Germany’s blockchain market combines a regulated market for crypto-asset services with an expanding infrastructure for tokenised financial instruments. These are distinct legal and commercial segments. Trading and custody of assets such as Bitcoin and Ether sit alongside the issuance, registration and settlement of bonds, shares and fund units using distributed ledger technology (DLT). Banks, securities firms, asset managers, exchange groups and specialist technology providers participate in this market. The practical focus is increasingly on integrating digital assets into established financial services, rather than treating every blockchain project as a separate asset class.[1]

Capital markets and investment management are prominent areas of adoption. German law permits electronic securities, including securities entered in a crypto-securities register, and provides a route for electronic fund units. Tokenisation is also used to represent contractual investment rights. These structures can support corporate and real estate financing, although a token representing a claim against an issuer does not give the investor direct ownership of the underlying property. Technical transferability must therefore be distinguished from the legal rights conveyed and from the existence of a liquid secondary market.[2]

Payments and settlement form another important segment. AllUnity GmbH obtained an electronic money institution licence in July 2025 and subsequently issued the euro-denominated EURAU token. Private electronic money tokens must be distinguished both from tokenised commercial bank deposits and from central bank money. Industry proposals for commercial bank money tokens target corporate treasury, automated industrial payments and machine-to-machine transactions. Their legal treatment depends on the precise deposit and payment arrangements, not merely on their use of a blockchain.[3]

Public-sector involvement is particularly visible in central bank infrastructure. On 21 September 2026, the Eurosystem launched Pontes, connecting market DLT platforms with TARGET Services for settlement in central bank money. This is separate from the retail digital euro project discussed below. It illustrates how DLT can be integrated into public financial infrastructure without turning a privately issued crypto-asset into legal tender.[4]

A further business model is the crypto-treasury company, which acquires substantial crypto-asset holdings on its own balance sheet, sometimes using debt or equity financing. This raises conventional corporate governance, financing and insolvency questions as well as crypto-specific custody and valuation issues. Consequently, adoption does not point towards a single ‘blockchain law’: its legal consequences follow the activity, the rights represented and the parties carrying it out.[5]

[1] Anika Patz, ‘Aktuelle Entwicklungen im Kryptorecht (2024/2025)’, BKR 2026, 296. Dimitrios Linardatos and Fabian Aubrunner, ‘Die MiCAR-Aufsicht im EWR’, RDi 2026, 1 (market data in that article are dated 8 December 2025).

[2] Electronic Securities Act (eWpG), sections 1 and 2. Karsten Wöckener and Rudolf Glekler, ‘Digitale Wertpapiere’, WM 2025, 137. Theresa Kreft and Marius Raetz, ‘Begebung und Handel von Fondsanteilen mittels Distributed-Ledger-Technologie’, BKR 2024, 497.

[3] AllUnity, electronic money institution licence announcement, 2 July 2025, and EURAU deployment announcement, 21 October 2025. Sebastian Omlor and Jannik Heine, ‘Erlaubnispflichten in Giralgeldtoken-Systemen’, RDi 2025, 177.

[4] European Central Bank, Pontes launch announcement, 21 September 2026, and Pontes service information.

[5] Luke B Tilson and Patrick Kral, ‘Rechtliche Rahmenbedingungen für Krypto-Treasury-Unternehmen’, BKR 2026, 351.

The starting point is the European Union’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 (MiCAR). Its provisions on asset-referenced tokens and electronic money tokens have applied since 30 June 2024, and its principal remaining provisions since 30 December 2024. MiCAR regulates specified offers and admissions to trading, issuers of particular token categories, crypto-asset service providers (CASPs) and market abuse. Germany’s Crypto Markets Supervision Act (Kryptomärkteaufsichtsgesetz, KMAG) supplies national supervisory, procedural, enforcement and liability rules. These measures regulate activities involving crypto-assets, not the use of blockchain technology as such.[1]

Crypto-assets that qualify as financial instruments fall outside MiCAR’s substantive product regime. Relevant legislation instead includes the second Markets in Financial Instruments Directive (MiFID II), the German Banking Act (Kreditwesengesetz, KWG), Securities Institutions Act (Wertpapierinstitutsgesetz, WpIG), Securities Trading Act (Wertpapierhandelsgesetz, WpHG), EU Prospectus Regulation and Securities Prospectus Act (Wertpapierprospektgesetz, WpPG). Collective investment structures require examination under the Capital Investment Code (Kapitalanlagegesetzbuch, KAGB). The Investment Products Act (Vermögensanlagengesetz, VermAnlG) can be relevant to investment arrangements that are not transferable securities. Its relationship with MiCAR must be assessed for the particular product rather than assumed from a domestic label.[2]

Blockchain-specific infrastructure legislation includes the Electronic Securities Act (Gesetz über elektronische Wertpapiere, eWpG), the Crypto Fund Units Ordinance (Kryptofondsanteilverordnung, KryptoFAV) and Regulation (EU) 2022/858 on a pilot regime for DLT market infrastructures. The pilot regime permits specified exemptions within the securities trading and settlement framework. It is not a general exemption from financial regulation for projects using DLT. Electronic money and payment services can additionally engage the second Payment Services Directive (PSD2) and the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz, ZAG).[3]

Cross-cutting requirements include the Money Laundering Act (Geldwäschegesetz, GwG), the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113 (TFR), the Digital Operational Resilience Act, Regulation (EU) 2022/2554 (DORA), the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), and the Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenzgesetz, KStTG). General contract, company, insolvency, consumer and tax law remains applicable.[4]

The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) is Germany’s principal financial regulator, with the Deutsche Bundesbank performing its statutory supporting supervisory functions. The European Securities and Markets Authority (ESMA) and the European Banking Authority (EBA) exercise their respective EU functions, including technical rulemaking and supervisory convergence. Significant stablecoin issuers are subject to the specific EU supervisory allocation under MiCAR. Tax authorities, the Financial Intelligence Unit and data protection authorities have separate responsibilities. The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), based in Frankfurt am Main, forms part of the developing European anti-money laundering (AML) supervisory framework.[5]

[1] MiCAR, Articles 1, 2 and 149. KMAG, especially sections 3–5 and 9–19. Fabian Aubrunner and Dimitrios Linardatos, ‘MiCA-VVG und KMAG’, RDi 2025, 117.

[2] MiCAR, Article 2(4). MiFID II, Article 4(1)(15) and Annex I, Section C. Maurice Ribak, ‘Zwischen MiCAR und MiFID II’, RDi 2026, 105. Dimitrios Linardatos, ‘Finanzinstrumente im Digitalzeitalter’, WM 2024, 1633 and 1685.

