Who governs German payroll: the authorities and what they own

How to read the map

Foreign operators usually arrive expecting one tax office and one social security agency, because that is what most jurisdictions have. Germany instead distributes payroll across specialised bodies — some federal ministries, some federal agencies, some self-governing insurance carriers that are not "the state" at all. The practical consequence: a single German pay run creates filings, payments or evidence duties toward five or more distinct counterparties, each with its own identifier, channel and audit right.

Two organising facts make the rest fall into place. First, rule-making and collection are split: the ministry that writes a rule is almost never the body you file to. Second, collection and audit are split: the Krankenkassen take the social insurance money, but it is the pension insurer that checks your books. Keep those two splits in mind and the dozen bodies below stop looking chaotic.

BMF and your Finanzamt: the wage-tax rules vs the wage-tax money

What they own. The Bundesministerium der Finanzen (BMF) — the Federal Ministry of Finance — owns the wage-tax rulebook. Its most payroll-shaped artefact is the Programmablaufplan (PAP): the official flowchart, announced each year in agreement with the Länder finance authorities under § 39b Abs. 6 EStG, that prescribes exactly how software must compute Lohnsteuer, Solidaritätszuschlag and the church-tax base. Every certified payroll engine in Germany implements the same BMF-published algorithm — the current one, for calendar 2026, was announced on 12 November 2025. The BMF also publishes the official form patterns, including the Muster for the Lohnsteuer-Anmeldung. The Finanzamt — specifically your Betriebsstättenfinanzamt, the local tax office competent for the place where wages are calculated — owns collection: it receives the Lohnsteuer-Anmeldung and the withheld amounts.

What they take from an employer. Nothing goes to the BMF directly — you consume its rules through your software. The Finanzamt takes the Lohnsteuer-Anmeldung (monthly, quarterly or annual depending on volume) by the 10th day after each filing period, plus the withheld Lohnsteuer, Solidaritätszuschlag and church tax, remitted by the same deadline. The channel is ELSTER: electronic, authenticated transmission per official data set is mandatory, with paper available only as a hardship exception. The filing and payment mechanics live in our lodgement guide; the withholding attributes themselves in the Lohnsteuer & ELStAM article.

When you'll hear from them. From the BMF: never — you hear from it through the annual PAP cycle your software vendor tracks. From the Finanzamt: on registration (it issues the Steuernummer after the Fragebogen zur steuerlichen Erfassung), on late filing (a discretionary Verspätungszuschlag) or late payment (Säumniszuschläge), on non-filing (it can estimate), and in a Lohnsteuer-Außenprüfung — the wage-tax field audit, whose findings are also handed to the pension insurer's auditors.

BZSt: the ELStAM database and the Steuer-ID

What it owns. The Bundeszentralamt für Steuern (BZSt) — the Federal Central Tax Office — runs the identity and attribute infrastructure under the wage-tax system: it issues the lifelong steuerliche Identifikationsnummer (Steuer-ID) to every taxpayer, and it operates the ELStAM database, from which employers retrieve each employee's electronic wage-tax deduction attributes — tax class, factor, child-allowance count, allowances, private-insurance amounts, and the church-tax attribute, which tells you whether to withhold Kirchensteuer at all and carries the rate digit (currently "8" or "9", set by Land law). Registry offices feed it: marriages, births and church exits change an employee's ELStAM without either of you filing anything.

What it takes from an employer. A registration event, not money: at the start of every employment you must register the employee with the tax administration and retrieve their ELStAM from the BZSt by authenticated remote data transfer (§ 39e Abs. 4 EStG), keyed by the employee's Steuer-ID and date of birth; a matching deregistration is due at exit. Between the two, you apply whatever changed ELStAM the database pushes to you.

When you'll hear from it. Rarely in person — the BZSt is deliberately behind-the-scenes. Its own guidance routes employer-side ELStAM questions to your Betriebsstättenfinanzamt, with operational support running through ELSTER. If ELStAM retrieval fails (bad Steuer-ID, mismatched birth date), the symptom appears in your payroll software, and the fallback is withholding at the punitive class VI until the record is fixed.

The Krankenkassen: the surprise at the centre of the system

What they own. Here is the fact that startles most foreign operators: Germany's statutory health insurers — around ninety competing Krankenkassen, a count that drifts downward as funds merge — are not just health insurers. Each Kasse is, for its own members, the Einzugsstelle: the statutory collection point for the entire Gesamtsozialversicherungsbeitrag — health, long-term care, pension and unemployment insurance together (§ 28i SGB IV). The Kasse monitors your Beitragsnachweis and payment (§ 28h SGB IV) and forwards the pension and unemployment shares to the carriers behind it.

What they take from an employer. The employee picks the Kasse — you answer to each one picked. Per Kasse in your workforce, you owe: the DEÜV event reports (hire, exit, annual and interruption reports), the monthly Beitragsnachweis (contribution statement, due two bank working days before the payment), and the contribution payment itself, due on the third-last bank working day of each month in estimated amount. The Kassen are also where you retrieve the eAU — the electronic sickness certificate. Rates, ceilings and who bears what: see the social insurance overview; the calendar mechanics: the lodgement timeline.

