DeFi regulation in Germany

BaFin, KMAG and the service you provide

For a Germany-based crypto-asset service provider, start with MiCA's service definitions and the German supervisory route. Section 3 of the Kryptomärkteaufsichtsgesetz (KMAG) identifies BaFin as the competent authority and assigns the Bundesbank its supporting responsibilities.

Describe the activity before choosing a form: custody, exchange, transfer, trading-platform operation or another service in Article 3 of MiCA. A DeFi interface can still involve an identifiable operator. Recital 22 distinguishes fully decentralized services without an intermediary from activities performed or controlled by a person, including partially decentralized arrangements.

Write down who contracts with the customer, controls the interface, signs transactions and can change deployed contracts. This factual description is the starting material for a scope assessment. It does not by itself establish whether a service requires authorization.

Prepare the BaFin application file

The BaFin application page asks applicants to arrange an initial discussion, use the current standard form and provide DORA documentation with the application. It also gives submission and copy-recipient instructions. Check those instructions when filing.

1. Record the legal entity and services. Map each proposed activity to the requested permission. Keep activities outside the initial launch in a separate change log.
2. Resolve authorization or notification. Articles 59 and 60 distinguish a CASP authorization from the service-specific notification route available to eligible existing financial institutions.
3. Index the evidence. Give every attachment a document identifier, owner, version and page reference. State explicitly which service an attachment covers.
4. Reconcile the file with the product. Compare the governance chart, supplier register and customer terms against the deployed architecture. Investigate discrepancies before submission.

Keep an evidence date alongside each record. A submitted application package can otherwise describe a product that has changed while the file is being assessed.

Connect application statements to technical evidence

The following DeFiSec worksheet is an editorial preparation aid. Its suggested artifacts help a team make its statements checkable; the official forms and applicable rules determine what must be submitted.

DORA Article 28 requires an information register for contractual arrangements concerning ICT services within its scope. For the work of connecting contract records to technical services, see Pharos Production's engineering guide to a crypto provider's DORA information register. Use its implementation discussion alongside the official register requirements.

For a service using a permissionless ledger, include a ledger disruption in the recovery exercise. Delegated Regulation 2025/299 addresses CASP business continuity, including relevant distributed-ledger risks. Record what the provider can control and what depends on the network.

Cross-border services and launch controls

Article 65 provides the procedure for an authorized CASP to supply services in other Member States. Maintain a destination-country list, service scope and notification record. The existence of a German company or a submitted application does not establish a passport.

Before launch, compare the permission actually obtained with the website, onboarding flow and customer contract. If the product has added custody or changed the contracting entity, reopen the scope assessment. The MiCA security obligations guide connects the EU requirements to contract and infrastructure controls.