[3] eWpG, sections 1–4. KryptoFAV. Regulation (EU) 2022/858, Articles 3–10. David John, ‘Regulierung von Handelsplattformen für DLT-basierte Werteinheiten’, BKR 2025, 632.

[4] GwG, section 2. TFR, Articles 2 and 40. DORA, Articles 2 and 64. KStTG, sections 9–11 and 21. Patz, BKR 2026, 296.

[5] KMAG, sections 3, 6 and 7. MiCAR, Title VII, especially Articles 93 and 117. Regulation (EU) 2024/1620 establishing AMLA.

The operative approach is to permit the technology while regulating the financial activities conducted through it. Germany has not imposed a general prohibition on privately holding or using crypto-assets. At the same time, blockchain does not exempt an issuer, intermediary or platform operator from authorisation, disclosure, conduct or anti-money laundering requirements. The eWpG and the DLT pilot regime provide specific legal routes for digital securities and market infrastructure, while MiCAR establishes requirements for the separate crypto-asset market.[1]

For providers, the central change in 2026 is that the MiCAR transitional arrangements can no longer be treated as a continuing market-access strategy. Germany shortened its principal national transition to 31 December 2025. The maximum transition under Article 143(3) MiCAR ended on 1 July 2026. A pending application does not itself authorise the applicant to continue regulated business. Providers must establish an applicable authorisation, notification or passporting route, or a genuinely available exemption.[2]

Supervisory practice also distinguishes the legal status of the provider from the quality or legal status of individual products. A CASP authorisation is not approval of every token it offers. BaFin can investigate suspected unauthorised activities, publish warnings and restrict offers or business. The Ethena proceedings illustrate that supervisory measures and securities-prospectus questions can arise alongside MiCAR issues. They also show why the procedural status of an enforcement decision must be distinguished from a final judicial ruling.[3]

For project planning, early regulatory engagement and a documented analysis of the business model are useful, but neither an informal discussion nor participation in a technical test replaces a required permission. The relevant questions are who contracts with the customer, who controls the assets or keys, what rights the token confers, how orders and payments are handled, and where the services are marketed. The legal framework therefore allows innovation through defined routes rather than through a general ‘blockchain’ exemption.

[1] MiCAR, Articles 2 and 59. eWpG. Regulation (EU) 2022/858. Florian Möslein, ‘Anleger- und Funktionsschutz im Recht der Kryptowerte’, WM 2024, 1729.

[2] MiCAR, Article 143(3). KMAG, section 50. David John and Alexander Spitzenpfeil, ‘Das Ende des MiCAR-Grandfatherings’, BKR 2026, 773. ESMA, public statement on the end of the MiCA transitional period, 23 June 2026.

[3] KMAG, sections 9 and 10(7). Administrative Court of Frankfurt am Main (VG Frankfurt am Main), order of 2 May 2025, 7 L 1257/25.F, BKR 2025, 611. See question 14.

Yes. Germany participates in the Eurosystem’s digital euro project through the Deutsche Bundesbank. This is a euro-area initiative, not a separate German cryptocurrency. A retail digital euro would be a form of central bank money, distinct from a private stablecoin, a commercial bank deposit or an investment token. The intended instrument would complement cash rather than convert existing privately issued tokens into sovereign money.[1]

As at 2 October 2026, preparations are continuing, but the digital euro has not been issued for general public use. The Eurosystem completed the previous preparation phase in October 2025. It now plans a twelve-month pilot beginning in the second half of 2027, involving 36 payment service providers, selected merchants and Eurosystem staff. Five selected payment service providers are German. The pilot is intended to test a beta version in practical payment situations and is not a general public launch.[2]

The European Central Bank (ECB) aims to be ready for a potential first issuance during 2029, on the assumption that the digital euro Regulation is adopted in 2026. The ECB has expressly made the issuance decision conditional on adoption of the legislative framework. Neither the target year nor the pilot should therefore be presented as an unconditional commitment to issue. Detailed product and intermediary obligations must be assessed against the final legislation and the resulting operational arrangements, rather than against earlier consultation positions.[3]

Wholesale settlement is a separate development. Pontes, launched on 21 September 2026, links market DLT platforms to TARGET Services so that eligible transactions can settle in central bank money. It addresses the cash side of tokenised financial transactions without establishing a retail CBDC. For legal analysis, it is essential to keep these categories separate: a private electronic money token gives its holder rights against its issuer, a tokenised deposit depends on the relevant banking relationship, and a central bank liability has a different legal issuer and risk profile.[4]

[1] Deutsche Bundesbank, ‘Zahlungsdienstleister für Pilotprojekt zum digitalen Euro ausgewählt’, 14 July 2026.

[2] ECB, ‘Digital euro pilot’, current project information. ECB, next-phase announcement, 30 October 2025. Deutsche Bundesbank, announcement of 14 July 2026.

[3] ECB, ‘Digital euro pilot’, timetable and conditions for issuance, accessed 2 October 2026.

[4] ECB, Pontes launch announcement, 21 September 2026. Sebastian Omlor, ‘Rücktauschansprüche bei Stablecoins’, RDi 2026, 66.

Financial regulation follows the rights and functions of the asset and the activity performed. The label chosen by a project is not decisive. A classification exercise must therefore precede the selection of an authorisation or disclosure route.

Financial instruments and other exclusions. A crypto-asset qualifying as a MiFID II financial instrument is excluded from MiCAR under Article 2(4)(a). This can include transferable securities, units in collective investment undertakings and derivatives. ESMA’s guidelines on classification, published in March 2025, apply a technology-neutral analysis. Standardisation, transferability and negotiability, and the economic and legal rights attached to a token must be examined together. A blockchain entry alone does not make an asset a security. Conversely, the absence of a paper certificate does not prevent securities classification. Hybrid structures must be assessed by substance, including whether they confer share-like or debt-like investment rights. Deposits and other expressly excluded products require their own analysis.[1]

MiCAR asset categories. Within MiCAR, electronic money tokens (EMTs) seek to maintain a stable value by reference to one official currency. Asset-referenced tokens (ARTs) use other references, including combinations of values or rights. Other crypto-assets fall within a residual category that includes many utility tokens. The exclusion for genuinely unique and non-fungible crypto-assets is narrow: a serial number, a particular technical token standard or a marketing description as a non-fungible token (NFT) does not establish it. Fractional interests and large series require particular care. Utility status also does not automatically eliminate white paper or service-provider obligations.[2]

ARTs and EMTs are subject to distinct issuer, governance, reserve and redemption requirements. EMTs may be issued only by credit institutions or electronic money institutions, and holders have a statutory right to redemption at par. The restrictions on granting interest and on distributing token-related benefits require separate attention. A stabilisation mechanism or reserve description cannot replace compliance with the relevant issuer regime.[3]

