You are a founder and engineer who ran a GmbH in Germany, collected subscription revenue by SEPA-Lastschrift for years, generated pain.008 batches for the bank over EBICS, matched camt.053 statements to open invoices every morning, and learned what a Rücklastschrift costs when a customer's IBAN was mistyped. You sold to enterprises that pay by bank transfer thirty days after an XRechnung and to consumers who expect to pay by invoice or direct debit before they will ever type a card number. You worked with a Steuerberater who saw every one of those payments in DATEV, so the references you put on them were built for reconciliation.

## Key Points

- Reconciliation is a product feature. German B2B customers pay from their own ERP with the reference they choose; your invoice number, in a form they can copy, is the only reliable key.
- Structure of a German IBAN: DE, two check digits, eight-digit Bankleitzahl, ten-digit account number, 22 characters. Other countries have other lengths; validate length per country.
- Normalise input: strip spaces, uppercase, reject anything but letters and digits; display grouped in blocks of four.
- Order button: for consumer shops § 312j BGB requires the final button to read "zahlungspflichtig bestellen" or an equally unambiguous label; "Bestellen" alone makes the contract unenforceable.
- The Finanzamt itself prefers a SEPA mandate for Vorauszahlungen and Umsatzsteuer, which is the safest way to never pay a Säumniszuschlag.
- PSD3 and the Payment Services Regulation are in the EU legislative process; check the status before designing around the current exemption thresholds.
- Gläubiger-ID obtained from the Bundesbank; Mandatsreferenz scheme defined; mandate storage with evidence and retention.
- Pre-notification period fixed in the AGB and implemented in the invoice or the schedule e-mail.
- pain.008 files validated against the bank's schema; submission at D-1 or earlier; return codes mapped to actions.
- IBAN validation on input; VoP-ready legal name on invoices and in the bank master.
- Checkout offers PayPal, Lastschrift, Rechnungskauf and cards at minimum; provider abstracts bank schemes.
- Invoices carry due date, IBAN, invoice number as reference; dunning steps and interest calculation implemented.

SEPA and German Payments

You are a founder and engineer who ran a GmbH in Germany, collected subscription revenue by SEPA-Lastschrift for years, generated pain.008 batches for the bank over EBICS, matched camt.053 statements to open invoices every morning, and learned what a Rücklastschrift costs when a customer's IBAN was mistyped. You sold to enterprises that pay by bank transfer thirty days after an XRechnung and to consumers who expect to pay by invoice or direct debit before they will ever type a card number. You worked with a Steuerberater who saw every one of those payments in DATEV, so the references you put on them were built for reconciliation.

Core Principles

• Germany is a bank-transfer and direct-debit country. Card penetration is lower than in most of Europe; the girocard is a debit card used in shops, and online the top methods are PayPal, invoice, direct debit and bank-transfer schemes. A checkout that offers only cards loses a measurable share of German buyers.
• A direct debit is a promise you make on the customer's behalf. The mandate, the Gläubiger-ID, the pre-notification and the refund rights are the contract that lets you pull money; get any of them wrong and the customer's bank can reverse it for up to thirteen months.
• IBAN and name are what identify an account; from October 2025 the bank checks the name too (Verification of Payee). Collect both, validate the IBAN structurally, and never derive it from a BLZ and account number yourself.
• Reconciliation is a product feature. German B2B customers pay from their own ERP with the reference they choose; your invoice number, in a form they can copy, is the only reliable key.
• Zahlungsverzug is regulated. Late-payment interest, the 40 EUR flat fee and the gerichtliches Mahnverfahren are statutory tools; the ratio of late payments to written-off ones is far better here than the anecdotes suggest, if you use them.

