# Crypto-asset and digital securities regulation in Germany

> **Is crypto legal in Germany?** Yes. Businesses have regulated routes to operate with crypto-assets, under predictable rules. MiCA and the eWpG provide authorizable services, passporting and recognition of electronic securities. In the Metlabs Regulatory Index it scores 100/100 and ranks 1 of 76 countries assessed (assessed October 3, 2026).

- **Author:** Javier Yáñez López, Legal & Regulatory at Metlabs
- **Last reviewed:** 2026-10-15
- **Latest regulatory change:** 2026-03-31
- **Scope:** European Union
- **Authorities:** BaFin, Deutsche Bundesbank
- **Metlabs Regulatory Index:** 100/100, rank 1 of 76 countries assessed
- **Web version:** https://metlabs.io/en/blockchain-regulation/germany/

Germany combines MiCA and its national supervisory law, KMAG, with separate banking and electronic securities frameworks. BaFin and the Bundesbank act within their respective responsibilities. The eWpG permits certain electronic issuances and distinguishes central registers from crypto-securities registers. CASP authorization, qualified crypto custody and register maintenance require separate analysis. Germany shortened the EU transitional period: since 2026, former national permissions no longer substitute for MiCA authorization or notification.

In Germany, a digital asset project must distinguish crypto-assets governed by the European Markets in Crypto-Assets Regulation, MiCA, from tokens representing financial instruments. MiCA regulates certain issuers and service providers, while electronic securities have their own statute, the eWpG. Asset classification determines which issuance rules apply and what permissions the entities safeguarding, distributing or trading it require.

Germany’s framework connects these rules with BaFin supervision, Bundesbank cooperation and regulated custody and register functions. Issuing an electronic security, maintaining its register and safeguarding client assets are separate decisions. This guide explains how to organize that assessment, the limits of each permission and what must be documented for digital representation to produce the intended legal effects.

## Which rules apply to the asset and services

The [MiCA framework described by the Bundesbank](https://www.bundesbank.de/de/aufgaben/finanzaufsicht/einzelaspekte/micar-markets-in-crypto-assets-regulation-799398) governs issuances and services involving crypto-assets within the scope of the EU regulation. Germany's KMAG structures national supervision. Financial instruments fall outside MiCA and require examination of the relevant securities, investment services or banking legislation. Legal classification of the token comes before license selection.

The [KWG](https://www.gesetze-im-internet.de/kredwg/__1.html) retains specific categories, including qualified custody of cryptographic instruments and crypto-securities register maintenance, which concern assets outside MiCA. Safekeeping a crypto security issued under the eWpG for third parties generally requires a KWG securities custody permission, not CASP authorization. The current text of the KWG excludes crypto-assets within MiCA from the relevant national definition. The former German crypto custody permission should therefore not be described as an additional, undifferentiated requirement for every CASP service.

## How BaFin and the Bundesbank divide their responsibilities

[Section 3 of KMAG](https://www.gesetze-im-internet.de/kmag/__3.html) assigns the relevant national supervisory functions to BaFin. [Cooperation with the Bundesbank](https://www.gesetze-im-internet.de/kmag/__6.html) includes ongoing monitoring as provided by law. This division does not make the two bodies alternative authorization routes. Firms must identify the procedure and supervisory contact appropriate to their activities.

Public registers allow verification of the legal entity and scope of permission. In an international group, one subsidiary's authorization does not automatically entitle another company to contract with clients. Cross-border services must comply with the applicable European procedure and the restrictions attached to the product and authorized services.

## What authorization a project needs to operate

The application must identify actual activities rather than rely on the product’s commercial name. A crypto-securities register administrator performs a different function from the platform distributing the issuance or the client’s custodian. Describing who controls the register, receives instructions and is accountable to the holder supports permission selection and avoids gaps between providers.

[BaFin's information on MiCA services](https://bafin.de/DE/unternehmen-maerkte/erlaubnis-registrierung/geschaefte-krypto/kryptowerte-dienstleistungen/kryptowerte-dienstleistungen.html) refers to CASP authorization and the exceptions and procedures in the regulation. Articles 59 and 60 distinguish a new authorization from notification by certain financial entities. Article 65 allows services in other Member States within the permitted scope.

