Germany crypto license 2026 — BaFin CASP authorisation
BaFin runs the German CASP regime under MiCA and the Kryptomärkteaufsichtsgesetz (KMAG). Firms holding a German licence for crypto business on 29 December 2024 could continue under section 50 KMAG, but those deemed licences lapsed on 31 December 2025 at the latest.
Last reviewed by the Crypto Law Index editorial desk
BaFin's approach to CASP files
BaFin has supervised crypto custody under the German Banking Act since 2020, and it now runs the CASP regime under MiCA and the KMAG. Advisers describe its approach as banking-grade discipline applied to non-bank firms, built on that earlier crypto-custody experience.
In practice, advisers report heavier documentation expectations, longer effective timelines, and higher counsel and consulting costs than in Lithuania, Cyprus or the Czech Republic. A useful question for German counsel is how their typical BaFin file differs from a Lithuanian or Estonian file for the same applicant; a generic 'BaFin compliance' answer suggests they have not identified the operational decision points.
What KMAG does and who the simplified procedure was for
The Kryptomärkteaufsichtsgesetz (KMAG) — the Cryptomarkets Supervision Act — is the German national law accompanying MiCA. It was published in the Federal Law Gazette on 27 December 2024, just before MiCA's 30 December 2024 application date. KMAG designates BaFin as the competent authority, sets national supervisory powers, penalties and procedural rules, and provides for cooperation between BaFin and the Deutsche Bundesbank (section 6 KMAG). KMAG does not replace MiCA — MiCA is directly applicable — it provides the German operational framework around it.
Its transitional rules were in section 50. Firms licensed on 29 December 2024 to provide crypto business under the German Banking Act and certain other German laws could continue under the supervisory position of that date. Those deemed licences lapsed on the MiCA decision or, at the latest, on 31 December 2025. Firms holding a German licence for crypto custody or other crypto financial services, other than CRR credit institutions, could use the simplified procedure in section 50(3) KMAG with MiCA Article 143(6). It was not an automatic conversion: BaFin had to refuse authorisation if the MiCA Title V requirements were not met. CRR credit institutions use the separate Article 60 notification, filed at least 40 working days before they start.
After the 2025 cut-off and what a BaFin file requires
Germany chose a 12-month transitional period — two-thirds of the 18-month maximum, between the Netherlands' 6 months and the 18 months used by Estonia, France and the Czech Republic. That period ended on 31 December 2025, and there was no extension mechanism. Since 1 January 2026 a firm needs a MiCA authorisation, an Article 60 notification or a passport from another member state to provide crypto-asset services in Germany. A firm without one has had to stop serving German clients or file as a new entrant; advisers put a fresh file at six months or more end-to-end (practitioner estimate).
A complete BaFin file covers a governance package (organisational structure, management-body suitability, three lines of defence, internal audit charter, conflict-of-interest policy), a prudential package (initial capital evidence per Annex IV, the own-funds calculation with the fixed-overheads test, wind-down plan, and any insurance policy relied on under MiCA Article 67(4)), an operational package (DORA ICT third-party risk documentation, business-continuity plan, ICT resilience, and trading-platform operating rules for Class 3 firms), an AML/CFT package (customer due diligence, transaction monitoring, suspicious-transaction reporting to the German FIU, sanctions screening, and Travel Rule implementation under TFR 2023/1113), and a substance package (registered office in Germany, effective management in the EU and at least one EU-resident director under MiCA Article 59(2)). Advisers report that BaFin cross-checks these packages closely.
