be required to pay supervisory costs amounting to 0.15% of its cost figure. (7) If the requirements of both para. 4 and para. 6 are applicable to a payment institution, then only para. 4 shall be applied. (8) Branches pursuant to Article 27 shall be charged the minimum amount stated in para. 4. Paras. 2 to 7 shall not be applicable for the calculation of costs for branches; however, the FMA shall take the costs charged to the branches into account when determining the costs for the other institutions in Accounting Group 1 pursuant to para. 3. Article 19 paras. 5 and 6 FMABG is to be applied in issuing the administrative decisions regarding costs with the restriction that:

1. the prepayments shall each be set as 100 % of the lump sum, and
2. the administrative decision regarding costs shall only deal with the setting of the lump sum in accordance with this paragraph unless positive or negative differences need to be taken into account due to payment delays or overpayments by the party from whom payment is due. Data protection Article 90. (1) The FMA and Oesterreichische Nationalbank are entitled to process of data as defined in Regulation (EU) 2016/679 provided that this lies within their scope of responsibilities pursuant to this Federal Act; namely:
3. licences of payment institutions and relevant circumstances for granting of such licences;
4. management, administrative and accounting-related organisation as well as internal control and audit of payment institutions;
5. branches and the exercising of the freedom to provide services;
6. own funds;
7. qualifying holdings in payment institutions;
8. annual financial statements and accounts;
9. regulatory measures pursuant to Articles 93 and 94;
10. administrative penalties pursuant to Articles 99 to 102;
11. investigations pursuant to Article 22b FMABG;
12. information, requested by competent authorities under the exchange of information pursuant to Article 92;
13. maintaining the register of payment institutions (Article 13 para. 2);
14. allocation of costs for payment service supervision.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 79 / 102 (2) The transmission of data pursuant to para. 1 by the FMA shall be permissible in providing official assistance. The transmission of data to the EBA, the ECB as well as to competent authorities in Member States, provided that this is necessary for them to perform tasks which correspond to the tasks of the FMA and Oesterreichische Nationalbank in accordance with this Federal Act, and provided that transmitted data is subject to professional secrecy at these authorities pursuant to Article 24 of Directive (EU) 2015/2366. (3) The transmission of data pursuant to para. 1 by the FMA shall also be permissible within the same framework, for the same purposes and with the same restrictions as for competent authorities in Member States pursuant to para. 2 to authorities in third countries that are required to perform tasks equivalent to those performed by the FMA or the Oesterreichische Nationalbank, provided that the transmitted data are subject to a comparable professional secrecy as the confidentiality regime pursuant to Article 24 of Directive (EU) 2015/2366, and if they are in keeping with Chapter V of Regulation (EU) 2016/679. (4) Payment service providers shall only be allowed to consult, process and store the personal data necessary for the provision of their payment services with the explicit approval of the payment service user. Payment service providers shall inform payment service users about the processing of personal data as defined in Articles 13 and 14 of Regulation (EU) 2016/679. Professional secrecy Article 91. Experts appointed by the FMA or the Oesterreichische Nationalbank shall be subject to the legal obligation of secrecy pursuant to Article 14 para. 2 FMABG. International exchanging of information Article 92. (1) The FMA shall act as competent authority pursuant to Article 22 (1) of Directive (EU) 2015/2366. (2) The FMA may cooperate with

1. the competent authorities of other Member States for the authorisation and supervision of payment institutions,
2. the European Central Bank as well as the central banks on other Member States in their capacity as monetary and supervisory authorities,
3. other authorities that are responsible for the protection of natural persons in the processing of personal data, and
4. the EBA within the scope of contributing to the uniform and coherent functioning of monitoring mechanisms, where this is necessary for the performance of duties determined in Directive (EU) 2015/2366 or in relation to official and legal assistance and provided that the information submitted to those authorities is subject to confidentiality requirements pursuant to Article 24 of Directive (EU) 2015/2366.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 80 / 102 (3) The FMA may, for the purpose of cooperation and the forwarding of data in accordance with this Chapter of the Federal Act, use its powers even if the conduct which forms the subject matter of the investigation does not constitute a violation of a legal provisions applicable in Austria. For the purpose of cooperation, the FMA may also use its powers pursuant to Article 93 para. 2 nos. 1 and 2 with regard to legal persons authorised to provide payment services in their home Member State as a payment institution pursuant to Article 4 (4) of Directive (EU) 2015/2366. (4) The Federal Minister of Finance, at the joint proposal of the FMA and the Oesterreichische Nationalbank, may conclude the following agreements with competent authorities regarding the procedure regarding cooperation with the FMA and Oesterreichische Nationalbank in the performance of duties of oversight and supervision of payment institutions, provided that the Federal Minister of Finance is authorised to conclude agreements pursuant to Article 66 para. 2 of the Federal Constitutional Act (B-VG; Bundesverfassungsgesetz):

1. agreements with competent authorities of other Member States; in particular, these agreements may regulate procedures of cooperation between the FMA and the competent authorities of Member States with regard to the information exchange stipulated in Article 26 of Directive (EU) 2015/2366.
2. agreements with competent authorities of third countries, provided that the information exchange with these competent authorities serves to fulfil supervisory tasks of this competent authority conditional on there being the equivalent degree of professional secrecy to Article 24 of Directive (EU) 2015/2366. Investigations and inspections Article 93. (1) The FMA shall conduct all investigations and take any measures that are necessary for the performance of the tasks conferred upon it in this Federal Act pursuant to Article 88 para. 1 or for the pursuit of the breach listed in Article 99 para. 3. (2) In exercising its competences pursuant to para. 1, the FMA, regardless of the powers conferred upon it by other provisions contained in Federal Acts, shall be authorised to:
3. inspect the books, documents, and storage media of the undertakings pursuant to Article 88 para. 1 and receive copies of the aforementioned items; Article 25 para. 4 shall apply to the scope of the FMA's information, presentation and inspection rights and the obligation to make documents available in Austria;
4. request information from the entities pursuant to Article 88 para. 1 and their bodies, as well as from all agents and organisations, to which payment services have been outsourced, to request information and to summon and question persons in accordance with laws governing administrative procedure;
5. allow all necessary inspections to be carried out by statutory auditors or other experts, with the reasons for exclusion stated in Article 25 para. 6 being applicable; the FMA may

