Germany

Regulatory architecture overview

Germany's financial regulatory architecture is structured around a single integrated supervisor: the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), headquartered in Bonn and Frankfurt, established under the Finanzdienstleistungsaufsichtsgesetz (FinDAG) in 2002. BaFin combines banking, securities, insurance and asset-management supervision and now administers cryptoasset supervision under both legacy KWG provisions and MiCA. The Deutsche Bundesbank, Germany's central bank and a member of the Eurosystem, exercises macroprudential authority and operational supervision of significant institutions jointly with BaFin and the European Central Bank under the Single Supervisory Mechanism. The Bundesfinanzministerium (Federal Finance Ministry) leads policy formulation and the German position in EU Council deliberations. The Bundesministerium für Wirtschaft und Klimaschutz (Federal Ministry for Economic Affairs and Climate Action) handles broader digital and innovation policy. The Bundeszentralamt für Steuern (Federal Central Tax Office) and the sixteen Länder tax authorities coordinate cryptoasset taxation. The Generalzolldirektion-FIU (Financial Intelligence Unit) handles AML supervision under the Geldwäschegesetz (GwG). Sixteen Länder have parallel commercial registry and notarial functions but federal authority predominates in financial services. The constitutional framework under the Grundgesetz (Basic Law) provides for federal pre-emption in banking and securities under Article 74. Germany's regulatory philosophy is characterised by detailed prescriptive rulemaking, rigorous supervisory engagement, and procedural conservatism — historically reflecting Bundesbank monetary culture and post-2008 banking-supervision reform. BaFin's institutional standing within the EU rivals the Banque de France, AMF and CNB; BaFin staff dominate ESMA and EBA technical working groups.

Crypto-specific framework

Germany's cryptoasset regulatory framework operates at two intersecting layers: legacy German law (predominantly the KWG and amendments through the Fifth and Sixth Anti-Money Laundering Directive transpositions) and EU-direct-effect MiCA. The Krypto-Verwahrgeschäft (cryptoasset custody business) license under § 1 (1a) Sentence 2 No. 6 KWG, introduced via the Implementation of the Fifth EU Anti-Money Laundering Directive Act effective January 1, 2020, was the world's first formal cryptoasset-custody banking license and required full BaFin authorisation under § 32 KWG. That regime has now been superseded: Germany's KWG crypto-custody licences ceased to be a standalone route when national grandfathering expired on 31 December 2025, and former licensees such as Coinbase Germany, Boerse Stuttgart Digital Custody, Tangany, Finoa and Upvest have converted to MiCAR authorisations. The Elektronische Wertpapiere Gesetz (eWpG, Electronic Securities Act, June 2021) created the legal framework for crypto-securities (Kryptowertpapiere) — bearer bonds and fund units that exist natively on a distributed ledger rather than via centralised registry. The Fund Location Act (Fondsstandortgesetz, 2021) amended the Investment Code (Kapitalanlagegesetzbuch, KAGB) to permit German Spezial-AIFs to allocate up to 20% of their assets to cryptoassets. MiCA CASP authorisation under Regulation (EU) 2023/1114 has been administered by BaFin since the CASP regime took effect on 30 December 2024, and Germany now has the largest authorised CASP population in the EU — 53 firms as of 4 May 2026, more than double second-placed Netherlands, with a further large cohort passporting in from other member states. Germany chose a shortened grandfathering period under § 50(2) no. 3 KMAG, so pre-MiCA national-licence holders lost their transitional cover on 31 December 2025 rather than at the EU-wide 1 July 2026 backstop. The Geldwäschegesetz (GwG) sits alongside the recast EU Transfer of Funds Regulation (EU) 2023/1113, which applies Travel Rule originator and beneficiary information requirements to crypto-asset transfers with no de minimis threshold — every transfer, regardless of value.

Recent enforcement actions

BaFin enforcement under both legacy KWG and MiCAR has been substantial and procedurally rigorous. The Ethena GmbH matter is the paradigm case and the EU's first landmark MiCAR enforcement. On 21 March 2025 BaFin prohibited new public offers of Ethena's USDe token, citing serious deficiencies in business organisation and MiCAR infringements, and froze the issuer's asset reserves. Ethena withdrew its authorisation application on 3 April 2025; BaFin ordered the business wound up, and on 25 June 2025 opened a supervised 42-calendar-day redemption window running to 6 August 2025 under a BaFin-appointed special representative, after which Ethena GmbH was treated as wound up across Germany, the EU and the EEA. Earlier, on 28 April 2021, BaFin publicly warned that Binance's tokenized stocks tracking Tesla, Coinbase and MicroStrategy had likely been offered without the prospectus required by Article 3(1) of the EU Prospectus Regulation — an administrative offence carrying a fine of up to EUR 5 million or 3% of annual revenue. Supervisory intervention short of enforcement is also common: BaFin's 2023 audit of Bitpanda's German subsidiary, reported by ICIJ, identified more than a dozen findings ranging from minor to serious, including information-security, data-storage and third-party-monitoring weaknesses, and BaFin ultimately issued an instructional letter rather than a formal measure after crediting the firm's remediation. The KMAG additionally equips BaFin with a "name-and-warn" power to publicly flag firms suspected of breaching MiCAR, which it has used against platforms marketing into Germany without authorisation.

