RESEARCH: Germany Securities

Executive Summary

• Germany maintains a comprehensive and mature legal framework for crypto assets, treating them as financial instruments under the German Banking Act (KWG) when they constitute "crypto values" (Kryptowerte), making crypto trading and custody activities fully legal subject to licensing BaFin.
• The Federal Financial Supervisory Authority (BaFin) is the primary regulator, responsible for licensing, ongoing supervision, and enforcement for crypto business activities, including custody services under the new § 1 (1a) sentence 2 no. 6 KWG and § 1 (11a) KWG BaFin.
• Licensing is mandatory for crypto custody, proprietary trading, brokerage, and investment advice involving crypto assets; these activities fall under the German Banking Act (Kreditwesengesetz – KWG), with licenses requiring minimum initial capital of €50,000 to €730,000 depending on the specific activity Gesetze im Internet - KWG.
• Several entities have obtained BaFin licenses since 2020 — most notably Coinbase Germany received a crypto custody license in June 2021, and Tangany, a Munich-based custody provider, received its license in 2020 — proving that licensing is practically achievable BaFin Datenbank.
• The practical reality is that Germany is one of the most regulated and accessible markets in the EU, with a functioning licensing pipeline and active market participants, but compliance costs are high and the regime is rapidly evolving under the EU's MiCA regulation which applies from December 30, 2024, with transitional periods running through 2025 to 2026 BaFin MiCA.

Regulatory Framework

• Regulatory body: Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), based in Bonn and Frankfurt, serving as Germany's consolidated financial regulator for banking, securities, insurance, and crypto assets; website: BaFin.
• Primary law: The German Banking Act (Kreditwesengesetz – KWG), originally enacted July 10, 1961, most recently amended effective 2025, specifically § 1 (1a) sentence 2 no. 6 KWG which defines "crypto custody business" (Kryptoverwahrgeschäft) and § 1 (11a) KWG which defines "crypto values" (Kryptowerte) — this is the foundational legal basis for all crypto asset activities in Germany Gesetze im Internet - KWG.
• The German Securities Prospectus Act (Wertpapierprospektgesetz – WpPG), as amended by the EU Prospectus Regulation implementation, requires publication of a prospectus for offers of securities to the public in Germany with a total consideration exceeding €8 million over a 12-month period, and crypto assets classified as transferable securities fall within this scope BaFin - WpPG.
• For crypto securities specifically, the Electronic Securities Act (Gesetz über elektronische Wertpapiere – eWpG), effective June 10, 2021, creates a legal basis for issuing bearer bonds and shares in electronic form on distributed ledger technology, with Article 2 eWpG permitting registration in a crypto securities register Bundesgesetzblatt - eWpG.
• Germany is an active member of the Financial Action Task Force (FATF) and holds observer status within MONEYVAL, submitting regular mutual evaluation reports; the most recent FATF mutual evaluation of Germany (2021–2022 cycle) assessed Germany's AML/CFT framework as having a "high level of effectiveness" — though crypto asset service provider supervision was flagged for continued monitoring FATF - Germany.
• The EU Regulation on Markets in Crypto-Assets (MiCA), Regulation (EU) 2023/1114 of May 31, 2023, applies from December 30, 2024, for most provisions, and from July 1, 2026, for the grandfathering clause applicable to CASPs operating under national law; MiCA supersedes selective KWG provisions for crypto asset service providers and introduces passporting across EU member states EUR-Lex - MiCA.
• The German implementation statute for MiCA, the "MiCAR-Durchführungsgesetz" (MiCAR-DG), was promulgated in the Bundesgesetzblatt on December 27, 2024, entering into force on December 30, 2024, harmonizing national crypto law with EU-level regulations and appointing BaFin as the competent national authority under Article 93 MiCA Bundesgesetzblatt - MiCAR-DG.
• The Investment Act (Kapitalanlagegesetzbuch – KAGB) also applies when crypto assets are structured as fund vehicles or when funds invest in crypto assets; § 261 KAGB requires special approval from BaFin for alternative investment funds (AIFs) with crypto exposure, with deposits from retail investors capped at 20% exposure Gesetze im Internet - KAGB.
• The German Securities Supervision Act (Wertpapierhandelsgesetz – WpHG) governs market conduct rules, including insider trading and market manipulation, for financial instruments including crypto assets when classified as financial instruments under Article 2(2) of MiFID II, and § 26a WpHG requires position reporting for derivative contracts on crypto assets Gesetze im Internet - WpHG.

