Germany Crypto License (BaFin) — Requirements & MiCA 2026

Bitcoin stack coins laptop keyboard — Germany Crypto License: BaFin Authorization 2026

Overview

Why BaFin Authorization Is Europe's Most Prestigious Crypto License

Germany has regulated crypto since 2020 when BaFin classified crypto assets as financial instruments under the Banking Act (KWG), requiring all crypto custodians and exchanges to obtain a license under § 32 KWG. Germany was also one of the first EU states to transpose the 5th AML Directive for crypto. Under MiCA, BaFin is now the competent authority for CASP authorizations in Germany.

A BaFin-authorized crypto license is one of the most prestigious in the world — comparable to FCA (UK) or MAS (Singapore). The depth of BaFin's due diligence, the ongoing supervisory requirements, and the difficulty of obtaining authorization means that BaFin-licensed entities command exceptional trust from institutional clients, banking partners, and regulators globally.

However, the process is long (12–18 months), expensive, and demanding. BaFin expects genuine German substance — not just a registered office, but functioning management, local compliance personnel, and real operational presence. Incomplete applications are rejected outright, not returned for revision.

Preparation is critical: BaFin does not iterate on incomplete applications. A rejected BaFin application resets the entire clock and timeline. Investing in thorough preparation — typically 6–8 months of pre-filing work with experienced BaFin counsel — is essential. Do not rush to file; file once, file correctly.

License Categories

BaFin Crypto — License Types

Germany offers multiple license types for crypto businesses under KWG and MiCA. The applicable route depends on the business model and the assets handled.

License Type	Legal Basis	Min. Capital
Crypto Custody Business (Kryptoverwahrgeschäft)	§ 1 Abs. 1a Nr. 6 KWG	€125,000
Crypto Asset Exchange (MiCA CASP)	EU MiCA Art. 59	€150,000–€730,000
Crypto Asset Broker (MiCA CASP)	EU MiCA Art. 59	€50,000–€125,000
Investment Brokerage (crypto financial instruments)	MiFID II + KWG	€125,000

Requirements

BaFin Crypto License — Key Requirements

Entity

German GmbH or AG required

GmbH recommended for most; AG required for some activities

Directors

Min. 2 directors; both with relevant expertise

BaFin fit & proper — extensive background review; must demonstrate crypto expertise

Shareholders

BaFin fit & proper for 10%+ holders

All qualifying shareholders subject to BaFin background check

Compliance Function

CCO, MLRO, and Risk Officer required

All three functions required; staffed by qualified individuals

AML/KYC

GwG (German Money Laundering Act) compliant

German-specific AML rules; Travel Rule compliance required

IT Security

BSI standards compliance

Federal Office for Information Security (BSI) guidelines apply

Capital Adequacy

Ongoing monitoring required

Regular capital adequacy reports to BaFin; liquidity monitoring

Recovery Plan

For larger operators

Recovery and resolution planning for systemically relevant entities

Process

How to Get a BaFin Crypto License — Step by Step

Incorporate German Entity and Inject Capital

Incorporate a German GmbH (recommended for most applicants) or AG at the Commercial Register (Handelsregister). Inject the minimum capital requirement for the intended license type. Establish a genuine physical office in Germany with functional management. German substance is a core BaFin expectation — not a formality.

4–6 weeks

Engage Compliance and Legal Counsel — Build Application

Engage BaFin-experienced legal and compliance counsel immediately. The application package is extremely detailed: comprehensive business plan, 5-year financial projections, organizational structure with CVs and fit & proper declarations for all directors and qualifying shareholders, AML/CFT policies per GwG, IT security framework per BSI, capital adequacy methodology, and operational risk framework.

8–12 weeks

File BaFin Application (§ 32 KWG or MiCA Form)

Submit the complete application to BaFin via the official electronic portal. BaFin will perform a completeness check — any gaps result in rejection, not a request to supplement. Ensure every section is addressed completely. BaFin application forms are detailed and German language documentation is often required alongside English materials.

Filing week

BaFin Review — Extensive Questioning and Possible On-Site

BaFin conducts the most thorough review of any EU crypto regulator. Expect multiple rounds of written clarification requests, interviews with directors, and potentially an on-site inspection of the German office and IT systems. All responses must be in German (or officially translated). Responses are typically required within 4–6 weeks of each BaFin request.

6–12 months

Authorization Issued — Ongoing BaFin Reporting

BaFin issues the authorization. Ongoing obligations are demanding: quarterly supervisory reports to BaFin, annual audited financial statements by a BaFin-approved auditor, annual AML/CFT review, capital adequacy monitoring, IT security reviews, and regular supervisory meetings with BaFin examiners. BaFin may conduct unannounced inspections.

