Germany crypto license 2026 — BaFin CASP authorisation
Germany is the EU's largest crypto market and strictest supervisor. BaFin runs the CASP regime under MiCA and the KMAG Cryptomarkets Supervision Act, with a simplified procedure for legacy German Banking Act custody licensees and a hard cliff after 1 January 2026.
Why Germany is the strict end of EU crypto licensing
Germany is the largest single domestic market for crypto-asset services in the EU, and it is also the strictest prudential regulator in the bloc. BaFin operates with banking-grade discipline applied to non-bank firms, and it has supervised crypto-custody firms under the German Banking Act predecessor regime since 2020. That combination — large market, strict supervisor, an established prior regime — produces a CASP environment materially different from the EU mid-tier.
In practice that means heavier documentation expectations, longer effective timelines, and higher counsel and consulting costs than counterparts face in Lithuania, Cyprus, or the Czech Republic. A file calibrated for Cypriot or Lithuanian review depth gets a substantive deficiency reception. The right diagnostic for German counsel is to ask how their typical BaFin file differs from a Lithuanian or Estonian file at the same applicant — counsel that gives a generic 'BaFin compliance' answer has not surfaced the operational decision points.
What KMAG does and who the simplified procedure is for
The Kryptomärkteaufsichtsgesetz (KMAG) — the Cryptomarkets Supervision Act — is the German national law accompanying MiCA. It was published in the Federal Law Gazette on 27 December 2024, just before MiCA's 30 December 2024 application date. KMAG designates BaFin as the competent authority, sets national supervisory powers, penalties and procedural rules, aligns AML/CFT supervision with the wider German framework, and establishes cooperation between BaFin and the Bundesbank. KMAG does not replace MiCA — MiCA is directly applicable — it provides the German operational framework around it.
Its most consequential feature is the simplified procedure under the transitional regime MiCA in conjunction with section 50(3) of KMAG. This is the bridge for firms that held German Banking Act crypto-custody or related crypto-asset financial-services authorisation on 29 December 2024 — excluding CRR credit institutions — who would otherwise have been treated as new entrants. Eligible firms must notify BaFin at least 40 days in advance. The procedure delivers a more direct transition that leverages the firm's existing supervisory record; it does not deliver an automatic conversion, since firms must still complete the procedure with MiCA-shape documentation.
The 2026 cliff and what a BaFin file requires
Germany chose a 12-month transitional period — half the EU maximum, sitting between the Netherlands' 6 months and the 18 months chosen by Estonia, France, the Czech Republic, and others. That period ended on 31 December 2025. From 1 January 2026, only firms with valid MiCA CASP authorisation may provide crypto-asset services in Germany, and there is no extension mechanism. Firms that authorised in time continue under seamless BaFin supervision; firms that missed the filing window have wound down German operations or entered a fresh new-entrant pipeline with a 6-month-plus timeline.
A complete BaFin file — under either the simplified or the full procedure — covers a governance package (organisational structure, management-body suitability, three-lines-of-defence, internal audit charter, conflict-of-interest policy), a prudential package (initial capital evidence per Annex IV, own-funds calculation with the fixed-overheads test, wind-down plan, custody insurance), an operational package (DORA Title V third-party-risk register, business-continuity plan, ICT resilience, and a trading-platform rules document for Class 3 firms), an AML/CFT package (customer due diligence, transaction monitoring, suspicious-transaction reporting into the German FIU, sanctions screening, and Travel Rule implementation under TFR 2023/1113), and a substance package (resident senior management and genuine operational presence in Germany). The BaFin file is typically deeper and more rigorously cross-checked than EU mid-tier files.
