Germany grants MiCA CASP authorisation through BaFin under the national implementing legislation, FinmadiG and KMAG, in force since 27 December 2024. The authorisation replaced the legacy KWG crypto custody licence, with a simplified transition track for firms already licensed under the KWG. Applications go to BaFin with the Deutsche Bundesbank involved in parallel, and BaFin is widely regarded as the most demanding CASP regulator in the EU.
The volume is the striking feature. Germany used a twelve month grandfathering window, with applications due before 8 October 2025, and by mid 2026 it had become the EU's largest CASP hub, holding roughly a quarter of the EU's authorisations, including Trade Republic, N26, Commerzbank and Bitpanda. The regime is demanding but well trodden.
Initial capital follows the MiCA class-based own-funds minimums, scaling with the service classes sought, or a quarter of fixed overheads where that is higher. BaFin's application fee is time-based and small relative to total application spend; the heavier costs sit in advisory, build, the annual supervisory levy and the compliance, ICT and audit overhead a full-scope firm carries. Statutory assessment clocks are short on paper, but the documentation-heavy filings and Bundesbank involvement stretch the real elapsed time well beyond them; the simplified KWG transition track runs faster.
Substance expectations are firm: a genuine German establishment, at least two qualified managing directors under the four-eyes principle, named compliance and money laundering officers, and DORA-aligned ICT resilience. Authorisation is scoped strictly to the services applied for, and BaFin publishes warnings and sanctions against unlicensed providers. Once granted, the authorisation passports across the EU and EEA under MiCA.