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 81 / 102 communicate information to the inspectors it has engaged, provided that this is necessary to perform the inspection engagement; 4. issue the Oesterreichische Nationalbank with a mandate to inspect payment institutions and their branches and representative offices outside of Austria; in so doing, Oesterreichische Nationalbank's competence to conduct on-site inspections as part of the supervision of payment institutions shall extend to covering the inspection of all business fields and all types of risk; the Oesterreichische Nationalbank shall ensure that it has sufficient staff and organisational resources to conduct these inspections; the FMA shall be authorised to allow its own employees to participate in the inspections conducted by the Oesterreichische Nationalbank; 5. also request authorities of the host Member State to conduct an inspection of branches and representative offices in Member States in the event that in comparison to an inspection pursuant to no. 4 this simplifies or accelerates the procedure, or for the sake of expediency, simplicity, speed or cost economy; under these conditions, the Oesterreichische Nationalbank may also be obliged to participate in such an inspection, and FMA employees may also participate in such an inspection; und 6. obtain information from the auditors. (3) For an inspection pursuant to para. 2 nos. 3 to 5, the bodies engaged shall be issued a written inspection engagement and they shall verify their identity and present the inspection engagement, without being requested to do so, prior to commencing the inspection. Otherwise, Article 71 BWG shall apply. Article 70 paras. 1a to 1c and Article 79 BWG shall apply with regard to the cooperation between the FMA and Oesterreichische Nationalbank and the conducting of inspections by these parties. (4) Para. 2 no. 4 shall be applied in such a way with regard to compliance with Article 20 para. 3 no. 6 of this Federal Act, including the procedures and data processing systems associated with this provision as defined in Article 20 para. 3 no. 4 of this Federal Act in such a ways that on-site inspections shall be carried out by the FMA. By way of derogation from para. 3 and Article 88 para. 3 of this Federal Act, Article 70 paras. 1a and 1b and Article 79 para. 4 BWG shall not apply in this regard. Supervisory measures and disclosure Article 94. (1) To avert any danger to the financial affairs of a payment institution's customers pursuant to Article 4 no. 4 lit. a in connection with its activities, the FMA may order temporary measures by means of an administrative decision, which shall expire no later than 18 months following their entry into force. The FMA, in particular, may issue administrative decisions which:

1. completely or partly prohibit withdrawals of capital and earnings as well as distributions of capital and earnings;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 82 / 102 2. appoint an expert supervisor (government commissioner), who is an attorney or an external auditor; the supervisor shall have full rights pursuant to Article 93 para. 2, who shall a. prohibit this payment institution from conducting any transactions, which might exacerbate the aforementioned danger, or b. in the event that the payment institution has been prohibited, either partly or completely from continuing to conduct transactions, allow individual transactions that do not exacerbate the aforementioned danger; 3. completely or partly prohibit directors of the payment institution from managing the company, while simultaneously notifying the body responsible for appointing the directors; the responsible body must re-appoint the corresponding number of directors within one month; in order to be legally effective, such appointments require the consent of the FMA, which is to be refused, if the newly appointed directors do not appear suitable for the purpose of averting the aforementioned danger; 4. completely or partly prohibit the continuation of business operations. (2) The FMA may, at the request of the supervisor (government commissioner) appointed pursuant to para. 1 no. 2 or para. 3, appoint a deputy, if and for as long as is necessary for important reasons, especially in the event of the supervisor being temporarily prevented from performing their duties. The same provisions shall apply to the appointment of any deputy as well as their rights and duties as for the supervisor. Subject to the FMA's approval, the supervisor (government commissioner) may enlist suitably qualified persons to assist in the performance of his tasks if required in light of scope and difficulty of the tasks. The FMA's approval shall specifically identify these persons and shall be transmitted to the payment institution. These persons shall act upon the instructions of and on behalf of the supervisor (government commissioner) or his/her deputy. (3) The FMA shall obtain recommendations about suitable government commissioners from the Austrian Bar (Österreichischer Rechtsanwaltskammertag) and the Chamber of Professional Accountants and Tax Advisors (Kammer der Wirtschaftstreuhänder). In the event that a government commissioner is to be appointed in accordance with para. 1 no. 2 or a deputy pursuant to para. 2 and such an appointment is not possible on the basis of these recommendations, the FMA shall notify the Austrian Bar or the Chamber of Professional Accountants and Tax Advisors responsible based on the address of the payment institution's registered office, to allow them to name an attorney or auditor with suitable professional qualifications as government commissioner. In cases of imminent danger, the FMA may appoint

1. a lawyer, or
2. an auditor as a temporary government commissioner. This appointment will be repealed once an attorney or external auditor has been appointed in accordance with the first sentence. (4) Any measures ordered by the FMA pursuant to paras. 1 and 2 shall be suspended for the duration of any receivership procedure.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 83 / 102 (5) The government commissioner is to be remunerated by the FMA with a fee (function fee) which is commensurate to the work involved in supervision and the expenses incurred for this purpose. The government commissioner is entitled to submit invoices for each previous quarter and after the termination of his/her activities. The FMA shall pay such remuneration without delay after reviewing the invoice. (6) Administrative decisions, in which directors are prohibited, either partly or completely (para. 1 no. 4 and para. 8), from managing a payment institution pursuant to Article 3 no. 4 lit. a, as well as any revocation of this measure, shall be communicated by the FMA to the Commercial Register Court for entry into the Commercial Register. (7) If any licence requirement pursuant to Article 7 para. 10 is no longer met after such a licence has been granted, or if a payment institution pursuant to Article 4 no. 4 lit. a breaches the provisions pursuant to Article 88 para. 1 of this Federal Act, or any regulation issued on the basis of this Federal Act or an administrative decision, the FMA shall take the measures specified in Article 70 para. 4 nos. 1 to 3 BWG with regard to this payment institution and, if need be, revoke its licence pursuant to Article 11. (8) The FMA may announce any measures it has taken in accordance with paras. 1, 3 and 7 as well as any sanctions arising from breaches of this Federal Act or Regulations issued upon the basis of this Federal Act by means of an announcement on the internet, or in any newspaper with nationwide circulation or by posting a notice in a suitable location at the business premises of the payment institution (Article 4 no. 4 lit. a). Measures in accordance with para. 7 in conjunction with Article 70 para. 4 no. 1 BWG, however, may only be published, if this is necessary based on the nature and severity of the violation for informing the general public, and is reasonable with regard to any disadvantages suffered by the affected parties. These publication measures may also be taken on a cumulative basis. (9) The FMA may notify the public by way of publication on the Internet, or in a newspaper with nationwide circulation that a named natural or legal person (person) is not authorised to perform certain payment services (Article 1 para. 2), provided that this person has given cause for such action and informing the general public that is proportionate with regard to any potential disadvantages for the affected parties. These publication measures may also be taken on a cumulative basis. This person shall be clearly identifiable in the publication; for this purpose, the FMA may, if known, also state the business or residential address, Commercial Register number, web address, telephone number and fax number. (10) The person subject to this publication may make an application to the FMA to review the lawfulness of the disclosure pursuant to paras. 8 or 9 in a procedure that shall result in an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in a similar manner. If, in the course of this review, it is found that the publication was unlawful, the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. If a complaint against an administrative decision, which has been announced pursuant to para. 8, is granted suspensory effect in proceedings conducted before