Services and market access. MiCAR regulates ten service categories, including custody, operating a trading platform, exchange, execution, placing, reception and transmission of orders, advice, portfolio management and transfers on behalf of clients. The ordinary route is CASP authorisation. Article 60 allows specified already-regulated financial entities to use a notification route, within the service scope permitted for their category. Cross-border provision requires the applicable MiCAR notification or passport arrangements. A third-country provider can rely on Article 61 only where the client’s own exclusive initiative genuinely explains the service. Advertising, affiliates or a contractual declaration of ‘reverse solicitation’ cannot manufacture that exception.[4]

DeFi. MiCAR recital 22 contemplates services provided in a fully decentralised manner without any intermediary. This is not a general exclusion for everything described as decentralised finance. The distribution of control must be examined in practice: control of upgrade or administrator keys, transaction routing, frontends, fee settings and the ability to determine or interrupt a service can be relevant. A public protocol and a commercial interface through which customers access it need not have the same regulatory status. Academic analysis emphasises both the limits of intermediary-based regulation for genuinely decentralised systems and the potential regulation of identifiable interface operators.[5]

Staking and lending are not separately enumerated MiCAR service categories, but their components can engage custody, transfer, execution, collective investment, banking or offering rules. A yield-bearing receipt token must be classified in its own right. ‘Non-custodial’ and ‘decentralised’ are factual descriptions requiring substantiation, not legal safe harbours.[6]

Outside MiCAR’s custody regime, Germany retains the national category of qualified crypto custody for specified cryptographic instruments and key-custody activities. Crypto-securities registration and securities custody also require separate permission analyses. The national qualified-custody permission is not itself an EU passport. Service architecture should therefore distinguish a MiCAR asset, a contractual security token and an eWpG security before selecting the custodian and registration arrangements.[7]

Payment-services overlap. EMTs are deemed electronic money under Article 48(2) MiCAR. Accordingly, a transfer service or a custodial wallet with payment-account functionality may also engage PSD2 and the ZAG. The EBA’s 2025 opinion and its February 2026 follow-up address this overlap. Continued activity after the initial 2 March 2026 transition depends on the relevant conditions and the competent authority’s approach. There is no general rule that a MiCAR permission replaces a payment-services authorisation or that an outstanding application automatically permits continued operation.[8]

[1] MiCAR, Article 2(4). ESMA, Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, 19 March 2025. Ribak, RDi 2026, 105. Wöckener and Glekler, WM 2025, 137.

[2] MiCAR, Article 2(3), Article 3(1)(6), (7) and (9), and recitals 10 and 11. David John, ‘Behandlung von NFT und Utility Token’, BKR 2025, 162. Hendrik Müller-Lankow and Sebastian Liebscher, WM 2024, 1152.

[3] MiCAR, Articles 16, 36–40 and 48–50. Omlor, RDi 2026, 66. Müller-Lankow and Liebscher, WM 2024, 1152.

[4] MiCAR, Articles 3(1)(16) and 59–65. Michael Jünemann and Johannes Wirtz, ‘ESMA-Leitlinien zur Reverse Solicitation der MiCAR’, RDi 2025, 67. John and Spitzenpfeil, BKR 2026, 773.

[5] MiCAR, recital 22. Caroline Böck and others, ‘Der unionsrechtliche Rahmen für Decentralised Finance (DeFi)’, ZfDR 2026, 131. Nata Sturua, Andelika Schiller and Vinzenz Treytl, ‘Online-Interfaces für Kryptodienste’, RDi 2025, 545.

[6] Patz, BKR 2026, 296. VG Frankfurt am Main, 2 May 2025, 7 L 1257/25.F, BKR 2025, 611. Böck and others, ZfDR 2026, 131.

[7] KWG, section 1(1a), second sentence, nos 6 and 8. Patz, BKR 2026, 296, sections V and VI. Wöckener and Glekler, WM 2025, 137.

[8] MiCAR, Article 48(2). EBA Opinion EBA/Op/2025/08 and EBA follow-up opinion announced on 12 February 2026. Aurelia Philine Birne and Felix-Julius Konow, ‘Die Übertragung von E-Geld-Token nach der PSD2’, RDi 2025, 240.

Crypto-asset services are subject to anti-money laundering and counter-terrorist financing requirements where the provider falls within the GwG’s categories of obliged entities. Core obligations include a risk assessment, internal safeguards, customer and beneficial-owner identification, ongoing monitoring, record-keeping and suspicious activity reporting to the Financial Intelligence Unit. On-chain analytics may support these controls, but do not replace the legal assessment of the customer, transaction or beneficial owner. Enhanced measures depend on the risks and statutory triggers, not merely on the fact that a transaction involves crypto-assets.[1]

The TFR has applied since 30 December 2024 and extends the ‘travel rule’ to covered crypto-asset transfers. Its territorial scope includes transfers where the crypto-asset service provider of the originator or beneficiary, or an intermediary provider, is established in the EU. Required information about the originator and beneficiary must be obtained and transmitted or retained as applicable. These information obligations are not generally confined to transfers above EUR 1,000. Transfers between individuals without the involvement of a CASP are excluded from the TFR, but are not thereby exempted from sanctions or criminal law.[2]

For transfers to or from self-hosted addresses, the provider must obtain and hold the prescribed information and ensure that the transfer is individually identifiable. Where a transfer exceeds EUR 1,000, additional measures are required to assess whether the address is owned or controlled by the provider’s relevant client. This threshold does not impose a universal source-of-funds certificate for every crypto transaction above EUR 1,000. Source-of-funds enquiries arise from the applicable risk-based or enhanced due diligence requirements and must be distinguished from address-control verification.[3]

Providers also need procedures for missing or incomplete information and a documented decision whether to execute, reject, return or suspend a transfer. Customer information need not be published on the blockchain. Secure separate communication channels can meet the information-transfer function while limiting disclosure of personal data.

EU financial sanctions apply independently of whether a service is decentralised or an asset falls under MiCAR. Asset-freezing and prohibitions on making funds or economic resources available can affect crypto-assets, counterparties and controlled entities. Identity and ownership information, wallet screening and investigation of alerts must therefore be combined. A software label or self-hosted wallet does not remove a sanctions prohibition, although identifying the responsible actor in a genuinely decentralised arrangement can be difficult.[4]

The next material transition is the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, whose principal requirements apply from 10 July 2027. It includes crypto-specific provisions on self-hosted addresses and anonymous accounts. These future requirements should not be presented as already applicable merely because the Regulation has entered into force. Equally, a claimed DeFi exclusion from MiCAR cannot automatically be carried across to the GwG, the TFR, sanctions or tax-reporting rules, which have their own scopes.[5]

[1] GwG, sections 2, 4–6, 8, 10–15a and 43. Awet Yohannes and Kemal Ahmedi, ‘Die Crypto Travel Rule’, BKR 2025, 834.