A Germany CASP authorisation is the licence granted by Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) under MiCA Regulation (EU) 2023/1114 and the German Cryptomarkets Supervision Act (KMAG, published 27 December 2024), authorising crypto-asset services in Germany and across the EU under the MiCA passport.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Kryptomärkteaufsichtsgesetz (KMAG), published in the Federal Law Gazette 27 December 2024 |
| Initial capital | €50,000 (Class 1) — €150,000 (Class 3), MiCA Annex IV |
| Transitional period | 12 months — ended on 31 December 2025 (section 50(2) KMAG); from 1 January 2026 a firm needs a MiCA authorisation, an Article 60 notification or a passport from another member state to provide CASP services in Germany |
| Simplified procedure (closed) | Section 50(3) KMAG with MiCA Article 143(6) — was open to firms holding a German licence for crypto custody or other crypto financial services on 29 December 2024, other than CRR credit institutions; it closed with the 31 December 2025 cut-off |
| Article 60 notification | CRR credit institutions and other firms already licensed for equivalent services notify BaFin at least 40 working days before starting (MiCA Article 60; BaFin MiCAR Merkblatt, January 2025) |
| Application language | Not set out in BaFin's published MiCAR guidance; advisers report a German formal application, with English supporting documents usually accepted alongside German summaries. Confirm with BaFin |
Top counsel for Germany CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Germany engagement, regardless of where they are headquartered.
Frequently asked questions about Germany CASP authorisation
Which German law transposes MiCA?
The Kryptomärkteaufsichtsgesetz (KMAG), the Cryptomarkets Supervision Act, published in the German Federal Law Gazette on 27 December 2024. KMAG accompanies MiCA with national supervisory and procedural provisions.
What was the simplified procedure under section 50(3) KMAG?
It was the route to MiCA authorisation for firms that held a German licence for crypto custody or other crypto financial services on 29 December 2024, excluding CRR credit institutions. BaFin still had to refuse authorisation if the MiCA Title V requirements were not met. The deemed licences it bridged lapsed on 31 December 2025 at the latest, so the route is closed.
When did the German transitional period end?
On 31 December 2025. From 1 January 2026 a firm needs a MiCA CASP authorisation, an Article 60 notification or a passport from another member state to provide crypto-asset services in Germany. Germany chose 12 months, two-thirds of the 18-month maximum MiCA allowed.
Does BaFin require German-language applications?
BaFin's published MiCAR guidance does not set out a language rule. Advisers report that the formal application is filed in German and that English supporting documents are usually accepted with German summaries. Confirm the approach with BaFin before filing.
Pitfalls and nuances in Germany
1 Confusing the Article 60 notification with a CASP authorisation
CRR credit institutions and other firms already licensed for equivalent services can provide crypto-asset services by notifying BaFin at least 40 working days before starting, under MiCA Article 60. Every other firm needs a full authorisation under Article 63. The 40-working-day notice is not a step in the authorisation procedure.
2 Assuming a German Banking Act licence carried over
A KWG licence held on 29 December 2024 did not convert into a MiCA authorisation. It was deemed to continue only until the MiCA decision or, at the latest, to the end of 2025 (section 50(2) KMAG). Even the simplified procedure required the firm to meet the MiCA Title V requirements. A firm that relied on the old licence without obtaining authorisation has had no basis to operate since 1 January 2026.
3 Treating BaFin like a mid-tier EU supervisor
Advisers report that BaFin applies banking-grade discipline to non-bank firms, and that files calibrated for review depth elsewhere in the EU draw substantial deficiency letters. Plan documentation depth, governance maturity and engagement style accordingly.
4 Not settling the filing language early
BaFin's published MiCAR guidance does not set a language rule. Advisers report that English documents without German summaries have slowed completeness checks, so agree the language approach with BaFin before filing.
5 Operating on a lapsed transitional licence
Germany's transitional period ended on 31 December 2025 and there was no extension. A firm still operating on a lapsed licence from 1 January 2026 is operating without permission and has to stop or file as a new entrant; advisers put a fresh file at six months or more end-to-end (practitioner estimate).
Practitioners in Germany
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Germany. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Germany is Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin). The legal basis is MiCA Regulation (EU) 2023/1114 + Kryptomärkteaufsichtsgesetz (KMAG). Visit www.bafin.de/EN/unternehmen-maerkte/erlaubnis-registrierung/geschaefte-krypto/kryptowerte-dienstleistungen/kryptowerte-dienstleistungen_node_en.html for the regulator's official guidance, application forms, and supervisory expectations.
For where every EU and EEA state stands — its authority, its national act and when its transitional period ended — see the MiCA implementation tracker.