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 84 / 102 public-law courts, the FMA shall make this known in the same manner. The publication shall be corrected or at the request of the concerned party either revoked or removed from the FMA's Internet presence, if the administrative decision has been repealed. (11) Following a hearing by the Oesterreichische Nationalbank, the FMA may prescribe by means of a Regulation that notifications and communications pursuant to Article 13 para. 4, Article 14 para. 1, Article 21 paras. 3 and 1, Article 25 para. 7, Article 28 para. 1 and Article 86 para. 1 shall be transmitted exclusively in electronic form and shall use specific formats and shall have to conform to minimum technical requirements and transmission procedures. In so doing, the FMA shall observe the principles of economy and expediency, ensuring that the data is electronically available to the FMA and the Oesterreichische Nationalbank at all times and supervisory interests are not compromised. Furthermore, the FMA may grant access to the electronic transmission system specified in the first sentence, in this Regulation, for auditors for certifications, communications, reports and notifications pursuant to Article 25 para. 8 and Article 95 paras. 1, 2 and 3. The FMA shall take appropriate arrangements to allow individuals subject to reporting requirements or, where applicable, individuals they have charged with submitting the reports on their behalf, to verify over an appropriate period of time whether the reporting data submitted by them or by the person charged with submitting the reports is correct and complete. Reporting obligations of auditors Article 95. (1) If an auditor, in auditing the annual financial statement of a payment institution specified in Article 4 no. 4 lit. a or performing any other activity prescribed by law at this institution, determines any circumstances that justify a reporting obligation pursuant to Article 273 paras. 2 and 3 UGB, they shall also submit the report pursuant to Article 273 para. 3 UGB at latest at the same time to the FMA and the Oesterreichische Nationalbank. (2) The auditor shall, even where no reporting obligation exists pursuant to Article 273 paras. 2 and 3 UGB, notify the FMA and the Oesterreichische Nationalbank and the directors as well as the supervisory body responsible in accordance with the law or the articles of association in writing without delay with explanations, if they discover during the performance of their duties as auditor facts that

1. point towards a material breach of the provisions specified in Article 88 para. 1 or of any regulations or administrative decisions issued by FMA issued on the basis of this Federal Act;
2. indicate that the fulfilment of the obligations of the payment institution may be endangered;
3. represent a substantial deterioration of the risk situation;
4. indicate that the true value for key balance sheet positions or off-balance sheet positions are not reflected; or
5. reasoned doubt exists about the correctness of documentation or completeness of the statement of completeness of the management board.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 85 / 102 If the auditor identifies other shortcomings, changes in the risk situation or economic situation which are not a cause for concern, or only minor violations of provisions, and if these shortcomings and violations can be rectified in the short term, then the auditor shall only be required to report to the FMA and the Oesterreichische Nationalbank in the event that the payment institution fails to correct the shortcomings and to provide the auditor with evidence of such corrections within a reasonable period of time, at the latest, however, within three months. The reporting requirement shall also apply in the event that the directors fail to provide information properly as requested by the auditor within a reasonable period of time. In cases where an external auditing company is appointed as the auditor, the reporting requirement also applies to the natural persons named pursuant to Article 77 para. 9 WTBG. (3) The auditor shall also be obliged to report any circumstances of which they become aware of during the performance of one of the aforementioned activities in an undertaking that is associated (Article 189a no. 8 UGB) to the payment institution identified in Article 4 no. 4 lit. a for which they are performing this activity. (4) In the course of performing their duties, the auditor is also obliged to inform the chairperson of the supervisory body even without an audit engagement from the supervisory body if, due to the nature and circumstances of the violations, reporting to the directors would not achieve the purpose of correcting the shortcomings and such shortcomings are severe. (5) If the auditor files a report pursuant to paras. 1 to 4 in good faith, this shall not be considered a violation of a disclosure restriction governed by a contract or by law, regulations or administrative provisions and shall not attach any liability to the auditor. Section 2: Alternative dispute resolution procedures Complaints Article 96. (1) The payment service users and other interested payments including consumer protection bodies may lodge complaints with the FMA for alleged breaches against the provisions of this Federal Act. (2) The FMA shall advise payment service users reporting a breach by a payment services institution against Article 18 (safeguarding of customer deposits), or by a payment service provider against a provision in Chapter 3 or 4 in the Regulation (EU) 2021/1230 or Regulation (EU) No 260/2012, to the possibility to lodge a complaint with the arbitration body pursuant to Article 98. Complaints handling procedure at payment service providers Article 97. (1) Payment service providers shall establish an appropriate and effective complaints handling procedure that is to be used in the case of complaints by payment service users in relation to the provisions of Chapters 3 and 4, before recourse is made to an alternative dispute resolution procedure pursuant to Article 98.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 86 / 102 (2) This procedure shall apply in that Member State in which the payment service provider is offering payment services, and shall be made available in the official language of the Member State, or in another language agreed upon between the payment service provider and the payment service user. (3) Payment service providers shall make every effort to respond to complaints by payment service users in paper form or, in the case of there being a corresponding agreement between payment service providers and payment service users, on another durable medium. In this response, which must be made within an appropriate timeframe, as latest within 15 working days following receipt of the complaint, must address all issues raised. If the payment service provider is unable, in exceptional cases for reasons that it shall not be required to justify, it shall be obliged to send an interim response clearly citing the reasons for the delay in answering the complaint, and to state therein by when the payment service user shall at latest receive the final answer. The deadline for receiving the final answer shall not in any case be permitted to exceed 35 working days. (4) The payment service provider shall inform the payment service user about the arbitration body pursuant to Article 98 that is competent for the resolution of disputes pursuant to Article 98 para. 2. The information must be shown in a clear, comprehensive and easily accessible manner on the payment service provider's website, where it has one, in the branch as well as in the general conditions in the contract between the payment service provider and payment service user. It shall specify how further information on the ADR entity concerned and on the conditions for using it can be accessed. Alternative dispute resolution - arbitration body Article 98. (1) The arbitration body in Austria is the Joint Conciliation Board of the Austrian Banking Industry (Gemeinsame Schlichtungsstelle der Österreichischen Kreditwirtschaft). Pursuant to the Alternative Dispute Resolution Act (AStG; Alternative-Streitbeilegung-Gesetz) published in Federal Law Gazette I No. 105/2015, it is required to guarantee an appropriate, independent, impartial, transparent and effective alternative dispute resolution procedure. (2) It is competent for procedures for the resolution of disputes between payment service providers and payment service users, in the case that the latter are consumers pursuant to Article 4 no. 20,