[2] TFR, Articles 2, 14–21 and 40. Robert Oppenheim and Sascha Grimm, ‘Travel Rule’, RDi 2025, 249.

[3] TFR, Articles 14(5) and 16(2). GwG, sections 15 and 15a. EBA Guidelines EBA/GL/2024/11. Yohannes and Ahmedi, BKR 2025, 834.

[4] For an example of the applicable asset-freezing framework, Council Regulation (EU) No 269/2014, Article 2. TFR, Article 23. Oppenheim and Grimm, RDi 2025, 249.

[5] Regulation (EU) 2024/1624, Articles 40, 79 and 90. Böck and others, ZfDR 2026, 131, on the different regulatory perimeters of MiCAR, the TFR and DAC8.

Tax treatment depends on the asset, the transaction and whether it belongs to private or business assets. The circular of 6 March 2025 issued by the Federal Ministry of Finance (Bundesministerium der Finanzen, BMF) is the principal administrative guidance on the income-tax treatment of crypto-assets. It is not a complete code for every DeFi arrangement: issues such as liquidity mining and non-fungible tokens are expressly outside that circular’s coverage.[1]

Private holdings. For privately held currency or payment tokens such as Bitcoin and Ether, disposal within one year of acquisition can constitute a taxable private disposal transaction under section 23 of the Income Tax Act (Einkommensteuergesetz, EStG). Exchanging one crypto-asset for another, or using it to buy goods or services, can be a disposal even where no fiat currency is received. The resulting gain is generally taxed at the individual’s applicable income-tax rate. Gains from the relevant private disposal transactions are exempt where the aggregate gain for the calendar year is less than EUR 1,000. This is a threshold, not a deduction of EUR 1,000 from every taxable gain. Disposal after the one-year period is generally outside this particular charging provision.[2]

The circular confirms that using currency or payment tokens for staking or lending does not extend this disposal period to ten years. Rewards must nevertheless be analysed separately. Depending on the activity and asset, staking or lending receipts may be miscellaneous income under section 22, no 3 EStG, business income or income governed by another charging provision. An eventual disposal of tokens received as rewards is a separate event. Interest-like or profit-participating rights attached to a security token may instead fall within the investment-income rules in section 20 EStG. There is no universal one-year exemption for everything represented by a token.[3]

Business and DeFi activities. Business profits do not benefit from the private one-year disposal rule. Mining, validating, trading or operating a service may constitute a business depending on the full circumstances. Transaction frequency alone is not a reliable legal test. In DeFi structures, exchanges, reward distributions, receipt tokens, liquidity positions, valuation and beneficial economic ownership require transaction-level analysis. The absence of an incorporated intermediary does not itself eliminate the user’s tax liability.

VAT. In Skatteverket v Hedqvist, the Court of Justice of the European Union held that the exchange of Bitcoin and traditional currency for consideration falls within the relevant financial-services exemption. This does not create a VAT exemption for every token or blockchain service. Tokens used for goods, services or other rights must be examined by reference to the underlying supply, applicable voucher rules where relevant, and the status of the supplier and customer. Mining and validation also require analysis of whether there is an identifiable supply for consideration.[4]

Reporting and records. The KStTG implements Directive (EU) 2023/2226 (DAC8) and establishes provider due diligence and reporting for covered crypto-asset transactions. The first reporting period is 2026, with reports generally due to the Federal Central Tax Office by 31 July 2027. Statutory reporting comprises specified information and aggregates by reportable asset and transaction category, not a universal transaction-by-transaction tax assessment. Individual taxpayers remain responsible for their returns. Wallet records, acquisition costs, valuation methods and complete exchange histories remain essential, including where platforms fail or cease providing data.[5]

[1] Federal Ministry of Finance, circular of 6 March 2025, ‘Einzelfragen zur ertragsteuerrechtlichen Behandlung bestimmter Kryptowerte’, including the official English courtesy translation and the Ministry’s accompanying explanation.

[2] EStG, section 23(1), first sentence, no 2, and section 23(3). Federal Fiscal Court (BFH), judgment of 14 February 2023, IX R 3/22. BMF circular of 6 March 2025, paragraphs 53–63.

[3] EStG, sections 15 and 20 and section 22, no 3. BMF circular of 6 March 2025, particularly paragraphs 46–65 and its discussion of security tokens.

[4] Skatteverket v Hedqvist, C-264/14, ECLI:EU:C:2015:718, especially paragraphs 49–54. VAT Directive 2006/112/EC, Articles 2 and 135. BMF, VAT circular of 27 February 2018 on Bitcoin and other virtual currencies.

[5] KStTG, sections 1, 9–11 and 21. Federal Ministry of Finance, official English translation of the Act of 22 December 2025. BMF circular of 6 March 2025, paragraphs 87 onwards.

German law accommodates both retail and institutional tokenisation, but the legal route must be selected before the technology is implemented. Three separate questions arise: what rights investors acquire, how those rights are validly issued and transferred, and which offering, intermediation, custody and trading requirements apply. Retail or wholesale distribution can change exemptions and conduct obligations, but does not itself determine the asset’s legal character.

Electronic securities. Under the eWpG, an eligible security can be issued by registration rather than a paper certificate. The statute distinguishes central-register securities and crypto-securities, and individual from collective registration. Its scope includes bearer bonds and specified forms of shares. Bearer shares are confined to the central-register route, whereas registered shares can also use a crypto-securities register. Electronic fund units have their own statutory and regulatory framework. The eWpG gives electronic securities the civil-law status of things and provides specific rules for entitlement, transfer and investor protection. An ordinary token deployed on a public blockchain does not acquire that status without satisfying the statutory issuance and registration requirements.[1]

Contractual security tokens. A second route is to tokenise contractual rights that qualify as transferable securities for regulatory purposes without being electronic securities under the eWpG. Depending on their terms, standardised profit-participation rights can fall into this category. Their transfer normally depends on assignment under sections 398 and 413 of the Civil Code (Bürgerliches Gesetzbuch, BGB), rather than the eWpG’s registration-based transfer mechanism. This distinction affects good-faith acquisition, custody, enforcement and insolvency treatment. The token and contractual documentation must actually produce the rights and transferability on which the regulatory classification relies.[2]

Underlying assets. Tokenisation does not override formalities for transferring the underlying property. In particular, selling a real estate token normally transfers a contractual investment right, not registered ownership of a fractional part of German land. Direct land transfers require the relevant notarised arrangements, conveyance and land-register entry. Similar care is needed where a token purports to transfer company interests subject to notarisation. Marketing must accurately identify the issuer, recourse, ranking and investment risk rather than imply direct ownership that the structure does not confer.[3]

For retail offers, the applicable prospectus or white paper regime, marketing rules, distribution restrictions and any requirement for a packaged retail investment product key information document must be assessed separately. Professional distribution can benefit from defined exemptions, but does not remove the need for valid rights, appropriate permissions or compliant custody.

