To operate as a crypto-asset service provider (CASP) in Germany under the EU Markets in Crypto-Assets Regulation (MiCA), a firm must obtain authorisation from BaFin, the German Federal Financial Supervisory Authority, before offering any regulated crypto-asset services to EU clients. The MiCA transitional period ended on 1 July 2026, with ESMA confirming on 17 April 2026 that no extensions would be granted; any business that has not yet secured a licence is now operating unlawfully if it continues to onboard or market to EU users. This guide walks through the authorisation procedure in Germany, from entity structuring to BaFin submission, common pitfalls, and realistic timelines.
Why Germany and Why Now
Germany is one of the most significant crypto-asset markets in the EU by institutional activity and regulatory track record. BaFin has established itself as a substantive, process-driven supervisor: it applies detailed scrutiny to governance arrangements, AML/CFT frameworks, and prudential buffers, which means both that the bar is high and that an authorisation carries genuine weight across the single market.
The urgency is no longer theoretical. ESMA's public statement of 23 June 2026 requires unauthorised CASPs to stop onboarding new clients and halt marketing immediately, limit ongoing activity to facilitating asset sales or transfers and closing open positions, and wind down in an orderly manner. With 325 authorised CASPs listed on the ESMA register as of 12 August 2026, competition for regulatory credibility is already active. Firms that delay risk both enforcement and market exclusion.
If your firm is reviewing its position or has already received correspondence from BaFin, our team can assess your situation promptly. Write to info@ferrazwhitmore.com or visit our contacts page.
Step 1 – Determine the Regulated Services and Applicable MiCA Category
MiCA sets out a defined list of crypto-asset services – including custody and administration, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placement, reception and transmission of orders, and advice or portfolio management in crypto-assets. Before drafting a single page of application, map every current and planned service precisely against this list.
The scope of your licence application dictates the capital requirements, the policies you must produce, and the level of BaFin scrutiny. A firm applying only for custody faces different prudential expectations from one seeking to operate a multilateral trading facility. Getting this mapping wrong at the outset is one of the most common errors seen in foreign client files.
Step 2 – Establish a Qualifying Legal Entity in Germany
BaFin requires the applicant to be a legal person or a certain undertaking established in the EU. For most international groups, this means incorporating a German subsidiary – most commonly a GmbH (Gesellschaft mit beschränkter Haftung). The entity must be registered in the Handelsregister (German commercial register) before a complete application can be filed.
- Registered office: The company's registered seat and, in practice, effective management must be in Germany. BaFin looks for genuine substance, not a brass-plate presence.
- Minimum share capital: MiCA prescribes minimum own-funds requirements that vary by service category; a GmbH's minimum statutory capital of €25,000 rarely satisfies these on its own. Ensure capitalisation is modelled against the MiCA thresholds before incorporation.
- Directors and senior management: At least two individuals must effectively direct the business ("four-eyes principle"). BaFin will conduct a fit-and-proper assessment of each.
- Beneficial owner disclosure: Every beneficial owner holding qualifying holdings must be disclosed and assessed. BaFin applies the same prudential-shareholder framework used in German banking supervision.
Step 3 – Build the AML/CFT Framework Before You Apply
A robust AML/CFT compliance programme is not something you attach to the application as an afterthought – it is assessed substantively by BaFin and feeds directly into the licence decision. Germany has transposed the applicable EU anti-money laundering directives through the Geldwäschegesetz (GwG), and BaFin expects CASP applicants to demonstrate how their specific service model maps onto German AML obligations.
The framework must include: a documented risk assessment of the business model, customer due diligence procedures (including enhanced due diligence for higher-risk scenarios), transaction monitoring, suspicious activity reporting channels to the Financial Intelligence Unit (FIU), and a designated AML officer with the appropriate skills and authority. Where a group has an existing AML framework, BaFin will examine whether it has been genuinely localised rather than simply translated.
For detailed guidance on structuring your AML/CFT compliance programme to meet BaFin's expectations, see our AML compliance services for Germany.
Step 4 – Prepare the Application Dossier
BaFin does not use a simple form submission. The application is a structured dossier that must be complete on first filing – incomplete submissions do not stop the clock and are commonly rejected or returned, adding months to the timeline. The core components include:
- Programme of operations: A detailed description of the services to be provided, the crypto-assets in scope, client categories, and the German and cross-border markets targeted.
- Business plan: Typically covering three years, with financial projections, capital adequacy calculations, and stress scenarios.
- Governance documentation: Organisational chart, management structure, job descriptions for key function holders, board composition, and internal control framework.
- Fit-and-proper documentation for directors and qualifying shareholders: CVs, criminal record certificates, regulatory history declarations, and – for qualifying shareholders – source-of-funds documentation tracing back to each beneficial owner.
- Policies and procedures: Client asset segregation, conflicts of interest, complaints handling (including any Mahnverfahren-adjacent escalation processes), business continuity, and outsourcing.
- IT and cybersecurity assessment: BaFin expects documentation of the technical infrastructure, key systems, and security controls, particularly for custody and trading platform applicants.
- AML/CFT programme: As described above, in full.
- Prudential information: Confirmation of initial capital, own-funds calculation, and any insurance or comparable guarantee arrangements if relied upon to meet prudential requirements.