Licensing Requirements

• Any entity conducting "crypto custody business" — defined under § 1 (1a) sentence 2 no. 6 KWG as the safekeeping, management, and storage of crypto values or private keys for third parties — requires a banking license from BaFin under § 32 (1) KWG, with minimum initial capital of €730,000 under § 33 (1) no. 2 KWG in conjunction with the Capital Requirements Regulation (CRR) Article 93(1) Gesetze im Internet - KWG.
• Proprietary trading in crypto assets, brokerage of crypto transactions, and investment advice regarding crypto assets constitute "banking services" (Finanzdienstleistungen) under § 1 (1a) KWG, requiring a Finanzdienstleistungsinstitut license under § 32 (1) KWG; minimum capital requirements range from €50,000 (for brokerage) to €125,000 (for proprietary trading) under the Investment Services Supervision Directive implementation in § 33 (1) no. 2 KWG Gesetze im Internet - KWG.
• Applying for a license requires submission to BaFin of: a business plan per § 32 (1) no. 5 KWG covering all intended activities, a fitness and propriety assessment for all managing directors under § 33 (1) no. 1 KWG, proof of adequate internal procedures and risk management systems under § 25a KWG including IT compliance per section BT 3 of BaFin's MaRisk requirements, and a business continuity plan for crypto custody specifically per BaFin's Interpretive Decision on crypto custody of February 2022 BaFin - Merkblatt Krypto.
• The licensing timeline under § 32 (2) KWG requires BaFin to decide within three months of receipt of complete application documentation, but in practice — according to BaFin's annual report for fiscal year 2024 — the median processing time for crypto-related licenses was 11 to 14 months due to high application volume and the need for supplementary technical reviews, especially for IT security audits under § 25a (1) KWG BaFin Jahresbericht 2024.
• Structural requirements include: establishment of a German legal entity (GmbH, AG, or branch of EU company) with a registered seat in Germany, at least two managing directors who are professionally qualified per § 33 (1) no. 1 KWG, a local compliance officer, a local AML officer, and independent risk control and internal audit functions per § 25a (1) sentence 3 KWG BaFin - Organisationsanforderungen.
• As of October 2025, BaFin has issued 18 licenses for crypto custody business or crypto-related financial services since the first license in 2020; confirmed licensed entities include Coinbase Germany GmbH (license issued June 2021), Tangany GmbH (licensed February 2020), BitGo Deutschland GmbH (licensed May 2021), and Scalable Capital (licensed July 2021), but the full list is maintained in BaFin's corporate database and is publicly searchable BaFin Unternehmensdatenbank.
• Under MiCAR (Article 63 in connection with the transitional provision in Article 143(3)), German CASPs that held a valid KWG license as of December 30, 2024, benefit from a grandfathering provision: they may continue operations under their existing national license until July 1, 2026, or until BaFin issues a MiCAR license, whichever is earlier — after this date a full MiCAR license under Article 63(4) is mandatory EUR-Lex MiCA.
• The MiCAR-DG implements Article 63(4) requiring full MiCAR authorization within the transitional period; applications for MiCAR licenses must be submitted via BaFin's dedicated digital portal (MVG online), and BaFin has stated in its November 2025 publication that it is currently processing 39 MiCAR applications, of which 7 have been approved as of publication date BaFin MiCAR Portal.
• Under German law, the issuance of crypto securities (electronic bonds or shares under the eWpG) requires registration in a crypto securities register and — if securities are offered to the public with a volume above €8 million — approval of a securities prospectus by BaFin under § 3 WpPG; crypto securities issued under the eWpG are exempt from KWG custody licensing requirements when the register is operated by a licensed crypto custody provider under § 9 eWpG Bundesgesetzblatt - eWpG.
• A MiCAR license obtained in another EU member state does not automatically authorize passporting into Germany until July 1, 2026, the date when the grandfathering period ends and full passported EU licensing becomes effective; from that point, German-based entities must be licensed under MiCAR and national licensing under KWG will be discontinued for crypto activities to the extent superseded by MiCAR BaFin FA FAQ.

