What it is
The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) is Germany's integrated financial supervisor. Established on 1 May 2002 by merging the federal offices for banking, securities, and insurance supervision, it operates from twin headquarters in Bonn and Frankfurt am Main and oversees banking, securities markets, insurance, and asset management under one roof, working alongside the Deutsche Bundesbank and, for significant banks, the ECB's Single Supervisory Mechanism. In crypto, BaFin carries unusual weight: Germany was the first jurisdiction to write crypto custody into national banking law, and BaFin has spent the years since building a reputation as one of Europe's most procedurally demanding — and therefore most credible — crypto licensors.
Crypto framework and stance
BaFin's crypto regime runs on two intersecting layers. The first is national: the act implementing the EU's Fifth Anti-Money Laundering Directive, effective 1 January 2020, added crypto custody business (Kryptoverwahrgeschäft) to the German Banking Act (KWG) as a licensable financial service — a world first, predating MiCA by years. Coinbase Germany became the first company licensed under that regime in June 2021, and a cohort of banks and specialist custodians followed. The second layer is European: under the Markets in Crypto-Assets Regulation (MiCAR), Germany's accompanying supervision act — the Kryptomärkteaufsichtsgesetz (KMAG), published in the Federal Law Gazette on 27 December 2024 — makes BaFin the competent authority for crypto-asset service providers, with authorisation applications filed to BaFin and the Deutsche Bundesbank. BaFin moved fast: in late January 2025 it granted Bitpanda one of the first MiCAR licences issued anywhere in the EU, passporting the Vienna-based exchange across all member states. BaFin's stance is exacting rather than hostile — thorough applications, German-language engagement, and substance requirements — and a German licence is widely treated as a premium credential across the EU.
Notable actions
- Ethena GmbH / USDe (2025): Germany's first landmark MiCAR enforcement. On 21 March 2025 BaFin halted public offers of Ethena's USDe token, citing serious deficiencies in business organisation and MiCAR infringements, and froze the issuer's asset reserves. After Ethena withdrew its authorisation application on 3 April 2025, BaFin ordered the business wound up, and on 25 June 2025 it opened a supervised 42-day redemption window (to 6 August 2025) for USDe holders under a BaFin-appointed special representative. Ethena exited the EU.
- Binance stock tokens (2021): On 28 April 2021 BaFin publicly warned that Binance's tokenized stocks tracking Tesla, Coinbase, and MicroStrategy likely violated the EU Prospectus Regulation's prospectus obligation — an offence carrying fines of up to €5 million or 3% of annual revenue. Binance discontinued the products later that year.
- Coinbase Germany custody licence (2021): The constructive side of the ledger — in June 2021 BaFin granted Coinbase Germany the first crypto custody licence under the KWG regime, establishing the template for regulated institutional custody in the EU three years before MiCA.
Key figures
Mark Branson has been BaFin's President since 1 August 2021, joining from the top of Switzerland's FINMA as part of the leadership overhaul that followed the Wirecard scandal. Under Branson, BaFin has held its double posture on crypto: willing to license and supervise serious operators under the KWG and MiCAR regimes, and equally willing to act quickly against non-compliant offerings, as the Binance stock-token warning and the Ethena wind-down showed. Branson has consistently framed crypto supervision as ordinary financial supervision — the same rigour, applied to a newer asset class.
What it means for users and builders
For builders, a BaFin authorisation is one of the most valuable crypto credentials in Europe — and one of the hardest-won. Expect a long, document-heavy application process, German-resident management and compliance substance, engagement with both BaFin and the Bundesbank, and MiCAR's capital minima as a floor rather than a ceiling. The payoff is EU-wide passporting from the bloc's largest economy and a supervisory imprimatur that institutional counterparties respect. Germany chose a shortened MiCAR grandfathering period under § 50(2) no. 3 KMAG, so national-licence grandfathering ended on 31 December 2025 rather than running to the EU-wide 1 July 2026 backstop; firms serving German customers now need a MiCAR authorisation — their own or a passported one — and BaFin has a record of moving against unauthorised foreign platforms marketing into Germany. For users, the Ethena case is the practical lesson: BaFin will freeze reserves and force an orderly, supervised redemption when an issuer falls short, which is precisely the protection MiCAR was designed to deliver.
Outlook
BaFin enters the post-transition MiCAR era as the EU's busiest crypto licensor — Germany has by some margin the largest population of MiCAR-authorised CASPs of any member state — with legacy KWG custody licensees converted to the European regime and a queue of further CASP applications in review. The open strategic question is the same one facing every EU national regulator: the European Commission's December 2025 proposal to shift direct CASP supervision to ESMA would, if adopted, gradually recentralise the authority BaFin currently exercises. Until then, expect BaFin to keep setting the bar — demanding applications, quick interventions against non-compliant offerings, and continued influence over ESMA and EBA technical standards through its outsized presence in EU working groups.