Kryptomärkteaufsichtsgesetz (KMAG)

The text of the KMAG (in German) opens with the goal and scope in section 1: the act serves the implementation of Regulation (EU) 2023/1114 and covers the crypto-assets defined in Article 3(1)(5) of that regulation. Section 2 defines an "Institut" as a company that offers asset-referenced tokens or e-money tokens to the public or seeks their admission to trading, or that provides crypto-asset services. Chapter 1 then assigns the tasks and general powers of BaFin and its cooperation with the Deutsche Bundesbank, and chapter 2 enforces the authorization requirement, with the action against unlicensed business in section 9 and the grant and withdrawal of an authorization in sections 11 to 14.

Chapter 3 covers public offers and admissions to trading, chapter 4 the supervision of the institutions, with special rules for stablecoin issuers in sections 27 and 28, for crypto-asset service providers in sections 29 and 30, and for trading platforms and market abuse in sections 31 to 36. Chapter 5 sets accounting and audit duties, chapter 6 measures in special cases such as a moratorium, chapter 7 the criminal and administrative penalties in sections 46 to 49, and chapter 8 the transitional provisions in sections 50 and 51.

Section 3 makes BaFin the competent authority under Article 93(1) of MiCA for the institutions and for trading on crypto-asset trading platforms, with the Bundesbank responsible for the tasks that section 6 assigns to it, and it makes BaFin the competent authority for digital operational resilience under DORA as well. Under section 4 BaFin may issue any order that is suitable and necessary to prevent or remedy a breach of MiCA or the act, demand information and documents from anyone, and name an institution publicly when it fails to meet its duties, a notice that it deletes after five years at the latest. Section 4(7) lets BaFin order telecommunications and online service providers to remove content, block access to an online interface or display a warning, and order a domain registry to remove a domain name, when customers face serious harm.

Section 9 is the provision against unlicensed business: when a company offers asset-referenced tokens, e-money tokens or crypto-asset services without the required authorization, BaFin orders it to stop at once and to wind down the business, may extend the order to shareholders and board members, and may appoint a liquidator who can file for insolvency over the company. BaFin used its authorization powers in the futurum bank case of 2026, when it refused the MiCA license of the operator of bitcoin.de after a review of more than 15 months.

Section 50 of the KMAG (in German) is the German choice under Article 143(3) of MiCA. A company with a permission under the Banking Act, the Investment Firm Act, the Payment Services Supervision Act or the Investment Code that lawfully provided crypto-asset services on 29 December 2024 could continue under the old law, and that permission was deemed to continue until BaFin decided on its MiCA application or the Article 60 period ended, at the latest until 31 December 2025. Section 50(3) opened a simplified authorization procedure for those firms, in which BaFin checked only the requirements that were new compared with the old license.

With that date Germany cut the EU maximum of 18 months to twelve, as the MiCA transitional period compares by country. BaFin confirmed in a notice of 8 July 2026 (in German) that Germany had shortened the period to 31 December 2025 and that since the end of the EU-wide period on 1 July 2026 only providers with a MiCA license may offer crypto-asset services. The national rules around the license are set out under MiCA in Germany, and the custody license under the Banking Act now covers crypto securities only.

Section 46 (in German) makes it a criminal offense to provide crypto-asset services without authorization, to offer an asset-referenced or e-money token without permission, to deal on inside information or to disclose it unlawfully, with up to five years of imprisonment or a fine, and up to three years for negligence in the first three cases. Section 47 (in German) holds the administrative fines: up to 5 million euros for a natural person and up to 15 million euros for a legal person in the most serious categories, or up to 15 percent of the total annual turnover of a company with a turnover above 100 million euros, or up to three times the gain from the breach where that is higher.

Lesser breaches carry fines of up to 700,000 euros for a natural person and up to 5 million euros for a legal person, and the fines of MiCA itself, up to 5 million euros or 5 percent of turnover for the provider rules under Article 111, run alongside. BaFin also publishes its measures, and MiCA compliance lists the duties whose breach these provisions punish.

The Finanzmarktdigitalisierungsgesetz, or FinmadiG, is the omnibus act that adapted German law to three EU texts at once: the Markets in Crypto-Assets Regulation through the KMAG as its Article 1, the Digital Operational Resilience Act through amendments to the Banking Act and the other sectoral laws, and the recast Transfer of Funds Regulation with the travel rule through the Money Laundering Act. The Bundestag passed it on 18 December 2024 with the consent of the Bundesrat, and the Federal President signed it on 27 December 2024, three days before Title V of MiCA began to apply.

For crypto custodians the FinmadiG changed the Banking Act as well: the German crypto custody business, a licensed financial service since 2020, shrank to the qualified custody of crypto securities under the Electronic Securities Act, while the custody of bitcoin, ether and other crypto-assets moved to MiCA. A firm with the old custody license therefore reads crypto custody in Germany for the securities part and the KMAG for the supervision of its MiCA business.

MiCAR, compliance and custody were topics of the Forum für Digitale Vermögenswerte, a German-language forum in Frankfurt with Finance Loop as a partner, where lawyers and compliance officers discussed the German rules. At the Bybit EU Crypto Evening at TechQuartier, Mykolas Majauskas of Bybit EU spoke on compliance under MiCAR, and the MiCAR certificate program of EBS Executive School and HEUKING teaches the KMAG and MiCAR in German at the EBS campus in Oestrich-Winkel.

The KMAG is the Gesetz zur Aufsicht über Märkte für Kryptowerte, the German act that names BaFin as the competent authority for the EU Markets in Crypto-Assets Regulation and gives it the powers to supervise crypto firms and to act against unlicensed business. It has 51 sections, applies to issuers of stablecoins and to crypto-asset service providers, and took over the German transitional rule that ended on 31 December 2025.

Kryptomärkteaufsichtsgesetz translates as Crypto Markets Supervision Act, and the long title Gesetz zur Aufsicht über Märkte für Kryptowerte as Act on the Supervision of Markets in Crypto-Assets. The Federal Ministry of Justice publishes no official English translation of the act, so an English reader works with the EU regulation, which exists in all official languages, and with the German text for the national provisions.

The consolidated text is on gesetze-im-internet.de, the legal information system of the Federal Ministry of Justice, with every section on its own page and the last amendment of 25 March 2026 included. The original act and its explanatory memorandum are in the Bundestag printed paper of the Finanzmarktdigitalisierungsgesetz, and BaFin explains the application procedure for crypto-asset service providers on its own pages.

The KMAG is Article 1 of the Finanzmarktdigitalisierungsgesetz of 27 December 2024, so the two names describe one legislative package: the FinmadiG is the omnibus act, and the KMAG is the new law it created. The same package adapted German law to DORA and to the EU travel rule for crypto transfers.

The KMAG gives BaFin its tasks and powers for crypto markets, from the grant and withdrawal of a MiCA authorization to orders against unlicensed business, the blocking of online interfaces and the appointment of a liquidator. BaFin ran the MiCA applications of German crypto firms under it from 30 December 2024 onward and had authorized eight firms under Article 63 and received 109 notifications under Article 60 by 22 October 2026, as the MiCA CASP list shows.