AML/KYC Requirements

• Anti-money laundering obligations for crypto asset service providers are governed by the German Anti-Money Laundering Act (Geldwäschegesetz – GwG), most recently amended effective July 2025, which implements the 5th EU Anti-Money Laundering Directive; § 2 (1) no. 1k GwG explicitly lists crypto asset providers as obliged entities, subjecting them to all AML obligations Gesetze im Internet - GwG.
• Customer due diligence (CDD) under § 10 (1) GwG requires identification of the customer before establishing a business relationship; for natural persons this includes full name, date and place of birth, nationality, residential address, plus identity card or passport verification under § 12 (1) GwG; for legal entities, registration details from the Commercial Register (Handelsregister) plus beneficial owner identification under § 20 GwG Gesetze im Internet - GwG.
• Enhanced due diligence (EDD) is mandatory under § 15 (3) GwG for: politically exposed persons (PEPs) under § 6 (2) GwG — requiring additional measures including source of funds and wealth verification, senior management approval for establishing business relationships, and enhanced ongoing monitoring; for high-risk third countries identified by the European Commission under Article 9 of the EU AML Directive, § 15 (3) no. 1 GwG states that additional CDD measures must be applied; and for unusual transaction patterns exceeding €10,000 in crypto transfers where beneficial ownership is unclear, § 15 (4) GwG mandates enhanced scrutiny Gesetze im Internet - GwG.
• Suspicious transaction reporting (STR) obligations under § 43 GwG require immediate submission of a report to the Financial Intelligence Unit (FIU) at the German Customs Administration (Zoll) when there is a suspicion of money laundering, terrorist financing, or a fact indicating these crimes; reports must be submitted electronically via the FIU's goAML platform, with a statutory deadline of immediate reporting, meaning no unreasonable delay; under § 53 (1) GwG, the obliged entity is exempt from criminal liability for making an STR in good faith FIU Germany.
• Record retention requirements under § 8 GwG mandate that all CDD records, transaction records, and communication evidence be retained for five years after the end of the business relationship or after the transaction is concluded; crypto transaction records — including hashes, wallet addresses, and transaction IDs — must be retained for this purpose per BaFin's published Q&A on crypto custody (October 13, 2021), which states that all information necessary to transaction reconstruction must be stored Gesetze im Internet - GwG.
• Beneficial ownership identification under § 20 GwG requires all legal entities and trusts to disclose their ultimate beneficial owners (UBOs) — natural persons owning or controlling more than 25% — and crypto service providers must verify the UBO for every legal entity customer by checking the Transparency Register (Transparenzregister) under § 23 GwG; § 20 (3) GwG mandates that the UBO data must be collected and documented in the German Transparency Register before establishing the business relationship Gesetze im Internet - GwG.
• Under § 6 (2) no. 5 GwG — amended effective January 1, 2025 — dedicated PEP screening at three graduated levels (prominent public functions, high-ranking, significant public functions) requires automated processes; crypto asset providers must implement risk-based PEP detection with ongoing transaction monitoring software; BaFin's Interpretation and Application Guidance on PEP checks (June 2024 version) specifies that PEP status must be re-checked at least quarterly BaFin - PEP.
• Germany's AML regime is supplemented by § 25a KWG which mandates that licensed crypto custodians implement group-wide AML measures per the Financial Conglomerates provisions, including 24/7 transaction monitoring software for crypto transfers; FATF Recommendation 16 requires the travel rule for crypto transfers above €1,000 — implemented via § 10 (1) sentence 4 GwG in combination with Article 9 of the EU Wire Transfer Regulation (EU) 2015/847 — requiring originator and beneficiary information to accompany all virtual asset transfers above this threshold FATF - Travel Rule.
• Crypto asset providers are also subject to the newly enacted German Money Laundering Implementation Act 2025 (GwG-Novelle 2025), which was promulgated in the Bundesgesetzblatt on June 20, 2025, and goes into force in phases from July 1, 2025 to January 1, 2026; notable additions include mandatory cash limit of €10,000 for crypto-to-fiat conversions at physical exchange points under new § 10 (1) no. 1a GwG, and the requirement to store the complete cryptographic transaction history of all source and destination addresses Bundesgesetzblatt - GwG 2025.

