Fintech, Payments and Crypto Assets

Fintech and crypto regulation in Germany

Fintech and crypto businesses in Germany are regulated by what they do, not by the technology they use. A company that executes payment transactions, issues e-money, lends, offers investment services, holds client assets, or exchanges, transfers or safeguards crypto-assets needs the corresponding licence, whether it is a start-up, a big-tech platform or an established bank.

The key frameworks are the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG), implementing the second Payment Services Directive (PSD2), the Banking Act (KWG) and Investment Firms Act (WpIG), the EU Markets in Crypto-Assets Regulation (MiCAR) supplemented by the Crypto Markets Supervision Act (Kryptomärkteaufsichtsgesetz, KMAG), and the Electronic Securities Act (eWpG) for tokenised securities. BaFin is the competent authority for all of them.

This page explains the licensing regimes for payment and e-money institutions, the MiCAR framework for crypto-asset service providers and token issuers, tokenisation and electronic securities, partnership models between fintechs and banks, and the cross-cutting rules on anti-money laundering, data protection and operational resilience. It is written for founders, product and compliance teams, investors in fintech companies, and banks working with fintech partners. For the general licensing and supervision framework, see our page on financial regulation and BaFin licensing.

Germany is one of the larger fintech and crypto markets in Europe, and BaFin has developed a substantial practice on the boundary between regulated and unregulated activities. For many business models, the most important early decision is whether to obtain a licence, to work with a licensed partner or to restructure the product so that it falls outside the licensing regime. That decision affects valuation, time to market and the company's relationship with investors and banks for years.

Payment and e-money licences under the ZAG

Anyone who provides payment services in Germany commercially, or on a scale requiring a commercially organised business, needs a licence as a payment institution unless it is already licensed as a bank or another type of payment service provider (§ 10(1) ZAG). Payment services include money remittance, the execution of payment transactions, acquiring, issuing payment instruments, payment initiation services and account information services. E-money business requires a separate licence as an e-money institution (§ 11 ZAG). Account information service providers only need registration rather than a full licence, but they must hold professional indemnity insurance.

Licence applicants must show initial capital appropriate to the services, safeguarding arrangements for client funds (segregation or insurance), fit and proper managers, a business plan, governance and internal control systems, security policies, and procedures for incident reporting and complaints. Payment institutions must apply strong customer authentication and comply with the technical standards for secure communication with banks under PSD2. Agents of payment institutions must be registered, and outsourcing of operational functions is subject to notification and control requirements.

Exemptions and the PSD3 reform

The ZAG contains exemptions that are important for platform businesses, notably for commercial agents authorised to negotiate or conclude sales on behalf of only the payer or only the payee, and for limited networks and limited ranges of goods and services.

BaFin interprets them narrowly, and marketplaces that collect money from buyers and pass it on to sellers frequently need either a licence or a regulated payment partner. At EU level, the Commission has proposed replacing PSD2 with a third Payment Services Directive (PSD3) and a directly applicable Payment Services Regulation, addressing fraud, open banking and the convergence of the payment and e-money regimes. Businesses should monitor the final texts and transition periods, which will require changes to licences and processes.

MiCAR and crypto-asset services

MiCAR (Regulation (EU) 2023/1114) created a harmonised EU framework for crypto-assets that are not already financial instruments, deposits or other regulated products. Its rules on asset-referenced tokens (ARTs) and e-money tokens (EMTs) have applied since 30 June 2024, and the remainder, including authorisation of crypto-asset service providers (CASPs) and the rules on other crypto-assets, since 30 December 2024. In Germany, BaFin is the competent authority, and the KMAG contains the supervisory powers, sanctions and procedural rules that complement the directly applicable regulation.

CASP authorisation covers services such as custody and administration of crypto-assets on behalf of clients, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution and reception and transmission of orders, placing, advice, portfolio management and transfer services. An authorised CASP can passport its services across the EU. Applicants must meet requirements on minimum capital, governance, fit and proper management, safekeeping of client assets, complaints handling, conflicts of interest, outsourcing and wind-down planning. Crypto-asset service providers are also within the scope of DORA, so their ICT risk frameworks must meet the same standards as those of other financial entities.

Providers that were operating under national law before 30 December 2024 could continue under a transitional regime until 1 July 2026 or until they were granted or refused authorisation, whichever was sooner (Article 143(3) MiCAR). That period has now ended, so any provider serving clients in the EU must have MiCAR authorisation or rely on another provider's licence. Offering crypto-assets to the public generally requires a crypto-asset white paper that is notified to the competent authority and published, with liability for its content.

Stablecoins

E-money tokens, which reference a single official currency, may only be issued by credit institutions or e-money institutions, and holders have a claim for redemption at par at any time. Asset-referenced tokens, which reference a basket of assets or currencies, require a specific authorisation and are subject to reserve, governance and disclosure requirements. Significant tokens are supervised by the European Banking Authority. Businesses that use stablecoins in payment flows must also consider whether their own activity amounts to a payment service or a crypto-asset service.

Tokenisation and electronic securities

Germany allows securities to be issued without a physical certificate under the Electronic Securities Act (Gesetz über elektronische Wertpapiere, eWpG). Electronic securities can be registered in a central register maintained by a central securities depository or custodian, or in a crypto securities register maintained on a distributed ledger by a licensed registrar. The scope of the Act covers bearer bonds and, following the Future Financing Act, registered shares and certain bearer shares (§ 1 eWpG). Running a crypto securities register is a regulated financial service.

