Crypto & Virtual Assets Compliance in Germany

Germany is open to crypto businesses, but only through MiCA authorisation or an EU passport. The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) licenses and supervises crypto-asset service providers and is also their anti-money laundering supervisor. Suspicious activity goes to the Financial Intelligence Unit (FIU), financial sanctions are administered by the Deutsche Bundesbank, and tax reporting goes to the Bundeszentralamt für Steuern.

For a new entrant the hardest part is usually not the licence itself but building onboarding that satisfies Germany's narrow list of accepted remote verification methods, together with Travel Rule messaging and self-hosted wallet controls that must work before the first transfer leaves the platform.

1. Who regulates this sector

Federal and state data protection authorities supervise onboarding data.

2. Licensing and authorisation

Who needs authorisation. MiCA (Regulation (EU) 2023/1114) applies to crypto-asset services from 30 December 2024 (Article 149). Only CASPs authorised under Article 63, or financial institutions that notify under Article 60, may provide them (Article 59). BaFin's guidance notice (January 2025) requires authorisation for commercial services provided "in Germany": through a seat, branch or other presence here, or by targeting German residents from abroad online. Reverse solicitation (Article 61) is narrow.

Transition. Under § 50 of the Kryptomärkteaufsichtsgesetz (KMAG), holders of German banking, securities, payment, exchange or fund licences providing crypto services on 29 December 2024 could continue at the latest until 31 December 2025. The EU-wide transitional period ended on 1 July 2026.

Full CASP authorisation

Application to BaFin under Article 62 using the forms in Implementing Regulation (EU) 2025/306, with evidence of compliance with the Digital Operational Resilience Act (DORA). A copy goes to the Bundesbank.

Notification route

Credit institutions, investment firms, e-money institutions, fund managers, central securities depositories and market operators may provide crypto services equivalent to their existing licence, within the limits of Article 60, after notifying BaFin at least 40 working days in advance.

EU passport

A CASP authorised elsewhere in the EU notifies its home authority; it may start in Germany when informed that the notice was passed on, or at the latest 15 calendar days after submitting it (Article 65).

Process and capital. BaFin checks completeness within 25 working days and decides within 40 working days of a complete application (Article 63); it normally allows four weeks for missing documents and charges fees by time spent. Minimum capital (Annex IV) is EUR 50,000 (class 1, e.g. order execution, transfer services, advice), EUR 125,000 (class 2, adding custody and exchange) or EUR 150,000 (class 3, trading platforms). A CASP needs a registered office in a Member State where it provides at least part of its services, effective management in the EU and at least one EU-resident director (Article 59(2)). On 22 October 2026 ESMA's interim register listed 117 entries with Germany as home state: 8 authorised under Article 63 and 109 notified under Article 60.

Unauthorised business is a crime under § 46 KMAG: up to five years' imprisonment or a fine (three years if negligent).

3. AML, KYC and customer due diligence

Scope. CASPs and some issuers of asset-referenced tokens (ARTs) are obliged entities under § 2(1) No. 2 of the Geldwäschegesetz (GwG, Money Laundering Act; last amended 29 June 2026). Firms offering only crypto advice are excluded (§ 1(31)); ART issuers authorised under Article 21 MiCA are covered unless they offer and list their tokens exclusively through a CASP (§ 1(32)).

When due diligence applies. Under § 10(3) GwG: on opening a relationship; for occasional crypto transfers of EUR 1,000 or more; for other occasional transactions of EUR 15,000 or more; on suspicion; and on doubts about identity data. Transfers are valued at execution at the current price on any CASP authorised in Germany (BaFin guidance, 4.2.3), and linked transactions count together.

Content. Identify the customer and anyone acting for them, establish beneficial owners (more than 25% of capital or votes), obtain the purpose, check for politically exposed persons (PEPs) and monitor on a risk basis (§ 10(1)); otherwise refuse or terminate (§ 10(9)).

Enhanced due diligence (§ 15) applies to PEPs, their family and close associates (for at least 12 months after leaving office), links to EU-listed high-risk third countries and unusual transactions. Cross-border correspondent relationships between CASPs require information on the respondent's authorisation (§ 15(7)).

Reporting. Suspicious activity is reported to the FIU without delay, regardless of amount (§ 43(1)), electronically; every obliged entity must register with the FIU whether or not it files (§ 45(1)). A reported transaction may proceed only with FIU or prosecutor consent or after the third working day, Saturdays excluded (§ 46(1)). Since 1 March 2026 the GwG Reporting Ordinance (GwGMeldV) requires structured reports with mandatory fields; for crypto cases these include the CASP's name, the account holders, the blockchain transaction ID and the amount in crypto units with the exchange rate.

