CASP authorisation in Germany — the BaFin MiCA licence, the KMAG and the crypto capital tiers
CASP authorisation in Germany runs through BaFin under MiCA, with the national KMAG bolted on top. The substantive rules come from Regulation (EU) 2023/1114 (MiCA), directly applicable across the EU; the German plumbing — the competent authority, the supervisory powers and the transition from the old crypto-custody regime — comes from the Kryptomärkteaufsichtsgesetz (KMAG). This piece walks through who grants what, what the dossier needs, how the KWG-to-MiCA transition works, and what switches on at grant.
1. Legal basis
- Regulation (EU) 2023/1114 — MiCA. The authorisation, capital, conduct, custody and market-abuse rules sit here and are identical in every member state.
- Kryptomärkteaufsichtsgesetz (KMAG) — the Crypto Markets Supervision Act, enacted as part of the Finanzmarktdigitalisierungsgesetz (FinmadiG) and published in the Federal Law Gazette on 27 December 2024. It designates BaFin as the competent authority and adds national supervisory powers (for example, the power to publish public warnings of compliance failures).
- BaFin guidance notes and the crypto-asset services section of the BaFin website, which set out the authority’s expectations on the dossier and the transition.
MiCA’s CASP obligations have applied in Germany since 30 December 2024.
2. Who grants what
Germany runs a single-authority model for crypto — BaFin handles the whole authorisation, with the Deutsche Bundesbank involved in prudential supervision as it is for banks and investment firms.
| Activity | Competent authority |
|---|---|
| CASP authorisation under Article 59 MiCA | BaFin |
| Asset-Referenced Token (ART) issuer authorisation | BaFin |
| Electronic-Money Token (EMT) issuance | BaFin (issuer must be a credit institution or an authorised electronic money institution) |
| Legacy crypto-custody business (Kryptoverwahrgeschäft) under the KWG | BaFin |
| AML supervision and SAR reception | BaFin plus the Financial Intelligence Unit via goAML |
3. The MiCA services catalogue
Article 3(1)(16) MiCA lists the crypto-asset services a CASP can be authorised to provide. The set chosen drives capital, conduct and custody obligations:
- Custody and administration of crypto-assets on behalf of clients
- Operation of a trading platform for crypto-assets
- Exchange of crypto-assets for funds
- Exchange of crypto-assets for other crypto-assets
- Execution of orders for crypto-assets on behalf of clients
- Placing of crypto-assets
- Reception and transmission of orders for crypto-assets
- Provision of advice on crypto-assets
- Portfolio management of crypto-assets
- Transfer services for crypto-assets on behalf of clients
4. Capital and prudential requirements
Article 67 MiCA and Annex IV set three minimum capital classes, tied to the services applied for:
- Class 1 — €50,000: reception and transmission of orders, advice, portfolio management, execution, placing, transfer services.
- Class 2 — €125,000: custody and administration, plus exchange of crypto-assets for funds or for other crypto-assets.
- Class 3 — €150,000: operation of a trading platform.
Ongoing own funds must be the higher of the applicable floor and one quarter of the previous year’s fixed overheads. BaFin, working with the Bundesbank, tests the fixed-overheads calculation and the way own funds are held and monitored.
5. What goes in the BaFin dossier
The MiCA application content is fixed by Article 62 and the ESMA-level technical standards. In Germany the file must be submitted in the form BaFin specifies and typically in German, and it mirrors the payment-institution dossier structure with crypto-specific additions:
- Programme of operations — the services in scope, the customer journey, the asset types handled.
- Business plan — three-year projections with own-funds evolution.
- Governance map — the management body, key function holders and fit-and-proper documentation.
- Internal-control framework — risk management, compliance and internal audit.
- ICT and operational-resilience framework aligned with DORA, including the register of information on ICT third-party providers.
- Custody and segregation — for custody CASPs: the segregation model, the cold/hot wallet split, the key-management framework and any sub-custody arrangement (Article 70 MiCA).
- Market-abuse policy — the Title VI MiCA rules on insider dealing and market manipulation in crypto-assets.
- AML / CFT programme — including the Travel Rule under Regulation (EU) 2023/1113, with FIU/goAML connectivity under the Geldwäschegesetz (GwG).
- Complaints handling under Article 71 MiCA.
6. The KWG-to-MiCA transition
Before MiCA, Germany already regulated crypto-custody business (Kryptoverwahrgeschäft) as a financial service under the Kreditwesengesetz (KWG). The transition from that regime is set by Section 50 KMAG:
- Entities holding an existing authorisation for crypto-related financial services may continue those activities until 31 December 2025 at the latest under Section 50 KMAG.
- That is a deliberately shortened window — Article 143 MiCA permits member states to run the transition to 1 July 2026, but Germany opted to close it at the end of 2025.