Authorization and ongoing

Costs

BaFin Crypto License — Full Cost Breakdown

Item	Details	Approx. Cost
BaFin application fee	By license type (non-refundable)	€1,500–€25,000
Annual BaFin supervisory levy	Ongoing annual regulatory levy	€5,000–€50,000/yr
Company formation (GmbH)	Notary, Handelsregister, constitutional docs	€3,000–€8,000
German office and management	Office lease + German-resident management	€30,000–€80,000/yr
Legal & compliance preparation	Application package, BaFin counsel, policies	€30,000–€80,000
Min. capital	Paid-up capital (by license type)	€125,000–€730,000
Estimated Year 1 Total (excl. capital)	Setup, regulatory fees, office, management, professional fees	€100,000–€250,000+

FAQ

BaFin Crypto License — Common Questions

Yes. Operating a crypto exchange or custody service targeting German clients requires BaFin authorization under § 32 KWG and/or the EU MiCA CASP regime. Unlicensed operations are a criminal offence under German law. BaFin actively monitors the market and pursues unauthorized operators. Note: EU firms with MiCA passports from other EU states can passport into Germany without a separate BaFin authorization.

Minimum capital depends on the license type: Crypto Custody Business (KWG): €125,000; Crypto Exchange (MiCA Class 3): €150,000; Full-service exchange with dealing on own account (MiCA Class 3+): up to €730,000. Working capital requirements are additional — BaFin will assess whether the capitalization is adequate for the projected business scale.

12–18 months for a complete application. BaFin is one of the most thorough financial regulators in the world. Incomplete applications are rejected outright, and re-filing resets the clock entirely. Proper preparation by experienced BaFin counsel — typically 6–8 months of pre-filing preparation — is essential. Well-prepared applications with full documentation can be authorized in 12 months; complex cases take longer.

No. BaFin only licenses German-incorporated entities (GmbH or AG). Foreign companies must establish a German subsidiary with genuine local management and substance. Branch authorizations for non-EEA firms are possible in limited cases under § 53 KWG, but this route has significant restrictions. EEA firms with MiCA licenses from other EU states can passport into Germany without a German subsidiary.

Combined approximately 30%: 15% corporate income tax (Körperschaftsteuer) + approximately 15% trade tax (Gewerbesteuer, varies by municipality, typically 14–17%) + 5.5% solidarity surcharge on the KSt. Germany has no special tax regime for crypto companies, unlike Malta (5% effective), Cyprus (12.5%), or Georgia (0% Virtual Zone). The high tax rate is offset by Germany's market size and regulatory prestige.

Total costs typically range from EUR 50,000 to EUR 150,000, including application fees (EUR 3,000-5,000), legal advisory fees (EUR 20,000-50,000), compliance setup (EUR 15,000-40,000), and ongoing operational costs. The exact amount depends on your business model complexity and whether you require additional registrations with German financial authorities. We recommend budgeting for professional support throughout the application process to avoid costly delays or rejections.

BaFin requires a detailed business plan, proof of minimum capital (EUR 125,000 for most crypto service providers), CVs and background checks for management, compliance policies, AML/KYC procedures, IT security documentation, risk management framework, and proof of suitable premises in Germany. You must also submit a Declaration of Compliance with the Money Laundering Act (Geldwäschegesetz) and demonstrate that your organization meets operational and governance standards set by BaFin.

BaFin licenses require higher capital reserves (EUR 125,000 minimum) and stricter compliance oversight than Liechtenstein's lighter-touch approach, but offer stronger market access within the EU under passporting rules until 2026. Malta's license is faster to obtain (3-6 months) but provides less regulatory certainty than BaFin. Germany's license is most expensive but grants the highest institutional credibility for operating across continental Europe.

BaFin-licensed crypto companies can establish accounts with major German banks and some international institutions, though many banks remain reluctant due to crypto sector risk. Fidor Bank and Solarisbank have been popular choices for crypto-friendly banking relationships as of 2026. Most licensed companies maintain relationships with 2-3 banking partners to ensure operational continuity, as individual banks may withdraw services without notice.

BaFin licenses do not have a fixed expiration date but require continuous compliance monitoring and annual reporting of operational metrics, financial statements, and compliance updates. If there are material changes to your business model, management, or capital structure, you must notify BaFin within 10 business days and may require approval for modifications. Failure to maintain compliance standards can result in license suspension or revocation at any time.

Major risks include AML/KYC enforcement failures (which can trigger EUR 1 million+ fines), inadequate transaction monitoring leading to sanctions violations, and insufficient customer due diligence. BaFin has increased enforcement activity since 2024, with particular focus on stablecoin operations and market manipulation detection. Companies must maintain audit trails for all transactions, implement real-time risk screening, and conduct quarterly internal compliance audits to avoid regulatory action.

A single BaFin license can cover multiple services such as exchange, custody, and trading if they are specified in your original application and your compliance framework supports them. However, each service category may require separate operational protocols, segregated client accounts, and distinct compliance procedures approved by BaFin. If you want to expand services after licensing, you must submit a formal modification request and demonstrate that your capital, staffing, and systems can handle the additional operational burden.

Compare European Licences