Remote VASP serving residents in Germany
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Germany with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Full adherence to GwG (German Money Laundering Act) with customer identification and transaction monitoring (de.licensing.amlcft-compliance-full-adherence-to)
- KYC verification of all transaction parties' identities (de.licensing.know-your-customer-kyc-verification)
- Travel Rule compliance under §3 KryptoTransferV — share originator's account, beneficiary's name and account (public keys) with zero-threshold (de.travel-rule.3-kryptotransferv-mandates-sharing-originators)
- Transaction monitoring and suspicious activity reporting to BaFin and FIU (de.licensing.amlcft-compliance-full-adherence-to)
- Ongoing AML/CFT supervision by BaFin under KWG and KMAG (de.aml.kmag-crypto-markets-supervision-act)
Key Restrictions
- Must establish a German legal entity (GmbH, AG, or bank) — pure cross-border remote service from abroad without local incorporation is not permitted (de.licensing.establishing-a-german-legal-entity)
- At least one managing director must satisfy BaFin's fit-and-proper requirements (de.licensing.fit-and-proper-requirements-at-least-one)
- Minimum capital of EUR 125,000 for custody license; EUR 150,000 for exchange/trading platform CASP authorization (de.licensing.custody, de.licensing.exchange)
- Professional liability insurance of minimum EUR 1,000,000 required (de.licensing.professional-liability-insurance-minimum-1000000)
- Customer asset segregation: complete separation of client and proprietary crypto assets (de.licensing.customer-asset-segregation-complete-separation)
- IT security procedures must comply with BAIT (BaFin IT Guidance) and DORA (de.licensing.it-security-procedures-per-bait)
Key Risks
- BaFin has a track record of issuing public warnings and enforcement actions against unlicensed foreign VASPs serving German residents (e.g., Binance warning in 2023)
- 6–12 month licensing process with thorough BaFin review — significant delay risk for market entry
- Travel Rule technical compliance is required at zero threshold; absence of standardized protocols may create operational gaps
- Regulatory ambiguity during MiCA transition period (pre-existing KWG regime vs. new CASP regime under MiCA) may cause dual-application burdens
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BaFin — authorises crypto-asset service providers under MiCA (KMAG § 3(1)) and licenses qualified crypto custody under KWG § 32; the ESMA interim MiCA register lists 103 entries with home state Germany as of 14 October 2026, covering both authorisations and Article 60 notifications.
Kreditwesengesetz (KWG) § 32 with § 1(1a) sentence 2 Nr. 6 — licence for "qualified crypto custody" (custody of crypto instruments and of keys for crypto securities, crypto fund units and DLT securities); the licence carries no EU passport, which is available only to MiCA-authorised crypto-asset service providers.
Crypto-asset service providers in Germany need a MiCA authorisation from BaFin (KMAG § 3(1)) or, for credit institutions and other listed financial firms, a MiCA Art 60 notification; the German transitional regime for pre-MiCA licensees ended at the latest on 31 December 2025 (KMAG § 50(2) Nr. 3). BaFin checks applications for completeness, sets a four-week deadline for missing documents and rejects applications still incomplete after it.
Custody and administration of MiCA crypto-assets for clients (Kryptoverwahrung, KMAG § 2(11)) is a MiCA crypto-asset service that needs BaFin authorisation and at least €125,000 minimum capital (MiCA Annex IV, Class 2); the KWG licence for crypto custody now covers only "qualified crypto custody" of crypto instruments, crypto securities, crypto fund units and DLT securities (KWG § 1(1a) sentence 2 Nr. 6).
Operating a crypto-asset trading platform in Germany requires MiCA authorisation from BaFin (KMAG § 3(1)) and at least €150,000 minimum capital (MiCA Annex IV, Class 3); exchanging crypto-assets for funds or other crypto-assets is a Class 2 service with a €125,000 minimum.
Establishing a German legal entity (GmbH, AG, or bank) with proper corporate governance
Fit-and-proper requirements: At least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business.
No German or EU primary sets a €1,000,000 minimum professional liability insurance for crypto custodians; MiCA Art 67 lets an insurance policy count towards a CASP's prudential safeguards without fixing a €1,000,000 floor.
Customer asset segregation: Complete separation of client and proprietary crypto assets required.
For KWG-only qualified crypto custodians BaFin applies BAIT until 31 December 2026 and DORA (Regulation (EU) 2022/2554) from 1 January 2027; firms that also hold a MiCA authorisation as crypto-asset service provider are subject to MiCA and DORA.
AML/CFT compliance: Full adherence to the German Money Laundering Act (GwG) with customer identification and transaction monitoring.
Know Your Customer (KYC): Verification of all transaction parties' identities.
The Geldwäschegesetz (GwG) is Germany's core AML/CFT law: since FinmadiG (BGBl. 2024 I Nr. 438) its obliged entities expressly include crypto-asset service providers and issuers of asset-referenced tokens (GwG § 2(1) Nr. 2), and BaFin is their AML supervisory authority (GwG § 50 Nr. 1 b).
The Kryptomärkteaufsichtsgesetz (KMAG, Art 1 FinmadiG, BGBl. 2024 I Nr. 438 of 27 December 2024) implements MiCA in Germany: BaFin is the competent authority under MiCA Art 93(1) (KMAG § 3(1)), may act against unauthorised business (§§ 9–10) and may publicly announce on its website when a firm breaches its obligations (§ 4(4)).
Germany applies the crypto travel rule through Regulation (EU) 2023/1113 from 30 December 2024, with no minimum threshold for crypto-asset transfers; GwG § 6(4a) obliges crypto-asset service providers to ensure compliance, BaFin supervises them (GwG § 50), and transfers over EUR 1,000 to or from a self-hosted address require a check that the client owns or controls it.
Under Regulation (EU) 2023/1113, applicable in Germany since 30 December 2024, the originator's crypto-asset service provider must send with every crypto transfer the originator's name, distributed-ledger address or crypto-asset account number, and address, official document number, customer number or date and place of birth (Art 14(1)), plus the beneficiary's name and address or account (Art 14(2)).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident VASP cannot serve German residents from abroad without establishing a local entity and obtaining BaFin licensing (either a crypto custody license under KWG or CASP authorization under MiCA), with high licensing burden including minimum capital, fit-and-proper requirements, and full AML/CFT obligations.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?