CASP licensing path in Germany.
CASP (Crypto-Asset Service Provider) licence in Germany is supervised by Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin). Time-to-licence is typically 9–12 months; EU/EEA passporting is available under EMD2 / PSD2.
What this licence allows.
Custody, exchange, transfer, advice or portfolio management for crypto-assets under MiCA.
BaFin is the most thorough EU regulator. Expect detailed product-by-product Q&A in the application; AML and IT-security questionnaires typically take longest.
- Corporate structure + beneficial ownership (UBO ≤ 25%)
- Initial capital deposited in a regulated EU/EEA bank
- Three-line-of-defence governance model
- AML programme + transaction monitoring policy
- Risk-based KYC + sanctions screening process
- ICT-security questionnaire (DORA-aligned from 2025)
- Outsourcing register (BSS, payment partners, cloud)
Three paths to CASP in Germany.
Acquire CASP directly from BaFin
Time: 9–12 months. Initial capital: €125,000 – €350,000 (MiCA Class-based). Full control, full obligations. Coreal helps with the IT-security questionnaire and three-lines-of-defence model.
Partner with an existing EU EMI
Use a sponsor EMI passport from another EU country (DE, FR, NL, etc.) and operate in Germany under freedom-of-services. Faster: 30–90 days vs 9–12 months.
Use the Coreal EMI passport
Coreal operates under its own EU EMI licence. Operator gets a fully-branded wallet without acquiring any licence. Ships in ~60 days.
Who is the CASP regulator in Germany?
Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin). They oversee authorisation, ongoing supervision and enforcement for CASP licence holders in Germany.
How long does CASP authorisation take in Germany?
Typically 9–12 months end-to-end. The bottleneck is usually the regulator's risk and IT-security questionnaire — plan for ≥4 months of regulator dialogue.
Does this licence work cross-border?
CASP authorisations under MiCA are passportable across the EU/EEA from the date the rules came fully into force (Dec 2024).
Bring the perimeter,
leave with a brief.
Read the Wave-1 runbook first.
The full 90-day launch sequence — phases, partner-bank gates, who signs off when. No form to read it.
Read the runbook →INDICATIVE DATA · Numbers and timelines reflect public regulator filings, vendor documentation and our own delivery experience. Per-engagement values vary with operator profile, BSS vintage and regulatory perimeter. Engage early for a fitted estimate under NDA.