When you'll hear from them. Monthly, structurally — and immediately when a Beitragsnachweis is missing or late, because the Einzugsstelle can then estimate your contributions, and late payment draws statutory Säumniszuschläge. The Kasse is also the first stop for insurance-status questions on individual employees.

Deutsche Rentenversicherung: the pension carrier that audits everyone

What it owns. The Deutsche Rentenversicherung (DRV) carries the statutory pension insurance — and, structurally more important for a payroll operator, it owns the employer audit. Under § 28p SGB IV the pension insurance carriers examine every employer at least every four years for the correctness of contribution payments and reports across the whole social insurance system, on behalf of all branches. The DRV also runs identity plumbing you use daily: Versicherungsnummer queries, the A1 posting-certificate machinery, and — via Knappschaft-Bahn-See — the Minijob-Zentrale.

What it takes from an employer. No monthly payment (your pension contributions arrive via the Kassen), but plenty of data. The audit is fed electronically: employers using certified payroll software must deliver audit-relevant payroll data ahead of the Betriebsprüfung through the euBP procedure, and the audit reaches settlement results, Entgeltunterlagen (pay records), Beitragsnachweise, Meldungen — and even the Finanzamt's wage-tax audit reports. Employment-status assessments (dependent employment vs self-employment, including for managing shareholders and working family members) sit inside the same audit.

When you'll hear from it. On the four-year clock, announced in advance (roughly a month, at latest 14 days) — plus ad-hoc audits on an Einzugsstelle's request or on events like closure or insolvency. And note who else gets audited: § 28p extends to "steuerberatende Stellen, Rechenzentren und vergleichbare Einrichtungen" — tax-advising offices, payroll data centres and comparable bodies that settle wages or file reports on employers' behalf are themselves audit subjects. A payroll operator like Ledra Pay is on the DRV's list in its own name, not just its clients'.

Bundesagentur für Arbeit: the number that keys everything

What it owns. The Bundesagentur für Arbeit (BA) — the Federal Employment Agency — carries the unemployment insurance branch and owns the Betriebsnummer: the eight-digit establishment number every employer must apply for electronically, per Beschäftigungsbetrieb, before participating in the social insurance reporting procedures (§ 18i SGB IV). The BA describes it as the elementary identifier of the entire Meldeverfahren — it rides on every DEÜV report and every contribution payment reference you will ever produce.

What it takes from an employer. The Betriebsnummer application at the start (which itself requires the accident-insurance Unternehmensnummer as an input — see the next section, and the full sequence in registrations & employer IDs). You never pay the BA directly — the unemployment contributions flow through the Krankenkassen as Einzugsstellen. At the other end of the lifecycle, the BA takes the Arbeitsbescheinigung: the employment certificate it needs to assess a departing employee's unemployment benefit, issued on demand of the employee or the BA and — for employments ended on or after 1 January 2023 — transmitted electronically over the BEA rail from your payroll system.

When you'll hear from it. At setup (Betriebsnummer issuance and changes to establishment data), and at exits, when an employee claims benefits and the BA requests the BEA certificate. Silence in between is normal.

DGUV and the Berufsgenossenschaften: the branch you almost forgot

What they own. Statutory accident insurance runs entirely outside the Krankenkassen circuit. The carriers are the Berufsgenossenschaften (BGen) — sector-organised, self-governing accident insurers — with the DGUV (Deutsche Gesetzliche Unfallversicherung) as their umbrella. They own sector classing: your enterprise is assigned to the competent BG for its industry and, within it, to risk classes (Gefahrklassen) from the BG's tariff, which — multiplied by your wage bill and the BG's annually set Beitragsfuß — produce a contribution with no national rate. Since 1 January 2023 they also own an identifier: the 15-digit Unternehmensnummer (UNR.S), issued via the DGUV as the uniform key of accident insurance.

What they take from an employer. Registration within one week of starting the enterprise (§ 192 SGB VII) — which is what triggers the Unternehmensnummer that the BA's Betriebsnummer application then requires, making the BG the logical first registration of a German employer. Annually, the digital Lohnnachweis (wage report) by 16 February, plus the UV-Jahresmeldung through the DEÜV channel; then the contribution notice, levied retrospectively and paid by the employer alone — employees contribute nothing. Cost mechanics: see employer costs.

When you'll hear from them. At registration (classification into the Gefahrtarif — worth checking, since it drives your rate for years), each year at Lohnnachweis and contribution time, and after workplace accidents, which must be reported and can trigger prevention-side visits.

Zoll and the FKS: the enforcement arm that doesn't call ahead

What they own. The customs administration (Zoll, under the finance ministry) owns ground-level labour enforcement through its Finanzkontrolle Schwarzarbeit (FKS) unit: minimum-wage compliance under the MiLoG, posted-worker minimum conditions, and the fight against undeclared work (Schwarzarbeit) and illegal employment. It is the reason German wage-floor law has teeth.