1. pursuant to Article 102 of Directive (EU) 2015/2366;
2. pursuant to Article 100 of Directive 2009/65/EC;
3. pursuant to Article 13 of Directive 2009/110/EC;
4. pursuant to Article 10 of Regulation (EU) 2021/1230; as well as
5. pursuant to Article 12 of Regulation (EU) No. 260/2012. (3) It is also competent for procedures for resolving disputes between payees and their payment service providers pursuant to Article 15 of Regulation (EU) 2015/751 on interchange fees for card￾based payment transactions, OJ L 123, 19.05.2015, p. 1.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 87 / 102 Section 3: Penal and procedural provisions Penal provisions Article 99. (1) Anyone performing payment services without the necessary authorisation pursuant to Article 1 para. 2 nos. 1 to 7, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 50 000. (2) Anyone providing account information services pursuant to Article 1 para. 2 no. 8 without being entered into the register of payment institutions pursuant to Article 15, commits an administrative offence and shall be punished and shall be fined by the FMA up to EUR 10 000. (3) Anyone breaching the reporting requirements pursuant to Article 3 para. 4 (threshold of limited networks), commits an administrative offence and shall be fined by the FMA up to EUR 30 000. (4) Parties who disclose or exploit confidential facts contrary to Article 20 para. 5, in order to create an economic advantage for themselves or others, or in order to place others at a disadvantage, shall be punished with a term of imprisonment of up to six months or with a fine of up to 360 per diem rates. The offender shall only be prosecuted with the authorisation of the person whose interest in confidentiality was breached. (5) Anyone breaching the provisions of Article 5 para. 1 or 2 as the operator of a payment system commits an administrative offence and shall be fined by the FMA up to EUR 30 000. Penal provisions for persons responsible (§ 9 VStG) Article 100. (1) Anyone acting as a person responsible (as per Article 9 of the Administrative Penal Act (VStG; Verwaltungsstrafgesetz)) for a payment institution pursuant to Article 4 no. 4 lit. a or a branch pursuant to Article 28, who breaches

1. a restriction pursuant to Article 7 (requirement to hold and scope of the licence),
2. an obligation pursuant to a. Articles 16 or 17 (own funds), b. Article 20 paras. 1 to 4 (organisational requirements), c. Article 24 (record keeping obligations), d. Article 26 (reporting), or
3. which omits to notify the FMA in writing of any acquisition and any disposal of a qualifying holding pursuant to Article 19 paras. 1 and 3, commits an administrative offence and shall be punished by the FMA by a fine of up to EUR 100 000 in the case of no. 1, or a fine of up to EUR 60 000 in any of the cases listed in nos. 2 and 3. (2) Anyone acting as a person responsible (pursuant to Article 9 VStG) for a payment institution pursuant to Article 4 no. 4 lit. a, an electronic money institution pursuant to Article 3 para. 2 E￾Geldgesetz 2010, or a branch pursuant to Article 28 who breaches the guarantee obligations contained in Article 18, is deemed to have committed an administrative offence, and shall be fined up to EUR 100 000.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 88 / 102 (3) Anyone acting as auditor for a payment institution pursuant to Article 4 no. 4 lit. a or a branch pursuant to Article 28 who breaches the reporting obligations pursuant to Article 95 paras. 1, 2 or 3, commits an administrative offence, and shall be fined by the FMA up to EUR 100 000. (4) Anyone acting as a person responsible (pursuant to Article 9 VStG) for a payment institution pursuant to Article 4 no. 4 lit. a or a branch pursuant to § 28 who fails to submit the annual financial statements to the FMA in a timely manner, in violation of Article 25 para. 3, is deemed to have committed an administrative offence, and shall be fined up to EUR 20 000. (5) The FMA has all competences under Article 93 para. 2 in investigations regarding administrative penal procedures as defined in Article 99 and pursuant to paras. 1 to 4, and paras. 6 to 9. (6) Any person who, as person responsible (Article 9 VStG) for a payment institution pursuant to Article 4 no. 4 lit a

1. violates the obligations pursuant to Article 21 paras. 1 and 2, Article 23 paras. 2 and 3, Articles 33, 50, 51, Article 62 para. 4, Articles 64, 72, 75, 77, 78, 85, 86 and 87 of this Federal Act of pursuant to Article 36 BWG, or
2. violates the obligations pursuant to Articles 35, 47, 48, 53, 54 and 57 of this Federal Act, or
3. who fails to notify the FMA in writing without delay the circumstances listed in Article 13 para. 4, Article 15, Article 21 para. 3 and Article 22 para. 1, commits an administrative offence and shall be fined by the FMA in the cases listed in accordance with no. 1 up to EUR 60 000, and in the cases listed in accordance with nos. 2 or 3 up to EUR 10 000. (7) Any person who, as person responsible (Article 9 VStG) for a branch pursuant to Article 27
4. violates the obligations pursuant to Articles 35, 47, 48, 54 or 57 of this Federal Act, or
5. violates the obligations pursuant to Articles 33, 50, 51, Article 62 para. 4, Articles 64, 72, 75, 77, 78, 85, 86 and 87 of this Federal Act of pursuant to Article 36 BWG, commits an administrative offence and shall be fined by the FMA up to EUR 10 000 for the cases in accordance with no. 1, and up to EUR 60 000 in cases in accordance with no. 2. (8) Anyone acting as a person responsible (Article 9 VStG) of a payment service provider pursuant to Article 1 para. 3 no. 1 and nos. 3 to 5, who
6. violates the obligations pursuant to Articles 35, 38, 47, 48, 53, 54, 57 and 87 of this Federal Act, or
7. violates the obligations pursuant to Articles 33, 50, 51, Article 62 para. 4, Articles 64, 72, 75, 77, 78, 85 and 86 of this Federal Act, commits an administrative offence and shall be fined by the FMA up to EUR 10 000 for the cases in accordance with no. 1, and up to EUR 60 000 in cases in accordance with no. 2. (9) In the event of a breach of an obligation pursuant to Article 13 para. 4, Article 14 para. 1 no. 1 regarding changes to the articles of association, nos. 4, 7, and 10 as well as Article 14 para. 2 with regard to Article 20 para. 3 BWG, the FMA shall refrain from initiating and conducting administrative penal proceedings if the notification that was not properly submitted was subsequently made before the FMA or the Oesterreichische Nationalbank had gained knowledge of this breach.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 89 / 102 Penal provisions for payment service providers in conjunction with cross-border payment transactions Article 101. (1) Any payment service provider that in contravention to Article 3 or Article 6 (1) of Regulation (EC) No 2021/1230

