Germany BaFin CASP Authorisation: KMAG, Simplified Procedure, and 2026 Reality

Why Germany matters for MiCA CASP strategy

Germany is the largest single domestic market for crypto-asset services in the EU. It is also the strictest prudential regulator in the bloc — BaFin operates with banking-grade discipline applied to non-bank firms, and has a long track record of supervising crypto-custody firms under the German Banking Act predecessor regime since 2020.

The combination — large market, strict supervisor, established prior regime — produces a CASP environment materially different from the EU mid-tier. CASPs targeting Germany face heavier documentation expectations, longer effective timelines, and higher counsel and consulting costs than counterparts in Lithuania, Cyprus, or Czech Republic.

What KMAG actually does

The Kryptomärkteaufsichtsgesetz (KMAG) — the Cryptomarkets Supervision Act — is the German national law accompanying MiCA. It was published in the Federal Law Gazette on 27 December 2024, just before MiCA’s 30 December 2024 application date.

KMAG does the following:

• Designates BaFin as the competent authority for MiCA in Germany
• Sets out national supervisory powers, penalties, and procedural rules
• Implements the simplified procedure under the transitional regime MiCA through section 50(3) of KMAG — the bridge for legacy German Banking Act crypto-custody licensees
• Aligns AML/CFT supervision and reporting requirements with the wider German framework
• Establishes the framework for cooperation between BaFin and the Bundesbank

KMAG does not replace MiCA — MiCA is directly applicable as an EU regulation. KMAG provides the German operational framework around it.

The simplified procedure: who qualifies, what it gets

The simplified procedure is the most operationally consequential feature of KMAG. It addresses a real problem: Germany had a domestic crypto-custody licensing regime under the German Banking Act from 2020 onwards, and a population of firms holding that licence on the 29 December 2024 cut-off would otherwise have been treated as new entrants under MiCA.

The simplified procedure under The transitional regime MiCA in conjunction with KMAG section 50(3) addresses this by providing a lighter transition pathway for eligible firms.

Eligibility test	Requirement
Authorisation type held on 29 Dec 2024	Crypto-custody business OR other German-Banking-Act-based financial-services authorisation with regard to crypto-assets
Entity type	Not a CRR credit institution (i.e. not a bank under EU Capital Requirements Regulation)
Notification window	At least 40 days in advance of intent to use the simplified procedure
Continuing services	Permitted to continue providing services covered by their prior authorisation through 31 December 2025 (transitional period)

What the simplified procedure delivers: a more direct transition pathway leveraging the firm’s existing supervisory record with BaFin. What it does NOT deliver: an automatic conversion. Firms must still complete the procedure with MiCA-shape documentation and address BaFin’s specific MiCA-era expectations.

Firms not eligible for the simplified procedure — new entrants without a prior German Banking Act authorisation, CRR credit institutions, EMIs adding CASP scope — file via the full MiCA new-entrant pathway under the application-content rule.

Germany’s transitional choice and its consequences

Germany chose a 12-month transitional period under the transitional regime — half the EU maximum. The choice sat between the 6 months chosen by the Netherlands and the 18 months chosen by Estonia, France, Czech Republic, and others.

The consequence: the German transitional period ended on 31 December 2025. From 1 January 2026, only firms with valid MiCA CASP authorisation may provide crypto-asset services in Germany. There is no extension mechanism for firms that missed the deadline.

The 2026 reality:

• Firms that authorised in time are operating with BaFin supervision continuing seamlessly
• Firms that filed in time but where authorisation was still pending continued under transitional operating rights through 31 December 2025 and then needed authorisation granted to continue
• Firms that missed the filing window have wound down German operations or are in a fresh new-entrant authorisation pipeline with the resulting 6+ month timeline

What does a BaFin CASP file actually require?

A complete BaFin file under either the simplified procedure or the full procedure addresses:

Governance package:

• Detailed organisational structure with reporting lines
• The governance arrangements management body suitability documentation
• Three-lines-of-defence integration
• Internal audit charter
• Conflict-of-interest policy with named-control mitigations

Prudential package:

• Initial capital evidence (€50K / €125K / €150K per Annex IV)
• The own-funds requirement own-funds calculation including fixed-overheads test
• Wind-down plan with specific liquidation triggers and timelines
• Insurance arrangements for custody firms

Operational package:

• DORA Title V third-party-risk register (comprehensive, not partial)
• Business-continuity plan
• ICT resilience documentation
• Operational-rules-of-trading-platform document for Class 3 firms

AML/CFT package:

• Customer due diligence procedures
• Transaction monitoring framework
• Suspicious-transaction-reporting workflow into the German FIU
• Sanctions screening framework
• Travel Rule (TFR 2023/1113) implementation

Substance package:

• Resident senior management
• Operational presence in Germany (not virtual office)
• Documented decision-making authority for the German entity

The BaFin file is typically deeper and more rigorously cross-checked than EU mid-tier files. Files that arrive with the depth expected for Cyprus or Lithuania get a substantive deficiency reception.

Germany compared to other strict-end EU jurisdictions

Dimension	Germany (BaFin)	Ireland (CBI)	Netherlands (DNB)	Estonia (FSA)
Transitional period chosen	12 months (ended 31 Dec 2025)	12 months (ended 29 Dec 2025)	6 months (ended 30 Jun 2025)	18 months (ends 1 Jul 2026)
Domestic market size	Largest in EU	Mid-sized	Mid-sized, sophisticated	Small
Application language	German formal; English supporting	English	Dutch / English	Estonian / English
Banking-grade discipline	Yes	Yes	Yes	Yes
Cost relative to mid-tier	High	High	High	Mid
Counsel pool	Deep	Deep	Mid	Mid (specialist crypto deep)

For applicants choosing among the strict-end jurisdictions, Germany is the natural choice for firms whose core market is German retail and institutional, or for firms with German-language operating capability. Ireland for English-language operations targeting UK/US-adjacent counterparties. Netherlands for pan-EU consumer-facing distribution. Estonia for cost-effective entry into a top-tier reputation jurisdiction.

Working with counsel on a BaFin file

The diagnostic for German counsel: ask how the firm’s typical BaFin file differs from a typical Lithuanian or Estonian file at the same applicant. Counsel that has handled both should be able to describe the documentation and engagement style differences concretely. Counsel that gives a generic “BaFin compliance” answer has not surfaced the operational decision points.

The firms in our index with documented BaFin CASP track record are listed below.