NATIONAL LEGISLATOR IN GERMANY
3. The so-called Anscheinsbeweis-rule in Germany
In comparison to the PSD 1, the revised PSD 2 contains an amendment of art 72 on evidence on authentication and execution of payment transactions. Art 72 para 2 sentence 2 PSD 2, which was not part of the PSD 1, now reads:
18 For the applicability of the rule on contributory fault in payment service law, see BGH, 24.4.2012 – XI ZR 96/11, Neue Juristische Wochenschrift (NJW), 2012, 2422, recital 29 et seqq.; S. Omlor, in: Staudinger, BGB, 2020, § 675v, Rn.
30 et seq.
“The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user.”
At first glance, the textual expansion of the rule on evidence is incomprehensible, as sentence 1 of art 72 para 2 PSD 2 states:
“Where a payment service user denies having authorized an executed payment transaction, the use of a payment instrument recorded by the payment service provider (...) shall in itself not necessarily be sufficient to prove either that the payment transaction was authorized by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfill one or more of his obligations.”
That means that both sentences essentially state the same – at least as far as they refer to potential misconduct of the payer.
Yet, in order to understand the second sentence, one needs to consider the study on the impact of the PSD 1.19 There it is said that national law based on prima facie evidence in cases of unauthorized transactions has not changed after implementation of the PSD 1, although the first sentence of art 72 para 2 did already existed in the PSD 1. In essence, the study criticizes that the regulatory objectives were missed. The study observes that “German consumers must still bear the entire loss” and that similar problems have been reported by associations from Denmark and Sweden. This means that, with its new sentence 2, the PSD 2 tried to avoid any automatism of evidence to the detriment of the customer – believing that such an automatism was, inter alia, in Germany in place. The background to this assumption is a German rule on evidence known commonly as
19 Study on the impact of Directive 2007/64/EC on payment services in the internal market and on the application of Regulation (EC) No 924/2009 on cross-border payments in the Community, Contract MARKT/2011/120/H3/ST/OP – Final report, p. 239 et seqq.
The transposition of the PSD 2: the role of EBA and of the national legislator in Germany
“Anscheinsbeweis” (prima facie evidence).20 The Anscheinsbeweis was developed by the German Federal Supreme Court (BGH).21 Courts apply the Anscheinsbeweis to discharge payment service provider of the burden to present evidence of pertinent circumstances that inherently cannot be detected since they lie within the inaccessible customer’s sphere. For example: If a debit card was used along with the PIN at an ATM in Bergamo (Italy), then the circumstances prima facie imply that it was the customer himself who made the withdrawal. It is then up to the customer to prove that he wasn’t able to do so since he was giving lectures in Mannheim (Germany) that very same moment.
The prima-facie-rule may not be confused with an irrebuttable presumption of proof (Beweisvermutung) since it merely relieves the plaintiff of its burden of proof. Thus, the Anscheinsbeweis is just a facilitation of proof (Beweiserleichterung).22 The customer does not need to fully rebut the prima-facie-rule by providing counterevidence. Instead, the customer needs to contest the evidence-rule based assumption by submitting sensible arguments and facts in a court hearing. Hence, the prima-facie-rule simply tries to take into account that facts stem from different spheres of influence (Verantwortungsbereiche) and that these facts cannot be reviewed by both parties nor does one party have the means to obtain knowledge about these facts within the area of control of the other party. Hence, to distribute burdens of proof appropriately, both the payer and the payment service provider are in each case responsible for facts within their own sphere. With the help of
20 The rule generally does apply to all kinds of payment methods (cf. Online Banking, cash withdrawal at ATMs, debit card payments at the point of sale, etc.).
21 See BGH, 26.1.2016, XI ZR 91/14, ECLI:DE:BGH:2016:260116UXIZR91.14.0;
first developed in BGH, 5.10.2004, XI ZR 210/03, Neue Juristische Wochenschrift (NJW), 2004, p. 3623 (in this case, a PIN-based ec-card was exposed and then misused).
