BaFin CASP Authorisation in Practice (MiCA)

Who needs MiCA-CASP authorisation?

Every firm providing crypto-asset services in or into Germany. The MiCA regulation (Markets in Crypto-Assets) has applied EU-wide in full to crypto-asset service providers (CASPs) since 30 December 2024. Germany’s national transitional regime for existing providers (§ 50 KMAG) expired on 31 December 2025 — there is no grandfathering route left. Anyone starting now, or continuing to operate, needs authorisation before providing services.

The competent authority in Germany is BaFin. Covered services include: custody and administration of crypto-assets, operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, execution, reception and transmission of orders, placing, advice, portfolio management and transfer services. For an overview of the license landscape, see our Crypto License (BaFin) practice area.

What own funds does MiCA require?

Annex IV MiCAR assigns the nine CASP services to three own-funds classes. In every case, the requirement is the higher of the stated class minimum or one quarter of the previous year’s fixed overheads (Art. 67 MiCAR):

Class	Services	Minimum capital
Class 1	Reception/transmission, advice, execution and placing of orders	€50,000
Class 2	additionally custody/administration and exchange of crypto-assets	€125,000
Class 3	additionally operating a trading platform	€150,000

In practice this means a growing provider with substantial fixed costs may need to hold considerably more than the nominal class minimum. Own-funds planning belongs at the start of application preparation, not at the end.

How does the procedure work — what do “25 + 40 working days” mean?

Art. 63 MiCAR gives the procedure a fixed rhythm:

• 25 working days: after receipt, BaFin checks whether the application is complete. If anything is missing, it sets a deadline for supplementation.
• 40 working days: from completeness, BaFin decides on the authorisation.
• Suspension: if BaFin requests further information during the assessment, the 40-day period can be suspended for up to 20 working days.

The statutory clock is only half the story, though: it starts with a complete application. In practice, most of the overall timeline goes into preparation — the business plan, governance documentation, outsourcing agreements, AML/KYC framework and IT security architecture must be consistent before filing. Every information request costs real weeks. An application that passes the completeness check cleanly is the most effective accelerator.

What documentation does BaFin expect?

Company and management

• A corporation (GmbH, AG) with its head office in Germany — for the formation mechanics, see our guide GmbH Formation for Foreigners
• At least two managing directors: reliable, professionally qualified (financial services, crypto, IT), reachable from Germany
• Evidence of own funds matching the service class
• A transparent shareholder structure, including holders of qualifying participations

Business plan and organisation

• Business model description for each service applied for
• Organisational chart, staffing plan, clear responsibilities
• Risk management and compliance function, anti-money-laundering officer
• Conflict-of-interest rules and complaints handling
• Outsourcing governance (contracts and controls)

IT security and custody

• IT security framework: cybersecurity, key management, cold storage
• Disaster recovery and business continuity planning
• Transaction traceability (audit trail)
• For custody: segregation of client assets and a custody concept

Anti-money laundering

• KYC procedures for customer identification
• Transaction monitoring and suspicious-activity reporting (FIU)
• Sanctions screening and travel-rule implementation

What does the end of the transitional regime (§ 50 KMAG) mean in practice?

Germany had granted existing providers — in particular holders of the 2020 KWG crypto custody license — a national transitional period. It expired on 31 December 2025. Since then:

• Operating solely on the basis of the KWG crypto custody license is no longer permitted.
• The simplified route into the MiCA world is closed — the regular authorisation procedure applies.
• New entrants must obtain CASP authorisation before providing services — launching “in parallel with the application” is not an option.

For planning purposes this means the authorisation date sets the market-entry date. If you are building up staff, IT and contracts, align that roadmap with the application timeline.

What does authorisation cost?

As non-binding market estimates — actual costs depend heavily on the business model and the maturity of your organisation:

• BaFin fees: €10,000-50,000 depending on license type
• Legal advice: €50,000-150,000
• Compliance consulting: €30,000-100,000
• IT infrastructure: €50,000-200,000
• Own funds: €50,000-150,000 depending on class (tied up, not spent)

Ongoing costs for personnel, compliance and IT continue after authorisation. The own funds are not a “price” but regulatory capital that remains the company’s.

What does a German authorisation deliver across the EU?

MiCA is a regulation — directly applicable in every member state. A CASP authorisation granted in Germany can be extended to the entire EU via passporting, without running a separate procedure in each country. Conversely, a CASP authorised in another EU state can operate in Germany, provided the home-state substance and supervision requirements remain satisfied.

For providers focused on the German-speaking market, Germany’s supervisory track record since 2020, the standing of a German authorisation with institutional clients, and easier banking access argue for the German route. A specialized lawyer can review your service classification, structure the application file and run the dialogue with BaFin.