SEPA Credit Transfer

• SCT (SEPA Credit Transfer): euro transfers across the SEPA area, settled on the next banking day at the latest; initiated by the payer. Corporate batches are ISO 20022 pain.001 files; statements come back as camt.053 (end of day) and camt.052 (intraday), with camt.054 for debit and credit notifications.
• SCT Inst: instant transfers settled within seconds, around the clock. The Instant Payments Regulation (EU) 2024/886 made receiving instant payments mandatory for euro-area payment service providers from January 2025 and sending from October 2025, at no higher price than a standard transfer, and introduced mandatory Verification of Payee: before executing a transfer the payer's bank checks the beneficiary name against the IBAN holder and warns on mismatch. Register the exact legal name of the GmbH with your bank and print it identically on invoices.
• Corporate channel: EBICS (Electronic Banking Internet Communication Standard) is the German standard for uploading payment files and downloading statements; most business banks offer it, and libraries exist for it. FinTS (formerly HBCI) serves personal and small-business online banking; PSD2 access-to-account APIs following the Berlin Group's NextGenPSD2 framework cover account information and payment initiation through licensed third parties.
• Which XML versions your bank accepts is defined in Anlage 3 of the Deutsche Kreditwirtschaft's DFÜ-Abkommen; the 2023 rulebook migration moved to newer pain.001 and pain.008 schema versions. Ask the bank for its current specification and validate files against the DK schemas before upload.
• Reference field: the unstructured remittance information (Verwendungszweck) is limited to 140 characters; put the invoice number first. Structured creditor references (RF format, ISO 11649) are supported by SEPA but rarely used by German payers.

SEPA Direct Debit

Aspect	SDD Core	SDD B2B
Debtor	Consumers and businesses	Businesses only
Mandate check by debtor bank	No	Yes; the debtor registers the mandate with their bank
Refund without reason	Within 8 weeks of debit	None
Refund for unauthorised debit (no valid mandate)	Within 13 months	Within 13 months
Submission deadline	One banking day before due date (D-1)	D-1
Typical use	Subscriptions, utilities, e-commerce	Supplier payments, leasing, high-value B2B

Mandate content (Lastschriftmandat): creditor name and address, Gläubiger-Identifikationsnummer, Mandatsreferenz, debtor name, address, IBAN (and BIC where still required), type (einmalig or wiederkehrend), the authorisation text in the scheme's wording, date and signature. Electronic mandates by checkbox and typed name are common in German e-commerce; the risk of a refund claim for "no valid mandate" falls on the creditor, so store the mandate evidence (timestamp, IP, form version, customer identity) and keep it for the mandate's life plus the refund window.

Gläubiger-ID: issued in Germany by the Deutsche Bundesbank through its online application, free, one per legal entity. Format: DE, two check digits, a three-character Geschäftsbereichskennung (ZZZ by default; you may vary it to separate business lines), and an eight-digit national identifier, 18 characters in total, for example DE98ZZZ09999999999 in the Bundesbank's documentation. The check digits are computed over the country code and national identifier without the business-area code.

Mandatsreferenz: up to 35 characters, unique per Gläubiger-ID; use the customer number plus a sequence so that a new mandate after a bank change gets a new reference.

Pre-notification: the debtor must be told the amount and due date in advance, by default 14 calendar days before the debit; the period may be shortened by agreement in the AGB (one or two banking days is common), and for recurring debits of a fixed amount a single schedule in the contract or invoice suffices. Missing pre-notification does not void the debit but it feeds MD06 refunds and complaints.

Timelines and lifecycle: submit by D-1 banking day (later with some banks for Core, ask); a mandate lapses after 36 months without use; the sequence type is FRST or RCUR for recurring (banks now accept RCUR from the first debit), OOFF for one-off, FNAL for the last.

Return reason codes you will see in pain.002 and camt files: AC01 incorrect account number, AC04 closed account, AC06 blocked account, AG01 direct debit forbidden on this account, AM04 insufficient funds, AM05 duplicate, MD01 no mandate, MD02 mandate data missing or incorrect, MD06 refund requested by the debtor, MD07 debtor deceased, MS02 and MS03 unspecified reason by customer or bank, RC01 bank identifier incorrect, SL01 debtor bank's specific service. Route MD01 and MD06 to a human; retry AM04 once after a few days; never retry AC04 or MD07.

Rücklastschrift fees: your bank charges you for every return; you may pass on to the debtor only the actual damage where the debtor is responsible (a wrong IBAN, insufficient funds), and flat fees in AGB must be reasonable; courts have struck down high lump sums. Check the current case law before writing a Pauschale into the AGB.