22 D. Linardatos, Neue Juristische Wochenschrift (NJW), 2017, 2145 (2146) with further references.
the prima-facie-rule, the courts try to impose the onus on the party who is in control of the circumstances that need to be proven and is hence in control of the evidence itself.
Now, regarding the aforementioned meaning of the prima-facie-rule, did the German legislator decide to exclude the Anscheinsbeweis in order to comply with the revised text of the PSD 2? There is no clear-cut answer to this question, since the legislator failed to express its opinion on this issue, leaving it to scholars and practitioners to determine the exact significance of the revised evidence rule in the PSD 2. However, according to the prevailing academic opinions, the prima-facie-rule does apply in payment services in Germany despite the revision of the PSD 2.23 It is argued by different scholars that the national legislator was not obliged to rule out the Anscheinsbeweis since the PSD 2 just reiterated its position that Member States have to avoid an evidence rule that always applies in favour of the payment service provider and that, in fact, cannot be disproven by the customer. Hence, it can be reasoned that there is no need to change the national procedural law if there is no irrefutable rule.
Indeed, such irrefutable rule to the detriment of the customer – as shown above – did never exist in German law. The Anscheinsbeweis is only intended to prevent an exorbitant onus of proof to the one-sided drawback of the payment services provider. This implies that, insofar as the prima-facie-rule is concerned, the impact study24 is faulty reporting on the German jurisdiction. According to the German Federal Supreme Court (BGH), the prima-facie-rule does only apply if25,
23 D. Linardatos, Neue Juristische Wochenschrift (NJW), 2017, 2145 et seqq.;
agreeing S. Omlor, Juristische Schulung (JuS), 2019, 289 (293); K. Zahrte, Neue Juristische Wochenschrift (NJW), 2018, 337 (340 et seq.); O. Böger, in V. Baas/P. Buck-Heeb/S. Werner (Ed.), Anlegerschutzgesetze, 2018, § 675w recital 30.
24 Cf. supra footnote 18.
25 See BGH, 26.1.2016, XI ZR 91/14, ECLI:DE:BGH:2016:260116UXIZR91.14.0, recital 27 et seqq.; prerequisites summarized in D. Linardatos, in Karsten Schmidt (Full Ed.), Münchener Kommentar zum HGB, Band 6: Bankvertragsrecht, 4th Edition 2019, K. Online-Banking, recital 250 and 254.
The transposition of the PSD 2: the role of EBA and of the national legislator in Germany
· first: the payment service provider proved that the payment transaction was authenticated, accurately recorded, entered into the accounts and not affected by a technical breakdown or some other deficiency of the service provided by the payment service provider – which means that the payment service provider must have met the requirements of section 675w BGB;
· second: a security system has been used that is virtually impossible to tackle and the interference of an unauthorized third party with the communication channel between payer and payment service provider is practically excluded;
· third: a dynamic TAN was used for the transaction and the payment service user was given the opportunity of reviewing the payment order before the transaction was released, which means that the requirements of the SCA must have been met.
One clear-cut example of a system that is not sufficiently secure is the now out-of-use paper TAN-list. Another example of a system that does not fulfil the Court’s criteria to apply the prima-facie-rule is the mobile TAN-system. According to the German Federal Supreme Court, the fact that several reports of successful hack attempts on the mobile-TAN-system are known is reason enough to exclude the prima-facie-rule. This assessment is of particular relevance since the mobile TAN-system does fulfil the requirements on SCA. Hence, it is fair to conclude that the requirements defined by the BGH in order to apply the prima-facie-rule are even stricter than the requirements set out in the Regulation on Strong Customer Authentication. Thus, the German legislator acted rightfully when he decided not to exclude the prima-facie-rule. In fact, legal scholars in Germany argue that art 72 para 2 sentence 2 of the PSD 2 can be simply ignored since the provision does not add noteworthy obligations.26
26 Cf. proofs in footnote 22; dissent Keßler, in Ebenroth/Boujong/Joost/
Strohn (Ed.), Handelsgesetzbuch, 4th Edition 2020, Section 675w recital 11 with footnote 27.
4. The supervisory regulation of the Third Party Service