The Payment Services Supervision Act (ZAG) regulates the provision of payment services in the European Economic Area (EEA). Although ecrop itself is not a payment institution and does not offer payment services within the meaning of the ZAG, understanding the ZAG is relevant for our customers and our business model, as our crypto securities issuers and custodians regularly interact with payment service providers in their business operations. The following sections explain the distinction between our services and regular payment services, the interfaces with payment service providers, the importance of integrating payment service providers for our customers, and additional measures to ensure compliance with applicable regulations.

​
What are Payment Services and Why are They Necessary Partners for ecrop Platform Customers?

Payment services under ZAG include services related to payment accounts, such as executing transfers, direct debits, and card payments, as well as issuing payment cards and e-money accounts. Although ecrop itself does not offer any of these services, they are relevant to our business model as our ecrop issuers receive fiat currencies in their payment service provider account to issue crypto securities.

​
Distinction of ecrop Services from Payment Services:

ecrop is not a payment institution within the meaning of the ZAG and therefore does not offer regular payment services. Our platform exclusively serves for maintaining the registry of crypto securities pursuant to § 1 Para. 1a Sentence 2 No. 8 KWG and the custody of crypto assets pursuant to § 1 Para. 1a Sentence 2 No. 6 KWG. These activities are explicitly excluded from the scope of the ZAG and are regulated by separate BaFin licenses.

​
Interfaces with Payment Service Providers:

To enable the deposit and withdrawal of fiat currencies by issuers, ecrop cooperates with the payment provider Secupay AG. Secupay AG is a regulated payment institution and holds the required licenses for providing payment services.
  • Secure Interface: The interface for information exchange between ecrop and Secupay is secure and complies with data protection requirements. Data exchange is encrypted (TLS encryption) and logged to ensure traceability and security of transactions.
  • Regular Reviews: We conduct regular reviews of the interface and Secupay AG to ensure security and compliance with applicable regulations.

​
Compliance:

Secupay ensures that the cooperation with ecrop complies with the requirements of the ZAG and anti-money laundering regulations.
  • Regular Controls: We conduct regular controls of processes and implementations.
  • Risk Management: Our risk management system assesses risks associated with cooperation with payment service providers and implements appropriate risk mitigation measures.
  • Reporting: We regularly report to management and supervisory authorities on the status of payment services and compliance with regulatory requirements.

​
Operational Implementation:

  • Defined Processes: Clear processes govern the cooperation with Secupay and information exchange between parties for the issuer.
  • Control Mechanisms: We employ control mechanisms to ensure security and compliance in payment transactions, e.g., transaction monitoring to ensure transaction data integrity.
  • Regular Reporting: We create regular reports on deposits and withdrawals that are reported to management and supervisory authorities.