BaFin (Germany’s Federal Financial Supervisory Authority)

BaFin supervises banks, insurers, investment firms and crypto service providers in Germany. It was formed on 1 May 2002 from three federal supervisory offices, is based in Bonn and Frankfurt am Main and falls within the remit of the Federal Ministry of Finance.^[1] In other EU countries, the national regulator plays this role.

What BaFin does in relation to Bitcoin

• Authorisation and supervision: under the KMAGGlossaryKMAG (German Crypto Markets Supervision Act)Germany’s act accompanying the EU’s MiCA regulation. It makes BaFin the competent supervisor, makes providing crypto services without authorisation a criminal offence and protects crypto-assets held in custody if the provider becomes insolvent.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →×, Germany’s Crypto Markets Supervision Act, it is the competent authority in Germany for the MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× regulation. Crypto service providers based in Germany need its authorisation.^[2]
• Warnings: it warns about unauthorised providers, fraudulent websites and typical scams.^[3]

What BaFin doesn’t do

It doesn’t supervise Bitcoin itself – the network has neither an operator nor an issuer. An authorisation doesn’t protect you from every provider insolvency, let alone from price losses. BaFin doesn’t give personal investment advice, and taxes are a matter for the tax office.

Check providers yourself

If someone claims to be ‘BaFin-licensed’, check it in BaFin’s company database and in the MiCA register of ESMAGlossaryESMA (European Securities and Markets Authority)The EU authority for securities and financial markets, based in Paris. What matters to you is its MiCA register: it lists all crypto-asset service providers authorised in the EU.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →×. The ESMA register also lists providers authorised in another EU country.^[4] More in MiCA & regulation simply explained.