Germany: crypto and stablecoin regulation (as of 6 November 2026)

As of 2026-11-06

In Germany, the Crypto Markets Supervision Act (KMAG) serves to implement MiCA and names BaFin as the competent authority. According to BaFin, authorised providers can provide their service cross-border throughout the EU after prior notification (EU passporting), without having to apply for a separate MiCAR authorisation in each member state; in its consumer warning of 29 September 2026, BaFin wrote that banking business, financial services and crypto-asset services may be offered in Germany only with a BaFin licence. The deemed licences that let KWG and other licence holders continue crypto activities under the old law lapsed at the latest at the end of 31 December 2025.

Status: MiCA (Regulation (EU) 2023/1114) is binding in its entirety and directly applicable in every member state; the Kryptomärkteaufsichtsgesetz (KMAG) serves to implement it; under KMAG § 3 the Federal Financial Supervisory Authority (BaFin) is the competent authority within the meaning of Article 93(1) MiCA, and the Deutsche Bundesbank is the competent body for the tasks assigned to it under § 6. Firms that on 29 December 2024 held a licence under the Banking Act (KWG) or another listed law for crypto-asset activities could continue under the supervisory law in force on that day, but that deemed licence lapsed at the latest at the end of 31 December 2025 (KMAG § 50). Qualified crypto custody business in principle needs a licence under the KWG (BaFin: "Das Geschäft ist grundsätzlich erlaubnispflichtig."). According to BaFin, only credit institutions or e-money institutions can issue e-money tokens or apply for their admission to trading, and companies that want to offer asset-referenced tokens to the public or apply for their admission to trading need prior BaFin authorisation (Article 16(1)(a) with Article 18 MiCA); MiCA also provides other routes, see the asset-referenced tokens bullet.

This page states what the official sources say. It is not legal advice. The German quotes are from the sources; the English renderings are our translation.

Germany crypto-asset rules: status as of 6 November 2026 (some rows read 10 November 2026)

Status	Rule	Since / from	Source
Law text	KMAG § 1: the act serves to implement Regulation (EU) 2023/1114 (MiCA) ("Dieses Gesetz dient der Durchführung der Verordnung (EU) 2023/1114").	— (BGBl citation not read; consolidated text)	gesetze-im-internet.de
Law text	KMAG § 3: BaFin is the competent authority within the meaning of Article 93(1) MiCA; the Deutsche Bundesbank is the competent body for the tasks assigned to it under § 6.	—	gesetze-im-internet.de
Lapsed	KMAG § 50, headed "Übergangsvorschrift zur Erbringung von Kryptowerte-Dienstleistungen nach Artikel 143 der Verordnung (EU) 2023/1114" (transitional provision for the provision of crypto-asset services under Article 143 of Regulation (EU) 2023/1114): for firms that held a licence under § 32 KWG or another listed law on 29 December 2024, the deemed licence lapses "spätestens mit Ablauf des 31. Dezember 2025" (at the latest at the end of 31 December 2025), earlier, for Article 59(1)(a) firms when the authorisation decision under Article 63 becomes final, and for Article 59(1)(b) firms when the relevant Article 60 period expires.	29 December 2024 to 31 December 2025 at the latest	gesetze-im-internet.de
EU law	MiCA Article 143(3): crypto-asset service providers that provided services under national law before 30 December 2024 may continue until 1 July 2026 or until they are granted or refused an authorisation under Article 63, whichever is sooner. Member states may decide not to apply this transitional measure or to reduce its duration if they consider their national framework applicable before 30 December 2024 less stringent than MiCA.	1 July 2026 at the latest (EU maximum; member states may shorten it)	EUR-Lex
Consumer warning (BaFin, 29 September 2026)	In its consumer warning of 29 September 2026, BaFin wrote that banking business, financial services and crypto-asset services may be offered in Germany only with a BaFin licence: "Bankgeschäfte, Finanzdienstleistungen und Kryptowerte-Dienstleistungen dürfen in Deutschland nur mit einer Erlaubnis der Bafin angeboten werden."	Warning dated 29 September 2026; read 10 November 2026	BaFin
Current (BaFin)	Qualified crypto custody business in principle needs a licence under § 32(1) in conjunction with § 1(1a) sentence 2 no. 6 KWG.	BaFin page, read 10 November 2026	BaFin
Current (BaFin)	Only credit institutions or e-money institutions can issue e-money tokens (EMT) or apply for their admission to trading; EMTs count as e-money under Article 48(2) MiCA.	BaFin page, read 10 November 2026	BaFin
Planned	BaFin, page read 10 November 2026: the notification ordinance that goes with the KMAG's notification and reporting duties "is to enter into force in 2026" ("Die dazugehörige Anzeigenverordnung soll 2026 in Kraft treten."); the page gives no date.	2026 (no date given)	BaFin