Sanctions. EU sanctions regulations apply directly. The Bundesbank's Servicezentrum Finanzsanktionen polls crypto custodians and banks after new listings; frozen assets must be reported, or a nil return filed. Since 23 April 2026, transactions with Russia-based crypto service providers and platforms are banned (Article 5bb of Regulation (EU) No 833/2014).

Records. Kept five years and destroyed after ten at the latest (§ 8(4)). Firms must copy or fully digitise identity documents, and video and audio recordings made for CDD are records (§ 8(2)).

4. Identity verification and onboarding

Data to collect. For individuals: first and last name, place and date of birth, nationality and residential address (§ 11(4) GwG). Identification must be complete before the relationship starts; completion during onboarding is allowed only where needed for normal business and the risk is low (§ 11(1)).

Accepted verification means. § 12(1) GwG lists the only evidence that may be used for individuals:

Under § 13(1) GwG verification is an adequate on-site check of the document or a procedure of equivalent security. BaFin's guidance (July 2025, 5.1.3.2) treats the eID, QES and notified eID as equivalent, keeps circular 3/2017 in force for video identification by BaFin-supervised entities, and notes that further remote procedures need a Federal Ministry of Finance ordinance, of which none had been issued. Documents must be presented in the original, so an uploaded photo of an ID card does not by itself verify identity.

Video identification (circular 3/2017), open under BaFin's guidance to all BaFin-supervised entities, including CASPs, requires trained staff in access-controlled rooms, explicit recorded consent, an end-to-end encrypted live session, IDs with white-light security features and a machine-readable zone, checks of at least three randomly selected security features, automated check-digit validation, a one-time code (TAN) sent by email or SMS and entered during the session, and full audio-visual recording kept for five years. Sub-outsourcing is not allowed.

Reliance and outsourcing. A firm may rely on another obliged entity, or outsource identification to a provider by contract, but remains responsible (§ 17(1) and (5)). Ongoing monitoring and enhanced due diligence cannot be delegated (BaFin guidance, 8). Since 1 July 2026 the Crypto Markets Notification Ordinance (KMAnzV, § 5) sets the content of the notice a CASP must give BaFin before and after a material outsourcing, including the data transferred and where it is stored.

5. Digital channels: what's different

Bottom line: the licence and the due diligence duties are the same online and in person, but a remote customer can only be verified through a short statutory list of electronic methods or BaFin-compliant video identification, and an online offer aimed at German residents from abroad counts as business in Germany.

A fixed list, not a free choice of method

§§ 12(1) and 13 GwG fix the permitted evidence. Document-and-selfie checks with automated liveness are not on the list, so video identification and the eID chip are the practical online routes.

Remote contact as a risk factor

GwG Annex 2 treats non-face-to-face relationships without safeguards such as electronic identification as a higher-risk factor.

Online offers from abroad

An app or website aimed at German residents is business in Germany, so capture country of residence early.

[Adopted, applies 10 Jul 2027] Under Article 22(6) of Regulation (EU) 2024/1624 (AMLR), identity may be verified by an identity document plus reliable independent sources where relevant, or by eIDAS electronic identification at assurance level "substantial" or "high".

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) governs onboarding data; the GwG supplies the legal basis for copying ID documents and caps retention (§ 8).

The Datenschutzkonferenz position paper on biometric analysis (3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg) holds that biometric identification is prohibited under Article 9(1) GDPR unless an Article 9(2) exception applies, typically explicit consent naming the biometric data.

Under the Crypto-Asset Tax Transparency Act (KStTG) the self-certification includes the tax identification number and date of birth (§ 6), may be checked against data already held for AML due diligence (§ 4(1)), and the related records are kept for ten years and then deleted (§ 14(2)), a different period from AML records.

7. Sector-specific obligations

Travel Rule

Under Regulation (EU) 2023/1113 (Transfer of Funds Regulation, TFR), applicable from 30 December 2024, every crypto transfer, with no minimum amount, must carry the originator's name, ledger address, account number, and address with document and customer number (or date and place of birth), plus the beneficiary's name, ledger address and account number (Article 14(1) and (2)). Data travels before or with the transfer, originator data must be verified from reliable sources, and nothing may be sent until the Article is met (Article 14(4), (6) and (8)). Breaches: up to EUR 200,000 (§ 56(2a) GwG).

Self-hosted wallets

For transfers to or from a self-hosted address, originator and beneficiary data must still be held, and above EUR 1,000 the CASP must assess whether the customer owns or controls the address (TFR Articles 14(5) and 16(2)). § 15a GwG adds a risk assessment and at least one mitigating measure, such as identifying the holder, establishing origin and destination, or enhanced monitoring. BaFin (guidance 7.6) accepts proof of control by a reference transfer or a signed message, not a wallet screenshot.

Tokens, stablecoins and custody

Security tokens, unique NFTs and tokenised deposits fall outside MiCA. E-money tokens may be issued only by credit or e-money institutions (Article 48); asset-referenced tokens need their own authorisation; other tokens' white papers go to BaFin 20 working days before publication and are not approved. Custodians must segregate client assets on the ledger and are liable for losses attributable to them (Article 75(7) and (8)).

