Gofaizen & Sherle prepares crypto service businesses for German authorization.
We support applications to BaFin, Germany’s financial supervisor, for crypto-asset service provider (CASP) authorization under the EU Markets in Crypto-Assets Regulation (MiCA or MiCAR). Approval covers specific services. Eligible regulated institutions may use Article 60 notification.
RegimeEU-wide MiCAR rules
RegulatorBaFin
RouteArticle 59 authorization or eligible Article 60 notification
ServicesPermission follows the selected activities
Safeguards€50,000/€125,000/€150,000 minimum safeguards by service class; fixed overheads may raise the requirement
ApplicationArticles 62/63 govern applications; preparation and fees assessed individually
PassportingArticle 65 notification to provide authorized services across EU borders
Ongoing DutiesCompliance continues after authorization
Is Germany the Right Fit
May fit
You plan to exchange or safeguard customers’ crypto assets, or operate a trading platform, with genuine German operations
May not fit
Your business combines crypto services with payments, e-money tokens (EMTs) or tokenized investments
Different Perimeter: Issuing tokens and handling financial instruments require classification beyond a CASP application
Choose the Regulatory Route
Regulatory Route
Legal Route
Authority
Output
Limitation
Crypto service applicant
Articles 59/63 authorization
BaFin
Approved services
Only authorized activities
Eligible financial institution
Article 60 notification before starting
BaFin
Category-limited service rights
Electronic money institutions: custody/transfer of their own EMTs only; payment institutions are not a category
Token issuance
Issuer rules
Depends on token category
Issuer obligations
CASP approval does not authorize issuance
Financial instruments
Markets in Financial Instruments Directive (MiFID II) rules
Depends on activity
Investment permission
Outside MiCAR’s crypto-service regime
Payment services
Payment-services rules
Depends on activity
Permission or authorized provider
CASP approval does not replace payment permission
Covered Crypto Asset Services
Custody and Administration Hold and administer customers’ crypto assets
Trading Platform Operate a venue where multiple buyers and sellers trade
Exchange for Funds Exchange crypto for money or money for crypto
Exchange for Crypto Assets Exchange one crypto asset for another
Execution Buy or sell crypto on customers’ behalf
Placing Market crypto assets for offerors; this does not authorize issuance
Reception and Transmission Receive customers’ orders and forward them for execution
Advice Give personalized recommendations
Portfolio Management Manage crypto portfolios under clients’ mandates
Transfers Transfer crypto between addresses with the required service permission
One business may need several permissions.
BaFin CASP Application Support
Gofaizen & Sherle supports your application by:
01
Assessment & Structuring
Classifying activities and coordinating the corporate structure
02
Documentation & Compliance
Preparing application documents, anti-money-laundering (AML) and governance materials
03
ICT Readiness
Supporting information and communications technology (ICT) readiness
04
Regulatory Interaction
Helping answer BaFin’s questions and correct documents
You provide accurate information and implement controls. BaFin decides which services you may provide. German counsel or partner tasks require agreement.
Official Fees: Confirm current charges before filing;
Third Party Costs: Banking, technology and operating providers charge separately.
Prudential safeguards are resources the company must maintain to cover risks, rather than fees paid to the regulator.
Application Process
Step1
Gofaizen & Sherle assesses your activities, entity and existing permissions, then agrees the route and work.
Step2
You establish the organization and implement controls while we prepare documents. Tasks can run in parallel.
Step3
You file the application or notification with our support.
Step4
BaFin reviews it
Missing information requires a response before the relevant review can proceed.
Step5
Approval permits only its stated services. Following refusal, address the reasons before pursuing another application.
Step6
Launch within permitted rights. Complete cross-border notification when needed.
Inputs for Assessment
Ownership & Management
Ownership, ultimate beneficial owners, managers and establishment
Business Model & Tech
Services, transaction flows, markets and technology,
business plan and three-year forecasts
Compliance & Resources
Financial resources, AML/customer-identification procedures, ICT, outsourcing, safeguarding and complaints documents
Our expertise
Why Gofaizen & Sherle?
We combine legal, regulatory and technical expertise to support businesses navigating complex regulatory requirements from initial assessment to implementation.
01Corporate structuringCompany formation and cross-border business setup.
02Financial regulationsApplication preparation and regulator-facing documentation.
03Compliance & GovernanceAML/CTF frameworks and post-authorisation support.
Preparation depends on your information and controls; banks and technology providers set their schedules.
Article 63
acknowledgment within 5 working days of receipt; completeness check within 25 working days. Assessment takes 40 working days from a complete application; decision notification follows within 5 working days of the decision.
Article 60
notify at least 40 working days before starting. BaFin checks completeness within 20 working days; a request for missing information can pause the 40-day period for up to 20 working days. Later requests add no pause. Incomplete notification prevents launch.
Article 65
authorized cross-border services may start 15 calendar days after notification or earlier communication of forwarding.
A necessary-information request by assessment working day 20 may suspend assessment for up to 20 working days. Later requests add no suspension. Initial incompleteness has no universal 20-day remedy limit.
LawMiCARKMAG
Effective from
Regulatory Framework
MiCAR Title V sets the EU CASP rules. Germany’s crypto-market supervision law (KMAG) governs national supervision.