A Germany CASP authorisation is the licence granted by Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) under MiCA Regulation (EU) 2023/1114 and the German Cryptomarkets Supervision Act (KMAG, published 27 December 2024), authorising crypto-asset services in Germany and across the EU under the MiCA passport.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Kryptomärkteaufsichtsgesetz (KMAG), published in the Federal Law Gazette 27 December 2024 |
| Initial capital | €50,000 (Class 1) — €150,000 (Class 3), MiCA Annex IV |
| Transitional period | 12 months — ended 31 December 2025; from 1 January 2026 only firms with valid MiCA authorisation may provide CASP services in Germany |
| Simplified procedure | Transitional regime MiCA + section 50(3) KMAG — for firms holding German Banking Act crypto-custody or related authorisation on 29 December 2024 (excluding CRR credit institutions) |
| Simplified procedure notification | Eligible firms must notify BaFin at least 40 days in advance |
| Application language | German for the formal application; supporting documentation in English typically accepted with German summaries |
Top counsel for Germany CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Germany engagement, regardless of where they are headquartered.
Frequently asked questions about Germany CASP authorisation
Which German law transposes MiCA?
The Kryptomärkteaufsichtsgesetz (KMAG), the Cryptomarkets Supervision Act, published in the German Federal Law Gazette on 27 December 2024. KMAG accompanies MiCA with national supervisory and procedural provisions.
What is the simplified procedure under the transitional regime MiCA + KMAG section 50(3)?
It is the lighter pathway for firms that held German Banking Act crypto-custody or related authorisation on 29 December 2024 (excluding CRR credit institutions), allowing transition to MiCA without a full new-entrant review.
When did the German transitional period end?
31 December 2025. From 1 January 2026, only firms with valid MiCA CASP authorisation may provide crypto-asset services in Germany. Germany chose 12 months — half the EU maximum.
Does BaFin require German-language applications?
The formal application is filed in German per BaFin standard practice; supporting documentation is typically accepted in English with German summaries. Counsel-led local-language drafting is standard.
Pitfalls and nuances in Germany
1 Missing the simplified procedure 40-day notification window
Eligible firms must notify BaFin at least 40 days in advance of intent to use the simplified procedure. Firms that filed late or skipped the notification step have to fall back to the full new-entrant pathway, which is materially slower and more demanding. The 40-day rule is procedural — get it right or accept the fallback.
2 Assuming German Banking Act authorisation transfers automatically
Even firms eligible for the simplified procedure must complete the procedure — providing MiCA-shape documentation, demonstrating substance, and addressing BaFin's specific MiCA-era expectations. Continuity is procedural, not substantive. Holding a BaFin licence on 29 December 2024 unlocks a faster pathway, not an automatic conversion.
3 Treating BaFin like a mid-tier EU supervisor
BaFin operates with banking-grade discipline applied to non-bank firms. Files calibrated for Lithuanian or Cypriot review depth get a substantive deficiency reception. Plan documentation depth, governance maturity, and engagement style for the BaFin standard, not the EU mid-tier.
4 Filing English-only without German summaries
BaFin's formal application process is German-language. English supporting documentation is typically accepted with German summaries. Filing English-only documents without German summaries is procedurally inadequate and triggers completeness-check delays.
5 Underestimating the post-1-January-2026 cliff
Germany's transitional period closed 31 December 2025. Firms operating without MiCA authorisation from 1 January 2026 are operating without permission. Some firms missed the deadline expecting an extension that did not arrive — the result is winding down operations or filing fresh as a new entrant with a 6-month-plus timeline.
Practitioners in Germany
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Germany. Editorial picks, sourced from public records.
Mark Branson
Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
MiCA CASP · Crypto custody · Stablecoin issuance
★ Editor's WatchPatrick Hansen
Circle Internet Financial
MiCA CASP · Stablecoin issuance · Crypto AML
★ Editor's WatchMarius Raetz
Linklaters LLP
Stablecoin issuance · MiCA CASP
★ Editor's WatchJohannes Wirtz
Bird & Bird
MiCA CASP · Token classification · Stablecoin issuance
Dr Clemens Boehm
Linklaters LLP
Stablecoin issuance
Dr Markus Kaulartz
CMS Hasche Sigle
MiCA CASP · Token classification
Regulator and primary sources
The supervisor of CASP authorisations in Germany is Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin). The legal basis is MiCA Regulation (EU) 2023/1114 + Kryptomärkteaufsichtsgesetz (KMAG). Visit www.bafin.de/EN/Homepage/homepage_node.html for the regulator's official guidance, application forms, and supervisory expectations.