Quick actions

Crypto License

Crypto License in Germany

Prepare your CASP application for BaFin under MiCA

de
Maksim Gasanbekov

Maksim Gasanbekov

Last updated: 11 min read

Fact Checked by: Mark Gofaizen

Service Snapshot

Regulatory & Service Snapshot

Gofaizen & Sherle prepares crypto service businesses for German authorization.

We support applications to BaFin, Germany’s financial supervisor, for crypto-asset service provider (CASP) authorization under the EU Markets in Crypto-Assets Regulation (MiCA or MiCAR). Approval covers specific services. Eligible regulated institutions may use Article 60 notification.

  • Regime EU-wide MiCAR rules
  • Regulator BaFin
  • Route Article 59 authorization or eligible Article 60 notification
  • Services Permission follows the selected activities
  • Safeguards €50,000/€125,000/€150,000 minimum safeguards by service class; fixed overheads may raise the requirement
  • Application Articles 62/63 govern applications; preparation and fees assessed individually
  • Passporting Article 65 notification to provide authorized services across EU borders
  • Ongoing Duties Compliance continues after authorization

Is Germany the Right Fit

sign positive

May fit

  • You plan to exchange or safeguard customers’ crypto assets, or operate a trading platform, with genuine German operations
sign warning

May not fit

  • Your business combines crypto services with payments, e-money tokens (EMTs) or tokenized investments

Different Perimeter: Issuing tokens and handling financial instruments require classification beyond a CASP application

Choose the Regulatory Route

Regulatory RouteLegal RouteAuthorityOutputLimitation
Crypto service applicantArticles 59/63 authorizationBaFinApproved servicesOnly authorized activities
Eligible financial institutionArticle 60 notification before startingBaFinCategory-limited service rightsElectronic money institutions: custody/transfer of their own EMTs only; payment institutions are not a category
Token issuance Issuer rulesDepends on token category Issuer obligationsCASP approval does not authorize issuance
Financial instrumentsMarkets in Financial Instruments Directive (MiFID II) rulesDepends on activityInvestment permissionOutside MiCAR’s crypto-service regime
Payment servicesPayment-services rulesDepends on activityPermission or authorized providerCASP approval does not replace payment permission

Covered Crypto Asset Services

  1. Custody and Administration
    Hold and administer customers’ crypto assets
  2. Trading Platform
    Operate a venue where multiple buyers and sellers trade
  3. Exchange for Funds
    Exchange crypto for money or money for crypto
  4. Exchange for Crypto Assets
    Exchange one crypto asset for another
  5. Execution
    Buy or sell crypto on customers’ behalf
  6. Placing
    Market crypto assets for offerors; this does not authorize issuance
  7. Reception and Transmission
    Receive customers’ orders and forward them for execution
  8. Advice
    Give personalized recommendations
  9. Portfolio Management
    Manage crypto portfolios under clients’ mandates
  10. Transfers
    Transfer crypto between addresses with the required service permission
One business may need several permissions.

BaFin CASP Application Support

Gofaizen & Sherle supports your application by:

  1. Assessment & Structuring

    • Classifying activities and coordinating the corporate structure
  2. Documentation & Compliance

    • Preparing application documents, anti-money-laundering (AML) and governance materials
  3. ICT Readiness

    • Supporting information and communications technology (ICT) readiness
  4. Regulatory Interaction

    • Helping answer BaFin’s questions and correct documents

You provide accurate information and implement controls. BaFin decides which services you may provide. German counsel or partner tasks require agreement.

Scope and Cost Categories

Application support within agreed scope

  • Deliverables: Route assessment, corporate structuring coordination, application documents, responses to BaFin;
  • Exclusions: BaFin’s decision, client implementation, additional services unless agreed;
  • Professional Fee: Quoted after assessment;
  • Official Fees: Confirm current charges before filing;
  • Third Party Costs: Banking, technology and operating providers charge separately.

Prudential safeguards are resources the company must maintain to cover risks, rather than fees paid to the regulator.

Application Process

  1. Gofaizen & Sherle assesses your activities, entity and existing permissions, then agrees the route and work.

  2. You establish the organization and implement controls while we prepare documents. Tasks can run in parallel.

  3. You file the application or notification with our support.

  4. BaFin reviews it

    Missing information requires a response before the relevant review can proceed.