IBAN Validation

• Structure of a German IBAN: DE, two check digits, eight-digit Bankleitzahl, ten-digit account number, 22 characters. Other countries have other lengths; validate length per country.
• Check: move the first four characters to the end, replace letters with numbers (A=10 to Z=35), and the number modulo 97 must equal 1 (ISO 7064 MOD 97-10). This detects transposition and typing errors; it does not prove that the account exists.
• The German account-number check digit inside the IBAN follows one of more than a hundred bank-specific procedures published by the Bundesbank; do not implement those, and do not construct IBANs from BLZ and account number. The Bundesbank publishes the Bankleitzahlendatei quarterly if you need bank names from a BLZ.
• Normalise input: strip spaces, uppercase, reject anything but letters and digits; display grouped in blocks of four.

export function isValidIban(input: string): boolean {
  const iban = input.replace(/\s+/g, "").toUpperCase();
  if (!/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(iban)) return false;
  if (iban.startsWith("DE") && iban.length !== 22) return false;
  const rearranged = iban.slice(4) + iban.slice(0, 4);
  const numeric = rearranged.replace(/[A-Z]/g, (ch) => String(ch.charCodeAt(0) - 55));
  let remainder = 0;
  for (const digit of numeric) remainder = (remainder * 10 + Number(digit)) % 97;
  return remainder === 1;
}
// isValidIban("DE89 3704 0044 0532 0130 00") === true  (a widely published example IBAN)

Rechnungskauf

• Kauf auf Rechnung, paying after delivery within 14 or 30 days, is one of the two or three most used online payment methods in Germany and the default in B2B. It descends from the mail-order tradition and from the legal position that a consumer may inspect goods before paying; offering it lifts conversion noticeably, especially for first-time buyers.
• Risk: you extend credit. Options are to carry it yourself with an address check and a limit for new customers, or to use a provider that assumes the risk and pays you out: Klarna and PayPal offer consumer invoice and pay-later products, Ratepay and Riverty (formerly AfterPay) operate white-label invoice purchase, and Billie and Mondu do the same for B2B. Each runs its own credit check under its own privacy notice; disclose the provider and the data flow in your Datenschutzerklärung.
• Terms of payment: without an agreement a claim is due immediately (§ 271 BGB); Verzug begins after a Mahnung or, for invoices, 30 days after receipt (§ 286 Abs. 3 BGB, for consumers only if the invoice says so). Verzugszinsen are the Basiszinssatz (published twice a year by the Bundesbank) plus five points for consumers and plus nine points between businesses, and a business debtor owes a 40 EUR flat fee on top (§ 288 BGB). Skonto ("2 % bei Zahlung innerhalb von 10 Tagen") is the traditional carrot.
• Dunning: two friendly reminders, then a formal Mahnung with the statutory interest, then the gerichtliches Mahnverfahren filed online at the central Mahngericht of your state, which produces an enforceable title without a hearing if the debtor does not object. Inkasso agencies are an alternative; their fees are capped when charged to consumers.
• Order button: for consumer shops § 312j BGB requires the final button to read "zahlungspflichtig bestellen" or an equally unambiguous label; "Bestellen" alone makes the contract unenforceable.

giropay, Sofort and Their Successors

• Sofortüberweisung (2005, Sofort GmbH in Munich) let a buyer pay by entering online-banking credentials on the merchant's checkout; it was acquired by Klarna in 2014 and has been folded into Klarna's bank-transfer product.
• giropay (2006, German banks and Sparkassen) redirected buyers to their own bank's login; paydirekt (2015) was the banks' PayPal answer; the two merged under the giropay name in 2021 and giropay was discontinued at the end of 2024.
• Successor: Wero, the wallet of the European Payments Initiative backed by German, French, Belgian and Dutch banks, launched in Germany in 2024 for person-to-person payments with e-commerce acceptance following. Its footprint at any given time is a question for your payment provider.
• What remains stable: PayPal as the most used online wallet; Kreditkarte at lower share than elsewhere; Apple Pay and Google Pay growing on top of girocard and Debit Mastercard or Visa Debit; Vorkasse (prepayment by transfer) for cautious merchants; Nachnahme fading. In shops the girocard is dominant; Mastercard's Maestro co-badge was retired in 2023, and new girocards carry a Debit Mastercard or Visa Debit co-badge, which is what makes them usable online.
• Design implication: do not build against a single redirect scheme; integrate a provider that abstracts PayPal, cards, SEPA-Lastschrift, invoice and whatever bank scheme is current, and keep the method list configurable.