For secondary markets, the DLT pilot regime offers a specific route for trading and settlement of eligible financial instruments with authorised exemptions. A token does not become freely listable on a MiCAR trading platform merely because both use blockchain technology. Settlement also requires attention to the cash instrument, insolvency protection and legal finality. The Settlement Finality Directive, Directive 98/26/EC, is distinct from the Financial Collateral Directive. Pontes adds a central-bank-money settlement connection but does not dispense with these private-law and infrastructure questions.[4]

[1] eWpG, sections 1, 2, 4 and 8. AktG, section 10. KAGB, section 95. KryptoFAV. Wöckener and Glekler, WM 2025, 137. Kreft and Raetz, BKR 2024, 497.

[2] Civil Code (BGB), sections 398 and 413. Wöckener and Glekler, WM 2025, 137, section II(a). Ribak, RDi 2026, 105.

[3] BGB, sections 311b, 873 and 925. Limited Liability Companies Act (GmbHG), section 15. Mario Martini, ‘Immobilien als Token’, RDi 2026, 493.

[4] Regulations (EU) 2022/858 and (EU) No 1286/2014. David John, BKR 2025, 632. Sebastian Omlor and Jannik Heine, ‘Giralgeldtoken unter der Finalitätsrichtlinie’, BKR 2025, 577. ECB, Pontes announcement, 21 September 2026.

There is no general German prohibition on acquiring, holding or trading crypto-assets, including through self-custody. Crypto trading is an established activity offered by specialist providers and increasingly through regulated financial institutions. This should not be confused with legal-tender status, deposit protection or a regulatory assurance of investment value. Private parties may agree to accept a crypto-asset in payment, but Bitcoin and comparable privately issued tokens are not euro legal tender.[1]

Restrictions principally concern the product, the activity and the provider. Operating a trading platform, dealing as a service for clients, executing or transmitting orders, or safeguarding clients’ assets can require authorisation. A MiCAR platform cannot treat financial instruments as MiCAR crypto-assets simply because they are tokenised. Similarly, offers and admissions to trading of ARTs and EMTs must satisfy the applicable issuer and product requirements. An asset’s availability on a non-EU platform does not establish that it can lawfully be marketed or offered in Germany.[2]

Trading platforms must maintain admission rules and assess the assets admitted. Article 76(3) MiCAR restricts the admission of crypto-assets with an inbuilt anonymisation function unless the platform can identify their holders and transaction histories. This is not the same as a blanket prohibition on every privately held privacy-enhancing asset. Sanctions, asset-freezing measures and prohibitions on making assets available apply independently of exchange admission and authorisation.

Market integrity rules impose further restrictions. Title VI MiCAR prohibits insider dealing, unlawful disclosure of inside information and market manipulation in relation to assets within its trading-related scope. The regime is not limited to conduct occurring on the platform itself. Tokenised financial instruments instead engage the applicable securities market-abuse framework. Participants should not assume that trading through decentralised software, an overseas venue or a personal wallet removes these obligations.[3]

[1] Patz, BKR 2026, 296. Linardatos and Aubrunner, RDi 2026, 1. For the distinction from central bank money, ECB, digital euro project information.

[2] MiCAR, Articles 2(4), 16, 48, 59 and 76. John, BKR 2025, 632. John and Spitzenpfeil, BKR 2026, 773.

[3] MiCAR, Articles 76(3) and 86–92. Market Abuse Regulation (EU) No 596/2014 (MAR). Philipp Maume, ‘Das Insiderrecht der Kryptowerte’, BKR 2025, 913.

Germany has experience of ICOs, particularly from the 2017/2018 fundraising period. The Envion litigation is a prominent example of disputes arising from token-based financing and representations to investors. Subsequent market development has not produced a single ‘ICO licence’. The applicable route depends on the rights offered, the offering activity and the entities performing it. A token’s name, its technical standard and the use of a ‘white paper’ do not decide the regulatory classification.[1]

Securities and investment products. If the token qualifies as a transferable security, a public offer normally requires an approved prospectus under the EU Prospectus Regulation unless an exemption applies. The monetary exemption changed from 5 June 2026: the relevant EU threshold is an aggregate consideration of less than EUR 12 million per issuer or offeror over twelve months, subject to the statutory aggregation rules, the absence of passporting under that exemption and any applicable national option. The German framework must be applied with the amended WpPG, not the former EUR 8 million threshold. A securities information sheet (Wertpapier-Informationsblatt, WIB) is required where section 4 WpPG so provides, and its publication requires BaFin’s authorisation. The former individual-investment limits and mandatory intermediary route in section 6 WpPG have been repealed. General licensing and conduct requirements for any intermediary nevertheless remain applicable. Other investment products and packaged retail products require separate examination under the VermAnlG and the Packaged Retail and Insurance-based Investment Products (PRIIPs) Regulation.[2]

Other crypto-assets under MiCAR. For a Title II crypto-asset, an offeror or person seeking admission to trading must satisfy the relevant MiCAR requirements, which ordinarily include a compliant white paper, notification and publication. A platform admitting an asset on its own initiative may itself bear the obligation. For a required Title II white paper, notification is generally at least twenty working days before publication. Unlike a securities prospectus, it is not subject to prior regulatory approval. The absence of approval does not dilute responsibility for its content.[3]

Exemptions must be examined by their precise scope. The white paper exemptions include offers to fewer than 150 persons per Member State, offers with total consideration not exceeding EUR 1 million over twelve months, and offers exclusively to qualified investors where the assets can only be held by such investors. Separate provisions address, among other cases, certain free distributions and utility tokens for existing goods or services. Conditions and exclusions, including the consequences of an intention to seek admission to trading, must be checked. These exemptions do not all remove the same obligations.

Required marketing communications must be identifiable, fair, clear, not misleading and consistent with the white paper. A retail purchaser may benefit from the fourteen-day withdrawal right under Article 13, subject to its conditions and exclusions, including the position of assets already admitted to trading. Project documentation should explain rights, technology, risks, use of proceeds and conflicts without suggesting guaranteed returns or regulatory endorsement.