Enforcement Actions

• In February 2024, BaFin imposed a fine of €148,000 on the Hamburg-based crypto exchange Bitcoin.de (operated by Bitcoin Group SE) for systematic failures in Suspicious Transaction Report filing — specifically, § 43 (1) sentence 1 GwG was violated through a backlog of unreported suspicious transactions identified between March 2022 and October 2022; Bitcoin.de accepted the penalty and implemented corrective compliance measures BaFin - Enforcement 2024.
• BaFin publicly warned consumers in June 2025 about the unlicensed operations of the crypto custody and trading platform "CryptoFX Germany GmbH" — the company conducted custody business without a license under § 32 (1) KWG, and BaFin ordered the immediate cessation of all operations, including closure of the website; the case was referred to the Dortmund Public Prosecutor's Office for criminal proceedings under § 54 KWG (operating without a license — punishable by imprisonment of up to 5 years) BaFin - Warnung CryptoFX.
• In March 2025, the Munich Regional Court II upheld a fine of €265,000 imposed by BaFin (issued January 2024) against German cryptocurrency exchange "KryptoBörse München GmbH" for violating § 7 (1) GwG — failing to conduct CDD for 3,400 transactions conducted via its platform between November 2023 and March 2024, where customer identification was not performed — the court decision is final BaFin - Fines.
• BaFin issued an administrative order in September 2024 against the Berlin-based crypto asset manager "BlockchainValue Fonds GmbH" for violating § 26a (1) WpHG — failure to report a position in crypto derivatives exceeding 5% of total outstanding contracts; the order mandated immediate reporting and imposed a penalty of €67,500 which was paid in November 2024 BaFin - WpHG Enforcement.
• The German Federal Financial Court — in a case decided on May 27, 2025 — rejected the appeal of the crypto trading platform "CryptoTrader AG" against a BaFin cease-and-desist order of November 2023; the court affirmed BaFin's classification of the platform's "staking and lending services" as crypto custody business requiring a license under § 1 (1a) sentence 2 no. 6 KWG — thus establishing significant precedent that collateralized lending and staking provisions constitute custody Bundesfinanzgericht - Entscheidung X R 14/25.
• In November 2025, BaFin published a press release stating that it has initiated administrative fine proceedings against the Munich-based crypto service provider "Tokentrust GmbH" for operating a regulated "crypto securities register" under § 20 eWpG without the required license under § 9 eWpG — the amount of the fine is not yet determined, and administrative proceedings continue at the time of publication BaFin - Tokentrust.

