Get BaFin CASP authorization in Germany under MiCA. RUE supports exchanges, custodians, brokers, and crypto platforms through the requirements, cost, timeline, and filing process.
Prepared by RUE editorial team · Reviewed by Milana · Updated 30 October 2026
Book BaFin Readiness CallA MiCA license in Germany means BaFin authorization as a crypto-asset service provider under Regulation (EU) 2023/1114. Germany combines strong regulatory credibility, institutional banking optics, and EU passporting, but BaFin expects real substance, robust AML controls, and operational readiness from day one.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
Regulated United Europe (RUE) structures Germany MiCA licensing projects end-to-end: perimeter review, company setup, governance design, AML/Travel Rule framework, safeguarding architecture, BaFin-facing dossier drafting, and post-authorization operating model support.
Sources used on this page: Regulation (EU) 2023/1114 (MiCA), BaFin guidance, ESMA and EBA materials, Regulation (EU) 2023/1113 (Travel Rule), DORA, GwG, and GDPR. See also MiCA regulation overview and MiCA application documents.
We also coordinate related workstreams that usually delay approval in practice: German company formation, banking strategy, accounting setup, outsourcing documentation, and remediation of MiCA vs MiFID II / KWG perimeter issues.
BaFin is one of the most respected financial supervisors in Europe. A Germany MiCA license sends a stronger governance signal to banks, payment partners, and institutional counterparties.
Once authorized in Germany, a CASP may passport services across the EU, subject to the MiCA notification framework and host-state conduct rules outside the core license.
Germany offers mature AML, audit, tax, legal, and banking infrastructure. This matters for firms that need sustainable post-license operations, not just a fast filing.
Germany is well suited for custody, brokerage, exchange, and platform models that need bank-grade safeguarding, outsourcing oversight, and DORA-ready ICT governance.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
A MiCA license in Germany requires a full CASP authorization file for BaFin as the national competent authority. In market language, MiCA License in Germany, Germany MiCA license, BaFin crypto license, and CASP authorization Germany usually refer to the same outcome: authorization to provide regulated crypto-asset services under Regulation (EU) 2023/1114.
Not every crypto business needs authorization. The trigger is whether your company provides regulated crypto-asset services, falls within issuer rules for ARTs or EMTs, or enters another regulated perimeter such as MiFID II, KWG, ZAG, or eWpG. BaFin will assess the actual operating model, control points, custody logic, client journey, outsourcing chain, and token classification—not just the labels used on your website.
Germany-specific friction usually appears in four places: substance, fit-and-proper governance, AML/Travel Rule operating design, and safeguarding architecture. A file that looks acceptable on paper but does not show real decision-making, clear wallet control, reliable client asset segregation, or credible outsourcing oversight will usually generate multiple rounds of information requests.
The core requirements below reflect the 2026 compliance stack for German CASPs under MiCA, with adjacent obligations under GwG, TFR, DORA, GDPR, and applicable German corporate and accounting rules.
Minimum capital depends on the CASP service class under MiCA. The headline thresholds are €50,000, €125,000, and €150,000. In practice:
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately. BaFin also assesses liquidity and the sustainability of the operating model.
Capital must be demonstrably available, traceable, and legally clean. Source-of-funds evidence, bank confirmations, shareholder funding documents, and consistency with the financial model are standard review points.
You normally need a German legal entity with genuine operational presence. In practice, most applicants use a GmbH; some larger groups use an AG. Corporate law capital for a GmbH is generally €25,000, while an AG generally starts at €50,000, but those figures do not replace MiCA prudential requirements.
BaFin does not license letterbox structures. The application should show:
For groups using outsourcing or shared service centers, the file should clearly explain which functions remain in-house, which are delegated, how oversight works, and where key risk decisions are actually taken.
BaFin assesses the management body, qualifying shareholders, and ultimate beneficial owners on a fit-and-proper basis. The review is not limited to criminal records. It also covers competence, integrity, time commitment, conflicts of interest, financial soundness, and ability to run the proposed model.
There is no safe shortcut such as appointing one nominal local director. What matters is effective management, documented responsibility allocation, and the ability to evidence real oversight.
A Germany CASP must operate an AML/CFT framework aligned with the German AML Act (GwG), the EU Transfer of Funds Regulation (TFR), FATF standards, and BaFin expectations. This is an operating system, not a policy pack.