- A simplified authorisation procedure is available under Article 143(6) MiCA and Section 50(3) KMAG for firms that already hold an equivalent national authorisation, so a KWG crypto-custodian does not start from zero.
- A firm that has neither been granted a CASP authorisation nor has a complete file under assessment by the end of the window cannot rely on the legacy KWG authorisation to keep operating.
7. Three worked examples
The rules read more clearly through the cases a German applicant actually meets.
- Legacy KWG custodian. A firm holding a KWG Kryptoverwahrgeschäft licence since 2021, safekeeping client crypto. Rule: Section 50 KMAG lets it continue until 31 December 2025; custody sits in Class 2 (€125,000). Action: it files a CASP dossier via the simplified procedure under Section 50(3) KMAG, reusing its existing governance and AML documentation and adding the Article 70 segregation detail MiCA now specifies. Outcome: continuity if the file is complete and under assessment before the year-end cut-off — the shortened window is the pressure point.
- Exchange newcomer. A firm launching a fiat-to-crypto and crypto-to-crypto exchange with no legacy licence. Rule: both exchange services sit in Class 2 (€125,000); it holds client assets, so custody-style safeguarding applies. Action: it applies fresh to BaFin with a full dossier, the German-language file and a Travel Rule build. Outcome: a €125,000 floor and the full conduct and market-abuse obligations from day one.
- Trading-platform operator. A firm intending to run an order book matching third-party buyers and sellers. Rule: operating a trading platform is the Class 3 service (€150,000) and triggers the heaviest market-abuse and transparency obligations under Title VI MiCA. Action: it builds surveillance and disclosure into the dossier, not as a later add-on. Outcome: the highest capital floor and the most scrutinised conduct file of the three.
8. Realistic timing
Article 63 MiCA sets a statutory 25 working days for BaFin to confirm completeness and a further 40 working days for the substantive decision. In practice, with pre-application engagement and feedback rounds, a first-time applicant should plan six to nine months end-to-end. The compressed German transition — closing 31 December 2025 — means legacy KWG holders in particular should already be in assessment rather than starting the file.
9. What switches on at grant
- Travel Rule compliance on every crypto-asset transfer, under Regulation (EU) 2023/1113.
- DAC8 reporting from 2026 onwards.
- AML, tipping-off and SAR obligations to the FIU via goAML under the GwG.
- Market-abuse monitoring and reporting under Title VI MiCA.
- Conduct and complaints handling under Articles 66 and 71 MiCA.
- BaFin and Bundesbank supervisory and prudential reporting.
- Passporting notifications under Article 65 MiCA where activity extends cross-border.
10. FAQ
Do I file with BaFin or with the Bundesbank?
With BaFin, which is the designated competent authority under the KMAG. The Deutsche Bundesbank participates in prudential supervision, as it does for banks and investment firms, but BaFin runs the authorisation.
If I hold a KWG crypto-custody licence, am I CASP-authorised?
No. Kryptoverwahrgeschäft under the KWG was a separate national regime. MiCA requires a fresh CASP authorisation. Section 50 KMAG lets an existing licence holder continue until 31 December 2025 while it obtains the CASP authorisation, using the simplified procedure under Section 50(3) KMAG.
When does the German transitional period end?
31 December 2025. Germany used a shorter window than the 1 July 2026 maximum that Article 143 MiCA allows, so German firms have less runway than those in most other member states.
What is the minimum capital?
€50,000, €125,000 or €150,000 depending on the services, per Article 67 MiCA and Annex IV. Ongoing own funds must be the higher of that floor and a quarter of the prior year’s fixed overheads.
Does a German CASP authorisation passport across the EU?
Yes. Article 65 MiCA passporting applies — BaFin as home authority notifies the host state, which has limited grounds to react. See our branch vs Freedom of Services piece.
How does German CASP compare to the Luxembourg route?
The substance is identical because MiCA is directly applicable. The differences are national: Germany transitions from a KWG crypto-custody licence and closes its window on 31 December 2025, while Luxembourg transitions from VASP registration and runs to 1 July 2026.
11. What to do, today
- Map each service you intend to provide to its Article 67 capital class before you cost the project.
- If you hold a KWG crypto-custody licence, treat 31 December 2025 as a hard deadline — aim to have a complete file under BaFin assessment, using the Section 50(3) simplified procedure.
- Build the Article 70 custody segregation, the Title VI market-abuse policy and the Travel Rule implementation into the dossier from the start.
- Prepare the file in the form BaFin specifies and in German, and run pre-application engagement to compress the feedback rounds.
- Plan post-grant reporting — Travel Rule, DAC8 and market-abuse monitoring switch on at grant.
Related: EMI licence in Germany (BaFin) · CASP authorisation in Luxembourg · MiCA Travel Rule
