Centralized exchange in Germany
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Germany with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full AML/CFT compliance under the German Money Laundering Act (GwG) — customer identification and transaction monitoring required
- Travel-rule compliance under KryptoWTransferV (Crypto Asset Transfer Regulation): originator and beneficiary identification must accompany all crypto transfers (no de minimis threshold — EUR 0)
- KYC: Verification of all transaction parties' identities required
- Ongoing CDD / transaction monitoring obligations under GwG
- Sanctions screening under Criminal Code (StGB) and applicable EU sanctions regimes
- Supervision by BaFin for all AML obligations
Key Restrictions
- Must establish a German legal entity (GmbH, AG, or bank) with proper corporate governance
- Customer asset segregation: complete separation of client and proprietary crypto assets required
- Professional liability insurance of minimum €1,000,000 covering custody service operation risks
- IT security procedures must comply with BAIT (BaFin Guidance on IT Requirements), including encryption, access controls, and incident response
- Fit-and-proper requirements: at least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business
- Capital adequacy: €125,000 minimum for custody (Kryptoverwahrgeschaeft) or €150,000 minimum for exchange/trading platform authorization under MiCA CASP
Key Risks
- BaFin is known for thoroughness and slower processing — licensing timeline may be 6-12 months or more
- Regulatory overlap: Pre-MiCA crypto custody license (KWG) and MiCA CASP authorization both apply; transition period may create ambiguity
- Non-compliance with KryptoWTransferV travel-rule obligations (EUR 0 threshold) creates enforcement risk — no small-transaction exemption
- IT security and BAIT/DORA compliance expectations are high and actively enforced
- Conservative BaFin enforcement posture — precedent of enforcement actions against unlicensed operators
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BaFin — authorises crypto-asset service providers under MiCA (KMAG § 3(1)) and licenses qualified crypto custody under KWG § 32; the ESMA interim MiCA register lists 103 entries with home state Germany as of 14 October 2026, covering both authorisations and Article 60 notifications.
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
Kreditwesengesetz (KWG) § 32 with § 1(1a) sentence 2 Nr. 6 — licence for "qualified crypto custody" (custody of crypto instruments and of keys for crypto securities, crypto fund units and DLT securities); the licence carries no EU passport, which is available only to MiCA-authorised crypto-asset service providers.
Crypto-asset service providers in Germany need a MiCA authorisation from BaFin (KMAG § 3(1)) or, for credit institutions and other listed financial firms, a MiCA Art 60 notification; the German transitional regime for pre-MiCA licensees ended at the latest on 31 December 2025 (KMAG § 50(2) Nr. 3). BaFin checks applications for completeness, sets a four-week deadline for missing documents and rejects applications still incomplete after it.
Custody and administration of MiCA crypto-assets for clients (Kryptoverwahrung, KMAG § 2(11)) is a MiCA crypto-asset service that needs BaFin authorisation and at least €125,000 minimum capital (MiCA Annex IV, Class 2); the KWG licence for crypto custody now covers only "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6).
Operating a crypto-asset trading platform in Germany requires MiCA authorisation from BaFin (KMAG § 3(1)) and at least €150,000 minimum capital (MiCA Annex IV, Class 3); exchanging crypto-assets for funds or other crypto-assets is a Class 2 service with a €125,000 minimum.
BaFin is Germany's competent authority under MiCA Art 93(1) (KMAG § 3(1)), authorising and supervising crypto-asset service providers and token issuers established in Germany, and it is the AML supervisor for crypto-asset service providers under GwG § 50 Nr. 1 b; ongoing monitoring is shared with the Deutsche Bundesbank (KMAG § 6).
German Banking Act (KWG): Since January 2020, crypto custody has been regulated as a financial service requiring a BaFin license.
Markets in Crypto-Assets Regulation (MiCAR): Applies EU-wide as of the end of 2024, establishing harmonized licensing requirements for crypto-asset service providers throughout the EU.
