For many investors, 1 July 2026 is the date European crypto regulation became real. In Germany that is not accurate. Here the deadline had already passed half a year earlier.
Two deadlines that are routinely confused
MiCAR allows incumbent providers a transitional period of up to 18 months. That produces the EU-wide cut-off of 1 July 2026. But each member state was free to shorten it, and Germany did.
Under the Crypto Markets Supervision Act (Kryptomärkteaufsichtsgesetz, KMAG), published together with the Financial Market Digitalisation Act in the Federal Law Gazette on 27 December 2024, the period was capped at twelve months. Germany's transitional window therefore closed on 31 December 2025. Providers relying only on an old national BaFin permission were operating without a valid basis from the start of 2026.
Germany was not alone in this strictness. The Netherlands drew the line as early as 30 June 2025; Finland and Poland opted for six months. France, Denmark and Czechia, by contrast, used the full 18 months. This staggering explains why some internationally active exchanges could keep operating until mid-2026 while different rules had long applied in Germany.
The joint BaFin and FIU notice
On 8 July 2026 the Financial Intelligence Unit and BaFin published a joint notice. The trigger: with the EU-wide deadline now passed, both authorities expect a large number of customers and substantial volumes of assets to move from unlicensed providers to licensed CASPs in short order.
For the receiving providers this is not a routine transfer. Every customer taken on constitutes, legally, a new business relationship. CASPs must meet their due diligence obligations, verify customer identity, and subject the relationship to a money laundering and terrorist financing risk assessment.
In practice, this means investors moving holdings to a licensed provider over the coming months should expect questions — about the source of funds, the previous platform, and transaction history. That is not one provider being awkward; it is a supervisory requirement.
Anyone still holding assets with an unlicensed provider should download their transaction history before access is restricted. It is often impossible to obtain afterwards, and without it both onboarding at the new provider and the eventual tax return become considerably harder.
What the licence covers, and what it does not
MiCAR defines ten regulated crypto-asset services, from custody through operating a trading platform to investment advice. Providing even one of them commercially triggers the authorisation requirement.
The key point: authorisation is service-specific. A provider may only supply the services its authorisation expressly covers. The register therefore records, for each CASP individually, which of the ten services are included. A licence for custody and execution specifically does not mean the same provider may offer advice or portfolio management.
For providers, the procedure in Germany runs through BaFin. Following receipt of an application, the authority checks completeness within 25 working days; once complete, it must decide on the substance within 40 working days. Credit institutions may, under certain conditions, provide crypto-asset services via a notification under Article 60 MiCAR, submitted at least 40 working days before activity begins. That is a different legal route from CASP authorisation and should not be equated with it.
Check for yourself rather than trusting
Since 30 December 2024 ESMA has maintained a central register for the entire EU crypto market. This interim MiCA register is updated weekly and is fed by notifications from national supervisors — for Germany, from BaFin's data.
Three points frequently overlooked when checking:
First, the legal entity name matters, not the logo in the app. Several international groups applied through a purpose-built European company. Whether your own contract is with that entity is stated in the terms of service.
Second, BaFin is not the only competent authority. An exchange may obtain its licence in another member state and offer services legally in Germany through EU passporting. That is entirely proper, but ongoing supervision then sits with the home state authority.
Third, a register entry says nothing about the value of the crypto-assets. MiCAR is a conduct and own-funds regime, not a deposit guarantee scheme. "Regulated" means supervised, not protected.
For private individuals, one thing is worth stating plainly: using an unlicensed exchange is not itself a criminal offence for the user. The authorisation requirement falls on the provider. The risk lies elsewhere — in a provider without supervision, without segregation of client funds, and without anyone to turn to when something goes wrong.