The Digital Operational Resilience Act (DORA) addresses ICT risk; Germany’s Money Laundering Act (GwG) governs AML duties. The Transfer of Funds Regulation (TFR) requires information about senders and recipients.
Requirements and Client Inputs
Article 63 applicants need:
A registered office where some services occur, effective management in the EU and at least one director resident in the EU.
Suitable managers and governance.
Safeguards equal to the higher of the service-class floor (€50,000, €125,000 with custody/exchange, €150,000 with a platform) and one-quarter of the preceding year’s fixed overheads (fixed operating expenses). New businesses use the first 12 months’ forecast.
Safeguards may combine qualifying own funds with appropriate insurance or a comparable guarantee. These resources need not all be share capital. Client assets cannot replace them.
Current Regulatory Status
Item
Status
CASP regime
MiCAR applies by service and route
German transition
MiCAR transition ended by December 31, 2025; German Banking Act (KWG) permission is not automatic MiCA authorization
Check the entity, permitted services and withdrawal status in ESMA and national records
Ongoing Compliance
AML and Transfers: Identify customers and beneficial owners, monitor transactions, report suspicions and handle required TFR information
ICT Resilience: Manage ICT risks, report major incidents, test systems and oversee technology providers under DORA
Safeguarding: Keep company resources, client money and crypto assets distinct and protected
Governance and Records: Maintain governance and handle complaints free of charge; keep MiCAR records five years, or up to seven on timely authority request
Outsourcing: The CASP remains responsible for outsourced work
Service Controls: Apply relevant custody, trading, execution, suitability and transfer requirements
Tax and Financial Planning
For German limited companies (GmbH/AG) in 2026, corporate income tax is 15%, plus solidarity surcharge of 5.5% of that tax and municipal trade tax. Entity, municipality, activities, staff and cross-border flows affect tax planning.
Unauthorized Activity Risk
Confirm service rights before launch. Under KMAG section 9, BaFin may order unauthorized activities to cease and be wound down.
Banking and Payment Readiness
Banks and payment providers decide independently whether to accept you.
They examine beneficial owners, funding sources, flows, markets, counterparties and risk. CASP authorization does not guarantee an account. Distinguish company funds, client fiat and crypto assets in your arrangements. Payment services need applicable permission or an authorized provider; not every crypto transfer is a payment service.
Compare EU Jurisdictions
Choose where you can genuinely operate and manage the business under Article 59. MiCA provides common service and safeguard rules.
Jurisdictions
Regulator
Fit
Operational Burden
Passporting
Limitation
Germany
BaFin
German service operations
Governance and controls
Article 65
Approved services only
Netherlands
AFM/DNB
Dutch operating base
AFM filing, DNB prudential matters
Article 65
Roles depend on activity
France
AMF
French operating base
MiCA governance and controls
Article 65
Common EU requirements still apply
Spain
CNMV
Spanish service operations
Distinguish service/issuer responsibilities
Article 65
Banco de España supervises asset-referenced token (ART) and EMT issuers
Lithuania
Bank of Lithuania
Lithuanian operating base
National forms and annexes
Article 65
National rules still apply.
Estonia
Finantsinspektsioon
Estonian operating base
Portal filing; application in Estonian
Article 65
Identify documents submitted in English
Passporting covers authorized services after notification. The home authority forwards information within 10 working days.
Yes, subject to ownership checks, an office where services occur, EU effective management and at least one director resident in the EU.
How much capital is required?
Article 67 safeguards use the higher of €50,000/€125,000/€150,000 by class and one-quarter of the preceding year’s fixed overheads, not a regulator fee.
What information does the application need?
Ownership, managers, operations, resources and controls; supporting documents depend on the requested services.
How long does BaFin assessment take?
40 working days from a complete application, subject to the information-request suspension; preparation and completeness review add time.
Can an authorized CASP serve other EU states?
Yes, within authorized scope, 15 calendar days after Article 65 notification or earlier communication of forwarding.
What compliance continues after authorization?
Applicable AML, transfer-information, DORA, safeguarding, governance and service-specific controls continue throughout operations.
Does authorization guarantee a bank account?
No. The bank conducts its own checks; payment permissions remain a separate question.
What determines the tax treatment?
Entity, municipality, activities, staff and cross-border flows determine the tax analysis.
We at Invity and SatoshiLabs as a whole were extremely pleased with the legal support provided by Gofaizen & Sherle in establishing our virtual assets business in Lithuania. Their expertise and thorough understanding of the virtual assets landscape were invaluable, ensuring that every aspect of our setup was compliant and robust. The team's professionalism and dedication made the entire process seamless and stress-free. We highly recommend Gofaizen & Sherle for their legal services in the virtual assets sector.
Services Provided: Global licensing strategy, Canada MSB company setup, compliance documentation, AML/KYC frameworks, HR & governance support, quarterly AML reporting, El Salvador DASP incorporation & licensing, and ongoing regulatory maintenance.
By clicking “Accept”, you agree to the storing of cookies and similar technologies on your device to enhance site navigation, analyze site usage, offer certain functionalities and assists in our marketing effort. Strickly necessary cookies are always active.
Our experts will tell you how to do it as quickly and easily as possible.
By clicking the button, I confirm that I have read the privacy policy and consent to the collection and processing of my personal data in accordance with the GDPR rules.
Thank you
Thank you for reaching us. Our team is working on your request, and we will contact you soon.