  5. Approval permits only its stated services. Following refusal, address the reasons before pursuing another application.

  6. Launch within permitted rights. Complete cross-border notification when needed.

Inputs for Assessment

  • user cog

    Ownership & Management

    Ownership, ultimate beneficial owners, managers and establishment

  • document

    Business Model & Tech

    Services, transaction flows, markets and technology,
    business plan and three-year forecasts

  • laptop

    Compliance & Resources

    Financial resources, AML/customer-identification procedures, ICT, outsourcing, safeguarding and complaints documents

Our expertise

Why Gofaizen & Sherle?

We combine legal, regulatory and technical expertise to support businesses navigating complex regulatory requirements from initial assessment to implementation.

  1. Corporate structuring Company formation and cross-border business setup.
  2. Financial regulations Application preparation and regulator-facing documentation.
  3. Compliance & Governance AML/CTF frameworks and post-authorisation support.

What we handle

  • w assessment Project assessment
  • w structuring Structuring & Classification
  • w documentation Documentation
  • w implementation Implementation support
Maksim Gasanbekov

Maksim Gasanbekov

Partner, Head of Sales (Crypto and Blockchain)

maksim@gofaizen-sherle.com
Mark Gofaizen

Mark Gofaizen

Senior Partner, Head of Consulting

mark@gofaizen-sherle.com

Timeline and Dependencies

Preparation depends on your information and controls; banks and technology providers set their schedules.

  • Article 63

    acknowledgment within 5 working days of receipt; completeness check within 25 working days. Assessment takes 40 working days from a complete application; decision notification follows within 5 working days of the decision.

  • Article 60

    notify at least 40 working days before starting. BaFin checks completeness within 20 working days; a request for missing information can pause the 40-day period for up to 20 working days. Later requests add no pause. Incomplete notification prevents launch.

  • Article 65

    authorized cross-border services may start 15 calendar days after notification or earlier communication of forwarding.

A necessary-information request by assessment working day 20 may suspend assessment for up to 20 working days. Later requests add no suspension. Initial incompleteness has no universal 20-day remedy limit.

Effective from

Regulatory Framework

MiCAR Title V sets the EU CASP rules. Germany’s crypto-market supervision law (KMAG) governs national supervision.

The Digital Operational Resilience Act (DORA) addresses ICT risk; Germany’s Money Laundering Act (GwG) governs AML duties. The Transfer of Funds Regulation (TFR) requires information about senders and recipients.

Requirements and Client Inputs

Article 63 applicants need:

  • A registered office where some services occur, effective management in the EU and at least one director resident in the EU.
  • Suitable managers and governance.
  • Safeguards equal to the higher of the service-class floor (€50,000, €125,000 with custody/exchange, €150,000 with a platform) and one-quarter of the preceding year’s fixed overheads (fixed operating expenses). New businesses use the first 12 months’ forecast.

Safeguards may combine qualifying own funds with appropriate insurance or a comparable guarantee. These resources need not all be share capital. Client assets cannot replace them.

Current Regulatory Status

ItemStatus
CASP regimeMiCAR applies by service and route
German transitionMiCAR transition ended by December 31, 2025; German Banking Act (KWG) permission is not automatic MiCA authorization
Application standardsRegulation 2025/305 specifies information; 2025/306 provides forms/templates
Official registersCheck the entity, permitted services and withdrawal status in ESMA and national records

Ongoing Compliance

  1. AML and Transfers: Identify customers and beneficial owners, monitor transactions, report suspicions and handle required TFR information
  2. ICT Resilience: Manage ICT risks, report major incidents, test systems and oversee technology providers under DORA
  3. Safeguarding: Keep company resources, client money and crypto assets distinct and protected
  4. Governance and Records: Maintain governance and handle complaints free of charge; keep MiCAR records five years, or up to seven on timely authority request
  5. Outsourcing: The CASP remains responsible for outsourced work
  6. Service Controls: Apply relevant custody, trading, execution, suitability and transfer requirements

Tax and Financial Planning

For German limited companies (GmbH/AG) in 2026, corporate income tax is 15%, plus solidarity surcharge of 5.5% of that tax and municipal trade tax. Entity, municipality, activities, staff and cross-border flows affect tax planning.

