Germany is the EU's largest MiCA jurisdiction, with 59 authorised crypto-asset service providers as of July 2026. Getting there means satisfying BaFin under the Kryptomärkteaufsichtsgesetz (KMAG) — a national companion law that shortened the EU transition by six months and folded crypto supervision into one of Europe's strictest financial-oversight cultures. Here is what the German route actually requires.
Published: July 2026 · Data as of 16 July 2026 · Reading time: ~9 minutes
Key Takeaways
- BaFin is the competent authority for CASP authorisation in Germany, with the Deutsche Bundesbank involved in the process and in ongoing reporting.
- The national framework is the Kryptomärkteaufsichtsgesetz (KMAG), enacted through the Finanzmarktdigitalisierungsgesetz and promulgated on 27 December 2024.
- Germany cut the MiCA transitional period in half: the grandfathering window for pre-MiCA providers closed on 31 December 2025 — six months before the EU-wide deadline of 1 July 2026.
- Minimum capital follows MiCA Annex IV: €50,000, €125,000 or €150,000 depending on the services — or one quarter of fixed overheads, if higher.
- BaFin charges no flat authorisation fee: costs are billed by time spent under the German fee regulation, and are payable even if the application is withdrawn or rejected.
- The December 2025 deadline produced a visible authorisation wave: 16 German CASP authorisations landed in December 2025 alone.
One Regulator, One Companion Law
MiCA (Regulation (EU) 2023/1114) applies directly across the EU — Title V, covering CASP authorisation, since 30 December 2024. But every Member State needed national legislation to designate its regulator and set enforcement powers. Germany's answer is the Kryptomärkteaufsichtsgesetz (KMAG), adopted as part of the Finanzmarktdigitalisierungsgesetz (FinmadiG) and promulgated in the Federal Law Gazette on 27 December 2024.
The KMAG replaced Germany's earlier national regime, under which crypto custody business (Kryptoverwahrgeschäft) was a licensable financial service under the German Banking Act (KWG). That KWG category largely disappeared into MiCA; what remains under national law is only the "qualified crypto custody business" tied to crypto securities registers — and BaFin is explicit that this residual KWG licence carries no European passport. Only a MiCA authorisation does.
BaFin supervises five categories of crypto entities under the KMAG: CASPs, institutions with qualified crypto custody authorisation, crypto securities register operators, e-money token issuers and other token issuers.
The German Grandfathering Cliff: 31 December 2025
MiCA's Article 143(3) allowed firms lawfully operating before 30 December 2024 to continue until 1 July 2026 — but let Member States shorten that window. Germany did, cutting it to twelve months: as BaFin puts it, the transitional period was shortened to 31 December 2025. Since 1 January 2026, only MiCA-authorised providers may offer crypto-asset services to German clients.
For incumbents holding a KWG licence, BaFin ran a pragmatic simplified procedure: it performed a gap analysis between the old KWG requirements and MiCA, so existing institutions only had to demonstrate compliance with what had actually changed — and could keep operating on their KWG authorisation until BaFin decided on their MiCA application.
The register data shows exactly what a hard national deadline does:
Sixteen authorisations in December 2025 — the largest single-month total any EU regulator has produced to date — followed by a steady flow of new entrants through 2026.
What BaFin Requires: The Application File
Applications go to BaFin's Referat ZK 4 (with a copy to the Bundesbank's competence centre), by post or electronically, using the standard EU application form under Implementing Regulation (EU) 2025/306, with content specified by the RTS under Article 62(5) and (6) of MiCA (Delegated Regulation (EU) 2025/305). BaFin recommends an initial consultation with ZK 4 before filing, and published a dedicated guidance notice (Merkblatt Kryptowerte-Dienstleistungen nach MiCAR, 3 January 2025).
The core file, per Article 62 of MiCA, must include:
| Requirement | What BaFin expects |
|---|---|
| Programme of operations | Types of crypto-asset services, and where/how they will be marketed |
| Prudential safeguards | Proof of own funds or insurance meeting Article 67 |
| Governance | Organisational structure, internal control, risk policies (incl. ML/TF risks), business continuity |
| Management | Evidence board members have good repute and appropriate knowledge, skills, experience |
| Shareholders | Identity and good repute of holders of qualifying holdings |
| ICT / DORA | Technical documentation of ICT systems and security (BaFin adds a DORA checklist to the file) |
| Client assets | Segregation procedure for clients' crypto-assets and funds |
| Complaints | Complaints-handling procedures |
| Service-specific | Custody policy; trading platform rules and market-abuse detection, where applicable |
Fitness and propriety of management and qualifying shareholders is assessed against the joint EBA/ESMA suitability guidelines for MiCA (EBA/GL/2024/09). Since 17 January 2025, CASPs are also financial entities under DORA, with ICT risk management, incident reporting to BaFin and resilience-testing obligations from day one.
Capital: Three Classes, One "Higher-Of" Test
| Class | Minimum capital | Covers |
|---|---|---|
| Class 1 | €50,000 | Execution of orders, placing, transfer services, reception & transmission, advice, portfolio management |
| Class 2 | €125,000 | Class 1 services + custody & administration, exchange crypto↔funds, exchange crypto↔crypto |
| Class 3 | €150,000 | Class 2 services + operation of a trading platform |
Under Article 67 of MiCA, actual prudential safeguards must be the higher of the Annex IV minimum or one quarter of the preceding year's fixed overheads, held as own funds or, in part, as a qualifying insurance policy. Start-ups use projected fixed overheads from their business plan.