All documents in a language other than German or English must be accompanied by certified translations. Where BaFin's published guidance specifies a particular form or template, use it; deviating without explanation delays review.
Step 5 – File With BaFin and Manage the Review Process
Applications are filed directly with BaFin through its electronic submission portal. Upon receipt, BaFin conducts a completeness check. If the file is incomplete, BaFin will issue a request for additional information, which pauses the statutory assessment period. Under MiCA, the competent authority has 25 business days to assess completeness after receipt of the application, and then a further period to reach a decision – the regulation sets a framework timeline, but BaFin's actual review may involve iterative exchanges on substantive points.
Active engagement with BaFin during review is standard practice. Expect written queries on governance, IT controls, and the AML framework. Response quality and speed materially affect the overall timeline. Foreign applicants sometimes underestimate the degree of German-language correspondence involved even where the application itself is accepted in English.
Realistic Timelines and Cost Drivers
There is no single "guaranteed" timeline for a BaFin CASP authorisation. Based on the regulatory framework and BaFin's published procedural guidance, applicants should plan for a process measured in months rather than weeks once the file reaches BaFin. Preparation – getting the entity, capital, personnel, and documentation ready before filing – typically takes as long as, or longer than, the formal review.
The principal cost drivers are:
- Entity setup: Notary fees, Handelsregister registration costs, and initial capitalisation (which must meet MiCA's own-funds thresholds, not just the GmbH minimum).
- Personnel: Recruiting or seconding qualified senior management, an AML officer, and key function holders with the right German-market experience adds significant overhead before revenues begin.
- Documentation and IT assessment: Engaging specialists to draft policies, conduct the IT security review, and produce a credible three-year financial model requires time and budget.
- Legal and compliance advisory: Firms that engage experienced counsel from the outset consistently navigate the process more efficiently than those who attempt to prepare in-house without familiarity with BaFin's expectations.
- BaFin supervisory fees: BaFin charges application and ongoing supervisory fees; the applicable schedule should be verified against BaFin's current published fee ordinance.
Common Errors by Foreign Applicants
International businesses entering Germany for the first time encounter a specific set of recurring difficulties. Awareness of them before you begin can save months of rework.
- Substance gaps: Registering a GmbH with a single director based abroad and no genuine German operational footprint. BaFin is explicit that effective management must be exercised from within the entity.
- Underestimating fit-and-proper scrutiny: Providing incomplete CVs or omitting disclosure of prior regulatory issues, even in non-EU jurisdictions. BaFin cross-checks against ESMA databases and its bilateral supervisory contacts.
- Treating the business plan as a formality: A templated or vague plan without genuine financial modelling triggers BaFin queries and signals inexperience.
- Copy-paste AML documentation: Submitting a group-level AML policy without demonstrating how it applies to the specific German entity and its client base.
- Ignoring the transition deadline: Several foreign-operated platforms that relied on the transitional period continued onboarding German users past 1 July 2026 without authorisation. This is now an enforcement exposure, not just a licensing queue matter.
- Underestimating language requirements: While BaFin accepts applications in English, correspondence and certain regulatory returns may be required in German. Senior management should have or have access to adequate German-language capacity.
Post-Authorisation Obligations
Obtaining the CASP licence is the beginning of an ongoing supervisory relationship with BaFin, not the end of the regulatory process. Authorised CASPs must maintain their prudential buffers on a continuous basis, report changes in qualifying holdings and senior management appointments for prior approval or notification, submit periodic regulatory reports, cooperate with BaFin's on-site and off-site supervision, and update their AML/CFT frameworks as FATF standards and German legislation evolve.
The ESMA register provides public visibility of authorised CASPs across the EU. Maintaining good standing on that register – which had reached 325 entries by 12 August 2026 – is a commercial as well as a regulatory imperative, particularly for firms seeking institutional or cross-border clients.
For a broader view of how the MiCA framework is being applied across EU jurisdictions, you may find it useful to review our alert on the end of the MiCA transitional period in Luxembourg, which addresses the same ESMA statements in a different national context.
Decision Checklist
Before committing resources to a BaFin CASP application, confirm the following:
- You have mapped all current and planned services against the MiCA list of crypto-asset services and identified the correct licence scope.
- Your German GmbH is incorporated or incorporation is in progress, with Handelsregister registration expected before filing.
- Two qualifying individuals have been identified as senior management and are prepared to undergo BaFin's fit-and-proper assessment.
- All beneficial owners holding qualifying holdings have been identified and documentation of their suitability is being assembled.
- Capitalisation meets or will meet the MiCA own-funds thresholds for your specific service categories on filing date.
- A dedicated AML officer has been appointed and a German-law-compliant AML/CFT programme is drafted.
- IT and cybersecurity documentation is complete and has been independently reviewed.
- A three-year business plan with financial projections has been prepared by personnel with knowledge of BaFin's expectations.
- You have not continued to onboard or market to EU clients after 1 July 2026 without authorisation.
If any of these points remain unresolved, it is advisable to address them before filing, as incomplete applications are returned and restart the clock. Our MiCA licensing team in Germany can review your readiness and identify the critical path items specific to your structure.
To discuss your firm's position and the steps most relevant to your business model, please contact us at info@ferrazwhitmore.com or through our contacts page. We work with international groups at all stages of the BaFin authorisation process, from initial scoping through to post-authorisation compliance support.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.