1. charges higher charges for payment service users for cross-border payments denominated in euro within the European Economic Area than for corresponding national payment transactions of the same amount and in euro, or
2. charges a payment service user a charge for the provision of information about their IBAN and BIC details, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 60 000. (1a) Anyone who contravenes the provisions of Regulation (EU) 2021/1230, by
3. failing to observe the information obligations and requirements in relation to card-based transactions pursuant to Article 4 of that Regulation as a payment service provider or party that provides currency conversions at an auto-teller machine (ATM) or at a point of sale,
4. failing to observe the information obligations as a payment service provider regarding charges for payment transactions and currency conversion charges related to credit transfers pursuant to Article 5 of that Regulation, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 10 000. (2) Any supplier of goods or any service provider accepting cross-border payments within the European Economic Area who, when invoicing goods or services within the European Economic Area, fails to disclose his IBAN and the BIC of his payment service provider contrary to Article 6 (3) of Regulation (EU) 2021/1230, commits an administrative offence, and shall be subject to a fine imposed by the FMA of up to EUR 10 000. (3) Anyone who fails, contrary to Article 6(1) or (3) of Regulation (EU) 2021/1230, to
5. indicate the IBAN and BIC on the statements of account of their payment service user or in an annex to these statements,
6. provide a payment service user the user's IBAN and BIC upon request,
7. inform a payment service user in due time prior to an agreement becoming legally effective, about additional fees and their amount which shall be charged, because the payment service user gave the payment service provider the order to execute a cross-border payment a. without indicating the IBAN, or b. without indicating the BIC, where stipulated pursuant to Regulation (EU) No 260/2012, for the payment account in the other Member State, or
8. break down the charges collected in accordance with no. 3 in an appropriate manner and in line with the actual costs, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 10 000.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 90 / 102 Penal provisions for payment service providers in conjunction with instant credit transfers and payee verification Article 101a. (1) Anyone who breaches the provisions of Regulation (EU) No 260/2012, by:

1. not offering the sending and receiving of instant credit transfers contrary to Article 5a (1) first subparagraph,
2. not ensuring the reachability of payment accounts for instant credit transfers contrary to Article 5a (1) second subparagraph, provided that no case of non-availability pursuant to Article 11 (1c) exists,
3. carrying out instant credit transfers contrary to Article 5a (4) points a to e,
4. failing to restore the payment account to the state in which it would have been had the transaction not taken place contrary to Article 5a (5),
5. failing upon the request of the payment service user, to offer a payment service user the possibility of setting a limit fixing a maximum amount that can be sent by means of instant credit transfer contrary to the rules stated in Article 5a (6),
6. failing to offer the possibility of bundling payment orders contrary to Article 5a (7),
7. levying higher charges for sending and receiving instant credit transfers in euro than for the sending and receiving of other credit transfers contrary to Article 5b (1),
8. charging a fee for payee verification for payment orders contrary to Article 5b (2),
9. failing to conduct payee verification for payment orders contrary to Article 5c (1), or conducting a payee verification that does not conform to the rules set out in Article 5c (1),
10. failing to ensure that the information concerning the payee in payment orders is correct contrary to Article 5c (2),
11. failing to have robust internal procedures in place contrary to Article 5c (3) to ensure that the information concerning the payee is correct,
12. failing to perform the service ensuring payee verification at the time of receipt of the payment order in the case of paper-based payment orders contrary to Article 5c (4),
13. failing to ensure contrary to Article 5c (5) that the performance of the verification of the payee for payment order and the service described in Article 5c (4) does not prevent the payer from authorising the credit transfer concerned,
14. failing to enable payment service users that are not consumers, contrary to Article 5c (6) the means to opt out from the verification of the payee for payment orders when submitting several payment orders as a package, or fail to ensure that payment service providers that have opted out have the right at any time to opt back in to receive that service.
15. failing to inform or failing to inform the payment service user in an orderly manner contrary to Article 5c (7), commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 10 000. (2) Anyone who as a payment service provider offers an instant credit transfer pursuant to Article 2 point 1a of Regulation (EU) No 260/2012, and who contrary to Article 5d (1) of Regulation (EU) No

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 91 / 102 260/2012 fails immediately following the entry into force of a new or amended targeted financial restrictive measure, and at least once every calendar day to verify whether any of their payment service users are persons or entities subject to targeted financial restrictive measures, commits an administrative offence and shall be fined by the FMA

1. in the case of a legal person, fines of up to 10 % of the total annual net turnover of that legal person in the preceding business year,
2. in the case of a natural person, a fine of up to EUR 5 000 000. For the purposes of no. 1 the relevant amount for the case that the legal person is a subsidiary of a parent undertaking pursuant to Article 2 point 9 of Directive 2013/34/EU or another undertaking that actually exercises a controlling influence on this legal person, is the revenue that arises from the consolidated financial statements of the ultimate parent undertaking in the preceding financial year. Penal provision on the basis of Regulation (EU) No. 260/2012 Article 102. (1) Anyone who violates the provisions of Regulation (EU) No. 260/2012. by:
3. contrary to Article 3, not being reachable as a payment service provider,
4. contrary to Article 4 (2) first sentence, not ensuring that the technical interoperability of payment systems is assured,
5. contrary to Article 4 (2), second sentence, adopting a business rule that restricts interoperability,
6. contrary to Article 4 (3), hindering the processing of a credit transfer or a direct debit through a technical obstacle,
7. contrary to Article 5 (1), (2), (4) or (7), carrying out a credit transfer,
8. contrary to Article 5 (1), (3), (5) or (6), carrying out a direct debit,
9. contrary to Article 5 (8), charging a fee for a read-out process specified therein,
10. contrary to Article 8, charging a multilateral interchange fee per direct debit transaction or other agreed remuneration with an equivalent object or effect,
11. contrary to Article 9 (1), as a payer, specifying the Member State in which the payment account of the payee is to be located,
12. contrary to Article 9 (2), as a payee, specifying the Member State in which the payment account of the payer is to be located, commits an administrative offence and shall be punished by the FMA with a fine of up to EUR 10 000. (2) The administrative penal provisions pursuant to para. 1 shall not apply to consumers. Special procedural provisions Article 103. (1) The FMA shall be the first instance responsible for the imposing of administrative penalties pursuant to Articles 99 to 102.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 92 / 102 (2) Fines imposed by the FMA pursuant to this Federal Act shall be passed on to the Federal Government. Penal provision on the basis of a lack of a licence Article 104. (1) Anyone who provides payment services pursuant to Article 1 para. 2 without the required authorisation, or grants credits in violation of the restrictions listed in Article 7 para. 5 or accepts deposits or issues electronic money in violation of Article 7 para. 4 shall not be entitled to a claim for any remunerations, costs or charges associated with such transactions. The legal ineffectiveness of the agreements associated with these transactions shall not, however, render the entire transaction legally ineffective. Agreements to the contrary as well as suretyships and guarantees associated with those transactions are legally invalid. Publication of administrative offences and fines Article 105. (1) The FMA may publish any imposed fine that is legally effective for a breach pursuant to Article 99 paras. 2 to 3 and 5, and Articles 100 to 102 including the identity of the person upon whom the sanction has been imposed and the information about the type and character of the underlying infringement without delay, once the person affected by the decision has been informed, on its official website. (2) The publication pursuant to para. 1 may be omitted, or be conducted on an anonymised basis, if the disclosure