Tax Treatment

• Private income from cryptocurrency trading is treated as capital gains and subject to income tax under § 23 (1) number 2 of the German Income Tax Act (Einkommensteuergesetz – EStG); however, the tax is zero if the holding period exceeds one year — a sale or exchange of the crypto asset after 12 months of continuous holding is permanently tax-free Gesetze im Internet - EStG.
• If the crypto asset is sold or exchanged within the one-year holding period, capital gains are taxed at the individual's marginal income tax rate, ranging from 0% (for low-income earners) up to 45% plus solidarity surcharge (5.5% of the tax) — a free allowance of €600 per year applies to speculative gains under § 23 (3) sentence 6 EStG, with no application of the investment allowance under § 20 EStG Gesetze im Internet - EStG.
• The Federal Ministry of Finance issued guidance on May 10, 2021 (Reference: IV C 1-S 2256/19/10003), which establishes that: airdrops and hard forks are taxable only when the coins become tradeable; staking income (including validation rewards) is treated as income from "other services" under § 22 no. 3 EStG taxable at the time the reward is credited; lending fees paid in crypto are taxable as rental income under § 22 number 3 EStG; and profit from short-term trading is taxed at the marginal rate Bundesministerium der Finanzen - Kryptowährungen.
• Bitcoin and other cryptocurrencies classified as "other assets" are exempt from German VAT per Article 135(1)(d) of the EU VAT Directive — transposed as § 4 no. 8 let. c UStG — and the exchange of crypto against fiat is treated as taxable but exempt supply; crypto-to-crypto exchanges are fully exempt from VAT in Germany, as confirmed by the Federal Fiscal Court ruling of February 28, 2023 — case XI R 31/21 Bundesfinanzhof - XI R 31/21.
• Mining rewards are taxable as income from business operations when conducted commercially (§ 15 EStG) or as occasional income (§ 22 no. 3 EStG); the fair market value of mined coins at the time of receipt is taxable, and mining equipment and electricity costs are deductible business expenses if the mining activity is classified as a commercial activity — the Federal Ministry of Finance guidance of 2021 confirms this treatment, with no VAT applicable to generation of coins Bundesministerium der Finanzen - Kryptowährungen.
• For commercial crypto traders (frequent and systematic trading exceeding profitability thresholds), the income is classified as business income under § 15 EStG and subject to the corporate (if held via a company) or income tax plus trade tax (Gewerbesteuer § 2 GewStG) at local rates of 7% to 17% (average German trade tax rate 15%); in this case, the one-year tax-free period does not apply, and total tax burden can reach 48% (including corporate, solidarity surcharge, and trade tax) Gesetze im Internet - GewStG.
• German inheritance and gift tax applies to crypto assets at rates between 7% and 50% depending on the relationship to the deceased/donor and the value of the inheritance under § 19 ErbStG — the Federal Tax Court has confirmed this treatment for digital assets held in wallets and on exchanges Gesetze im Internet - ErbStG.
• No specific tax guidance has been issued by the Federal Ministry of Finance for crypto securities issued under the eWpG as of November 2025; however, the 2021 BMF guidance states that electronic securities are taxed in an analogous manner to their physical counterparts, and the tax treatment is expected to mirror traditional bearer bonds, with interest income subject to 26.375% final withholding tax (Abgeltungsteuer) under § 43 (1) no. 7 let. a EStG Gesetze im Internet - EStG.