Tax reporting of users

[In force since 24 Dec 2025] The KStTG implements EU crypto tax reporting. Tax residence must be self-certified and checked before reportable transactions (§§ 4, 7(1)); for customers onboarded by 31 December 2025 the deadline is 1 January 2027 (§ 7(2)), and non-responders must be blocked within 60 to 90 days (§ 8(3)). Reports go to the BZSt by 31 July, first for 2026 (§§ 9, 21); fines reach EUR 50,000, and repeat fines are passed to BaFin (§ 18).

8. Risk indicators and red flags

Crypto typologies from BaFin and the FIU (red-flag paper, July 2026)

• Straw-man accounts: accounts opened in third parties' names to hide who controls the funds.
• Mixer use and rapid swaps: assets passed through mixing services or exchanged quickly across many crypto-assets.
• Crypto ATM patterns: cash split below thresholds, unusually many or large ATM purchases, or use far from home despite high fees.
• Bridges and chain-hopping: deposits from bridge-linked addresses the customer cannot explain, traced to ransomware or darknet wallets.
• Pass-through accounts: incoming crypto forwarded at once to non-custodial wallets, making no economic sense after fees.
• Migrated customers: users moving in bulk from providers that lost the right to operate when MiCA transitional periods ended.
• Unlicensed or high-risk platforms: counterparties seated in sanctioned or high-risk jurisdictions, or not registered with any supervisor.
• Anonymity-enhancing coins: requests to move privacy coins, which the AMLR bars CASPs from supporting through anonymising accounts from 10 July 2027.

9. Enforcement and penalties

MiCA breaches (§ 47 KMAG). Most CASP breaches: up to EUR 700,000 for individuals and EUR 5 million for firms, or 5% of turnover above EUR 100 million, or twice the profit. Market manipulation: up to EUR 15 million or 15% of turnover, or three times the profit.

AML breaches (§ 56 GwG). Basic fines reach EUR 150,000 for intentional breaches and EUR 100,000 otherwise. Serious, repeated or systematic breaches reach EUR 1 million or twice the economic benefit, and for financial-sector firms, including CASPs, the higher of EUR 5 million or 10% of prior-year total turnover. Travel Rule breaches reach EUR 200,000.

Recent actions. On 20 August 2024 BaFin, with police and the Bundesbank, seized 13 unauthorised crypto ATMs at 35 locations and retained almost EUR 250,000 in cash, citing money laundering risk (then under the banking licence regime). BaFin's annual report for 2025 (12 May 2026) records that it refused the first asset-referenced token applied for under MiCA's transitional rule and prohibited its further distribution, accompanied four crypto custodians through orderly wind-down, and for the first time appointed a special representative at a crypto custodian to restore proper business organisation.

10. Recent changes and what to watch

• 10 Jul 2027[Adopted, applies 10 Jul 2027] The AMLR applies directly, including identity verification under Article 22(6) and the Article 79 ban on anonymous crypto accounts and anonymity-enhancing coins.
• 1 Jan 2027[In force, deadline ahead] KStTG self-certifications due for customers onboarded by 31 December 2025; first annual tax report due 31 July 2027.
• 7 Oct 2026[Review, no proposal yet] AMLA set out AML priorities for the Commission's MiCA review, including staking, DeFi and unauthorised stablecoins.
• Jul 2026[In force] The EU-wide MiCA transitional period ended on 1 July; BaFin and the FIU warned on 8 July that customers taken over from unlicensed providers need full due diligence, and the FIU updated its crypto red-flag paper.
• 1 Jul 2026[In force] The KMAnzV sets the content of KMAG notifications, including material outsourcing.
• 23 Apr 2026[In force] EU ban on transactions with Russia-based crypto-asset service providers and platforms.
• 1 Mar 2026[In force] GwGMeldV: structured suspicious activity reports with crypto-specific mandatory fields.

11. What this means for identity verification

• Method choice is legal, not just technical. German onboarding needs eID or notified eID, QES plus reference transfer, or video identification meeting circular 3/2017; automated document and selfie checks can support but not replace these.
• Biometrics and evidence. Obtain explicit, recorded consent where face images are used, and store full session recordings as AML records.
• Data model. Place of birth, nationality, address, tax residence and tax ID feed Travel Rule messages, KStTG reports and structured FIU reports.
• Re-verification triggers. Doubts about identity data, a new PEP status, self-hosted addresses above EUR 1,000 and customers migrated from other providers.
• Vendors and retention. Material outsourcing of identification must be notified to BaFin; keep AML records five years (delete by ten) and tax records ten.
• 2027 readiness. Plan for AMLR verification by eIDAS "substantial" or "high" means.