Germany’s MiCA transition ended on 31 December 2025. Crypto firms now need BaFin authorisation or an EU passport to serve German clients. Scorechain supports CASP AML compliance.
BaFin, the Federal Financial Supervisory Authority, authorises and supervises crypto-asset service providers in Germany. The Deutsche Bundesbank supports it on ongoing supervision. Under the Markets in Crypto-Assets (MiCA) regulation and Germany’s Crypto Markets Supervision Act (KMAG), a business offering crypto services in Germany needs a CASP (Crypto-Asset Service Provider) authorisation. That authorisation also lets it serve clients across the EU.
Germany shortened its transition period, so applicants have to show working AML and risk controls from the start. Scorechain provides blockchain analytics, transaction monitoring and AML tools that help CASPs meet these expectations.
CASP License Timeline in Germany
1 January 2020: crypto custody becomes a licensed activity under the German Banking Act (KWG).
27 December 2024: the KMAG is published in the Federal Law Gazette.
30 December 2024: MiCA’s CASP rules and the EU Travel Rule start to apply.
17 January 2025: DORA applies.
31 December 2025: Germany’s shortened 12-month transition period ends.
1 January 2026: only MiCA-authorised providers may offer crypto-asset services to German clients.
1 July 2026: the EU-wide maximum transition period ends.
2026 Update: What BaFin and the FIU Expect After the Transition
In a notice of 8 July 2026, BaFin and the German financial intelligence unit (FIU) said they expect many customers and large asset volumes to move quickly from unlicensed providers to licensed CASPs. A CASP that takes them on is starting a new business relationship, so it must verify each identity and assess the money laundering and terrorist financing risk.
What is a CASP License in Germany?
A CASP license is the authorisation that companies need to provide crypto-asset services in Germany and across the EU under MiCA. It replaces the national regime, in which crypto custody required a KWG license, and adds MiCA conduct and prudential rules on top of AML and counter-terrorism financing (CFT) obligations.
MiCA and CASP License Compliance Requirements in Germany
Authorisation from BaFin: a KWG permission alone no longer covers services in scope of MiCA.
Real EU presence: a legal entity with effective management in the EU and at least one EU-resident director.
Minimum capital: €50,000, €125,000 or €150,000 depending on the services, or 25% of the previous year’s fixed overheads if that is higher.
AML and KYC controls: under the German Anti-Money Laundering Act (GwG), CASPs run customer due diligence, assess risk and report suspicious activity to the German FIU.
Travel Rule compliance: the EU Transfer of Funds Regulation requires originator and beneficiary data with every transfer.
Which Route to a CASP License in Germany Fits Your Starting Point
You are
Your route
What to watch
A bank, investment firm, e-money institution or similar regulated firm
Notify BaFin under MiCA Article 60 at least 40 working days before you start
An e-money institution may only offer custody and transfer for e-money tokens it issues itself
A holder of a KWG crypto custody permission
The simplified switch to MiCA, which closed with the transition on 31 December 2025
It covered only services your permission already included
A crypto-native newcomer
Full application under Article 62 to BaFin
Management, controls and ownership must be real from day one
A CASP authorised in another EU state
Passport under Article 65, no BaFin authorisation
Notify your home authority first
A non-EU firm
Authorisation is required to offer services actively to EU clients
Serving a client on their own initiative is the only narrow exception
BaFin treats a business as active in Germany if it is seated there, has a branch or physical presence there, or offers services remotely while targeting people resident in Germany.
The KWG to KMAG Hand-Over: Why Germany Has Two Layers
Germany regulated crypto custody in 2020, four years before MiCA, and kept that law for what MiCA does not cover.
MiCA and the KMAG cover crypto-assets in scope of the regulation, with BaFin as the competent authority.
The KWG keeps a narrower qualified crypto custody business for assets such as security tokens. A KWG permission carries no EU passport, and DORA applies to these custodians from 1 January 2027.
A custodian holding both types of asset needs a MiCA authorisation for one and a KWG permission for the other.
The Ten MiCA Services as BaFin Reads Them
BaFin’s guidance note maps most services to a MiFID II counterpart. The classification decides your capital class.
Service
German reading
Capital class
Custody and administration
Includes wallet providers. Comparable to the former KWG crypto custody business
Class 2 (€125,000)
Operating a trading platform
Equivalent to operating a multilateral or organised trading facility
Class 3 (€150,000)
Exchange for funds or other crypto-assets
Equivalent to dealing on own account
Class 2 (€125,000)
Execution of orders; placing; reception and transmission of orders; advice; portfolio management
Each equivalent to its MiFID II counterpart
Class 1 (€50,000)
Transfer services
Staking offered as a service may fall here. Pure validator, node or miner activity does not. Transfers of e-money tokens are reserved for authorised payment institutions
Class 1 (€50,000)
NFTs, security tokens and tokenised deposits fall outside this authorisation.
Who Holds a License Today
Germany is one of the largest CASP hubs in the EU. An analysis of ESMA register data from 18 August 2026 found Germany as the home state of 71 of 323 active CASP entities (22%). Micawatch counted 95 authorised CASPs in Germany on 24 September 2026, 60 of them banks, most holding order execution. Counts change weekly, so check the live ESMA register and BaFin’s company database.
