DeFi protocol frontend in Germany
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Germany with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- KYC/identity verification required under GwG (German Money Laundering Act) for all transaction parties
- Travel rule compliance under KryptoWTransferV — originator and beneficiary identification on crypto transfers
- Transaction monitoring and suspicious activity reporting to FIU (Financial Intelligence Unit)
- Full AML/CFT program per GwG obligations for CASPs
- Customer identification and due diligence measures applied at onboarding
Key Restrictions
- Frontend operator likely requires a CASP authorization under MiCA or existing KWG crypto custody license if it controls private keys / facilitates transactions
- Must establish a German legal entity (GmbH, AG, or bank) with proper corporate governance
- If the frontend merely provides non-custodial access to permissionless protocols without fee-taking or active transaction facilitation, it may fall outside regulated activity — significant regulatory ambiguity
- Fee-taking (commission, spread, gas markup) likely triggers CASP classification and licensing requirement
- Geofencing / blocking of German residents may be required to avoid falling under BaFin's jurisdiction if unlicensed
Key Risks
- High enforcement risk: BaFin has a track record of issuing public warnings and enforcement actions against unlicensed crypto operators targeting German residents
- Regulatory ambiguity: no clear safe harbor for non-custodial DeFi frontends — BaFin assesses activities on a case-by-case basis
- If the frontend also engages in proprietary trading, market making, or order routing, additional licensing triggers may apply (MiFID/MiCA overlap)
- Tax reporting obligations for German-resident users may create compliance complexity for the operator
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BaFin — authorises crypto-asset service providers under MiCA (KMAG § 3(1)) and licenses qualified crypto custody under KWG § 32; the ESMA interim MiCA register lists 103 entries with home state Germany as of 14 October 2026, covering both authorisations and Article 60 notifications.
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
Kreditwesengesetz (KWG) § 32 with § 1(1a) sentence 2 Nr. 6 — licence for "qualified crypto custody" (custody of crypto instruments and of keys for crypto securities, crypto fund units and DLT securities); the licence carries no EU passport, which is available only to MiCA-authorised crypto-asset service providers.
Crypto-asset service providers in Germany need a MiCA authorisation from BaFin (KMAG § 3(1)) or, for credit institutions and other listed financial firms, a MiCA Art 60 notification; the German transitional regime for pre-MiCA licensees ended at the latest on 31 December 2025 (KMAG § 50(2) Nr. 3). BaFin checks applications for completeness, sets a four-week deadline for missing documents and rejects applications still incomplete after it.
Custody and administration of MiCA crypto-assets for clients (Kryptoverwahrung, KMAG § 2(11)) is a MiCA crypto-asset service that needs BaFin authorisation and at least €125,000 minimum capital (MiCA Annex IV, Class 2); the KWG licence for crypto custody now covers only "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6).
Operating a crypto-asset trading platform in Germany requires MiCA authorisation from BaFin (KMAG § 3(1)) and at least €150,000 minimum capital (MiCA Annex IV, Class 3); exchanging crypto-assets for funds or other crypto-assets is a Class 2 service with a €125,000 minimum.
BaFin is Germany's competent authority under MiCA Art 93(1) (KMAG § 3(1)), authorising and supervising crypto-asset service providers and token issuers established in Germany, and it is the AML supervisor for crypto-asset service providers under GwG § 50 Nr. 1 b; ongoing monitoring is shared with the Deutsche Bundesbank (KMAG § 6).
German Banking Act (KWG): Since January 2020, crypto custody has been regulated as a financial service requiring a BaFin license.
Markets in Crypto-Assets Regulation (MiCAR): Applies EU-wide as of the end of 2024, establishing harmonized licensing requirements for crypto-asset service providers throughout the EU.
Establishing a German legal entity (GmbH, AG, or bank) with proper corporate governance
Know Your Customer (KYC): Verification of all transaction parties' identities.
AML/CFT compliance: Full adherence to the German Money Laundering Act (GwG) with customer identification and transaction monitoring.
The Geldwäschegesetz (GwG) is Germany's core AML/CFT law: since FinmadiG (BGBl. 2024 I Nr. 438) its obliged entities expressly include crypto-asset service providers and issuers of asset-referenced tokens (GwG § 2(1) Nr. 2), and BaFin is their AML supervisory authority (GwG § 50 Nr. 1 b).
Since MiCA applied on 30 December 2024, custody, exchange and trading of MiCA crypto-assets in Germany require a MiCA authorisation from BaFin under the KMAG, not a KWG licence; a KWG § 32 licence is still needed for "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6), and pre-MiCA KWG crypto licences lapsed at the latest at the end of 31 December 2025 (KMAG § 50(2) Nr. 3).
The Kryptomärkteaufsichtsgesetz (KMAG, Art 1 FinmadiG, BGBl. 2024 I Nr. 438 of 27 December 2024) implements MiCA in Germany: BaFin is the competent authority under MiCA Art 93(1) (KMAG § 3(1)), may act against unauthorised business (§§ 9–10) and may publicly announce on its website when a firm breaches its obligations (§ 4(4)).
Since 30 December 2024 the crypto travel rule in Germany is the directly applicable Regulation (EU) 2023/1113; FinmadiG added GwG § 15a, which requires enhanced due diligence for crypto transfers to or from a self-hosted address, on top of the Regulation's originator and beneficiary information duties.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — operating a DeFi frontend in or targeting Germany likely triggers CASP licensing requirements under MiCA/KWG if the operator takes custody, processes transactions, or charges fees, but there is significant regulatory ambiguity for purely non-custodial, fee-free frontends; BaFin has enforcement authority and a track record of acting against unlicensed operators.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?