Tokenised bonds have been issued by banks, corporates and public issuers, often in pilot projects that also test settlement in central bank money or tokenised cash. The EU's DLT Pilot Regime allows market infrastructures to operate trading and settlement systems for tokenised instruments with targeted exemptions. For issuers, the legal questions are the same as for conventional securities (prospectus, disclosure, market abuse, investor protection), plus the technical and legal robustness of the register, the treatment of private keys and the allocation of liability between registrar, issuer and custodian. See our page on capital markets for the general framework.

Partnerships, banks and embedded finance

Many fintech and crypto businesses operate without their own full licence by partnering with a licensed bank, payment institution or CASP. In "banking as a service" models, the licensed partner provides accounts, cards, lending or custody under its licence while the fintech designs the product and manages the customer interface. Embedded finance brings payment, lending and insurance features into non-financial platforms, such as e-commerce marketplaces, software providers and mobility services.

These models depend on careful allocation of roles. The licensed partner remains responsible to the supervisor and must control the fintech as an outsourcing provider or agent: it needs audit and instruction rights, data access, exit arrangements and assurance on anti-money laundering processes. The fintech must ensure that its own activities do not themselves require a licence, for example because it receives client funds, gives investment advice or brokers loans. Commercial terms should address revenue sharing, customer ownership, data use, liability for compliance failures and what happens if the partner terminates or loses its licence.

• Map each step of the customer journey to the regulated party responsible for it.
• Do not touch client funds unless licensed or clearly exempt.
• Negotiate exit and migration rights so that customers can be moved to a new partner.
• Align marketing with the partner's licence: do not describe services as your own if they are not.

Lending and crowdfunding platforms

Online lending platforms usually do not lend themselves. In the common German model, a partner bank grants the loans and sells the receivables to investors or to the platform, while the platform brokers the loans and services them. Loan brokerage to consumers requires a trade licence and is subject to consumer credit rules, and receivables purchases can themselves be regulated factoring. Investment-based and lending-based crowdfunding for business projects falls under the EU Crowdfunding Regulation, which requires authorisation of the platform as a crowdfunding service provider and offers an EU passport, with investor protection rules such as entry knowledge tests and key investment information sheets.

Neo-brokers and digital wealth management

Trading apps, robo-advisers and digital wealth managers provide investment services and need a licence under the WpIG or operate as tied agents of a licensed firm. They must comply with MiFID II conduct rules on suitability or appropriateness, product governance, best execution and costs disclosure. Business models based on payments for order flow have come under regulatory scrutiny at EU level, and gamification features and the marketing of complex products to retail clients attract BaFin's attention.

AML, data and resilience for fintech and crypto

Fintech and crypto firms that are regulated as financial institutions are obliged entities under the Money Laundering Act (GwG). They must identify and verify customers, determine beneficial owners, apply enhanced due diligence to high-risk cases, monitor transactions and report suspicious activity. For crypto-asset transfers, the EU Transfer of Funds Regulation extends the "travel rule" so that information on the originator and beneficiary accompanies transfers between providers. The EU's new AML Regulation and the Anti-Money Laundering Authority will tighten and harmonise these obligations further.

Data protection is equally central. Payment and account data are personal data subject to the GDPR, and open banking access must respect both PSD2 and GDPR principles. Digital operational resilience under DORA, which has applied since 17 January 2025, covers payment institutions, e-money institutions and CASPs, requiring ICT risk management, incident reporting, resilience testing and management of ICT third-party providers. See our pages on GDPR and German data protection law and cybersecurity.

Consumer protection rounds out the picture. Consumer credit, buy-now-pay-later products and payment services are subject to detailed information duties and withdrawal rights under the BGB, and BaFin can act against practices that harm consumers collectively. Marketing of crypto-assets must be fair, clear and not misleading and must be consistent with the white paper. Influencer campaigns and referral schemes are marketing communications for these purposes, and the provider remains responsible for their content.

Investing in fintech and crypto companies

Investors in regulated fintech and crypto companies must consider owner control: acquiring 10% or more of a payment institution, e-money institution, investment firm or CASP generally requires prior notification to and assessment by BaFin, with further thresholds at 20%, 30% and 50%. Financing rounds and secondary sales must be planned around this procedure. Regulatory due diligence should cover the licence scope, open supervisory findings, AML and outsourcing frameworks, safeguarding of client funds and the robustness of partner bank relationships. Our page on venture capital explains the corporate side of financing rounds.

Valuations of fintech and crypto companies depend heavily on regulatory status. A pending licence application, an unresolved supervisory finding or dependence on a single partner bank are value-relevant risks that should be reflected in warranties, conditions or price. Conversely, a licence with an EU passport can be a significant asset in its own right, which explains the market for acquisitions of licensed entities as a route to market entry.

How TRW & Co helps

We advise fintech and crypto companies, banks and investors on the regulation of payment, lending, investment and crypto-asset business in Germany. We analyse business models against the licensing triggers in the ZAG, KWG, WpIG and MiCAR, request binding views from BaFin, prepare licence and CASP authorisation applications, and draft white papers and terms of use. We structure and negotiate banking-as-a-service and embedded finance partnerships, advise on tokenisation under the eWpG, and set up AML, outsourcing and DORA frameworks. For investors we conduct regulatory due diligence and owner control filings. To discuss a product or a licence question, please contact us.