BaFin Crypto Licence Germany: VASP vs CASP, Explained (2026)

VASP vs CASP – and the legacy KWG "crypto custody licence"

Three terms get used interchangeably, and only one is current. "VASP" (Virtual Asset Service Provider) is an FATF anti-money-laundering term. It was never the EU's licensing label, and you should read it as the AML concept, not the licence. The correct EU and German label is CASP – crypto-asset service provider. Separately, the "crypto custody licence" under §1(1a) sentence 2 no. 6 KWG, in force from 2020, was the original German licence for holding crypto for clients. It has now been superseded by MiCA, and its transition ended on 31 December 2025. So if a guide tells you to "register as a VASP" or "get the KWG crypto custody licence," it is describing a regime that no longer governs new entrants.

The regime in plain English – MiCA + BaFin

MiCA is Regulation (EU) 2023/1114, the EU rulebook for crypto-assets that are not financial instruments. Its CASP rules (Title V) became applicable on 30 December 2024. BaFin authorises and supervises German CASPs, while ESMA maintains the central EU register of authorised providers. Germany's accompanying national law is the Kryptomärkteaufsichtsgesetz (KMAG, Crypto-Markets Supervision Act), published in the Federal Law Gazette on 27 December 2024. On 3 January 2025, BaFin published a guidance note (Merkblatt) on crypto-asset services under MiCAR, which is the primary supervisory reference for the services, the authorisation requirement, the notification route and the exemptions. (BaFin's site blocks automated retrieval, so the MiCAR pages should be opened directly by a human when verifying.)

The eight crypto-asset services

MiCA Art. 3 defines the regulated perimeter as a set of crypto-asset services. Providing any of them in Germany requires a CASP authorisation or an EU passport. They are:

1. Custody and administration of crypto-assets on behalf of clients
2. Operation of a trading platform for crypto-assets
3. Exchange of crypto-assets for funds
4. Exchange of crypto-assets for other crypto-assets
5. Execution of orders for crypto-assets on behalf of clients
6. Placing of crypto-assets
7. Reception and transmission of orders for crypto-assets on behalf of clients
8. Advice on crypto-assets, and portfolio management of crypto-assets

To these MiCA adds transfer services for crypto-assets on behalf of clients. If your business model touches one of these, you are inside the regime.

How much capital? The €50k/€125k/€150k classes

MiCA sets minimum own funds by class in Annex IV. The figures below are statutory floors, not a "price" for a licence.

Safeguard = higher of the class minimum or ¼ of preceding-year fixed overheads (Art. 67(1)).

The prudential requirement is the higher of the Annex IV class minimum or one quarter of the preceding year's fixed overheads (Art. 67(1)), held as own funds (CET1) or an eligible insurance policy / comparable guarantee (Art. 67(4)–(5)). There is no single "licence price." BaFin and Bundesbank fees, legal and audit costs, AML systems and qualified staffing all sit on top of the capital, and we never present an advisory cost estimate as an official figure. Re-verify each euro figure against Annex IV at the time you rely on it.

The expired KWG transition – the currency point

This is the part that dates badly if you read an older guide. Before MiCA, crypto-custody business was a regulated financial service under §1(1a) sentence 2 no. 6 KWG, in force since 2020 – the original "BaFin crypto licence."

Under MiCA Art. 143, the EU-wide grandfathering backstop is 1 July 2026. Germany, however, shortened its own window to 31 December 2025 – a roughly 12-month national path, not the EU's 18-month backstop.

BaFin's wording was that institutions holding crypto-custody authorisation on 29 December 2024 could continue "until 31.12.2025 at the latest" under the KWG. A simplified ("fast-track") procedure was available, with applications accepted until 31 August 2025, and BaFin aimed to complete its decisions by the end of December 2025. As of 10 June 2026, the German transition has expired. A firm without a granted German CASP authorisation must passport in from another Member State or stop; operating without authorisation or a passport is unauthorised business.

AML and the travel rule

Authorisation is only part of the picture. CASPs are "obliged entities" under §2 Geldwäschegesetz (GwG), which means know-your-customer and customer due diligence, transaction monitoring, recordkeeping, and suspicious-activity reporting to the Financial Intelligence Unit. They are also subject to the EU Transfer of Funds Regulation (TFR) "travel rule," under which originator and beneficiary information must accompany crypto transfers; Germany moved to the uniform EU standard at the end of 2024. AML is a continuous operating obligation, not a one-off box to tick at authorisation.

How long does authorisation take?

MiCA Art. 63 sets the statutory clock. BaFin must check the application for completeness within 25 working days of receiving it, and must reach a substantive decision within 40 working days of a complete application. In practice, end-to-end timelines commonly run to 6+ months once pre-application work, governance build-out and information requests are counted. Treat the statutory clock as a floor, not a promise; the practical figure depends heavily on how ready your file is when you submit it.

The Art. 60 notification route

Certain already-authorised entities – credit institutions and investment firms among them – may notify BaFin under Art. 60 instead of seeking full CASP authorisation, transmitting the MiCA-specified information at least 40 working days before they first offer the service. This is a lighter on-ramp for incumbents, not a general shortcut, and the precise eligibility is set out in BaFin's 3 January 2025 guidance.

What is – and isn't – a regulated service

A lot of crypto work needs no CASP authorisation. The dividing line is whether you are providing one of the regulated services to clients.

One edge case worth flagging: BaFin has clarified that installing or operating a crypto-ATM in Germany triggers a licence requirement. On the other side, pure software or protocol development, non-custodial tooling where the user keeps their keys, node operation, infrastructure, analytics and consulting are generally not crypto-asset services and can sit in an ordinary GmbH or UG. And a token that is itself a financial instrument – a security token, a tokenised bond, fund unit or share – is carved out of MiCA into the eWpG and MiFID II/WpIG/KWG. The single most useful rule is: classify the token first. Our guide to MiCA versus the eWpG in depth walks through that carve-out, and the broader regulatory landscape helps you check whether your activity is even regulated.

If you actually want to set one up

If you have read this and decided you do want to provide a regulated crypto-asset service, the next step is the practical one: how to set up a crypto company in Germany, including the GmbH or AG vehicle behind any CASP and what BaFin expects in an application. This page is the explainer; that page is where the formation work lives.