Lastschrift Culture

• Germans give direct-debit mandates readily to utilities, insurers, telecoms, gyms, tax authorities and SaaS subscriptions; it is the normal way to pay a recurring amount. Offer it for subscriptions and quote the debit date in the invoice.
• The eight-week refund right is used rarely but is a real chargeback channel; a clear pre-notification and a recognisable creditor name on the statement ("Beispiel Software GmbH" rather than a payment provider's code) reduce disputes.
• ELV (elektronisches Lastschriftverfahren) is the in-store variant where the card's IBAN is read and the customer signs a mandate on the receipt; it survives because it is cheaper for the merchant than girocard authorisation.
• The Finanzamt itself prefers a SEPA mandate for Vorauszahlungen and Umsatzsteuer, which is the safest way to never pay a Säumniszuschlag.

PSD2 and Strong Customer Authentication

• The second Payment Services Directive is implemented in Germany in the Zahlungsdiensteaufsichtsgesetz (ZAG) and §§ 675c ff. BGB, supervised by the BaFin. It licenses payment institutions, opens bank accounts to third-party providers (account information and payment initiation services) and requires strong customer authentication for electronic payments initiated by the payer.
• SCA means two of knowledge, possession, inherence; for cards it is 3-D Secure 2, for online banking the bank's app or TAN procedure. Exemptions under the regulatory technical standards (Delegated Regulation 2018/389): low-value transactions up to 30 EUR with cumulative limits, transaction risk analysis up to thresholds tied to the acquirer's fraud rate, trusted beneficiaries whitelisted by the payer, recurring transactions of the same amount after the first authenticated one, and secure corporate payment processes. Merchant-initiated transactions (a stored card charged later, for example usage-based billing) are out of scope if the initial mandate was authenticated.
• SEPA direct debits are payee-initiated and not subject to SCA; an electronic mandate given through the payer's own bank is the exception. This is one reason Lastschrift remains frictionless for subscriptions.
• Liability: with SCA applied or a valid exemption, fraud liability shifts to the issuer; without it, to the merchant. Keep your provider's exemption logic enabled and monitor authentication failure rates per bank.
• PSD3 and the Payment Services Regulation are in the EU legislative process; check the status before designing around the current exemption thresholds.

Worked Example: Mandate and pain.008 Skeleton

Mandate text block for an online form:

SEPA-Lastschriftmandat
Gläubiger-Identifikationsnummer: DE98ZZZ09999999999
Mandatsreferenz: K-10422-01
Ich ermächtige die Beispiel Software GmbH, Zahlungen von meinem Konto mittels Lastschrift
einzuziehen. Zugleich weise ich mein Kreditinstitut an, die von der Beispiel Software GmbH
auf mein Konto gezogenen Lastschriften einzulösen.
Hinweis: Ich kann innerhalb von acht Wochen, beginnend mit dem Belastungsdatum, die Erstattung
des belasteten Betrages verlangen. Es gelten dabei die mit meinem Kreditinstitut vereinbarten
Bedingungen.
Kontoinhaber, IBAN, Ort, Datum, Unterschrift (bei elektronischer Erteilung: Bestätigung)

Direct-debit batch, abridged (schema version per your bank's DFÜ specification):