One practical point many applicants miss: unhosted wallet handling should be operationally defined in advance, including ownership verification logic, risk scoring, transaction restrictions, and escalation thresholds.
If your model includes custody or client money touchpoints, safeguarding is a core licensing issue. BaFin will expect a clear explanation of how client assets are protected, segregated, recorded, and recoverable.
A strong file usually includes a safeguarding policy, reconciliation procedure, custody liability map, insolvency treatment logic, and sample client disclosures on asset risks and ownership treatment.
By 2026, a Germany MiCA license application must be read together with the broader EU operational resilience environment, especially DORA. Even where DORA scoping nuances depend on the exact entity and implementation layer, BaFin expects bank-grade ICT governance from serious CASPs.
For custody-heavy models, BaFin will usually pay particular attention to key management, wallet provider concentration risk, API security, and segregation between development, staging, and production environments.
Your application must show that the business is understandable, fundable, and governable. A weak commercial model is a regulatory problem because it undermines prudential stability and client protection.
BaFin often tests internal consistency across the file. If the business plan, staffing plan, outsourcing contracts, and safeguarding design do not match each other, the review will slow down materially.
BaFin review quality depends heavily on dossier quality. A formally complete file can still be substantively weak. The strongest applications are written as regulator-facing operating manuals, not promotional decks.
At RUE, we treat the BaFin file as a controlled evidence package. That reduces avoidable RFIs and helps management present a coherent operating model from the first submission.
Compare Germany with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Germany does not offer a light-touch tax story for licensed crypto firms. A Germany MiCA license should be budgeted as a regulated operating platform with normal German corporate taxation, accounting, payroll, audit, and compliance costs. Tax treatment depends on the legal entity, revenue model, token flows, transfer pricing, and whether the firm performs regulated services, software development, treasury activity, or issuance-related functions.
Legal information only: this section is a high-level overview and should not be treated as legal, tax, or investment advice. Corporate tax analysis for a German CASP should be confirmed with German tax counsel and accountants before launch, especially where the group has foreign founders, IP holding structures, or cross-border service arrangements.
The useful formula is:
For many founders, the real cost driver is not the minimum MiCA capital threshold but the operating model needed to satisfy BaFin on substance, AML, safeguarding, and ICT resilience.
Depending on scope, a realistic first-year budget often includes:
These ranges vary with headcount, outsourcing, banking setup, transaction monitoring tooling, and whether the applicant builds proprietary custody infrastructure or relies on third-party providers.
Authorization is only the start. A BaFin-authorized CASP must maintain continuous compliance across MiCA, GwG, TFR, operational resilience, safeguarding, and corporate governance.
A MiCA license in Germany is a market term for BaFin CASP authorization under Regulation (EU) 2023/1114. It allows a company established and authorized in Germany to provide regulated crypto-asset services within the scope approved by BaFin and, after the relevant notification steps, to use EU passporting across the Union.
The legal regime for CASPs became fully applicable from 30 December 2024. In 2026, the practical question is no longer whether MiCA exists, but whether your business model is correctly mapped to the MiCA perimeter, whether Germany is the right home state, and whether your file is strong enough for BaFin review.
Three points remove most market confusion:
RUE treats Germany MiCA licensing as a perimeter + operating model + evidence package project. That is the only reliable way to avoid the common failure mode: a formally complete application that does not prove how the business actually works.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define CASP scope, token classification, target markets, custody model, and MiCA vs MiFID II / KWG / ZAG perimeter. This is the highest-value early step. Typical duration: 1-2 weeks.
Incorporate the German entity, prepare shareholder documents, secure office/substance, and align governance. Usually a GmbH or AG depending on structure. Typical duration: 1-4 weeks.
Appoint directors and control-function coverage, define reporting lines, prepare fit-and-proper files, and map outsourcing oversight. Typical duration: 2-4 weeks, often overlapping with company setup.
Prepare the full BaFin application package: program of operations, AML/TFR framework, safeguarding, ICT/security, business plan, financial projections, and policy suite. Typical duration: 6-10 weeks.
Submit the completed file to BaFin, organize annexes, and ensure consistency across legal, compliance, and financial materials. Typical duration: 1 week once the dossier is finalized.