ARTs, EMTs and legacy assets. ARTs and EMTs follow their own issuer, authorisation, white paper, reserve and redemption regimes. In particular, an EMT issuer must be a credit institution or electronic money institution. The Title II statement that white papers are not pre-approved must not be generalised to all stablecoin arrangements. Article 143’s transition for specified assets already admitted to trading before 30 December 2024 allows qualifying platform operators until 31 December 2027 to meet the relevant white paper requirement. It is not a blanket postponement for new offers or every market participant.[4]

The Commission’s answer published in ESMA Q&A 2552 treats crypto-assets without an identifiable issuer as outside Titles II to IV by reference to recital 22. This supervisory interpretation is significant but not binding on courts, and its basis in the operative provisions is disputed in the literature. An issuer that has not yet been identified is not necessarily unidentifiable. The distinction matters particularly in Germany, where section 19 KMAG addresses liability for a missing required white paper, alongside Article 15 MiCAR’s liability regime for incorrect information.[5]

[1] Valentin Konstant, ‘Die Prospekthaftung bei ICOs’, BKR 2024, 1081. Lisa Majerus, ‘Security Token und Prospekthaftung’, BKR 2024, 944. See also question 14.

[2] Prospectus Regulation (EU) 2017/1129, Articles 1 and 3, as amended by Regulation (EU) 2024/2809, applicable in this respect from 5 June 2026. WpPG, sections 4, 5 and 7 and repealed section 6. Regulation (EU) No 1286/2014 (PRIIPs Regulation), especially Articles 4 and 5.

[3] MiCAR, Articles 4–15. Carola Rathke and David John, ‘Systematik der Whitepaper-Pflichten unter MiCAR’, BKR 2024, 641.

[4] MiCAR, Titles III and IV and Article 143(1) and (2). Johannes Wirtz, Chantal Raab and Timo Förster, ‘Whitepaperpflichten der MiCAR’, BKR 2026, 844.

[5] European Commission answer of 18 February 2026, published in ESMA Q&A 2552. MiCAR, recital 22 and Article 15. KMAG, section 19. For the contrary doctrinal analysis and civil-liability risk, Wirtz, Raab and Förster, BKR 2026, 844.

Yes. German law distinguishes technical control over an asset from legal entitlement to it. Native crypto-assets such as Bitcoin are not tangible things within section 90 of the BGB. The ordinary rules for transferring ownership of movable things therefore cannot simply be applied to an on-chain transfer. That does not leave holders without legal protection: contractual, restitutionary, tort and insolvency rights may be available, but their basis must be identified rather than inferred from possession of a private key.[1]

Where a token represents a contractual claim, transfer normally requires a legally effective assignment under section 398 BGB, where appropriate together with section 413. The system can be designed so that a token transfer also expresses and effects the necessary assignment, but technical movement alone is not a substitute for the legal agreement. The governing terms must address the assignable rights, restrictions, identification of the creditor and discharge by the debtor. There is no general good-faith acquisition of an ordinary contractual claim merely because a purchaser relies on an apparently valid blockchain entry.[2]

The eWpG creates a different statutory regime for electronic securities. It distinguishes the registered holder from the person legally entitled, and provides specific transfer and good-faith acquisition rules. For individually registered securities, the statutory combination of agreement and re-registration is central. Collective registration engages a different custody and co-entitlement structure. Practitioners must determine which regime applies before describing a blockchain entry as conclusive evidence of ownership.[3]

Taking security requires the same distinction. A pledge or security assignment over a claim must comply with the applicable rules, including any notification or other perfection requirement. Security over an individually registered electronic security must satisfy the eWpG’s registration requirements. For native crypto-assets, contractual control arrangements, escrow or multi-signature structures can reduce operational risk, but do not by themselves resolve the existence, priority or insolvency effectiveness of a proprietary security right. Custodian liens, competing claims, transfer restrictions, rehypothecation and cross-border enforceability must be examined.

Enforcement also depends on access. In its order of 26 June 2024, the Higher Regional Court of Cologne applied section 888 of the Code of Civil Procedure where only the debtor could transfer crypto-assets from specified trust wallets. Claimed inability to perform was insufficient while reasonable means of obtaining access remained unexhausted. Recovery procedures and evidence of authority therefore matter even where legal entitlement is clear.[4]

[1] BGB, section 90. eWpG, section 2(3), for the separate statutory treatment of electronic securities. Wöckener and Glekler, WM 2025, 137. Higher Regional Court of Cologne (OLG Köln), order of 26 June 2024, 11 W 15/24, BKR 2024, 859.

[2] BGB, sections 398–413. Wöckener and Glekler, WM 2025, 137, section II(a). Martini, RDi 2026, 493.

[3] eWpG, sections 2, 3, 8, 9 and 24–27. BGB, sections 1273 and 1280, for pledges of rights and claims.

[4] OLG Köln, order of 26 June 2024, 11 W 15/24, BKR 2024, 859, especially paragraphs 18 and 45. Code of Civil Procedure (ZPO), section 888.

A smart contract is not a separate statutory category of contract under German civil law. It may implement an agreement already made in natural language, provide the mechanism through which an agreement is concluded, or operate without creating a contractual relationship between every participant. The legal analysis remains one of declarations of intention, agreement, attribution, capacity and the content of the parties’ obligations. Code and legal terms should therefore be examined together.[1]

Automated execution does not dispense with offer and acceptance or with the need to attribute a declaration to a person. Nor does every interaction with a protocol make its developers or every token holder a contracting party. The interface, representations, governance arrangements and actual transaction structure matter. Where the natural-language terms and code diverge, interpretation must determine what the parties agreed and who bears the risk of the discrepancy. The proposition that ‘code is law’ does not override mandatory German law.

Errors in programming, inputs or external data can raise questions of mistake, defective performance, damages or unjust enrichment. A successful legal challenge need not reverse the blockchain itself: it may instead give rise to a duty to retransfer assets or pay compensation. The difficulty is often identifying and reaching the responsible party, preserving evidence and enforcing a remedy after automatic execution. An irreversible technical transaction and an irreversible legal result are not the same thing.[2]

Formal requirements also remain relevant. A smart contract does not replace notarisation of a land transaction or a transfer of a German limited liability company interest where the law requires it. Consumer information and withdrawal rules, controls on unfair standard terms, and restrictions on excluding liability continue to apply. The same is true of data protection requirements where automated execution processes personal data or produces a decision within Article 22 GDPR.[3]

Article 36 of the EU Data Act, Regulation (EU) 2023/2854, addresses essential requirements for smart contracts used to execute data-sharing agreements within its scope. These include robustness and access control, safe termination and interruption, and consistency with the underlying agreement. This is a specific regulatory context, not a universal requirement to add an unrestricted termination switch to every crypto-asset smart contract.[4]

In practice, agreements should identify the deployed code and version, allocate responsibility for external data feeds, define administrator and upgrade powers, address forks and emergency interventions, and specify applicable law and dispute resolution. Technical audits and contractual risk allocation serve different purposes: an audit does not determine whether the legal rights are valid or whether a provider requires authorisation.