[Section 50 KMAG](https://www.gesetze-im-internet.de/kmag/__50.html) allowed certain existing national permissions to continue, but required them to expire no later than the end of December 31, 2025, earlier than the July 1, 2026, limit allowed by Article 143(3) MiCA. Since January 1, 2026, providing crypto-asset services without MiCA authorization or a valid notification is not permitted, and BaFin publishes warnings identifying unauthorized operators under Section 10(7) KMAG. Earlier expiry could follow the procedure’s outcome or the Article 60 route. This arrangement must not be confused with the European maximum period or presented as automatic MiCA authorization.

ART and EMT issuance has separate MiCA requirements. Permission for custody or exchange does not alone permit issuance of these token categories. If the product is a security or financial instrument, investment services permissions and offering requirements must be assessed. Capital, governance and documentation depend on the service and entity, so there is no single market entry figure for every project.

## What the eWpG permits for electronic securities issuance

[Section 1 of the eWpG](https://www.gesetze-im-internet.de/ewpg/__1.html) limits its scope to bearer bonds, registered shares and bearer shares where the latter are entered in a central register. This distinction prevents treating every share class as eligible for a crypto-securities register on the same basis. The security category and register system are legal as well as technical choices. Investment fund units follow their own route: [Section 95 KAGB](https://www.gesetze-im-internet.de/kagb/__95.html) and its specific regulation (KryptoFAV), which refer to the eWpG with adaptations.

[Section 2](https://www.gesetze-im-internet.de/ewpg/__2.html) allows entry in an electronic register to replace a physical certificate and gives the electronic security equivalent legal effects unless otherwise provided. [Section 16](https://www.gesetze-im-internet.de/ewpg/__16.html) sets requirements for integrity, chronological order and protection of recorded data in crypto-securities registers. The [German regulation on electronic securities registers](https://www.gesetze-im-internet.de/ewprv/BJNR188200022.html) (eWpRV) specifies those requirements, and the KWG identifies maintenance of the register as a specific financial activity. A standalone smart contract does not establish compliance with this framework. Shares issued as crypto securities face an additional corporate condition: under [Section 10(6) AktG](https://www.gesetze-im-internet.de/aktg/__10.html), the articles of association must expressly permit their entry in a crypto-securities register and exclude their certification in physical documents.

Issuance documentation must connect the security, its terms and the register with the holder's rights. A bond financing property confers the defined rights against the issuer; it does not necessarily make the investor the property's owner. Electronic representation also does not remove offering, distribution or intermediation obligations or guarantee secondary trading.

## Which obligations must be reflected in operations

MiCA, KMAG and the relevant sectoral framework require an appropriate operating organization behind an authorization. Responsibilities, custody, conflicts, complaints and external providers must be documented. Entities subject to DORA also face the corresponding digital resilience duties. Transfers covered by Regulation 2023/1113 require originator and beneficiary information, alongside applicable anti-money laundering controls. For tax purposes, the [German Act transposing](https://www.recht.bund.de/bgbl/1/2025/352/regelungstext.pdf) the EU directive on administrative cooperation for crypto-assets (DAC8), which contains the Kryptowerte-Steuertransparenz-Gesetz (KStTG), requires reporting providers to carry out due diligence on their users and to report the previous year's information to the Federal Central Tax Office (Bundeszentralamt für Steuern) by July 31 each year; the first reporting period is 2026.

Separating issuer, custodian and register administrator allocates functions that software alone cannot resolve. The project must address corrections, access recovery, continuity and instructions that conflict with legal documents. Selecting a distributed network does not remove legally required intermediaries or establish that every participant is authorized.

## How to prepare an issuance or regulated service

To structure an issuance, first define the security and its terms: who issues it, what the holder can claim and how the right transfers or is enforced. Then select the permitted register type and the entities performing regulated functions. This sequence avoids designing a smart contract that later proves incompatible with the chosen security category.

Issuance should also be separated from the secondary market. On December 3, 2024, BaFin granted 21X AG a permission for a DLT trading and settlement system (DLT TSS) under the [DLT Pilot Regime](https://eur-lex.europa.eu/eli/reg/2022/858/oj), the first of that category in [ESMA's list of authorized DLT market infrastructures](https://www.esma.europa.eu/sites/default/files/2026-01/Authorised_DLT_Market_Infrastructures.pdf). That infrastructure does not replace the eWpG or make every issuance tradable: admission to trading keeps its own prospectus and disclosure requirements, and the chosen register still determines the security's legal framework.