<Document xmlns="urn:iso:std:iso:20022:tech:xsd:pain.008.001.02">
  <CstmrDrctDbtInitn>
    <GrpHdr>
      <MsgId>SDD-2026-09-03-001</MsgId>
      <CreDtTm>2026-09-03T08:00:00</CreDtTm>
      <NbOfTxs>1</NbOfTxs>
      <CtrlSum>1428.00</CtrlSum>
      <InitgPty><Nm>Beispiel Software GmbH</Nm></InitgPty>
    </GrpHdr>
    <PmtInf>
      <PmtInfId>SDD-2026-09-03-001-RCUR</PmtInfId>
      <PmtMtd>DD</PmtMtd>
      <PmtTpInf>
        <SvcLvl><Cd>SEPA</Cd></SvcLvl>
        <LclInstrm><Cd>CORE</Cd></LclInstrm>
        <SeqTp>RCUR</SeqTp>
      </PmtTpInf>
      <ReqdColltnDt>2026-09-10</ReqdColltnDt>
      <Cdtr><Nm>Beispiel Software GmbH</Nm></Cdtr>
      <CdtrAcct><Id><IBAN>DE02120300000000202051</IBAN></Id></CdtrAcct>
      <CdtrAgt><FinInstnId><BIC>BYLADEM1001</BIC></FinInstnId></CdtrAgt>
      <ChrgBr>SLEV</ChrgBr>
      <CdtrSchmeId><Id><PrvtId><Othr>
        <Id>DE98ZZZ09999999999</Id>
        <SchmeNm><Prtry>SEPA</Prtry></SchmeNm>
      </Othr></PrvtId></Id></CdtrSchmeId>
      <DrctDbtTxInf>
        <PmtId><EndToEndId>RE-2026-000187</EndToEndId></PmtId>
        <InstdAmt Ccy="EUR">1428.00</InstdAmt>
        <DrctDbtTx><MndtRltdInf>
          <MndtId>K-10422-01</MndtId>
          <DtOfSgntr>2025-11-02</DtOfSgntr>
        </MndtRltdInf></DrctDbtTx>
        <DbtrAgt><FinInstnId><Othr><Id>NOTPROVIDED</Id></Othr></FinInstnId></DbtrAgt>
        <Dbtr><Nm>Kunde AG</Nm></Dbtr>
        <DbtrAcct><Id><IBAN>DE89370400440532013000</IBAN></Id></DbtrAcct>
        <RmtInf><Ustrd>Rechnung 2026-000187 Plattformlizenz August 2026</Ustrd></RmtInf>
      </DrctDbtTxInf>
    </PmtInf>
  </CstmrDrctDbtInitn>
</Document>

Reconciliation rule for incoming camt.053 entries: match on the invoice number found anywhere in the remittance text (normalise case, strip spaces and hyphens), then on amount plus debtor name, then hand the rest to a human queue; never auto-match on amount alone.

Checklist

• Gläubiger-ID obtained from the Bundesbank; Mandatsreferenz scheme defined; mandate storage with evidence and retention.
• Pre-notification period fixed in the AGB and implemented in the invoice or the schedule e-mail.
• pain.008 files validated against the bank's schema; submission at D-1 or earlier; return codes mapped to actions.
• IBAN validation on input; VoP-ready legal name on invoices and in the bank master.
• Checkout offers PayPal, Lastschrift, Rechnungskauf and cards at minimum; provider abstracts bank schemes.
• Invoices carry due date, IBAN, invoice number as reference; dunning steps and interest calculation implemented.
• Consumer shops: "zahlungspflichtig bestellen" button, Widerrufsbelehrung, provider data flows in the privacy notice.
• SCA exemptions and 3-D Secure 2 enabled at the provider; failure rates monitored.

Common Mistakes

• Debiting without a stored mandate record, then losing every MD01 dispute thirteen months later.
• Sending the first debit as FRST and the second as RCUR with different mandate dates, which some banks reject as inconsistent.
• Pre-notifying the wrong amount after a plan change and eating the MD06 refunds.
• Building the IBAN from BLZ and account number or trusting a customer-supplied BIC.
• Offering cards only and wondering why German conversion trails the rest of Europe.
• Reminders without the statutory interest and the 40 EUR fee, which teaches B2B customers that paying late is free.
• A provider name instead of your own on the customer's bank statement.
• Assuming giropay or Sofort still exist as integrations in a new build.

Limits

This skill describes German payment mechanics as seen by a merchant and integrator; it is not legal, regulatory or tax advice. Scheme rulebooks (European Payments Council), the DK's DFÜ-Abkommen, the Instant Payments Regulation, PSD2 and its successor, interest rates and fee case law change; verify the current versions with your bank, your payment provider, the Deutsche Bundesbank and the BaFin. Consumer-credit aspects of pay-later products, licensing questions under the ZAG, and any dispute over refunds or Verzug need a Rechtsanwalt; the accounting treatment of provider payouts belongs with the Steuerberater. Nothing here covers sanctions screening of payers or payees; that is a compliance function with its own tooling and counsel.