Licensed CASPs (MiCA register)

Crypto-asset service providers authorised under MiCA with home member state Germany (competent authority: Federal Financial Supervisory Authority (BaFin)), per ESMA's consolidated CASP register — 57 firms registered; a selection:

• Trade Republic Bank GmbH — authorised 28 Apr 2025 — custody; order execution; reception & transmission of orders; transfers
• N26 Bank SE — authorised 14 May 2025 — reception & transmission of orders
• Commerzbank Aktiengesellschaft — authorised 7 Apr 2025 — custody; transfers
• DZ BANK AG Deutsche Zentral-Genossenschaftsbank — authorised 23 Dec 2025 — custody; order execution; transfers
• DekaBank Deutsche Girozentrale — authorised 1 Dec 2025 — custody; order execution; transfers
• Scalable Capital Bank GmbH — authorised 2 Mar 2026 — advice
• Boerse Stuttgart Digital Custody GmbH — authorised 17 Jan 2025 — custody; transfers
• Bitpanda Asset Management GmbH — authorised 24 Jan 2025 — exchange (fiat & crypto); custody; transfers
• BitGo Europe GmbH — authorised 9 May 2025 — exchange (fiat & crypto); custody; order execution; reception & transmission of orders; transfers
• Bullish Europe GmbH — authorised 4 Sep 2025 — exchange (fiat & crypto); custody; order execution; transfers
• Crypto Finance (Deutschland) GmbH — authorised 24 Jan 2025 — exchange (fiat & crypto); custody; order execution; transfers
• flatexDEGIRO Bank AG — authorised 4 Apr 2025 — order execution

Full register: ESMA interim MiCA register — as of July 2026.

Tax treatment

German crypto taxation is governed primarily by the Einkommensteuergesetz (Income Tax Act, EStG) as interpreted through the Federal Ministry of Finance's May 10, 2022 guidance letter (BMF-Schreiben) on individual crypto income taxation, updated July 2023. The defining feature is the one-year holding-period exemption under § 23 EStG: cryptoassets held as private assets (Privatvermögen) by an individual for more than twelve months are tax-free on disposal, regardless of gain magnitude. Cryptoassets held less than twelve months face progressive income tax rates up to 45% plus 5.5% solidarity surcharge. The annual EUR 1,000 (raised from EUR 600 in 2024) tax-free threshold applies cumulatively to private speculative gains. Staking, lending and yield-farming returns received during the holding period extend the holding period to ten years under the previous interpretation, though the May 2022 BMF letter walked this back to a one-year holding period for the underlying staked assets — a meaningful clarification favourable to retail. Mining, professional trading and business-context crypto activity are taxed as Gewerbeeinkünfte (business income) at progressive rates plus trade tax (Gewerbesteuer, ~14% effective). NFT taxation follows the same private-versus-business distinction. Corporate crypto holdings face full corporate income tax (15%) plus solidarity surcharge plus trade tax, totalling 28-32% effective. The DAC8 reporting framework has been transposed by the Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenzgesetz, KStTG), in force since 1 January 2026, which requires crypto-asset service providers to collect customer self-certifications and report transaction data to the Bundeszentralamt für Steuern for cross-border exchange; the first reports, covering 2026, are due in 2027. The combination of a one-year holding exemption and full DAC8 reporting leaves Germany with one of the EU's most favourable retail crypto-tax regimes alongside meaningful enforcement capacity.

Banking and on-ramp infrastructure

German banking access for crypto businesses has improved substantially through 2024-2025 driven by KWG license normalisation, MiCA authorisation and explicit BaFin supervisory comfort. Tier-one institutions have moved in: Deutsche Bank applied to BaFin for a crypto custody licence in June 2023 and partnered with Swiss provider Taurus for custody and tokenisation technology; Commerzbank obtained a KWG crypto-custody licence in November 2023 and holds a MiCAR authorisation for custody and transfers; DZ Bank and DekaBank are both MiCAR-authorised for custody, execution and transfers. Neobrokers and neobanks are authorised too — Trade Republic, N26, Scalable Capital and flatexDEGIRO all hold BaFin CASP authorisations. Specialist crypto-friendly banks such as Bankhaus von der Heydt, Solaris and Sutor Bank service the broader CASP ecosystem. The Boerse Stuttgart Group's BSDEX is a leading German cryptoasset trading venue, with Boerse Stuttgart Digital Custody separately MiCAR-authorised; Boerse Stuttgart's Bison consumer app provides retail access. Deutsche Börse's Clearstream and D7 platforms operate native digital securities infrastructure. SEPA Instant access is universal for German-authorised CASPs. Card programmes operate through Visa Europe and Mastercard Europe with multiple German issuers. Identity verification operates through Schufa, eID infrastructure under § 1 PAuswG, and the rolling out European Digital Identity Wallet under eIDAS 2.0. The combination of established universal-bank crypto operations, specialist crypto-bank ecosystem, native digital-securities infrastructure, and rigorous regulatory oversight produces among the most credible institutional crypto-banking environments globally.