Applying to BaFin: How the Process Works
Initial meeting: BaFin asks applicants to arrange one before filing.
Submission: by post to BaFin in Bonn (Referat ZK 4) or electronically, with a copy to the Bundesbank. Use the standard form from Implementing Regulation (EU) 2025/306.
DORA in the file: BaFin expects documents showing DORA compliance.
Statutory clock: MiCA Article 63 allows 25 working days to check completeness and 40 working days to decide, with up to 20 working days of pause for information requests.
Gaps: BaFin sets a four-week deadline for missing documents and rejects the application if it is still incomplete.
Fees even if you fail: fees apply to withdrawn and rejected applications too, based on BaFin’s time.
Publication: authorisations appear in the Federal Gazette, the BaFin company database and the ESMA register.
Documents Required for a CASP License Application in Germany
MiCA Article 62 sets the content of the file, and Delegated Regulation (EU) 2025/305 details it. In practice, expect to provide:
Applicant details: legal name, legal form, LEI, articles of association and the services you plan to offer.
Programme of operations: your business model, where and how you market, and the crypto-assets involved.
Governance: the management body’s structure, plus proof of good repute and competence for each member.
Ownership: the identity of shareholders with qualifying holdings and proof of their good repute.
Internal controls: risk management, conflicts of interest, complaints handling and business continuity.
AML and CFT framework: policies, risk assessment and monitoring procedures set against the GwG.
ICT and security: technical documentation of your systems and your DORA arrangements.
Service-specific policies: custody, client fund segregation, order execution, and trading platform rules where relevant.
Prudential safeguards: evidence of your minimum capital or insurance.
Life after Authorisation: What BaFin and the Bundesbank Expect
When
Duty
Without delay
Notify BaFin and the Bundesbank of a 25% loss of own funds, a change of seat or branch, plans to wind up, material outsourcing, and qualifying holdings crossing 20, 30 or 50% (§ 21(1) KMAG)
Every quarter
Financial information to the Bundesbank
Every year
Report of close links and qualifying holdings
Continuous
DORA incident reporting, suspicious activity reports to the FIU, Travel Rule data with every transfer
Any time
BaFin may inspect without a specific reason (§ 20(2) KMAG)
These duties apply to authorised CASPs, not to banks and other providers that only notified BaFin.
Travel Rule in Germany Under the EU Transfer of Funds Regulation
The EU Transfer of Funds Regulation has applied to CASPs since 30 December 2024. Every transfer must carry originator and beneficiary data, and you need procedures for self-hosted wallets and for counterparties in other jurisdictions. The Travel Rule page explains how the exchange works, and the Travel Rule API sends and receives that data through partner infrastructure.
How Scorechain Supports CASP Compliance in Germany: An Evidence Map for Your BaFin File
BaFin can inspect without a specific reason, so your controls need to run before you file. This map links each expectation to proof you can produce.
Scorechain’s tools support your compliance program and do not replace your own policies or compliance officer. To see them running before you submit your application, book a demo with the Scorechain team.
Why Get Your CASP License in Germany?
A defined process: BaFin publishes a guidance note on crypto-asset services, an application page with the form and timelines, and an overview of DORA documentation.
EU and EEA passporting: an authorisation lets you serve clients across the EU and EEA within the authorised services.
An established market: most authorised German CASPs are banks, which signals demand for compliant technology and custody partners.
When did the MiCA transition period end in Germany?
On 31 December 2025. Germany shortened the transition to 12 months, six months before the EU-wide maximum of 1 July 2026.
I hold a KWG crypto custody permission. Do I need a MiCA authorisation too?
For crypto-assets in scope of MiCA, yes. The simplified switch closed with the transition. The KWG permission stays relevant for assets MiCA does not cover, such as security tokens.
How much capital do I need for a CASP license in Germany?
€50,000, €125,000 or €150,000 depending on the services, or 25% of previous-year fixed overheads if higher.
How long does BaFin take to decide?
25 working days to check completeness and 40 working days to decide on a complete application, with up to 20 working days of pause for information requests. Preparing the file usually takes much longer than the review.
What happens if my application is rejected?
Fees still apply, based on BaFin’s time. Missing documents get a four-week deadline first, and an application still incomplete after that is rejected.
Is my staking product covered?
Staking offered as a service may fall under transfer services. Pure validator, node or miner activity does not. Confirm the classification with BaFin before filing.
Can I serve Germany from another EU country?
Yes, with a passport from your home state under Article 65 of MiCA. You need no separate BaFin authorisation.
Who supervises me after authorisation?
BaFin supervises authorised CASPs and can inspect them without a specific reason. The KMAG also requires reports to the Bundesbank, including quarterly financial information.
Do CASPs in Germany need AML and transaction monitoring tools?
Yes. CASPs must run customer due diligence, monitor transactions, comply with transfer information rules and report suspicious activity to the German FIU.
Ready to Get Clarity on Your Risks?
From wallet screening and KYT monitoring to deep-dive investigations, Scorechain gives you everything you need to stay compliant, secure, and audit-ready.
