On-shore VASP in Germany
Locally-incorporated VASP that operates under full local jurisdiction, holding all required licenses and registrations.
On-shore VASP is conditionally permitted in Germany with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full adherence to the German Money Laundering Act (GwG) for obliged entities like CASPs — customer identification and transaction monitoring required.
- KYC: Verification of all transaction parties' identities.
- Travel Rule compliance under KryptoWTransferV (Crypto Asset Transfer Regulation) — no threshold (EUR 0); must share originator's account/public key and beneficiary's name and account/public key.
- AML/CFT compliance supervised by BaFin under KMAG (Crypto Markets Supervision Act).
- Criminal Code (StGB) sanctions apply for violations.
Key Restrictions
- Must establish a German legal entity (e.g., GmbH, AG, or bank) with proper corporate governance.
- BaFit-and-proper requirement: at least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business.
- Professional liability insurance of minimum €1,000,000 required.
- IT security procedures per BAIT (BaFin Guidance on IT Requirements) — encryption, access controls, incident response.
- Customer asset segregation: complete separation of client and proprietary crypto assets required.
- Minimum capital requirements vary by activity type: €125,000 for custody (Kryptoverwahrgeschaeft) under KWG, €150,000 for trading platforms under MiCA CASP authorization.
- Transition arrangements: Pre-MiCA license holders benefit from a 12-month BaFin transition period under MiCA.
Key Risks
- BaFin is known for thoroughness and slower processing — authorization can take 6–12 months.
- Dual regulatory framework (KWG pre-MiCA + MiCA CASP) creates complexity and potential gaps during transition.
- High IT security and operational resilience expectations (BAIT/DORA) impose significant compliance cost.
- Travel Rule compliance without standardized protocols may require bespoke technical solutions with risk of BaFin scrutiny.
- Corporate taxation (15% + trade tax) and FIFO accounting for crypto inventory create administrative burden for VASPs.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BaFin — authorises crypto-asset service providers under MiCA (KMAG § 3(1)) and licenses qualified crypto custody under KWG § 32; the ESMA interim MiCA register lists 103 entries with home state Germany as of 14 October 2026, covering both authorisations and Article 60 notifications.
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
Kreditwesengesetz (KWG) § 32 with § 1(1a) sentence 2 Nr. 6 — licence for "qualified crypto custody" (custody of crypto instruments and of keys for crypto securities, crypto fund units and DLT securities); the licence carries no EU passport, which is available only to MiCA-authorised crypto-asset service providers.
Crypto-asset service providers in Germany need a MiCA authorisation from BaFin (KMAG § 3(1)) or, for credit institutions and other listed financial firms, a MiCA Art 60 notification; the German transitional regime for pre-MiCA licensees ended at the latest on 31 December 2025 (KMAG § 50(2) Nr. 3). BaFin checks applications for completeness, sets a four-week deadline for missing documents and rejects applications still incomplete after it.
Custody and administration of MiCA crypto-assets for clients (Kryptoverwahrung, KMAG § 2(11)) is a MiCA crypto-asset service that needs BaFin authorisation and at least €125,000 minimum capital (MiCA Annex IV, Class 2); the KWG licence for crypto custody now covers only "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6).
Operating a crypto-asset trading platform in Germany requires MiCA authorisation from BaFin (KMAG § 3(1)) and at least €150,000 minimum capital (MiCA Annex IV, Class 3); exchanging crypto-assets for funds or other crypto-assets is a Class 2 service with a €125,000 minimum.
BaFin is Germany's competent authority under MiCA Art 93(1) (KMAG § 3(1)), authorising and supervising crypto-asset service providers and token issuers established in Germany, and it is the AML supervisor for crypto-asset service providers under GwG § 50 Nr. 1 b; ongoing monitoring is shared with the Deutsche Bundesbank (KMAG § 6).
German Banking Act (KWG): Since January 2020, crypto custody has been regulated as a financial service requiring a BaFin license.
Fit-and-proper requirements: At least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business.
No German or EU primary sets a €1,000,000 minimum professional liability insurance for crypto custodians; MiCA Art 67 lets an insurance policy count towards a CASP's prudential safeguards without fixing a €1,000,000 floor.
For KWG-only qualified crypto custodians BaFin applies BAIT until 31 December 2026 and DORA (Regulation (EU) 2022/2554) from 1 January 2027; firms that also hold a MiCA authorisation as crypto-asset service provider are subject to MiCA and DORA.
