MiCAR CASP Authorisation in Germany

Who needs CASP authorisation in Germany

CASP authorisation is the central licensing question for crypto businesses in Germany. Since 30 December 2024, anyone who provides crypto-asset services in the EU must be either an authorised crypto-asset service provider (CASP) under the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 (MiCAR), or a credit institution, investment firm or other financial entity that may provide such services after notifying its supervisor (Article 59(1) MiCAR).

In Germany, CASP authorisation is granted by BaFin. Crypto-asset services include custody and administration, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, execution and reception and transmission of orders, placing, transfer services, advice and portfolio management. The German Crypto Markets Supervision Act (Kryptomärkteaufsichtsgesetz, KMAG) supplements MiCAR with supervisory powers, sanctions and procedural rules.

An authorised CASP must have its registered office in a member state where it carries out at least part of its services, its place of effective management in the EU and at least one director resident in the EU (Article 59(2) MiCAR). A CASP authorisation from BaFin allows the provider to passport its services to other member states after notification (Article 65 MiCAR), and providers authorised elsewhere in the EU can serve German clients in the same way.

The German transitional period has ended

MiCAR allowed providers that operated lawfully before 30 December 2024 to continue until 1 July 2026 or until their authorisation decision, but member states could shorten that period (Article 143(3) MiCAR). Germany used the option. Firms that held a German licence under the Banking Act for crypto custody or other crypto activities on 29 December 2024 could continue on the basis of their existing licence, which was deemed to continue, and could use a simplified authorisation procedure. That deemed licence expired with the final decision on the MiCAR application and in any event at the end of 31 December 2025 (§ 50(2) no. 3 KMAG).

As of November 2026, the transitional regime in Germany is therefore over. A provider that serves clients in Germany needs a MiCAR authorisation, a notification-based entitlement as an existing financial entity under Article 60 MiCAR, or a passport from another member state. Providing crypto-asset services without authorisation is a criminal offence under § 46(1) no. 3 KMAG, and BaFin can intervene against unauthorised business.

The CASP authorisation application process

The application must contain, among other things, the applicant's legal form and articles, a programme of operations covering the services and the marketing approach, evidence of prudential safeguards, governance arrangements, the reliability and expertise of management, the identity and suitability of shareholders with qualifying holdings, internal control and risk management, business continuity, ICT systems and security, anti-money laundering procedures, procedures for safeguarding client assets, complaints handling and, where relevant, custody policies, trading platform rules and execution policies (Article 62 MiCAR). Technical standards specify the content and format.

BaFin must acknowledge receipt within five working days and assess completeness within 25 working days, setting a deadline for missing information (Article 63(1), (2) MiCAR). Once the application is complete, BaFin has 40 working days to assess compliance and adopt a reasoned decision (Article 63(9) MiCAR). It may request further information, which suspends the assessment for a limited period. In Germany, BaFin may also refuse authorisation where the application remains incomplete after the deadline, and it can grant authorisation subject to conditions (§ 11 KMAG). In practice, applicants should expect pre-application meetings and several rounds of questions before the formal clock starts.

Capital and organisational requirements

CASPs must at all times hold prudential safeguards of at least the higher of the permanent minimum capital in Annex IV MiCAR and one quarter of the previous year's fixed overheads (Article 67(1) MiCAR). The minimum capital is EUR 50,000 for class 1 services such as order execution, placing, transfer services, reception and transmission, advice and portfolio management; EUR 125,000 for class 2, which adds custody and exchange services; and EUR 150,000 for class 3, which adds operating a trading platform. Safeguards can take the form of own funds or an insurance policy. CASPs must also meet DORA's ICT risk requirements; see our insight on DORA ICT risk rules.

Conduct, custody and client assets

Authorised CASPs must act honestly, fairly and professionally in the best interests of clients, provide clear and not misleading information, publish pricing and fees, and maintain policies on conflicts of interest and complaints. Custodians must agree the terms of custody with clients, keep a register of positions for each client, segregate client crypto-assets from their own, report positions to clients regularly and return assets promptly. Where they use sub-custodians, they remain responsible for the safekeeping arrangements.

German law reinforces asset protection: crypto-assets held in custody for a client are deemed to belong to the client, unless the client has consented to dispositions for the account of the institution or third parties (§ 45(1) KMAG). In the insolvency of the custodian, clients can therefore claim segregation of their assets rather than ranking as unsecured creditors.