What they take from an employer. Evidence, on demand: payroll records, working-time records and (for foreign employers) German-language documents held in Germany. Employers of minijobbers and employers in the sectors listed in § 2a of the Schwarzarbeitsbekämpfungsgesetz — construction, hospitality, transport and logistics, building cleaning, meat, security and the rest of the statutory list — additionally carry the § 17 MiLoG duty to record each day's working time and keep the records for the FKS to inspect. The same sector list drives the Sofortmeldung: in those industries the hire report is due before work starts, precisely so an FKS patrol can check workers against the register in real time. Rates, record rules and the fine bands: see the minimum-wage article.

When you'll hear from them. Without warning. FKS checks are suspicion-independent and may be unannounced, during working hours, and reach back into past periods. This is the one authority on this page whose first contact is most likely to be physical presence at your (or your client's) premises — the mitigation is boring: complete time records, payslips that reconcile, and pay at or above the floor.

BMAS: where wage law is made

What it owns. The Bundesministerium für Arbeit und Soziales (BMAS) — the Federal Ministry of Labour and Social Affairs — owns labour and social policy: the Minimum Wage Act and its adjustment machinery, working-time law, and the approval of the social insurance data-exchange rulebooks. The minimum wage itself is proposed by the standing, independent Mindestlohnkommission that the Federal Government established; the government then enacts the proposal by ordinance — the current rates come from the Fifth Minimum Wage Adjustment Ordinance (MiLoV5).

What it takes from an employer. Nothing, ever — BMAS has no employer-facing counter. Its output reaches you as law: the wage floor you must pay, the working-time recording position it publishes guidance on, and the approved Grundsätze your payroll software implements.

When you'll hear from it. You won't; you'll hear about it, on the two-year minimum-wage ordinance cycle and whenever working-time recording law moves. Its Mindestlohn pages are the reference of record for the current rate — always confirm the figure for your pay period there or in our minimum-wage article rather than trusting a cached number.

ITSG and the GKV certification bodies: who blesses your payroll software

What they own. Germany's social insurance reporting has no paper channel: § 95b SGB IV permits transmission only from systemgeprüfte — system-examined — payroll programs or certified manual-entry tools, and the data-acceptance points verify the software's certification ID on every single transmission. The examination itself, the Systemuntersuchung, is owned by the ITSG (Informationstechnische Servicestelle der gesetzlichen Krankenversicherung), acting on behalf of the GKV-Spitzenverband, with the pension, accident and employment-agency organisations participating; the GKV-Spitzenverband issues the formal certification decision, and an annual quality-control cycle keeps it alive.

What they take from an employer. Usually nothing directly — the burden sits on whoever builds the software, including in-house builds. But every employer inherits the dependency: if your payroll system's certification lapses, the acceptance points reject your reports, and the missed-filing consequences land on you. Note the boundary: the Systemuntersuchung covers social insurance correctness only; the tax side runs on the separate ELSTER/PAP regime with no product certificate. The full regime — who must certify, stages, timelines, the annual treadmill — is in our payroll software certification article.

When you'll hear from them. As a software operator: at application, examination, piloting and every annual re-check. As an employer: only through your vendor — a question worth asking any provider is simply "what is your Prod-ID, and when was your last Qualitätskontrolle?"

Bundesbank and BaFin: the layer under the money

Bundesbank — the rails. The Deutsche Bundesbank is not a payroll authority and will never write to you about wages; it is the central bank that runs and co-runs the infrastructure your net-pay run ultimately settles on — the Eurosystem's TARGET services for central-bank-money settlement, TIPS for instant payments, and its own SEPA-Clearer for retail clearing. For payroll purposes its work surfaces as facts of life: euro wages move as SEPA credit transfers, instant transfers are available around the clock, and your commercial bank's cut-off — not anything the Bundesbank publishes — is the deadline that decides whether payday is met. How a German wage actually moves: see paying employees in Germany.

BaFin — the perimeter, carefully. The Bundesanstalt für Finanzdienstleistungsaufsicht supervises Germany's payment-services perimeter under the Zahlungsdiensteaufsichtsgesetz (ZAG). An employer paying its own employees is not thereby providing a payment service. The perimeter question arises for third parties that move wage money as a service: per BaFin's published guidance, receiving an employer's funds and disbursing them onward can constitute licensable business (the Finanztransfergeschäft catch-all), the analysis is not switched off by the payroll services wrapped around the money movement, and it can be triggered even without holding funds in one's own name — for example by operating under a payment power of attorney over a client's account. A narrow exemption shelters pure technical service providers that at no time come into possession of the funds — the natural home of payroll software that computes the pay run and generates the payment file the employer itself signs and submits. Whether any concrete structure falls inside or outside the perimeter is an individual-case determination that belongs with specialist advisers and, ultimately, BaFin — treat every generalisation here, including this one, as a starting point rather than an answer.

The map on one screen

Quick answers

Related