[1] BGB, sections 133, 145–157 and 164 onwards. For the distinction between technical execution and the legal attribution of services, Sturua, Schiller and Treytl, RDi 2025, 545.

[2] BGB, sections 119, 121, 122, 280 and 812. For practical enforcement limits, OLG Köln, 26 June 2024, 11 W 15/24, BKR 2024, 859.

[3] BGB, sections 305–310, 311b and 312 onwards. GmbHG, section 15. GDPR, Article 22. European Data Protection Board, Guidelines 02/2025, version 2.0 of 7 July 2026, paragraph 107.

[4] Data Act, Regulation (EU) 2023/2854, Article 36. European Commission, ‘Data Act explained’, discussion of interoperability and smart contracts for data-sharing agreements.

German law does not provide a general, bespoke legal form for a decentralised autonomous organisation (DAO). The expression describes an organisational and technical model, not an automatic legal personality or liability shield. A DAO’s legal treatment depends on the relationship between participants, their common purpose, governance arrangements, external dealings and any incorporated entity used for the project.[1]

An unincorporated arrangement may constitute a civil-law partnership (Gesellschaft bürgerlichen Rechts, GbR) where the requirements of section 705 BGB are met. A legally capable partnership may arise where the participants intend the organisation to participate in legal transactions. Partners in such a partnership are generally personally and jointly liable for its obligations under section 721 BGB. A commercial business may require examination under the rules governing commercial partnerships. However, merely holding a token does not automatically establish partnership membership: an agreement, participation in the common purpose and the relevant legal relationships must be established on the facts.[2]

Using a company, foundation or other legal entity can provide an identifiable contracting party and an organised liability structure. It does not automatically place every protocol activity inside that entity, bind every token holder or eliminate the liability of persons acting outside its authority. The relationship between token voting and the entity’s legally competent organs must be specified. A foreign DAO entity also raises questions of recognition, governing law, representation and enforcement in Germany.

The regulatory perimeter is independent of the organisational label. A DAO-related undertaking may provide a crypto-asset service, operate a trading venue, issue a security or collective investment interest, or perform another regulated activity. Pooling capital from investors under a defined investment policy requires particular attention under the KAGB. A finding of sufficient decentralisation for one MiCAR issue does not settle tax-reporting, AML or civil-law status. Voting concentration, upgrade rights, control over the treasury and commercial interfaces may be relevant to identifying responsible actors.[3]

The principal drafting task is therefore to connect on-chain governance with enforceable off-chain arrangements. These should identify who owns or controls treasury assets, who may bind the organisation, how proposals become binding decisions, who can change or suspend the code, and what happens when participants exit or disputes arise. Without that connection, technical consensus can leave representation, liability and the enforceability of member rights uncertain.

[1] BGB, sections 705 onwards. For the distinction between technical decentralisation and identifiable responsible actors, Böck and others, ZfDR 2026, 131.

[2] BGB, sections 705 and 721. Commercial Code (HGB), section 105. Application to a particular DAO depends on its agreement and actual organisation, rather than the token label.

[3] KAGB, section 1(1). MiCAR, Articles 3(1)(15) and 59 and recital 22. Böck and others, ZfDR 2026, 131. Sturua, Schiller and Treytl, RDi 2025, 545.

Yes. BaFin has used supervisory restrictions, public warnings and orders to stop or wind down unauthorised activities involving crypto-assets. These measures address regulated conduct rather than blockchain technology itself. The applicable basis can be the KMAG, the KWG or securities-prospectus legislation, depending on the product and activity. Section 10(7) KMAG provides a specific basis for public warnings concerning suspected unauthorised crypto-asset business.[1]

The Ethena proceedings are a significant example. In March 2025, BaFin took measures concerning Ethena GmbH’s USDe business, including stopping new business, restrictions concerning reserve assets and the appointment of a special representative. It subsequently ordered the winding down of the unauthorised business in April 2025. These measures concerned the MiCAR treatment of USDe and requirements applicable to the undertaking. The associated sUSDe arrangement separately raised the question whether investment-like rights made it a transferable security subject to prospectus requirements.[2]

The Administrative Court of Frankfurt am Main rejected an application for interim relief against BaFin’s publication in its order of 2 May 2025, 7 L 1257/25.F. The procedural qualification is important: the court considered the legality of the contested publication and the basis for the relevant supervisory suspicion. The order should not be described as a final, generally applicable ruling that every staking token is a security. The rights attached to the particular token, its economic structure and the statutory test remain decisive. The attribution of connected website content can also matter when determining whether a public offer has been made.[3]

Private enforcement complements supervisory action. The Envion cases illustrate potential liability arising from ICO documentation and the allocation of responsibility between issuers, founders and other participants. The applicable cause of action and the defendant’s role must be established: publication of a document called a white paper does not automatically select one liability regime. Separately, the Cologne wallet-transfer proceedings discussed in question 11 demonstrate that courts can enforce obligations to deliver crypto-assets through coercive measures even where performance requires the debtor’s access credentials.[4]

Taken together, these developments make transaction documentation, accurate marketing, a defensible classification and evidence of the actual operating model important before launch. They also underline the need to distinguish a published suspicion, an interim order, an administrative measure and a final merits judgment when describing enforcement history.

[1] KMAG, sections 9 and 10(7). KWG, sections 37 and 44c. WpPG, section 18. Linardatos and Aubrunner, RDi 2026, 1.

[2] Linardatos and Aubrunner, RDi 2026, 1, discussion of BaFin’s Ethena measures of March and April 2025 and related prospectus proceedings. VG Frankfurt am Main, 2 May 2025, 7 L 1257/25.F, BKR 2025, 611.

[3] VG Frankfurt am Main, order of 2 May 2025, 7 L 1257/25.F, especially paragraphs 21, 24, 35 and 51, with the accompanying case note in BKR 2025, 611.

[4] Konstant, BKR 2024, 1081, on Kammergericht, 25 November 2021, 20 U 1088/20, and Federal Court of Justice (BGH), 9 July 2024, XI ZR 344/22. Majerus, BKR 2024, 944. OLG Köln, 26 June 2024, 11 W 15/24, BKR 2024, 859.