1. of a sanctioned person would be disproportionate,
2. would endanger the stability of the financial markets of a Member State or several Member States of the European Union,
3. would jeopardise the conducting of ongoing criminal law investigations, or
4. the parties concerned would suffer a disproportionately high level of damage, insofar as the level of damage is able to be determined. (3) The person affected by a publication may make an application to the FMA to review the lawfulness of the publication pursuant to para. 1 in a procedure that shall result in an administrative decision. In this case, the FMA shall announce the initiation of such proceedings in a similar manner. If, in the course of this review, it is found that the publication was unlawful, the FMA shall correct the publication or, at the request of the person subject to this publication, either revoke it or remove it from its website. If a complaint against an administrative decision, which has been announced pursuant to para. 1, is granted suspensory effect in proceedings conducted before public-law courts, the FMA shall make this known in the same manner. The publication shall be corrected, or, upon request of the concerned party, revoked or removed from the website if the administrative decision is repealed.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 93 / 102 Section 4: Receivership and insolvency provisions General provisions Article 106. (1) Recovery proceedings may not be instigated against the assets of a payment institution. In the event of the bankruptcy of a payment institution, no application of the recovery plan shall take place. (2) The FMA shall have the status of a party to the proceedings in receivership and bankruptcy proceedings concerning payment institutions. (3) The application to instigate bankruptcy proceedings against a payment institution may only be submitted by the FMA. Otherwise, Article 70 IO shall apply. (4) A natural or legal person may be appointed as receiver. (5) The court must consult the FMA before appointing or dismissing a receiver or a bankruptcy trustee. (6) The court shall notify the FMA without delay about the receivership order by sending a court order. Application for the opening of proceedings Article 107. (1) Payment institutions that are overindebted or unable to pay, may in cases where it appears likely that their overindebtedness or incapacity to pay may be remedied, may apply for a receivership order with the court having jurisdiction for the instigation of bankruptcy. This request may also be submitted by the FMA. (2) Payment institutions shall submit an orderly list of their receivables and liabilities as well as the annual accounts, including the notes and the management reports, of the last three years with the application. (3) In preparing its decision, the court may hear informants and expert witnesses, as well as conducting other investigations. Receiver Article 108. (1) In cases where receivership is ordered, the court shall appoint a receiver. The receiver shall be responsible for overseeing the running of the payment institution. The receiver shall be liable to all parties involved for any damage caused by the negligent performance of his/her function. (2) The receiver shall have the right to inspect the business documents of the payment institution; the receiver shall be invited to meetings of the executive and supervisory bodies and may also convene such meetings. The receiver is authorised to prohibit the execution of resolutions taken by the bodies of the payment institution. (3) The court may revoke the appointment of the receiver at any time.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 94 / 102 (4) The receiver shall be entitled to be remunerated for his/her activities; the amount of which shall be determined by the court. (5) The receivership order and appointment of the receiver shall be made public. The court shall arrange for the receivership order and the appointment of the receiver to be entered into the Commercial Register. Legal effects Article 109. (1) Receivership shall take effect from the start of the day following the public announcement of the court order about the receivership order. (2) Once receivership takes effect, all previously incurred claims against the payment institution, including claims arising from bills of exchange and cheques which would have to be satisfied in bankruptcy proceedings by means of the joint bankruptcy estate (Article 50 IO) as well as interest and other ancillary fees arising, shall be deferred, even where they only became due or were only accrued during the period of receivership. (3) After ordering receivership, the court shall have the financial situation of the payment institution assessed by experts, the cost of the assessment being borne by the payment institution. The receiver must report to the court in writing on the result of this assessment. The report shall also indicate whether the payment institution is able to pay a certain fraction of the liabilities it incurred before receivership legally took effect. Based on the report, the court may order that only a fraction of the prior claims be subject to cancellation; the court may also allow the receiver to settle prior claims in their entirety to be determined according to their type or amount. (4) During receivership, prior claims must neither be secured nor, unless partial payment is permitted (para. 3) paid out or satisfied in any way. (5) During receivership, neither may bankruptcy proceedings be instigated against old claims against the assets of the payment institution, nor may a judicial pledge or right to satisfy a claim be acquired on the associated assets, provided that they are subject to a deferment of payment. (6) The period of time, by which payment is postponed as a result of deferment, shall not be included in the calculation of the limitation period or statutory periods for the bringing of lawsuits. (7) In the event of the bankruptcy of the payment institution, payment service users shall be entitled to offset their claims against the payment institution against the payment institution's claims. Special rules Article 110. (1) In the case that the payment institution, for which a receivership order has been imposed, is a cooperative society, then the cooperative shares in the undertaking may not be legally called, nor may the shares and the balances otherwise due to the member that has withdrawn, be paid out based on the cooperative relationship; notice and liability periods which are already in progress shall be suspended.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 95 / 102 (2) The payment institution may continue to conduct its business activities, unless the court has ordered to the contrary at the receiver's request. However, the credit institution must obtain the consent of the receiver in order to conduct transactions which are not part of normal business operations. The payment institution shall however also refrain from activities forming part of normal business operations, if the receiver objects to such activities. Legal acts carried out without the consent or against the objection of the receiver shall be ineffective towards the creditors, in the event that the involved third party knew or ought to have known that such acts exceeded the scope of normal business operations, and the receiver had neither granted consent for, nor objected to those acts. (3) The funds, which the payment institution receives from transactions concluded after receivership has commenced (new claims), shall be accounted for and administered separately; these funds – even after the expiration of receivership – shall constitute a special bankruptcy estate for the purpose of the preferential settlement of new claims. Application for waiving of obligations Article 111. After two years following the termination of receivership, the payment institution may apply, unless bankruptcy proceedings have been initiated against the assets of the payment institution during this period of time, to have the obligation waived to account for and administer the funds received on the basis of new claims separately. If such an application is submitted, the court shall review the applicant's financial situation. If this review reveals the security of the new claims not to be jeopardised by such an exemption, the request shall be approved; thereafter the special bankruptcy estate shall be deemed to be dissolved. Orders by the receiver Article 112. In the event of disputes arising from the receiver's orders, the court shall decide by means of a decision. The court may also obtain the required information without the involvement of the parties and, by virtue of office, carry out all suitable investigations in order to make the necessary determinations. Expiry of receivership Article 113. (1) Receivership shall be terminated by a court decision revoking receivership, as well as by the initiation of bankruptcy proceedings. (2) The court shall terminate receivership, if:

