Pursuant to Section 22 of the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG), institutions governed by this Act are required to have their annual accounts reviewed by an external auditor. The audit report must be submitted to BaFin and the Bundesbank immediately after the audit has been completed. Pursuant to Section 24(3) ZAG, BaFin has adopted a regulation that contains, amongst other things, more detailed requirements regarding the subject of the audit by the external auditor, when it is to be conducted, and the form and content of the audit reports. The auditor must comply with these requirements.

The Audit Report Regulation concerning Payment Institutions (Zahlungsinstituts-Prüfungsberichtsverordnung – ZahlPrüfbV) stipulates that, in addition to the audit report, the auditor also submits three annexes that form an integral part of the audit report. These annexes contain specific information, structured as follows:

• Annex 1 contains a data overview for institutions that have outsourced activities to another undertaking.
• Annex 2 contains a form for the presentation and assessment of the measures taken to prevent money laundering and terrorist financing.
• Annex 3 contains a data overview for payment and electronic money institutions with regard to business activity data.

The annexes must be completed carefully by the auditor and must be attached to the audit report so as to ensure complete and rule-compliant documentation.