Safekeeping, administration, and safeguarding of crypto assets or private keys
Operation of trading platforms (cryptocurrency exchanges)
Exchange services (conversion between fiat and crypto, or between different crypto assets)
Fit-and-proper requirements: At least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business.
No German or EU primary sets a €1,000,000 minimum professional liability insurance for crypto custodians; MiCA Art 67 lets an insurance policy count towards a CASP's prudential safeguards without fixing a €1,000,000 floor.
For KWG-only qualified crypto custodians BaFin applies BAIT until 31 December 2026 and DORA (Regulation (EU) 2022/2554) from 1 January 2027; firms that also hold a MiCA authorisation as crypto-asset service provider are subject to MiCA and DORA.
Customer asset segregation: Complete separation of client and proprietary crypto assets required.
AML/CFT compliance: Full adherence to the German Money Laundering Act (GwG) with customer identification and transaction monitoring.
Know Your Customer (KYC): Verification of all transaction parties' identities.
Establishing a German legal entity (GmbH, AG, or bank) with proper corporate governance
Preparing a comprehensive business plan describing crypto custody offerings, technology platform, and security procedures
Documenting capital adequacy with €125,000 minimum through bank accounts and audited financial statements
The Geldwäschegesetz (GwG) is Germany's core AML/CFT law: since FinmadiG (BGBl. 2024 I Nr. 438) its obliged entities expressly include crypto-asset service providers and issuers of asset-referenced tokens (GwG § 2(1) Nr. 2), and BaFin is their AML supervisory authority (GwG § 50 Nr. 1 b).
Since MiCA applied on 30 December 2024, custody, exchange and trading of MiCA crypto-assets in Germany require a MiCA authorisation from BaFin under the KMAG, not a KWG licence; a KWG § 32 licence is still needed for "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6), and pre-MiCA KWG crypto licences lapsed at the latest at the end of 31 December 2025 (KMAG § 50(2) Nr. 3).
The Kryptomärkteaufsichtsgesetz (KMAG, Art 1 FinmadiG, BGBl. 2024 I Nr. 438 of 27 December 2024) implements MiCA in Germany: BaFin is the competent authority under MiCA Art 93(1) (KMAG § 3(1)), may act against unauthorised business (§§ 9–10) and may publicly announce on its website when a firm breaches its obligations (§ 4(4)).
Since 30 December 2024 the crypto travel rule in Germany is the directly applicable Regulation (EU) 2023/1113; FinmadiG added GwG § 15a, which requires enhanced due diligence for crypto transfers to or from a self-hosted address, on top of the Regulation's originator and beneficiary information duties.
Germany applies the crypto travel rule through Regulation (EU) 2023/1113 from 30 December 2024, with no minimum threshold for crypto-asset transfers; GwG § 6(4a) obliges crypto-asset service providers to ensure compliance, BaFin supervises them (GwG § 50), and transfers over EUR 1,000 to or from a self-hosted address require a check that the client owns or controls it.
Under Regulation (EU) 2023/1113, applicable in Germany since 30 December 2024, the originator's crypto-asset service provider must send with every crypto transfer the originator's name, distributed-ledger address or crypto-asset account number, and address, official document number, customer number or date and place of birth (Art 14(1)), plus the beneficiary's name and address or account (Art 14(2)).
German AML law now refers to Regulation (EU) 2023/1113 for crypto transfers: FinmadiG Art 8 defined it in GwG § 1(28) and § 1(29)–(30) and requires crypto-asset service providers to take adequate measures to ensure compliance with it (GwG § 6(4a)); Regulation 2015/847 is no longer the basis of the crypto travel rule.
Crypto Securities Transfer Regulation (KryptoTransferV): Primary law, detailed in German Federal Ministry of Finance draft (English translation via DeepL).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange (order-book with custody) may operate in Germany only after obtaining a BaFin CASP authorization under MiCA (or the existing KWG crypto custody license during transition), with a local German entity, minimum capital of €125,000–€150,000, full customer asset segregation, €1M professional liability insurance, BAIT-compliant IT security, and zero-threshold travel-rule compliance under KryptoWTransferV.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?