Germany crypto-asset key rules

Germany competent authority, CASP authorisation and the end of the transition

The national act. The Kryptomärkteaufsichtsgesetz (KMAG, Crypto Markets Supervision Act) states its purpose in § 1: "Dieses Gesetz dient der Durchführung der Verordnung (EU) 2023/1114" (this Act serves to implement Regulation (EU) 2023/1114). (gesetze-im-internet.de)
Who supervises. Under KMAG § 3, "Die Bundesanstalt ist zuständige Behörde im Sinne des Artikels 93 Absatz 1 der Verordnung (EU) 2023/1114" (BaFin is the competent authority within the meaning of Article 93(1) MiCA). The Deutsche Bundesbank is the competent body within the scope of the tasks assigned to it under § 6. (gesetze-im-internet.de)
Authorisation and where it is published. According to BaFin, MiCA governs the authorisation duty, the exemptions and the procedure for crypto-asset service providers (CASPs). An authorisation is published in the Federal Gazette (Bundesanzeiger), in the BaFin company database and in the ESMA interim MiCA register, and "Zugelassene Anbieter können ihre Dienstleistung nach vorheriger Anzeige grenzüberschreitend in der gesamten EU erbringen ( EU Passporting), ohne in jedem Mitgliedstaat eine separate MiCAR -Zulassung beantragen zu müssen." (authorised providers can provide their service cross-border throughout the EU after prior notification (EU passporting), without having to apply for a separate MiCAR authorisation in each member state). Under KMAG § 14, BaFin must announce in the Federal Gazette the grant and withdrawal of a CASP authorisation, and the grant, withdrawal and lapse of an authorisation for asset-referenced tokens. (BaFin, gesetze-im-internet.de)
The German transition. KMAG § 50 lets firms that on 29 December 2024 held a licence under § 32 KWG, § 15 of the Investment Firm Act (WpIG), § 11(1) of the Payment Services Supervision Act (ZAG) or another listed law for crypto-asset activities continue "unter Fortgeltung der aufsichtlichen Rechtslage vom 29. Dezember 2024" (under the supervisory law in force on 29 December 2024); the licence is deemed to continue, but "spätestens mit Ablauf des 31. Dezember 2025" (at the latest at the end of 31 December 2025). (gesetze-im-internet.de)
The EU limit. MiCA Article 143(3): "Anbieter von Kryptowerte-Dienstleistungen, die ihre Dienste nach geltendem Recht vor dem 30. Dezember 2024 erbracht haben, dürfen damit bis zum 1. Juli 2026 oder bis zu dem Zeitpunkt fortfahren, zu dem sie eine Zulassung oder Verweigerung nach Artikel 63 erhalten, je nachdem, welcher Zeitpunkt zuerst eintritt." and "Die Mitgliedstaaten können beschließen, die in Unterabsatz 1 vorgesehene Übergangsregelung für Anbieter von Kryptowerte-Dienstleistungen nicht in Anspruch zu nehmen oder ihre Geltungsdauer zu verkürzen, wenn sie der Auffassung sind, dass ihr vor dem 30. Dezember 2024 geltender nationaler Rechtsrahmen weniger streng ist als diese Verordnung." (crypto-asset service providers that provided services under national law before 30 December 2024 may continue until 1 July 2026 or until they are granted or refused an authorisation under Article 63, whichever is sooner. Member states may decide not to apply this transitional measure or to reduce its duration if they consider their national framework applicable before 30 December 2024 less stringent than MiCA.) (EUR-Lex)

Germany qualified crypto custody under the Banking Act (KWG)

The licensed activity. The Banking Act lists as a financial service "das qualifizierte Kryptoverwahrgeschäft" (qualified crypto custody business), carried on through "a) die Verwahrung und Verwaltung kryptografischer Instrumente für andere oder b) die Sicherung privater kryptografischer Schlüssel für andere" (a) the custody and administration of cryptographic instruments for others, or b) the safeguarding of private cryptographic keys for others). (gesetze-im-internet.de)
What a cryptographic instrument is. KWG § 1(1a) defines cryptographic instruments as digital representations of a value that has not been issued or guaranteed by any central bank or public body and does not have the legal status of a currency or money. Crypto-assets within the meaning of Article 3(1) no. 5 MiCA that fall within MiCA's scope are on the list of things that are not cryptographic instruments. (gesetze-im-internet.de)
Licence and no passport. BaFin says the licensing requirement follows from § 32(1) in conjunction with § 1(1a) sentence 2 no. 6 KWG, and that the KWG licence for qualified crypto custody does not entitle an institution to operate cross-border in other EEA countries or to set up a branch there. (BaFin)
IT rules from 2027. In BaFin's overview for institutions licensed for qualified crypto custody without a CASP authorisation, the IT and supervisory requirements are the banking IT rules (BAIT) until 31 December 2026 and the EU's Digital Operational Resilience Act (DORA) from 1 January 2027. (BaFin)

Germany stablecoin and token issuer rules (EMT, ART, white papers)