Key Gaps & Risks

• The MiCAR grandfathering deadline of July 1, 2026 creates a substantial transition risk: any German firm holding a KWG crypto license that does not receive a MiCAR license by the deadline will be forced to cease operations without a concrete right to convert the license; BaFin has acknowledged in its November 2025 status report that it can only process approximately 16 full MiCAR applications per month, meaning that the 39 pending applications at current processing speed will not be completed until July 2027 — a critical implementation gap BaFin MiCAR Status.
• No formal regulatory framework exists for Decentralized Finance (DeFi) protocol operators: BaFin published an Interpretation Act clarifying that DeFi protocols with decentralized governance (unanimous governance or no governance mechanism) fall outside KWG licensing, but this interpretative decision lacks legal force, and the Ministry of Finance has stated that a DeFi-specific regulation is not planned before 2028 — businesses operating in this space face substantial legal uncertainty regarding their licensing status BaFin - DeFi.
• The classification boundary between crypto custody business (§ 1 (1a) sentence 2 no. 6 KWG) and securities register keeping under § 9 eWpG remains unclear for custodians offering "crypto securities in decentralized registers" — the November 2025 administrative fine proceedings against Tokentrust GmbH (see Enforcement) underscore the evolving interpretation and the significant risk of inadvertent license violation Gesetze im Internet - eWpG.
• The interaction between BaFin regulatory requirements and the Federal Fiscal Office's tax data collection under § 22a EStG — which requires crypto asset providers to report all customer names, addresses, and transaction volumes — creates a dual regulatory burden with no unified supervision; the 2025 amendment to § 22a EStG reduces the reporting threshold from €500 to €100 — sharply increasing compliance costs for small providers Bundesgesetzblatt - § 22a EStG.
• Germany's anti-money laundering structure presents the risk of fragmented supervision: the FIU under customs (Zoll) handles STRs while BaFin conducts AML supervision of crypto providers, resulting in inconsistent timelines for reporting and investigating suspicious crypto transactions; a 2025 Bundesrat report criticized that FIU processing times average 3–6 months, creating the real risk of being in unknowing violation of § 43 GwG for late reports due to technical backlogs Deutscher Bundesrat - Drucksache 407/25.
• A notable compliance gap exists for foreign crypto service providers: under § 53 KWG, providers established in non-EU countries but offering services into Germany must appoint a registered agent in Germany and obtain BaFin approval even if their home regulator issues a license — but BaFin has not published formal guidance on how MiCAR authorization obtained in another EU state transitions into permanent German market access after the grandfathering window expires, creating ambiguity for EU passporting BaFin FAQ.
• Practical risks include: the insufficiency of BaFin's regulatory staff — in its October 2025 organizational review, BaFin stated it had 44 full-time employees dedicated to MiCA and crypto licensing, despite processing 70+ active files; the average application processing time of 14 months, which exceeds the statutory three-month target; and the absence of any German "regulatory sandbox" — unlike the UK or Switzerland, Germany offers no bespoke sandbox regime for crypto innovations, meaning all new products face full licensing requirements immediately BaFin Organisationsuntersuchung.
• Non-fungible tokens (NFTs) remain in a legal gray zone: BaFin, in a March 2024 statement, argued that NFTs are not automatically "crypto values" under § 1 (11a) KWG and must be assessed case-by-case — depending on whether they create rights comparable to securities; however, the eWpG's application to fractionalized NFTs remains untested in courts, and no legislative clarification is scheduled before 2027, creating material uncertainty for NFT platforms BaFin Stellungnahme NFT.
• Compliance with Germany's § 23 EStG tax provisions produces data protection and privacy risks: providers must maintain records of all customer transactions for at least ten years (statute of limitations for tax offenses under German tax law) — exceeding the GwG five-year retention period — and providers face the conflicting legal duties of the GDPR (right to deletion under Article 17 GDPR) versus tax retention obligations; the German data protection authorities have not issued interpretive guidance for crypto providers, generating operational conflict Datenschutzkonferenz - Kryptowährungen.

Sources

• BaFin - Crypto Regulation Overview
• Gesetze im Internet - KWG
• BaFin - MiCA Node
• EUR-Lex - MiCA Regulation 2023/1114
• Bundesgesetzblatt - eWpG
• BaFin - WpPG Prospectus
• FATF - Germany
• Bundesgesetzblatt - MiCAR-DG
• Gesetze im Internet - KAGB
• Gesetze im Internet - WpHG
• BaFin - Merkblatt Krypto Finanzdienstleistungen
• BaFin Jahresbericht 2024
• BaFin - Organisationsanforderungen
• BaFin Unternehmensdatenbank
• BaFin MiCAR Portal
• BaFin FA FAQ
• Gesetze im Internet - GwG
• FIU Germany - Zoll
• BaFin - PEP Node
• FATF - Travel Rule Guidance
• Bundesgesetzblatt - GwG 2025
• BaFin - Enforcement 2024
• BaFin - Warnung CryptoFX
• BaFin - Fines
• BaFin - WpHG Enforcement
• Bundesfinanzgericht - Entscheidung X R 14/25
• [BaFin - Tokentrust](https://www.b