Germany is not a wild west for digital assets. If you are running a crypto business here, or planning to enter the market, you need to know that BaFin-the Federal Financial Supervisory Authority-is watching closely. The days of operating in legal gray areas are over. With the full implementation of the EU’s Markets in Crypto-Assets Regulation (MiCAR) and strict national laws like the Kryptomärkte-Aufsichtsgesetz (KMAG), compliance is no longer optional. It is the price of admission.
This guide cuts through the bureaucracy. We will break down exactly what BaFin requires, how the new tax rules from early 2025 affect your bottom line, and where most businesses trip up during the authorization process. Whether you are an exchange, a custodian, or just a merchant accepting Bitcoin, understanding these rules is critical for survival in 2026.
The Regulatory Framework: From FinmadiG to MiCAR
To understand where we stand in 2026, you have to look at the transition that happened recently. For years, Germany operated under transitional acts like the Act on the Digitalisation of the Financial Market (FinmadiG). These were stopgaps designed to bridge the gap until Europe could agree on a unified standard. That standard is now here.
MiCAR provides a comprehensive regulatory framework for crypto-assets across the European Union. In Germany, BaFin is the enforcer. This means that if you provide any service related to crypto-assets-including custody, trading, or exchange operations-you need formal authorization. The old licenses issued under FinmadiG were valid only until December 31, 2025. If you didn’t transition to a MiCAR-compliant license by then, you are likely operating illegally today.
Under the German Banking Act (Kreditwesengesetz, KWG), crypto assets are classified as financial instruments. This classification is powerful because it brings crypto services under the same rigorous scrutiny as traditional banking. You cannot hide behind the label of 'technology company' if you are holding customer funds or facilitating trades. BaFin sees this as financial service provision, plain and simple.
Who Needs a License? The Scope of BaFin’s Authority
A common mistake founders make is assuming they don’t need a license because they are based outside Germany but serve German customers. BaFin disagrees. Their authority extends to any entity providing crypto-asset services within German jurisdiction. This includes companies with legally dependent branches or even those maintaining a physical presence from which they conduct business.
If you actively target natural or legal persons with registered offices or habitual residence in Germany, BaFin considers this a domestic connection. You need a license. The only exception is the 'passive freedom to provide services,' which applies only when services are provided strictly on the customer’s initiative, without active marketing from your side. But let’s be real: if you are advertising on forums, running ads, or listing on aggregators, you are not passive.
- Custody Services: Holding private keys for clients requires a specific crypto-custody authorization.
- Trading Platforms: Exchanges matching buy and sell orders must be authorized.
- Exchange Offices: Converting crypto to fiat (or vice versa) falls under licensing requirements.
- Stablecoin Issuers: Entities issuing asset-referenced tokens face strict reserve and redemption rules.
Even mining pools can trigger licensing requirements if they operate in a way that helps sustain or create markets, such as advertising regular sales of mined coins to third parties. Proprietary trading businesses fall under Section 1(1a) no. 4 of the KWG if they engage in external advertising for regular purchases or sales.
AML and KYC: The Travel Rule in Practice
Compliance isn’t just about getting a license; it’s about daily operations. The biggest operational headache for most firms is Anti-Money Laundering (AML) compliance, specifically enforced through the German Crypto Asset Transfer Regulation (KryptoWTransferV). This regulation implements the international 'travel rule' set by the Financial Action Task Force (FATF).
Here is what this means for you: every time a crypto transfer happens, you must collect and transmit information about the originator and the beneficiary. No more anonymous transactions. You need to verify the identities of all transaction parties. This is Know Your Customer (KYC) taken to the extreme. If you fail to ensure that the sender and receiver are known and traceable, you risk heavy fines and license revocation.
This requirement applies to transfers above certain thresholds, but given BaFin’s enforcement stance, it is safer to implement robust identity verification for all significant transactions. Your IT infrastructure must support this. You cannot rely on manual spreadsheets. BaFin mandates minimum IT security standards to protect consumer assets and data. Regular audits are part of the ongoing supervision.
| Requirement | Regulation Source | Key Obligation |
|---|---|---|
| License Authorization | KWG / MiCAR | Mandatory before starting operations; old FinmadiG licenses expired Dec 2025. |
| Travel Rule | KryptoWTransferV | Collect/transmit originator/beneficiary info for crypto transfers. |
| White Paper Submission | MiCAR | Required for public offerings of new crypto-assets. |
| IT Security | BaFin Guidelines | Minimum cybersecurity standards for asset protection. |
Tax Implications: The 2025 BMF Circulars
While BaFin handles licensing, the Federal Ministry of Finance (BMF) handles taxation. On March 6, 2025, the BMF published updated circulars that changed how crypto assets are treated for income tax purposes. This is crucial for both businesses and individual investors.