Unauthorized Activity Risk

Confirm service rights before launch. Under KMAG section 9, BaFin may order unauthorized activities to cease and be wound down.

Banking and Payment Readiness

Banks and payment providers decide independently whether to accept you.

They examine beneficial owners, funding sources, flows, markets, counterparties and risk. CASP authorization does not guarantee an account. Distinguish company funds, client fiat and crypto assets in your arrangements. Payment services need applicable permission or an authorized provider; not every crypto transfer is a payment service.

Compare EU Jurisdictions

Choose where you can genuinely operate and manage the business under Article 59. MiCA provides common service and safeguard rules.

JurisdictionsRegulatorFitOperational BurdenPassportingLimitation
GermanyBaFinGerman service operationsGovernance and controlsArticle 65Approved services only
NetherlandsAFM/DNBDutch operating baseAFM filing, DNB prudential mattersArticle 65Roles depend on activity
FranceAMFFrench operating baseMiCA governance and controls Article 65Common EU requirements still apply
SpainCNMVSpanish service operationsDistinguish service/issuer responsibilitiesArticle 65Banco de España supervises asset-referenced token (ART) and EMT issuers
LithuaniaBank of LithuaniaLithuanian operating baseNational forms and annexesArticle 65 National rules still apply.
EstoniaFinantsinspektsioon Estonian operating basePortal filing; application in EstonianArticle 65Identify documents submitted in English

Passporting covers authorized services after notification. The home authority forwards information within 10 working days.

Frequently Asked Questions

What does CASP authorization cover?

Only approved crypto services; token issuance and financial instruments require separate assessment.

How do Articles 59 and 60 differ?

Article 59 requires authorization; Article 60 permits eligible financial institutions’ category-limited services after notification.

Can foreign founders apply?

Yes, subject to ownership checks, an office where services occur, EU effective management and at least one director resident in the EU.

How much capital is required?

Article 67 safeguards use the higher of €50,000/€125,000/€150,000 by class and one-quarter of the preceding year’s fixed overheads, not a regulator fee.

What information does the application need?

Ownership, managers, operations, resources and controls; supporting documents depend on the requested services.

How long does BaFin assessment take?

40 working days from a complete application, subject to the information-request suspension; preparation and completeness review add time.

Can an authorized CASP serve other EU states?

Yes, within authorized scope, 15 calendar days after Article 65 notification or earlier communication of forwarding.

What compliance continues after authorization?

Applicable AML, transfer-information, DORA, safeguarding, governance and service-specific controls continue throughout operations.

Does authorization guarantee a bank account?

No. The bank conducts its own checks; payment permissions remain a separate question.

What determines the tax treatment?

Entity, municipality, activities, staff and cross-border flows determine the tax analysis.

Client Testimonials

Trusted by Industry Leaders

We at Invity and SatoshiLabs as a whole were extremely pleased with the legal support provided by Gofaizen & Sherle in establishing our virtual assets business in Lithuania. Their expertise and thorough understanding of the virtual assets landscape were invaluable, ensuring that every aspect of our setup was compliant and robust. The team's professionalism and dedication made the entire process seamless and stress-free. We highly recommend Gofaizen & Sherle for their legal services in the virtual assets sector.

inviti logo Jan Chudoba Head of Legal Invity
Basal Pay Case study

Basal Pay

Services Provided: Global licensing strategy, Canada MSB company setup, compliance documentation, AML/KYC frameworks, HR & governance support, quarterly AML reporting, El Salvador DASP incorporation & licensing, and ongoing regulatory maintenance.

Read case

Connect with our experts

Our experts will tell you how to do it as quickly and easily as possible.

Maksim Gasanbekov
Maksim Gasanbekov
Partner, Head of Sales (Crypto and Blockchain)
Mark Gofaizen
Mark Gofaizen
Senior Partner, Head of Consulting
Get in touch
Phone
Estonia +372 Estonia

    Connect with our experts

    Our experts will tell you how to do it as quickly and easily as possible.

    Estonia

      By clicking the button, I confirm that I have read the privacy policy and consent to the collection and processing of my personal data in accordance with the GDPR rules.

      Thank you

      Thank you for reaching us. Our team is working on your request, and we will contact you soon.

      Message not sent