BaFin checks whether the application is complete enough for substantive review. Legal benchmark is commonly referenced at up to 25 working days, but incomplete files trigger delays and follow-up requests.
BaFin reviews the file in depth, often issuing RFIs on governance, AML, safeguarding, outsourcing, and financial assumptions. Baseline review window is commonly referenced at up to 40 working days after completeness, but practical timing is often longer.
After approval, finalize banking, vendor onboarding, client disclosures, Travel Rule operations, reconciliations, and internal controls before commercial launch. Typical final readiness period: 2-6 weeks.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
Yes, a non-EU founder can obtain a MiCA license in Germany through a properly structured legal entity. The key issues are not nationality but ownership transparency, source of funds, fit-and-proper assessment, governance quality, and real substance in Germany. BaFin will expect a credible German operating company, not a remote shell. Foreign-owned structures often face enhanced scrutiny on control, decision-making, and banking readiness.
Yes, a Germany MiCA license can be passported across the EU after the relevant notification process. This allows a BaFin-authorized CASP to provide services in other EU Member States without obtaining a separate full license in each country. However, passporting is not a free pass for all local law issues: consumer, marketing, tax, and data protection rules may still differ by country.
MiCA requires prudential safeguards at all times equal to the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of the preceding year’s fixed overheads. Providers operating for less than one year use projected fixed overheads for their first 12 months. The safeguards may consist of qualifying own funds, compliant insurance or a comparable guarantee, or a combination under Article 67. Operating expenses and company-law share capital must be planned separately.
A realistic timeline is usually 3-6+ months for a well-prepared application. The legal review mechanics are commonly referenced as up to 25 working days for completeness review and up to 40 working days for substantive assessment after completeness, but the real-world timeline depends on RFIs, dossier quality, business-model complexity, and how quickly the applicant answers BaFin questions.
Sometimes no, sometimes yes—it depends on control and intermediation. A pure software provider that never controls client assets, orders, or transfer flow may fall outside MiCA. A DeFi front end with admin keys, fee capture, governance control, routing logic, or embedded custody/execution features may still trigger licensing analysis. Do not rely on labels such as “non-custodial” or “decentralized” without a written perimeter review.
BaFin is the competent authority for granting CASP authorization in Germany. ESMA and EBA play EU-level coordination, standards, and supervisory convergence roles, while the Deutsche Bundesbank remains an important institutional actor in the broader German financial system. For a Germany CASP application, the licensing interface is with BaFin, not ESMA.
You need real substance in Germany, and in practice that usually means more than a registered address. BaFin expects effective management, operational presence, and a credible control environment. A virtual office alone is not enough for a serious CASP application. The exact substance model depends on your service scope, outsourcing design, and group structure, but letterbox setups are a common red flag.
Yes, a GmbH is the most common vehicle for a Germany MiCA license. An AG may also be used, especially for larger or more institutional structures. The legal entity choice should be aligned with ownership, governance, funding, and future scaling plans. Remember that GmbH share capital and MiCA regulatory capital are different concepts and should not be confused.
The most common delay reasons are weak perimeter analysis, thin local substance, generic AML documents, unclear safeguarding, and poorly controlled outsourcing. Other frequent issues include inconsistent financial projections, incomplete fit-and-proper files, and slow responses to RFIs. In Germany, many delays are caused not by missing forms but by a file that does not prove how the business will actually operate.
Not necessarily. If a token qualifies as a financial instrument under MiFID II, it may sit outside MiCA and fall under securities or investment-services regulation instead. This is one of the most important perimeter questions in Germany, especially for tokenization, investment rights, and structured products. A token classification memo should be prepared before any licensing strategy is chosen.
Ongoing obligations include governance maintenance, AML/KYC operations, Travel Rule compliance, safeguarding, reconciliations, incident handling, outsourcing oversight, accounting, and regulatory reporting. Authorization is not a one-time approval. BaFin expects the CASP to remain operationally compliant, adequately funded, and able to evidence its controls through records, testing, and management oversight.
Yes. RUE supports Germany MiCA clients not only with the authorization file but also with related operational tasks such as bank account opening in Germany, crypto business banking, German accounting support, and preparation of MiCA application documents. This matters because most post-license failures happen in operations, not in the approval letter.