Before operations begin, check permission scope, provider responsibilities and recovery, correction and continuity procedures. Offering conditions, tax and collective investment rules require assessment where relevant to the product. Neither the electronic security’s legal equivalence nor CASP authorization resolves all these matters on its own.

## Key takeaways

- MiCA and KWG must not be presented as two universally cumulative licenses for every crypto-asset.
- The eWpG distinguishes bearer bonds, registered shares and bearer shares, with different limits.
- Maintaining a crypto-securities register is a regulated function distinct from CASP custody.
- MiCA passporting is limited to the permission’s scope and the European procedure.
- Germany closed its national transitional period earlier than the EU maximum.

## Regulatory milestones

- **2021-06-10** — The eWpG enters into force. The Act dated June 3 takes effect on June 10. It initially introduces electronic issuance for bearer bonds; current categories reflect subsequent amendments. (source: [eWpG · Commencement note](https://www.gesetze-im-internet.de/ewpg/BJNR142310021.html))
- **2021-06-28** — First German crypto custody permission. BaFin grants Coinbase Germany the first permission for the then-new custody activity. This is a national framework milestone, not an early MiCA authorization. (source: [Bundestag · Government response](https://www.bundestag.de/presse/hib/853856-853856))
- **2024-12-03** — DLT trading and settlement system permission under the DLT Pilot Regime. BaFin grants 21X AG a permission for a DLT trading and settlement system (DLT TSS) under the EU DLT Pilot Regime, the first of that category in ESMA's list of authorized DLT market infrastructures. (source: [ESMA · Authorised DLT Market Infrastructures](https://www.esma.europa.eu/sites/default/files/2026-01/Authorised_DLT_Market_Infrastructures.pdf), [European Union · Regulation (EU) 2022/858](https://eur-lex.europa.eu/eli/reg/2022/858/oj))
- **2024-12-30** — MiCA applies to service providers. The European provider regime and national supervisory framework apply. Services must fall within the relevant authorization or notification. (source: [MiCA · Article 149](https://eur-lex.europa.eu/eli/reg/2023/1114/oj))
- **2025-12-31** — Deadline for permissions continuing under Section 50 KMAG. National permissions covered by Section 50(1) expire no later than the end of this date. The provision also specifies earlier expiry events. From January 1, 2026, firms that operated under those permissions may provide crypto-asset services only with MiCA authorization or a valid notification. (source: [KMAG · Section 50(2)](https://www.gesetze-im-internet.de/kmag/__50.html))
- **2026-09-07** — Hybrid bond issuance through a central register. Linklaters reports advising on a Deutsche Börse issuance through D7 under eWpG. This records the announcement date and distinguishes a central register from a crypto-securities register. (source: [Linklaters · Transaction announcement](https://www.linklaters.com/about-us/news-and-deals/deals/2026/september/linklaters-advises-deutsche-boerse-on-electronic-hybrid-bond-issuance))

## Frequently asked questions

### Can every electronic share be recorded on blockchain?

This should not be assumed. The eWpG distinguishes security classes and register types. Section 1 includes bearer shares where they are entered in a central register, so the crypto-securities register route cannot automatically be extended to them.

### Does a CASP license also cover crypto-securities register maintenance?

Not by itself. The KWG identifies register maintenance as a specific activity. The register administrator’s required permission must be assessed separately from the security’s framework and other services performed.

### Did the former German permission automatically become MiCA authorization?

No. Section 50 KMAG allowed certain activities to continue under former permissions during a limited transition. Those permissions expired no later than the end of December 31, 2025, earlier than the maximum period the EU regulation allowed, with possible earlier expiry. MiCA authorization or the applicable notification must be verified for each entity and service.

### Does every German electronic security use blockchain?

No. The eWpG distinguishes securities entered in a central register from those entered in a crypto-securities register. Electronic representation alone does not identify the system used. The chosen register, security category and participating entities’ functions must be checked.

### Does custody authorization permit stablecoin issuance?

Not by itself. MiCA sets separate requirements for asset-referenced tokens, ARTs, and electronic money tokens, EMTs. Product classification, the issuer’s framework, reserves and applicable redemption rights must be assessed. Permission to safeguard client assets serves a different purpose.

## How to cite this guide

Yáñez López, J. (2026, October 15). Crypto-asset and digital securities regulation in Germany. Metlabs. https://metlabs.io/en/blockchain-regulation/germany/