Anti-money laundering obligations apply in full, and weaknesses in this area expose a CASP to supervisory measures and fines. CASPs are obliged entities under the Money Laundering Act and must apply the Transfer of Funds Regulation, which requires originator and beneficiary information to accompany crypto-asset transfers (the travel rule). Our insight on anti-money laundering duties under the GwG covers the German requirements.

Ongoing supervision, acquisitions and market abuse

CASP authorisation is the start of ongoing supervision, not the end of the process. Authorised providers must notify BaFin of changes in management, maintain their prudential safeguards, have their annual financial statements audited and submitted, and keep their policies, outsourcing arrangements and ICT systems up to date. The KMAG gives BaFin a full set of supervisory tools, including information requests and audits, measures against managers, special representatives, temporary measures in case of danger and the suspension or prohibition of crypto-asset services.

Investors acquiring a qualifying holding in a CASP must notify BaFin in advance, and BaFin assesses the proposed acquisition under Article 83 MiCAR on criteria similar to owner control procedures for banks; see our insight on BaFin owner control procedures. Transactions involving German CASPs therefore need a regulatory condition precedent and enough time between signing and closing.

MiCAR also introduces a market abuse regime for crypto-assets admitted to trading or for which admission has been requested (Article 86 MiCAR). It prohibits insider dealing (Article 89), unlawful disclosure of inside information and market manipulation (Article 91), and requires anyone professionally arranging or executing transactions in crypto-assets to have effective systems to prevent and detect market abuse and to report suspicious orders and transactions (Article 92). In Germany, intentional insider dealing in crypto-assets and certain forms of market manipulation are criminal offences under § 46 KMAG. Trading platforms and brokers should integrate crypto market surveillance into their compliance framework from the outset of their CASP authorisation project.

White papers, token offerings and stablecoins

CASP authorisation is distinct from the rules for issuing crypto-assets. Offerors of crypto-assets other than asset-referenced tokens (ARTs) and e-money tokens (EMTs), and persons seeking their admission to trading, must draw up, notify and publish a crypto-asset white paper. BaFin may not require prior approval of the white paper or of marketing communications (Article 8(3) MiCAR), but it can suspend or prohibit offers and require changes. If a required white paper was not published, buyers can demand that the issuer, offeror, applicant, trading platform operator and members of their management bodies take back the crypto-assets against reimbursement of the purchase price (§ 19 KMAG).

Issuers of ARTs need an authorisation and an approved white paper; EMTs may only be issued by credit institutions and e-money institutions. Trading platforms must ensure that white papers exist for crypto-assets admitted to trading before 30 December 2024 by 31 December 2027 (Article 143(2) MiCAR). Tokenised securities remain outside MiCAR and are governed by securities law, including the German Electronic Securities Act discussed in our insight on electronic securities and crypto securities.

Practical steps for applicants and existing providers

1. Classify each service against the MiCAR definitions and check whether any activity falls under MiFID II, the payment services rules or e-money rules instead.
2. Decide on the route: full CASP authorisation, an Article 60 notification by an existing licensed entity, or a passport from another member state.
3. Build the German entity's substance: management, key function holders, compliance, risk and AML staff, and governance documents.
4. Prepare the programme of operations, financial projections, ICT and security documentation, custody and safeguarding policies and outsourcing agreements.
5. Plan for ongoing duties after authorisation: reporting, audits, market abuse rules for crypto-assets, and notifications of changes in management or qualifying holdings.
6. Review client contracts, general terms and onboarding flows, because MiCAR's information duties, fee disclosure and complaint handling rules apply from the first day of authorised business and existing customers may need to be migrated to new terms.
7. Check the tax and accounting treatment of client assets and own holdings, and align the custody set-up with the segregation rules so that auditors can confirm that client crypto-assets are protected in an insolvency.

For the broader licensing landscape for fintechs, see our page on fintech, payments and crypto assets.

How TRW & Co helps

We advise crypto businesses, banks, investment firms, asset managers and investors on CASP authorisation and MiCAR compliance in Germany. We analyse business models, prepare CASP authorisation applications and Article 60 notifications, draft governance, custody and conflict policies, review outsourcing and ICT contracts, and accompany the dialogue with BaFin. For token issuers, we prepare and review white papers and marketing communications. For investors in crypto businesses, we handle owner control procedures and regulatory due diligence. This page is general information, not legal advice. To discuss your project, please contact us.