Which classes German applicants actually target is visible in the register — the German market is dominated by brokerage-style services:
The pattern is distinctive: 34 of 59 German CASPs hold "execution of orders", reflecting Germany's wave of banks and brokers adding crypto to existing securities businesses — Commerzbank, N26, Trade Republic, Baader Bank and flatexDEGIRO all appear in the register. Only two German entities operate a trading platform.
Timelines and Fees
BaFin works to the MiCA Article 63 clock: acknowledgment within 5 working days, completeness check within 25 working days, and a substantive assessment within 40 working days of a complete file, with suspensions for missing information capped at 20 working days. In practice BaFin applies a strict four-week deadline for applicants to remedy incomplete filings — and has warned publicly that files not completed within MiCA's short deadlines must be rejected.
On fees, Germany is unusual: there is no published flat fee for a CASP authorisation. Fees are charged under the German financial supervision fee regulation based on the time BaFin spends on the case — and they are due even if the application is withdrawn or rejected. Ongoing supervision is funded through BaFin's industry cost-allocation levy.
AML: GwG Duties and the Travel Rule
Authorisation is only half the German compliance story. CASPs are obliged entities under the German Anti-Money Laundering Act (GwG): full customer due diligence, a designated money-laundering officer (notified to BaFin via its MVP portal), continuous risk assessment and suspicious-transaction reporting to the German FIU. BaFin and the FIU jointly reminded the market in July 2026 that customers migrating from unlicensed providers must be treated as new business relationships, with fresh KYC and risk assessment.
The EU Transfer of Funds Regulation (2023/1113) — the "travel rule" — has applied since 30 December 2024, and BaFin has made its implementation an explicit supervisory priority for 2026, with at least 75 special AML inspections planned. The new EU Anti-Money Laundering Authority (AMLA), seated in Frankfurt, begins direct supervision of selected entities in 2028 — and crypto-asset service providers are squarely in its intended scope.
After the Licence
Authorised firms are supervised as Kryptoinstitute, with ongoing notification and reporting duties routed through BaFin's MVP portal and the Bundesbank's reporting systems; a dedicated KMAG notification regulation is expected to enter into force in 2026. Authorisations are published in the Bundesanzeiger, BaFin's company database and ESMA's interim MiCA register.
This article is part of our country-by-country series on MiCA licensing. See also: France (AMF), the Netherlands (AFM) and the full EU licence map 2026.
Frequently Asked Questions
Who grants MiCA CASP licences in Germany? BaFin, the Federal Financial Supervisory Authority, under MiCA and the German KMAG. The Deutsche Bundesbank receives application copies and handles parts of ongoing reporting.
How much capital does a German CASP need? €50,000, €125,000 or €150,000 depending on the service class — or one quarter of annual fixed overheads if that is higher (MiCA Art. 67 and Annex IV).
How much does the BaFin licence cost? There is no fixed amount. BaFin bills by time spent under the German fee regulation, and the fee is payable even if the application is withdrawn or rejected.
Is the old German crypto custody licence still valid? The KWG crypto custody regime was superseded by MiCA. German grandfathering ended on 31 December 2025; only a residual "qualified crypto custody business" licence remains under the KWG, and it carries no EU passport.
How long does BaFin take to decide? MiCA sets 25 working days for the completeness check plus 40 working days for the assessment, with limited suspensions. Incomplete files face rejection — BaFin applies a four-week remediation deadline.
Sources
- BaFin — Kryptowerte-Dienstleistungen (CASP authorisation page, German)
- BaFin — Merkblatt Kryptowerte-Dienstleistungen nach MiCAR (guidance notice, German)
- BaFin — MiCAR: simplifications and challenges in the authorisation procedure (English)
- BaFin — MiCAR supervision overview (German)
- BaFin/FIU — notice of 8 July 2026 on ML risks after the transition (German)
- Federal Law Gazette — FinmadiG, BGBl. 2024 I Nr. 438 (German)
- ESMA — MiCA Article 63 (assessment of the application)
- ESMA — MiCA Annex IV (minimum capital requirements)
- ESMA — list of MiCA grandfathering periods under Art. 143(3) (PDF)
- ESMA — Markets in Crypto-Assets Regulation (MiCA), interim register
- EBA/ESMA — joint guidelines on suitability under MiCA (EBA/GL/2024/09, PDF)
- European Commission — AMLA: frequently asked questions
- Regulation (EU) 2023/1114 (MiCA) — EUR-Lex
---
Analysis based on official BaFin, ESMA, EBA and European Commission publications and ESMA's interim MiCA register (CASP file), 16 July 2026 snapshot. Counts are unique legal entities per home Member State.
Disclaimer: This article is provided for general information and analytical purposes only. It does not constitute legal, regulatory, investment, tax or any other form of professional advice, and it should not be relied upon as such. While we strive for accuracy, the underlying registers and regulatory frameworks are updated frequently and details may have changed since the stated data date. Always verify current information directly with official sources (ESMA, the European Commission, and national competent authorities such as BaFin) before making any decision. MICA Watch accepts no liability for any loss or damage arising from the use of this content.