Germany: Crypto Licensing

Crypto Licensing

BaFin's refusal of futurum bank AG's MiCAR crypto-asset service provider (CASP) authorisation application is the material licensing event of this cycle for Germany. The application, filed 27 June 2025, was refused in a decision disclosed on 6 October 2026, more than fifteen months after filing. Notably, the public record for this refusal currently rests entirely on Bitcoin Group SE's own mandatory ad-hoc disclosure as futurum bank's parent; no BaFin-published primary enforcement or decision notice has been independently located for this specific refusal as of this cycle. This is an evidentiary gap worth flagging explicitly: the fact of the refusal is well-attested through a regulated issuer's own disclosure obligations, but the detailed grounds for refusal are not yet independently confirmed from the regulator's own published record.

The refusal ends the toleration (Duldung) arrangement under which futurum bank had continued to provide crypto-asset services, chiefly via the Bitcoin.de platform, while its authorisation application remained pending. This toleration mechanism itself reflects a specific feature of Germany's implementation of the MiCA transition: Germany shortened its own national grandfathering period under MiCA Article 143(3) to end on 31 December 2025, six months ahead of the EU's outer limit of 1 July 2026, after which unauthorised provision of CASP services becomes unlawful in Germany. Exact citation to the specific national legislative provision fixing this earlier date (within the KMAG/FinmadiG package) has not been independently verified against the statutory text this cycle, and this remains sourced to a secondary legal-commentary source rather than the primary instrument itself.

The underlying licensing framework itself remains unchanged and well-settled: crypto-asset services in Germany require either BaFin authorisation under MiCAR Article 59 or a valid notification under Article 60 for entities already authorised in an equivalent regulated capacity elsewhere. This is a standing EU-wide standard applied consistently through BaFin's own published guidance, and nothing in this cycle's events alters that baseline. What has changed is the demonstrated consequence of that framework reaching the end of a national transition period: a platform carrying more than 1.1 million registered users has now had its toleration arrangement withdrawn following an unsuccessful authorisation application, converting what had been a theoretical end-of-transition risk into an observed regulatory outcome.

Outlook

Two specific procedural developments would materially change how this refusal should be read going forward. First, whether futurum bank has lodged, or lodges, a formal appeal (Widerspruch) against the refusal within the one-month window typically available under German administrative procedure; this was not established as of this cycle. Second, whether BaFin publishes its own primary notice regarding the refusal and its grounds, which would substantially strengthen an evidentiary record that currently depends on a single corporate disclosure. Absent either development, the refusal's precise legal and factual basis remains less transparent than its commercial consequences would suggest is warranted.

Crypto Licensing

Germany's national transitional arrangement for crypto-asset service providers has closed. Under KMAG Section 50, the national grandfathering protection ('Bestandsschutz') available to pre-MiCA crypto-asset service providers expired at the latest on 31 December 2025, a date set deliberately ahead of the EU-wide outer limit of 1 July 2026 permitted under MiCA Art 143(3). This means that, as of this cycle, any crypto-asset service provider continuing to operate in Germany must hold either a full MiCA CASP authorisation issued by BaFin or a valid passport obtained from another EU or EEA member state; there is no longer a national fallback legal basis available to firms that have not completed one of those two routes.

The authorisation regime itself carries a tiered capital structure under MiCA Art 59, as implemented by BaFin. Class 1 authorisation, covering the most basic crypto-asset services, requires minimum own-funds capital of EUR 50,000. Class 2 authorisation, which extends to custody and administration of crypto-assets on behalf of clients and to exchange services, requires EUR 125,000. Class 3 authorisation, which extends further to the operation of a trading platform for crypto-assets, requires EUR 150,000. This graduated structure ties the capital requirement directly to the risk and complexity of the licensed activity, with custody and trading-platform operation treated as materially higher-risk than basic Class 1 services.

Secondary reporting associates Germany's earlier-than-EU-mandated transitional cutoff with a resulting concentration of CASP authorisations: Germany is reported to hold the largest population of MiCA CASP authorisations in the EEA as of September 2026. The precise figure is not settled; cited counts range from approximately 53 to approximately 91 depending on the source and date consulted, and neither figure has been checked against the European Securities and Markets Authority's own CASP register this cycle. This divergence should be read as a research-completeness gap rather than as evidence of instability in the underlying licensing framework itself, which appears to be functioning as a mature, in-force regime rather than one still working through transitional ambiguity.

On enforcement, BaFin holds broad powers under KMAG, including the ability to prohibit unauthorised business activity, to order searches of business premises, to order the wind-down of non-compliant operations, and to impose administrative fines. These powers position BaFin as a supervisor with meaningful operational reach over the authorised population, consistent with a mature licensing regime rather than one still reliant primarily on registration and light-touch oversight. However, the exact maximum fine amounts available under the consolidated KMAG statute text were not confirmed against primary legislative sources this cycle; this is an open verification item rather than a finding that penalty ceilings are absent or unclear in the statute itself.