The term 'virtual currencies' has been replaced with 'crypto assets.' More importantly, the guidelines differentiate between active and passive staking. Passive staking rewards are generally taxed differently than active participation in network validation. For the first time, the tax implications for decentralized finance (DeFi) protocols are addressed, though the guidance remains complex. You need clear documentation of transaction overviews and valuation methods. Daily market rates are often used for valuing crypto assets. Retention obligations are strict; keep your records organized.
Recent Enforcement Actions: What Happens When You Break Rules
Theory is one thing; enforcement is another. BaFin has shown it is willing to pull the plug on non-compliant entities. A prime example is the case of Ethena GmbH. On June 25, 2025, BaFin ordered the winding up of Ethena’s operations related to its USDe stablecoins in Germany. Token holders were given until August 6, 2025, to redeem their tokens, with a special representative appointed to oversee the process.
This wasn’t a minor fine. It was a complete shutdown of local operations. Why? Because the issuer failed to meet the stringent requirements for stablecoin issuance and reserve management under MiCAR. This serves as a stark warning: if your product doesn’t fit the regulatory box, BaFin will remove it from the market. They do not wait for scandals to unfold; they act preemptively.
The Authorization Process: Faster but Still Rigorous
Historically, BaFin was known for slow, overly cautious authorization processes, especially after the Wirecard scandal. However, the landscape has shifted. As of 2025 and into 2026, BaFin has introduced stricter deadlines and demanded more compact presentations from applicants. The result? Many decisions are now issued within months rather than years.
This efficiency comes with a catch. BaFin expects perfection in your application. Missing documents or vague business models lead to immediate rejection. You need to demonstrate:
- Clear governance structures and fit-and-proper tests for key personnel.
- Robust AML/KYC procedures aligned with KryptoWTransferV.
- Adequate capital reserves meeting MiCAR requirements.
- Detailed IT security protocols.
If you are launching a new token offering, remember the white paper requirement. You must submit a detailed white paper to BaFin before any public offering. This document must disclose risks, technology details, and tokenomics. Failure to do so can result in the offer being banned.
Merchants and Payment Providers: A Hidden Trap
You might think, "I’m just a coffee shop accepting Bitcoin." Does that require a license? Generally, no. Accepting cryptocurrency as a substitute currency for goods or services does not constitute a banking transaction. However, there is a trap.
If you use a payment provider to process these payments, and that provider forwards the cryptos or exchanges them for euros before paying you, that provider needs a BaFin license. If they don’t have one, BaFin can initiate legal proceedings against you, the merchant, for using an unlicensed intermediary. Always verify that your payment processor holds the necessary authorizations. Don’t assume they are compliant because they are a big tech name. Check directly with BaFin’s register.
Conclusion: Navigating the New Normal
Germany offers one of the clearest regulatory environments in Europe for cryptocurrency. But clarity demands compliance. The era of ambiguity is gone. MiCAR, KMAG, and BaFin’s active enforcement mean that you must build your business around these regulations from day one. Whether it’s securing your license, implementing the travel rule, or preparing your tax documentation, cutting corners is not a strategy-it’s a liability. Get it right, and you benefit from a trusted, stable market. Get it wrong, and you risk everything.
Do I need a BaFin license to mine Bitcoin in Germany?
Pure mining for personal use does not typically require a license. However, if you operate a mining pool that advertises regular sales of mined coins to third parties or engages in proprietary trading activities under Section 1(1a) no. 4 of the KWG, you may need authorization. Consult a legal expert to assess your specific operational model.
What happened to my FinmadiG license in 2026?
Licenses issued under the transitional FinmadiG act expired on December 31, 2025. If you did not transition to a MiCAR-compliant license by that date, you are currently operating without valid authorization. You should immediately cease regulated activities and apply for a new license.
How does the 'travel rule' affect small transactions?
The KryptoWTransferV mandates collecting originator and beneficiary information for crypto transfers. While thresholds exist, BaFin encourages robust KYC practices for all significant transactions. Failing to verify identities can lead to severe penalties regardless of transaction size.
Can a foreign company serve German clients without a license?
Only under the 'passive freedom to provide services,' meaning the client initiated contact without any active marketing from you. If you advertise to German residents, maintain a branch, or target them specifically, you need a BaFin license.
What are the tax implications of DeFi staking in 2026?
The 2025 BMF circulars differentiate between active and passive staking. Active staking rewards may be taxed as business income, while passive staking might be treated differently. Detailed record-keeping of transaction dates and values is essential for accurate tax reporting.