1. the conditions which prompted the receivership order no longer exist, or
2. a period of one year has passed since receivership was ordered. (3) The lifting of the receivership order shall be announced publicly once the decision to lift receivership has become legally effective. The court shall also arrange that the termination of the receivership order is entered in, and the receiver deleted from, the commercial register.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 96 / 102 (4) In cases where receivership is terminated due to the initiation of bankruptcy proceedings, or where bankruptcy proceedings are initiated on the basis of a petition submitted within 14 days after the termination of receivership, then the periods to be calculated retroactively from the date of the petition for the initiation of such proceedings or from the date of initiation of such proceedings according to the Insolvency Code (IO) are to be calculated from the date on which receivership went into effect. (5) Both the payment institution and the FMA may take recourse against the rejection of a request for the imposing of receivership and against the termination of receivership; however, only the payment institution may take recourse against decisions which define the amount of remuneration and the cash expenses to be reimbursed to the receiver. Other decisions may not be contested. Appeals beyond rulings of the provincial superior court will not be permitted. Public announcements Article 114. (1) The provisions of the Insolvency Code (IO; Insolvenzordnung) shall apply to public announcements. (2) Inspection rights in the insolvency database shall no longer be granted, if three years have elapsed since the lifting of receivership. In cases where receivership was terminated due to the initiation of bankruptcy proceedings, then such an inspection shall be permitted until the period for inspection in bankruptcy proceedings has also expired (Article 256 IO). CHAPTER 6: TRANSITIONAL AND FINAL PROVISIONS Transitional provisions Article 115. (1) Payment institutions that were granted a licence pursuant to ZaDiG, as published in Federal Law Gazette I No. 66/2009 until 31 May 2018 for their activities, may continue to perform such activities, without needing to apply for a licence pursuant to Article 9. Payment institutions that intend to continue to provide the payment services covered by their licence beyond 31 May 2018, shall be required to submitted all factually relevant information to the FMA until 13 July 2018, so that the FMA may assess whether these payment institutions fulfil the requirements set forth in Articles 5 and 6 as well as Chapter 2 of this Federal Act. Prior to 13 July 2018 the FMA shall refrain from imposing administrative penalties for breaches against the listed provisions. (2) For payment institutions that have proven to the FMA pursuant to para. 1, that the requirements of Articles 9 and 10 are complied with, the licence shall be deemed to have been granted. The FMA shall enter these payment institutions into the register of payment institutions pursuant to Article 13 para. 2, and shall inform the EBA as well as the payment institution concerned about this. (3) Where the submitted information pursuant to para. 1 does not permit any positive assessment from the FMA's perspective, or if the payment institution has omitted to submit the information pursuant to para. 1, then the FMA shall revoke the licence (Article 11).

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 97 / 102 (4) Regardless of para. 1 payment institutions that held licences to provide the payment services listed in Article 1 para. 2 no. 6 ZaDiG, published in Federal Law Gazette I No. 66/2009, shall keep their licence to provide the payment services listed in Article 1 para. 2 no. 3 of this Federal Act, if they have provided the FMA with proof by 13 January 2020 that they comply with the requirements of Article 16 para. 1 no. 3 and Article 17. Prior to 13 July 2020 the FMA shall desist from imposing administrative penalties. (5) Legal entities that already provided payment initiation services (Article 1 para. 2 no. 7) or account information services (Article 1 para. 2 no. 8) prior to 13 January 2016 in Austria, shall be allowed to continue to perform such activities until Articles 59 to 61 and Article 87 enter into force, without needing to apply for a licence pursuant to Article 9 or a registration pursuant to Article 15. Other payment services shall not be allowed to be performed. Legal entities that also wish to provide the named payment services following the entry into force of Articles 59 to 61 and Article 87, must apply for a licence pursuant to Article 9 or a registration or a registration pursuant to Article 15 until the date when Articles 59 to 61 and Article 87 enter into force. If this application is submitted promptly and completely, then the applicant shall be allowed to continue to be active until the FMA's decision regarding the application becomes legally effective. (6) Legal entities that have provided payment initiation services (Article 1 para. 2 no. 7) or account information services (Article 1 para. 2 no. 8) since 13 January 2016 in Austria and that also wish to provide these activities after 1 June 2018, shall be required to apply for a licence pursuant to Article 9 or a registration pursuant to Article 15 until 1 June 2018. If this application is submitted promptly and completely, then the applicant shall be allowed to continue to be active until the FMA's decision regarding the application becomes legally effective. (7) Where the submitted information pursuant to para. 5 or para. 6 does not permit any positive assessment from the FMA's perspective, or if the legal entity has omitted to submit the information pursuant to para. 5 or para. 6, then the licence pursuant to Article 9 or the registration pursuant to Article 15 shall be deemed to no longer be granted. (8) Account servicing payment service providers shall not be allowed to refuse payment initiation service providers and account information service provider access to the payment accounts that they service until the entry into force of Articles 59 to 61 and Article 87, because they do not satisfy the requirements of Articles 59 to 61 and Article 87.(9) Applications pursuant to Article 9 (licence application) and Article 15 (registration application for account information services) shall be permissible from the date of publication of this Federal Act. Gender-neutral use of language Article 116. Where expressions in this Federal Act relating to persons are given only in the masculine form, they shall refer equally to men and women. The respective gender-specific form shall be used when applied to specific persons.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 98 / 102 References Article 117. (1) Where references to other Federal Acts are made in this Federal Act, they shall be applicable in their most recently amended versions, unless explicitly specified otherwise. (2) Where in other legal regulations issued by the Federal Government, including those published by the FMA refer to the provisions of the ZaDiG, published in Federal Law Gazette I No. 66/2009 that have been repealed, the corresponding provisions of this Federal Act shall instead apply in their place. (3) Where references are made in this Federal Act to Directives issued by the European Union, unless instructed otherwise, the following listed versions thereof shall apply:

1. (repealed by the amendment published in Federal Law Gazette I 37/2018);
2. Directive 2002/87/EC on the supplementary supervision of credit institutions, insurance undertakings and investment firms in a financial conglomerate and amending Council Directives 73/239/EEC, 79/267/EEC, 92/49/EEC, 92/96/EEC, 93/6/EEC and 93/22/EEC, and Directives 98/78/EC and 2000/12/EC, OJ L 35, 11.02.2003, p. 1, last amended by Directive 2013/36/EU, OJ L 176, 27.06.2013, p. 338;
3. Directive 2007/64/EC on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC, OJ L 319, 05.12.2007, p. 1 most recently amended by Directive 2009/111/EC, OJ L 302, 17.11.2009, p. 97;
4. Directive 2009/65/EC on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS), OJ L 302, 17.11.2009, p. 32, last amended by Directive 2014/91/EU, OJ L 257, 28.08.2014, p. 186;
5. Directive 2009/110/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC, OJ L 267, 10.10.2009, p. 7;
6. Directive 2009/138/EC on the taking-up and pursuit of the business of Insurance and Reinsurance, OJ L 335, 17.12.2009, p. 1, last amended by Directive (EU) 2016/2341, OJ L 354, 23.12.2016, p. 37, in the version of the corrigendum, OJ L 108, 28.04.2015, p. 8;
7. Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 173, 12.06.2014, p. 349, last amended by Directive (EU) 2016/1034, OJ L 175, p. 8, as amended by the corrigendum, OJ L 64, 10.03.2017, p. 116.
8. Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC, OJ L 141, 05.06.2015, p. 73;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 99 / 102 9. Directive (EU) 2015/2366 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC, OJ L 337, 23.12.2015, p. 35, as amended by Regulation (EU) 2024/886, OJ L 2024/886, 19.03.2024; 10. Directive 98/26/EC on settlement finality in payment and securities settlement systems, OJ L 166, 11.06.1998, p. 45, in the version of Regulation (EU) 2024/886, OJ L 2024/886, 19.03.2024; 11. Directive 2006/43/EC on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC, OJ L 157, 09.06.2006, p. 87, most recently amended by Directive (EU) 2023/2864, OJ L 2023/2864, 20.12.2023; 12. Directive 2013/34/EU on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC, OJ L 182, 29.6.2013, p. 19, in the version of Directive (EU) 2024/1306, OJ L 2024/1306, 08.05.2024. (4) Where references are made in this Federal Act to EU Regulations, unless instructed otherwise, the following listed versions thereof shall apply:

1. Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1;
2. Regulation (EU) 2021/1230 on cross-border payments in the Union, OJ L 274, 30.07.2021, p. 20.
3. Regulation (EU) No 1092/2010 on European Union macro-prudential oversight of the financial system and establishing a European Systemic Risk Board, OJ L 331, 15.12.2010, p. 1;
4. Regulation (EU) No 1093/2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, OJ L 331, 15.12.2010, p. 12;
5. Regulation (EU) No. 260/2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009, OJ L 94, 30.03.2012, p. 22, in the version of Directive (EU) 2024/1306, OJ L 2024/1306, 08.05.2024;
6. Commission Implementing Regulation (EU) No 646/2012 of 16 July 2012 laying down detailed rules on fines and periodic penalty payments pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council, OJ L 187, 17.07.2012, p. 29;
7. Regulation (EU) No 575/2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 646/2012, OJ L 176, 27.6.2013, p. 1.
8. Commission Delegated Regulation (EU) No. 241/2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions, OJ L 74, 14.03.2014, p. 8;

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 100 / 102 9. Regulation (EU) 2015/751 on interchange fees for card-based payment transactions, OJ L 123, 19.05.2015, p. 1; 10. Regulation (EU) No 2015/847 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006, OJ L 141, 05.06.2015, p. 1; 11. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 04.05.2016, p. 1; 12. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No. 909/2014 and (EU) 2016/1011, OJ L 333, 27.12.2022, p. 1; 13. Regulation (EU) No 2024/886 amending Regulations (EU) No. 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro, OJ L 2024/886, 19.03.2024. (5) Any regulation issued based on this Federal Act as amended may be issued from the day following publication of the Federal Act to be implemented; however, Regulations shall not be allowed to enter into force before the statutory provisions to be implemented have themselves entered into force. Transposition Note Article 117a. (1) Directive (EU) 2015/2366 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC, OJ L 337, 23.12.2015, p. 35, is transposed by the Federal Act published in Federal Law Gazette I No. 17/2018. (2) The Federal Act published in Federal Law Gazette I No. 39/2020 serves the purpose of implementing Regulation (EU) 2019/518 amending Regulation (EC) No 924/2009 as regards certain charges on cross-border payments in the Union and currency conversion charges, OJ L 91, 29.03.2019 p. 36. (3) The Federal Act published in Federal Law Gazette I No. 201/2021 serves the purpose of implementing Directive (EU) 2019/713 on combating fraud and counterfeiting of non-cash means of payment and replacing Council Framework Decision 2001/413/JHA, OJ L 123, 10.05.2019, p. 18. (4) The Federal Act published in Federal Law Gazette I No. 33/2023 serves the purpose of implementing Regulation (EU) No. 2021/1230 on cross-border payments in the Union, OJ L 274, 30.07.2021, p. 20. (5) The Federal Act published in Federal Law Gazette I No. 112/2014 transposes Directive (EU) 2022/2556 amending Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 regarding digital operational resilience in the financial sector, OJ L 333, 27.12.2022, p. 153.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 101 / 102 (6) The Federal Act published in Federal Law Gazette I No. 5/2026 serves to implement Regulation (EU) 2024/886 amending Regulations (EU) No. 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro, OJ L 2024/886, 19.03.2024. Enforcement Article 118. (1) The following shall be responsible for the enforcement of this Federal Act

1. with regard to Article 5 para. 4, Article 11 para. 4, Article 13 para. 1, Article 19 para. 4 no. 3, Article 19 paras. 5 and 6, Article 23 para. 1, Articles 34, 38, 58, 63, 67, 68, 70, 71, 73, 74, 79 to 84, Article 99 para. 3 as well as Articles 106 to 114 the Federal Minister for Justice,
2. with regard to Article 20, Article 23 para. 2, Articles 32, 33, 35 to 37, 39 to 57, 62, 64 to 66, 69, 72 and 75 to 78 the Federal Minister of Finance in cooperation with the Federal Minister for Justice,
3. with regard to all other provisions the Federal Minister of Finance. Entry into force Article 119. (1) This Federal Act shall enter into force on 1 June 2018. (2) Articles 59 to 61 and Article 87 shall enter into force 18 months after the entry into force of the delegated act that the European Commission shall issue pursuant to Article 98 of Directive (EU) 2015/2366. (3) Article 86 paras. 3 to 6, Article 88 para. 3 no. 3 and Article 117a para. 3 in the version of the Federal Act amended in Federal Law Gazette I No. 36/2022 shall enter into force on the day following publication. (4) Article 89 para. 6 in the version of the Federal Act amended in Federal Law Gazette I No. 36/2022 shall apply to the FMA’s financial years that begin after 31 December 2021. (5) Article 3 para. 3 no. 10, Article 9 para. 1 nos. 5, 6 and 8, Article 9 para. 3, Article 21 para. 1, Article 85 para. 1a, Article 86 para. 7, Article 117 para. 4 nos. 11 and 12 and Article 117a para. 5 in the version amended by Federal Act in Federal Law Gazette I No. 112/2024 shall enter into force on 17 January

(6) The table of contents regarding Article 5a and Article 101a, Article 5 para. 3, Article 5a including heading, Article 18 para. 1 first sentence, no. 1 lit. b, no. 2 and para. 3, Article 86 para. 7 introductory paragraph, Article 88 para. 9, Article 89 para. 6, Article 100 para. 2, Article 101a including heading, Article 117 para. 3 nos. 10 to 12 and para. 4 nos. 5, 12 and 13 as well as Article 117a para. 6 in the version amended in Federal Law Gazette No. I 5/2026 shall enter into force on the following day after publication. Article 89 para. 6 shall apply for the first time to FMA financial years that begin after 31 December 2025.

Payment Services Act 2018 (ZaDiG 2018; Zahlungsdienstegesetz 2018) 102 / 102 Repeal Article 120. The Payment Services Act (ZaDiG; Zahlungsdienstegesetz), published in Federal Law Gazette I No. 66/2009, shall be repealed at the end of 31 May 2018.