Crypto Country GuideCrypto rules and tax, country by country

Germany: regulation

Last reviewed: October 2026

On this page
  1. Legal status and supervision
  2. Exchanges and KYC
  3. Stablecoins
  4. Crypto ATMs
  5. Scams
  6. Self-custody
    1. If you lose access
  7. Sources
  • BaFin supervises crypto-asset service providers under the EU MiCA Regulation, which Germany supplements with the KMAG. The German transitional period ended on 31 December 2025.
  • Expect identity checks. For transfers of more than €1,000 to or from your own wallet, the provider must check whether that wallet is yours.
  • Only banks and e-money institutions may issue e-money tokens (euro or dollar stablecoins under MiCA).
  • BaFin publishes warnings about fake crypto platforms almost daily. If you have been defrauded, report it to the police; BaFin cannot get your money back.

This page covers who supervises crypto in Germany, what that means when you use a provider, and the rules for your own wallet. Which exchanges are licensed, with their fees, is on exchanges; the EU-wide rules are on EU rules. It is general information, not legal advice.

Owning, buying and selling crypto is legal in Germany. The EU Markets in Crypto-Assets Regulation (MiCA) applies directly; Germany supplements it with the Kryptomärkteaufsichtsgesetz (KMAG). Under section 3 KMAG, the Federal Financial Supervisory Authority (BaFin) is the competent authority, and the Deutsche Bundesbank carries out some supervisory tasks. BaFin says MiCA has applied to crypto-asset services since 30 December 2024.

Firms that already held a German license could keep operating under a transitional rule until they received a decision on their MiCA authorization, but at the latest until the end of 31 December 2025 (section 50 KMAG). That period is over. The German Banking Act (KWG) still has its own license for “qualified crypto custody business” (keeping crypto or private keys for others). BaFin says this KWG license does not allow a firm to operate in other EEA countries; only a MiCA authorization gives that “European passport”.

Exchanges and KYC

An exchange or custodian that serves customers in Germany needs a MiCA authorization from BaFin or from the regulator of another EU country that has passported it to Germany. BaFin lists the firms it has authorized or that have notified it in its company database (Unternehmensdatenbank); ESMA’s interim MiCA register lists all EU providers and the countries they may serve. How to check a provider is on exchanges.

Crypto providers are obliged entities under the Money Laundering Act (GwG), so they must identify you. Under section 10(3) GwG their due diligence duties also apply to crypto transfers worth €1,000 or more. Since 30 December 2024, the EU Transfer of Funds Regulation (Regulation (EU) 2023/1113, the “travel rule”) requires providers to send the sender’s and recipient’s details with every crypto transfer, whatever the amount. For a transfer of more than €1,000 to or from a self-hosted wallet, the provider must take adequate measures to assess whether you own or control that wallet. Providers also collect your tax identification number for reporting to the tax authorities; see filing.

Stablecoins

MiCA distinguishes e-money tokens (EMTs), which refer to one official currency such as the euro, and asset-referenced tokens (ARTs), which refer to other values or a basket. According to BaFin:

  • Only credit institutions and e-money institutions may issue e-money tokens, and each needs a crypto-asset white paper.
  • Anyone who wants to offer an asset-referenced token to the public, or have it admitted to trading, needs BaFin’s authorization beforehand (Articles 16 and 18 MiCA).

ESMA’s register of e-money token white papers (file of 7 October 2026) lists one German issuer, AllUnity GmbH, an e-money institution supervised by BaFin, with tokens in euros, Swiss francs, Swedish kronor and US dollars. Tokens from issuers in other EU countries, such as Circle’s (France), are listed too. Tether’s USDT is not in the register. Whether a German exchange may still offer a particular stablecoin depends on MiCA; we did not find a BaFin list of permitted or restricted stablecoins, so check the ESMA register for the token you want to use.

Crypto ATMs

We found no current BaFin publication on crypto ATMs (October 2026). Exchanging crypto for cash or the other way round is “exchange of crypto-assets for funds”, a crypto-asset service under MiCA, so a machine operated as a business in Germany would need an authorization like any other provider. We did not find a provider in ESMA’s register that describes itself as a crypto ATM operator in Germany. If you see a crypto ATM, check the operator in BaFin’s company database before you use it.

Scams

BaFin describes the typical pattern of fake trading platforms: contact by phone, email, social media or adverts with faked celebrity endorsements; promises of high, safe returns; a “broker” who asks you to open an account at a crypto exchange and send coins to a wallet that belongs to the criminals; remote-access software on your device; a dashboard with fake profits; and, when you want to withdraw, demands for “taxes” or “fees” first. BaFin warns that years later the same people may pose as helpers who can recover your money, sometimes claiming to act for BaFin. Its advice includes:

  • Be skeptical of unsolicited calls about investments; cold calling is generally prohibited.
  • Check that the provider is licensed, in BaFin’s company database or the register of another EEA regulator, and check BaFin’s warnings.
  • Do not invest if a website has no or an incorrect legal notice (Impressum), and never give strangers remote access to your devices.
  • Be wary when asked to pay into accounts that are not obviously the provider’s own.

BaFin’s warning list is updated often. In the week before we checked it, BaFin warned among others about a series of near-identical “AI trading platform” websites offering crypto-asset services without authorization (29 September 2026) and about bitbucks(.)space (30 September 2026). BaFin itself says its warnings can never be complete.

Where to report. If you think you have been defrauded, BaFin says to report it to the police or the public prosecutor (Staatsanwaltschaft) as soon as possible. You can tell BaFin about a firm that operates without a license, by letter, fax or email to [email protected]. BaFin uses such tips in its supervision, but it cannot help in individual cases: “Die BaFin kann Verbraucherinnen und Verbrauchern im Einzelfall nicht zu ihrem Recht verhelfen.” It does not recover money; for that you need the police, a lawyer or the courts.

Self-custody

We found no German rule that requires you to register or license a wallet you control yourself. Keeping crypto or private keys for others is a licensed activity under MiCA and the KWG, keeping your own is not. For tax, moving coins between your own wallets is not a sale, and coins in your own wallet are taxed like coins on an exchange; see personal tax. The rules do reach you when you move coins between a provider and your own wallet: above €1,000 the provider must check that the wallet is yours.

Holding crypto yourself means the keys are your responsibility. If you keep larger amounts of bitcoin in your own wallet, this explanation of multisig versus a single hardware wallet sets out what each protects against.

If you lose access

The BMF letter of 6 March 2025 does not say how lost private keys or stolen coins are treated for income tax, and we found no other official German guidance on it (October 2026). It does say that missing records and data lost through an exchange’s insolvency or a hack count against you, so keep your own copies of transaction histories; see records. What heirs need to do to reach crypto in a wallet or on an exchange is covered in this guide to crypto inheritance in Germany; for email, password managers and other online accounts, see this introduction to planning a digital estate.

Sources

This page is general information, not legal advice. Rules change, so check the official sources above before you act.