Court-tested precedents

German cryptoasset jurisprudence is more developed than most EU member states reflecting Germany's longer regulatory track record. The foundational decision is the Kammergericht Berlin's judgment of 25 September 2018 (case (4) 161 Ss 28/18 (35/18)), which held that Bitcoin is neither a "Rechnungseinheit" (unit of account) and therefore not a financial instrument under § 1(11) KWG, nor e-money under the ZAG. On that basis the operator of a Bitcoin trading platform could not be convicted of unlicensed banking business, and the court pointedly rejected BaFin's attempt to extend the statute by administrative interpretation. The German legislature effectively answered the ruling by writing crypto custody into the KWG from 1 January 2020 and, later, by MiCAR. On tax, the Federal Tax Court (Bundesfinanzhof) ruling of 14 February 2023 (case IX R 3/22) confirmed that cryptoassets are "other economic goods" whose disposal within the one-year period is taxable under § 23 EStG, validating the BMF interpretation. BaFin administrative court proceedings before the Verwaltungsgericht Frankfurt have produced procedural rulings on licensing and supervisory measures — including the first German judicial engagement with MiCAR, in the Ethena litigation. The pre-MiCA cryptoasset jurisprudence base is more developed than other EU member states; post-MiCA jurisprudence is just beginning to develop.

Regulatory roadmap

The 2026-2028 German cryptoasset regulatory roadmap is shaped by MiCA full implementation, ongoing BaFin supervisory practice refinement, and German federal legislative agenda. Conversion of legacy KWG crypto-custody licensees is already complete, Germany's shortened grandfathering having expired on 31 December 2025, so the near-term workload is processing new CASP applicants on top of the largest authorised population in the EU. The dominant strategic question is external: the European Commission's legislative package of 4 December 2025 proposes transferring direct supervision of all CASPs from national competent authorities to ESMA, which would over time recentralise the authority BaFin currently exercises; the proposal has drawn resistance from member states that benefit from the national-authority model. The eWpG (Electronic Securities Act) review is expected to expand the eligible asset classes for native digital issuance from current bearer bonds and fund units to potentially equity-like instruments through 2027 amendments. The Federal Ministry of Justice review of cryptoasset succession law and notarial procedures has been ongoing through 2025-2026. ESMA peer review pressure on BaFin supervisory standards is constructive rather than corrective; BaFin is widely viewed as exceeding the ESMA standards baseline. The Deutsche Bundesbank joined the MAS-led Project Guardian asset-tokenisation initiative and signed a tokenisation and cross-border settlement MoU with MAS, alongside Eurosystem work on settling tokenised assets in central bank money. The German DAC8 implementation is fully active for 2026 reporting cycle. Federal election cycle considerations may affect cryptoasset policy continuity.

Practical implications for operators

Operating a cryptoasset business serving German residents requires either MiCA CASP authorisation directly from BaFin or an EU-passported authorisation from another EU member state competent authority. BaFin direct authorisation is operationally demanding: typical timeline 18-24 months from initial pre-application engagement through full authorisation, application materials in German with German legal counsel essentially required, substantive engagement with BaFin supervisors throughout the process. Initial capital requirements follow MiCA prescriptive minima (EUR 50K for advice/reception/transmission, EUR 125K for custody/trading platform, EUR 150K for principal-on-own-account services) plus BaFin substance expectations including German-resident senior management (Geschäftsführer with relevant experience), German-resident compliance officer, MaRisk-compliant risk management framework, and audited German financial statements. Ongoing compliance costs — compliance staff, audit, ICT under DORA, AML and Travel Rule tooling, and BaFin supervisory engagement — run to seven figures annually for a full-service CASP, though no regulator publishes benchmark figures. Once authorised, the German market is roughly 84 million people with high cryptoasset adoption, a supportive retail tax framework, deep institutional capital base, sophisticated DeFi developer community, and EU-wide passport. The Coinbase Germany, Bitpanda, Trade Republic, Boerse Stuttgart Group, and N26 Crypto operations demonstrate the achievable path for well-capitalised operators. The strategic logic for German crypto operators combines direct access to Europe's largest economy, institutional banking and capital markets infrastructure, the most favourable EU retail tax regime, and BaFin authorisation prestige that opens institutional doors throughout the EU. The near-term operational reality is that BaFin processes are slow, expensive and procedurally rigorous, but the resulting authorisation is one of the most valuable cryptoasset credentials available globally.