Taken as a whole, Germany's crypto-licensing architecture presents as functioning and in force, with an active and apparently disproportionately large authorisation pipeline relative to its EEA peers, following a deliberately compressed national transitional timeline. The principal residual uncertainty is empirical rather than legal: how many authorisations have actually been granted, and whether BaFin's enforcement powers, while clearly defined in scope, have been exercised against the newly authorised population in a way that would establish a visible supervisory track record.

Outlook

The clearest near-term resolution path is a direct cross-check of Germany's CASP authorisation count against the European Securities and Markets Authority's own register, which would settle the approximately 53 versus approximately 91 divergence without requiring any change to the underlying legal analysis. On enforcement, the absence of confirmed penalty-ceiling figures from primary KMAG text is a gap worth closing in a future cycle, particularly given BaFin's otherwise broad confirmed enforcement toolkit. No legislative change to the licensing framework itself is indicated by the available material this cycle; Germany's transitional period has closed, and the regime should now be assessed as an established, in-force authorisation and supervision framework rather than one still in flux.

Crypto Licensing

Providing custody and administration of crypto-assets for clients on a commercial basis in Germany requires CASP authorisation under Article 59 of the Markets in Crypto-Assets Regulation (MiCAR), or a transitional permission under Section 32 of the Kreditwesengesetz (KWG), per BaFin's guidance notice on crypto-asset services under MiCAR, a confirmed-confidence finding drawn directly from BaFin's own published guidance. The pre-MiCA German crypto-custody licence under KWG Section 1(1a) (Kryptoverwahrgeschäft) is transitional under MiCA's grandfathering framework; Germany appears to have shortened its national grandfathering window relative to the EU-wide default, although secondary sources diverge on the precise cut-off date and this has not been resolved against a primary BaFin or KMAG transitional-provision citation this cycle, a genuine and flagged evidentiary gap rather than a resolved fact.

Germany's MiCA CASP authorisation count reached 79 as of an ESMA-register update reported 24 August 2026, the highest of any EU or EEA member state, up from 53 as of May 2026, a probable-confidence finding sourced to secondary trade-press reporting. This leading position reflects the conversion of Germany's large pre-existing national crypto-custody licence base into the harmonised MiCA regime, rather than an unusually permissive new-entrant pathway; the underlying authorisation process remains operationally demanding, involving substantial documentation and extended processing timeframes for applicants. The dual-track structure, MiCA/KMAG CASP authorisation layered on top of the transitional KWG Section 1(1a) custody licence, is the operative regime of record for Germany this cycle, settled in primary law but administratively demanding in practice.

Outlook

The unresolved cut-off date for KWG Section 1(1a) grandfathering is the key near-term item: it determines the compliance timeline facing Germany's remaining pre-MiCA custody licensees. Watch for a primary BaFin or KMAG citation that pins down this date definitively, and for whether Germany's CASP count continues its growth trajectory toward the next reporting update.

Crypto Licensing

Germany's MiCA implementation bridges prior national VASP licensing into the MiCA CASP regime under BaFin via FinmadiG and KMAG. The defining development this cycle is the compression of the CASP transition window: rather than the eighteen-month grandfathering period available in much of the EU, Germany has set a hard 31 December 2025 deadline for pre-MiCA BaFin licensees to complete their transition, and new market entrants must meet MiCAR requirements from day one with no grandfathering available to them at all. This is a materiality-5, binding, in-force instrument change in this cycle's evidence set, though it currently rests entirely on T3 secondary trade-press reporting (Yellow.com) rather than a located BaFin primary statement -- the absent_field_provenance register explicitly notes the lack of T1 confirmation, and that gap is treated here as a live sourcing hold rather than a settled fact.

A secondary, lower-materiality observation concerns MiCA Article 143(6), which permits simplified authorisation pathways for entities already licensed under prior national law. German firms and BaFin appear to use this pathway less aggressively than counterparts in France, a comparative posture rather than a substantive divergence in the underlying legal mechanism, and one carried at low confidence given its T4 sourcing.

The practical effect of the compressed timeline is already visible in market behaviour: at least one stablecoin issuer discontinued German operations rather than pursue MiCA authorisation domestically, a development discussed further in this cycle's stablecoin sub-brief. Read together, licensing policy and market response indicate BaFin is applying MiCA's transitional flexibility conservatively relative to peer jurisdictions, favouring a faster convergence on the harmonised EU standard over an extended national accommodation period.

Outlook

The near-term question for this module is evidentiary: whether BaFin publishes primary-source confirmation of the 12-month/31 December 2025 deadline in terms consistent with current secondary reporting. A second-order question is whether other EU member states follow Germany's compressed-timeline approach or whether Germany proves an outlier at the strict end of the transitional spectrum, a dynamic with direct bearing on where CASP licensing activity concentrates across the bloc.