BaFin

The responsibilities of BaFin cover banks, insurers and securities markets, alongside other regulated financial businesses (in German). Prudential supervision examines whether a firm can meet its obligations and manage its risks. Market supervision addresses conduct such as insider trading and market manipulation.

The authority also acts against unauthorized business and oversees anti-money-laundering obligations within its remit. These functions protect the conditions under which customers and companies use financial services. Supervision does not guarantee the success of an investment or mean that a supervised company can never fail.

BaFin works with the Deutsche Bundesbank and ECB Banking Supervision. The ECB directly supervises significant banks within the Single Supervisory Mechanism, with BaFin participating in joint supervisory teams. German authorities supervise less significant banks within the European framework.

BaFin can issue binding supervisory measures, while the Bundesbank contributes ongoing analysis of institutions. The banking-supervision framework covers capital requirements and risk management, among other obligations (in German). The institution and the relevant task determine which authority is responsible.

BaFin assesses a fintech business by its activities, not simply by whether its founders call it a technology company. Banking, payments and investment services can require permission even when software changes how customers access them. The applicable requirements include BaFin authorization and payments regulation in Germany.

The official fintech service offers a contact person through the BaFin navigator. Companies can ask about the supervisory implications of a business model and receive support navigating an application. BaFin does not provide legal advice, and contact with the authority is not an authorization or a promise that an application will succeed.

BaFin supervises relevant obligations under DORA in Germany, the European framework for digital operational resilience. Requirements concern ICT risk management and the handling of technology suppliers. Covered financial entities must also meet rules for incident reporting and resilience testing.

BaFin supervises the IT and cybersecurity obligations that DORA places on covered financial entities. The framework distinguishes a financial firm's own responsibilities from the European oversight of designated critical ICT third-party providers. Outsourcing a system does not outsource management responsibility for the service.

BaFin received new AI market-surveillance responsibilities in July 2026 (in German). Its remit covers AI systems directly connected with a regulated financial activity at supervised firms. Examples include creditworthiness assessment and risk assessment in life or health insurance.

The mandate addresses applicable AI Act requirements, including transparency and prohibited practices. Financial firms remain responsible for their AI systems. Other applications, such as human-resources systems, fall outside this specific BaFin remit. AI in finance therefore involves both financial-supervision duties and the rules that apply to the particular system.

BaFin is the German authority responsible for authorizing crypto-asset service providers under MiCA in Germany. The authorization framework defines application requirements and exceptions for crypto-asset services. The required permission depends on the service and the applicant's existing regulatory status.

MiCA provides an authorization framework that applies across the EU. An authorized provider must meet the applicable notification requirements before supplying services across borders. Firms planning crypto custody or other crypto services need to identify the relevant obligations before launch.

Customers can check the company database of BaFin for information about institutions and their permissions. The exact legal name and the scope of the permission matter. A missing entry is a reason to investigate further, not enough on its own to conclude that every service is unlawful: cross-border arrangements and different regulatory regimes can affect the relevant register.

BaFin also publishes consumer warnings and provides a complaints process (in German). Collective consumer protection does not mean that the authority awards compensation in an individual contract dispute.