E-money tokens. BaFin: "Nur Kreditinstitute oder E-Geld-Institute können E-Geld-Token (englisch: E-Money Token; Abkürzung: EMT) emittieren oder die Handelszulassung für solche Token beantragen" (only credit institutions or e-money institutions can issue e-money tokens or apply for their admission to trading). E-money tokens count as e-money under Article 48(2) MiCA, and the European Securities and Markets Authority (ESMA) keeps all authorised EMT issuers in a register. (BaFin)
Asset-referenced tokens. According to BaFin, companies that want to offer asset-referenced tokens (ART) to the public, or to apply for the admission of such a token to trading, "benötigen vorab eine Zulassung der Bafin, siehe Artikel. 16 Abs. 1 Buchstabe. a) in Verbindung mit Artikel 18 der Verordnung (EU) 2023/1114 (MiCAR)" (need prior BaFin authorisation, see Article 16(1)(a) in conjunction with Article 18 MiCA). MiCA Article 16(1): "… von der zuständigen Behörde ihres bzw. seines Herkunftsmitgliedstaats gemäß Artikel 21 hierzu eine Zulassung erhalten hat, oder b) ein Kreditinstitut ist, das Artikel 17 einhält. Ungeachtet des Unterabsatzes 1 können mit schriftlicher Zustimmung des Emittenten eines vermögenswertereferenzierten Token andere Personen diesen vermögenswertereferenzierten Token öffentlich anbieten oder dessen Zulassung zum Handel beantragen. Diese Personen müssen die Artikel 27, 29 und 40 einhalten."; Article 17(1): "für den vermögenswertreferenzierten Token ein Kryptowerte-Whitepaper gemäß Artikel 19 erstellt und dieses … der zuständigen Behörde seines Herkunftsmitgliedstaats … zur Genehmigung vorlegen und das Kryptowerte-Whitepaper von der zuständigen Behörde genehmigt wird; b) die jeweils zuständige Behörde mindestens 90 Arbeitstage vor der erstmaligen Ausgabe … benachrichtigt". MiCA Article 16(1) also lets an issuer that is a credit institution complying with Article 17 offer the token to the public or seek its admission to trading without an Article 21 authorisation: its white paper must be approved by the competent authority of its home member state, and the respective competent authority must be notified at least 90 working days before first issuance (Article 17(1)(a)-(b); Article 17 sets further requirements). With the issuer's written consent, other persons may offer the token or seek its admission to trading; they must comply with Articles 27, 29 and 40 (our translation of the German text). (BaFin, EUR-Lex)
Other crypto-assets. BaFin: companies that offer to the public, or apply for admission to trading of, a token that is neither an ART nor an EMT must draw up a crypto-asset white paper at the latest 20 working days before its publication and send it to BaFin under Article 8 MiCA; BaFin notes that it does not approve the white paper (Article 6(3) MiCA). Under MiCA Article 8(1) the white paper goes to the competent authority of the home member state ("müssen der zuständigen Behörde ihres Herkunftsmitgliedstaats ihr Kryptowerte-Whitepaper übermitteln"); Article 4(2) and (3) list offers for which these duties do not apply. (BaFin, EUR-Lex)
Unauthorised business. Under KMAG § 9, BaFin may order a company, its shareholders and the members of its bodies to cease business immediately and wind up the transactions without delay when, among other cases, asset-referenced tokens are offered or crypto-asset services are provided without the authorisation MiCA requires. Where facts justify that assumption, KMAG § 10(7) lets BaFin inform the public, naming the company. In a consumer warning of 29 September 2026, BaFin said that by its findings the unknown operators of a series of platforms offer crypto-asset services without authorisation. (gesetze-im-internet.de, gesetze-im-internet.de, BaFin)

Germany crypto-asset timeline

Date	Event	Source
29 December 2024	Reference date of the KMAG § 50 transition: firms then allowed to carry on crypto-asset activities under a KWG or other listed licence may continue under the law of that day	gesetze-im-internet.de
30 December 2024	MiCA Article 143(3) reference date: providers serving clients under national law before this date may use the EU transitional period	EUR-Lex
31 December 2025	KMAG § 50: the deemed licence ends at the latest at the end of this day	gesetze-im-internet.de
1 July 2026	MiCA Article 143(3): latest end of the EU transitional period for existing providers (EU maximum; member states may shorten it)	EUR-Lex
29 September 2026	BaFin consumer warning about a series of platforms offering crypto-asset services without authorisation	BaFin
1 January 2027	DORA replaces BAIT as the IT requirement for institutions licensed for qualified crypto custody without a CASP authorisation, per BaFin's overview	BaFin

Not covered here

Tax is not covered: the Federal Ministry of Finance (BMF) letter of 6 March 2025 on the income-tax treatment of crypto-assets could not be read (the ministry site returned a security check), so this page does not say how the one-year holding period of § 23 of the Income Tax Act (EStG) applies to crypto-assets. The KMAG text is the unofficial consolidated version on gesetze-im-internet.de; its Federal Law Gazette (BGBl) publication was not read. The BaFin company database and the ESMA interim MiCA register were not opened, so this page gives no count of authorised German CASPs or token issuers. The domain names listed in BaFin's warning of 29 September 2026 are not reproduced. EU-level MiCA rules are cited from EUR-Lex.

See all jurisdictions: regulation tracker.

Compare all jurisdictions in one table

Sources

Updated: 2026-11-11 · Markdown version

Cite as: Germany: crypto and stablecoin regulation, achivx.org, https://achivx.org/regulation/germany/, as of 2026-11-06, CC BY 4.0