Customer asset segregation: Complete separation of client and proprietary crypto assets required.
AML/CFT compliance: Full adherence to the German Money Laundering Act (GwG) with customer identification and transaction monitoring.
Know Your Customer (KYC): Verification of all transaction parties' identities.
Establishing a German legal entity (GmbH, AG, or bank) with proper corporate governance
Preparing a comprehensive business plan describing crypto custody offerings, technology platform, and security procedures
Documenting capital adequacy with €125,000 minimum through bank accounts and audited financial statements
The Geldwäschegesetz (GwG) is Germany's core AML/CFT law: since FinmadiG (BGBl. 2024 I Nr. 438) its obliged entities expressly include crypto-asset service providers and issuers of asset-referenced tokens (GwG § 2(1) Nr. 2), and BaFin is their AML supervisory authority (GwG § 50 Nr. 1 b).
Since MiCA applied on 30 December 2024, custody, exchange and trading of MiCA crypto-assets in Germany require a MiCA authorisation from BaFin under the KMAG, not a KWG licence; a KWG § 32 licence is still needed for "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6), and pre-MiCA KWG crypto licences lapsed at the latest at the end of 31 December 2025 (KMAG § 50(2) Nr. 3).
The Kryptomärkteaufsichtsgesetz (KMAG, Art 1 FinmadiG, BGBl. 2024 I Nr. 438 of 27 December 2024) implements MiCA in Germany: BaFin is the competent authority under MiCA Art 93(1) (KMAG § 3(1)), may act against unauthorised business (§§ 9–10) and may publicly announce on its website when a firm breaches its obligations (§ 4(4)).
Since 30 December 2024 the crypto travel rule in Germany is the directly applicable Regulation (EU) 2023/1113; FinmadiG added GwG § 15a, which requires enhanced due diligence for crypto transfers to or from a self-hosted address, on top of the Regulation's originator and beneficiary information duties.
Breaches of MiCA in Germany are sanctioned nationally by the KMAG: listed unauthorised activities are crimes punishable by up to five years imprisonment or a fine (§ 46), and administrative fines reach up to €5 million (§ 47(5)); MiCA itself applies from 30 December 2024 (Titles III and IV from 30 June 2024).
Germany applies the crypto travel rule through Regulation (EU) 2023/1113 from 30 December 2024, with no minimum threshold for crypto-asset transfers; GwG § 6(4a) obliges crypto-asset service providers to ensure compliance, BaFin supervises them (GwG § 50), and transfers over EUR 1,000 to or from a self-hosted address require a check that the client owns or controls it.
Under Regulation (EU) 2023/1113, applicable in Germany since 30 December 2024, the originator's crypto-asset service provider must send with every crypto transfer the originator's name, distributed-ledger address or crypto-asset account number, and address, official document number, customer number or date and place of birth (Art 14(1)), plus the beneficiary's name and address or account (Art 14(2)).
Grace periods for missing travel-rule protocols under Germany's 2021 national crypto transfer ordinance are superseded as the operative regime: since 30 December 2024 the directly applicable Regulation (EU) 2023/1113 governs crypto transfers, and GwG § 6(4a) requires crypto-asset service providers to take adequate measures to ensure compliance with it.
German AML law now refers to Regulation (EU) 2023/1113 for crypto transfers: FinmadiG Art 8 defined it in GwG § 1(28) and § 1(29)–(30) and requires crypto-asset service providers to take adequate measures to ensure compliance with it (GwG § 6(4a)); Regulation 2015/847 is no longer the basis of the crypto travel rule.
Crypto Securities Transfer Regulation (KryptoTransferV): Primary law, detailed in German Federal Ministry of Finance draft (English translation via DeepL).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a locally-incorporated on-shore VASP may operate in Germany, but must obtain either a crypto custody license under KWG (€125k capital) or CASP authorization under MiCA (€150k for trading) from BaFin, with a 6–12 month application process, full AML/GwG compliance, travel rule adherence, €1M professional liability insurance, BAIT IT security, fit-and-proper management, and customer asset segregation.
Questions this verdict aims to answer
- What license(s) are required to operate locally?
- What capital, governance, and reporting obligations apply?
- What is the application process and timeline?