On 21 February 2025, Germany’s Federal Financial Supervisory Authority (BaFin) announced new regulatory measures under the European Union’s Markets in Crypto-Assets Regulation (MiCAR), which has been in force since December 2024. BaFin stated that crypto-asset service providers (CASPs) must submit well-prepared authorisation applications, as strict deadlines under MiCAR limit the time available for supervisory review.
MiCAR is the first harmonised European Union framework governing crypto-assets, which provides a structured approach to regulation to enhance investor protection, prevent money laundering and terrorist financing, ensure market integrity, and maintain financial stability. MiCAR establishes a clear legal structure for innovations in distributed ledger technology (DLT). MiCAR introduces transparency requirements for the issuance and trading of crypto-assets, mandates authorisation for CASPs, outlines supervisory requirements, and sets rules for consumer protection, market abuse prevention, and product intervention.
The announcement clarifies that BaFin now holds expanded supervisory responsibilities under MiCAR. While some regulatory aspects were previously covered under the Germany Banking Act (Kreditwesengesetz – KWG), MiCAR brings additional provisions and harmonised supervision across the European Union. CASPs, including crypto custodians, operators of crypto-asset trading platforms, and firms offering advisory, transfer, or portfolio management services for crypto-assets, now fall under BaFin’s oversight.
Entities intending to operate as CASPs in Germany must apply for authorisation from BaFin under MiCAR. MiCAR also introduces the EU passporting mechanism, allowing authorised CASPs to provide services across all EU member states without separate approvals. In Germany, service providers seeking this option must submit a passporting notification to BaFin, which will inform relevant authorities in other EU countries.
Institutions already authorised under KWG must obtain fresh MiCAR authorisation. However, they benefit from a transitional provision enabling them to continue operations under their KWG authorisation while awaiting a decision on their MiCAR application. These institutions cannot utilise the EU passporting mechanism until their MiCAR authorisation is granted. BaFin conducted a gap analysis comparing MiCAR’s requirements with the existing KWG framework, identifying compliance gaps and streamlining the authorisation process for firms transitioning to MiCAR supervision.
BaFin stated: “The more thoroughly and professionally an application has been prepared, the greater the likelihood that BaFin will issue a positive authorisation notification.” MiCAR mandates strict deadlines for reviewing applications, limiting BaFin’s ability to request additional information and avoid rejections. Applications deemed incomplete or inconsistent will be rejected if the applicant fails to meet the requirements within the specified timeframe.
MiCAR specifies documentation requirements, outlined in the Regulatory Technical Standard (RTS) and Implementing Technical Standard (ITS) under Article 62. These standards are currently under consultation. As per Bafin documentation must demonstrate a viable business model and compliance with IT security requirements. BaFin has provided information on its website under the Digital Operational Resilience Act (DORA) section.
MiCAR came into force in phases, with transparency, issuance, and supervision requirements applicable from 30 June 2024, while trading, CASP authorisation, market abuse prevention, and product intervention measures became effective on 30 December 2024. BaFin’s latest announcement indicates that CASPs must act promptly to meet MiCAR’s requirements, particularly given the limited timeframe for supervisory review and application processing.