Data protection. Blockchain data can be personal data even where it contains only wallet addresses, pseudonyms or cryptographic references. The GDPR assessment depends on whether a person can be identified using means reasonably likely to be used. An immutable or publicly accessible ledger is not outside the GDPR. Controllers and processors must be identified by their actual roles, with a lawful basis, purpose limitation, data minimisation, appropriate retention, security and arrangements for exercising individual rights.[1]

The European Data Protection Board (EDPB) adopted the final version of its blockchain guidelines on 7 July 2026. It emphasises architectural choices and data protection by design. Keeping additional personal data off-chain can reduce risk, but hashing or encryption does not automatically make the remaining information anonymous. Erasure and rectification must remain effective, and data protection impact assessments are required where processing is likely to create high risk. Public distribution and international nodes also require attention to the rules on transfers outside the European Economic Area. Where technical design makes compliance impossible, describing the ledger as immutable is not a legal answer.[2]

Insolvency and custody. MiCAR requires a custodian’s clients’ crypto-assets to be separated from its own assets and legally segregated from its estate, in accordance with applicable law, so that the custodian’s creditors have no recourse to those assets. German national provisions supplement the allocation and insolvency treatment. Effective records, reconciliation and the customer’s actual legal position are crucial. An unsecured lending claim against a provider is not transformed into a segregated custody asset by calling the product a wallet or staking account.[3]

The insolvency of the token issuer presents a different question. A token holder’s recovery depends on the underlying right, contractual ranking, any security and applicable mandatory law. An investment token may convey only an unsecured or subordinated claim. Rights of EMT and ART holders must instead be examined under the relevant redemption and reserve regimes. Neither custody segregation nor a white paper is a guarantee against market losses, issuer default, smart-contract defects or the inability to recover inaccessible assets.[4]

Consumer and private international law. Standard-term controls, consumer information, withdrawal rights where applicable and rules against misleading commercial practices remain relevant. Claims that a product is risk-free, equivalent to a bank deposit or approved by the regulator require particular care. Cross-border projects must separately determine governing law, jurisdiction, the reach of mandatory consumer protections and enforceability. Selecting a foreign law in the terms does not disapply German or EU supervisory rules where their territorial conditions are met.

Corporate and property law. Ordinary rules on directors’ duties, maintenance of capital, transfers of company interests and property formalities continue to apply. A token cannot confer land ownership, a corporate membership right or a proprietary security interest more effectively than the underlying legal structure permits. These matters should be resolved alongside regulatory classification, rather than left until after the code has been deployed.[5]

[1] GDPR, Articles 4–6, 12–22, 24–32 and 44 onwards. EDPB, Guidelines 02/2025 on processing of personal data through blockchain technologies, version 2.0, 7 July 2026.

[2] EDPB, Guidelines 02/2025, version 2.0, sections 3.3, 4 and 5, especially paragraphs 91 and 102–104.

[3] MiCAR, Articles 70 and 75(7). KMAG, section 45. KWG, section 46i (qualified crypto custody). Patz, BKR 2026, 296. Dennis Fritz, ‘Anbieter von Kryptowerte-Dienstleistungen nach der MiCAR’, BKR 2023, 747.

[4] MiCAR, Articles 36–39 and 49–50. Omlor, RDi 2026, 66. Martini, RDi 2026, 493.

[5] BGB, sections 305 onwards, 311b, 873 and 925. GmbHG, sections 15, 30 and 43. Stock Corporation Act (AktG), section 93. Regulations (EC) No 593/2008 and (EU) No 1215/2012. Tilson and Kral, BKR 2026, 351.

Three distinctions deserve continuing attention: a token’s regulatory classification is not its civil-law form, a provider’s authorisation is not approval of the token, and technical control is not necessarily legal entitlement. A project can satisfy one of these dimensions and still fail another. Legal documentation should connect them throughout issuance, transfer, custody, trading and exit.

Operational resilience and outsourcing. DORA has applied since 17 January 2025 to the financial entities within its scope, including authorised CASPs and ART issuers. Relevant obligations cover information and communication technology risk management, incident reporting, resilience testing and third-party risk. Outsourcing under MiCAR does not transfer the regulated provider’s responsibility. White-label arrangements must leave customers able to identify their actual provider and must not enable an unlicensed entity to perform a regulated service in its own right. In particular, Article 75(9) MiCAR restricts the use of other providers for custody. Access, audit, continuity and exit rights must be workable, not merely included as standard clauses.[1]

Governance, competence and conflicts. Management and staff must meet the applicable competence and suitability requirements. Advice and portfolio management engage additional obligations, including suitability and conflict management. Referral fees, revenue-sharing, group execution and staking incentives require scrutiny against the actual services and remuneration rules. Article 80(2) MiCAR, for example, prohibits specified benefits for routing client orders to a particular platform or provider. An ‘affiliate’ or ‘ambassador’ label does not settle the intermediary’s regulatory role.[2]

Market disclosures and technical changes. Material protocol vulnerabilities, changes to token rights or reserve arrangements, governance decisions and significant service interruptions may require consideration under white paper updating, contractual disclosure and market-abuse rules. The tests are not interchangeable. In particular, MiCAR’s insider-information regime should be analysed on its own wording rather than assuming that every development under the securities Market Abuse Regulation automatically carries across.[3]

Treasury and succession. Companies holding crypto-assets need defensible custody, liquidity, valuation and financing arrangements. Leverage can magnify both investment exposure and refinancing risk. For individuals and family businesses, succession planning must combine the transfer of legal rights with secure access arrangements. The heir’s entitlement under section 1922 BGB will not itself recreate a lost key. Recovery procedures should therefore be designed without exposing assets to unauthorised access during the holder’s lifetime.[4]

Finally, compliance calendars should distinguish rules already applicable from measures with deferred application or proposals still being negotiated. The 2026 KStTG reporting period and the principal AML Regulation application date of 10 July 2027 already require concrete preparation. Future changes to EU supervision, the DLT pilot regime or payment services should not be treated as enacted exemptions. The same discipline applies to proposed tax reforms: investment and product decisions must be based on the law applicable to the relevant transaction and period, not on an announced policy intention.[5]

[1] DORA, Articles 2, 5–16, 17–23 and 28–30. MiCAR, Articles 73 and 75(9). Jens Brauneck, ‘Das Outsourcing kryptobezogener Tätigkeiten unter der MiCAR’, RDi 2025, 15. John and Spitzenpfeil, BKR 2026, 773.

[2] MiCAR, Articles 68, 72, 80(2) and 81. Jens Brauneck, ‘ESMA-Leitlinien in der Grauzone zulässigen Handelns’, RDi 2026, 389, on the legal basis and scope of the 2026 competence guidelines.

[3] MiCAR, Articles 12 and 86–92. Maume, BKR 2025, 913. Rathke and John, BKR 2024, 641.

[4] AktG, section 93. GmbHG, section 43. BGB, section 1922. Tilson and Kral, BKR 2026, 351.

[5] KStTG, sections 9–11 and 21. Regulation (EU) 2024/1624, Article 90. EStG, section 23. John and Spitzenpfeil, BKR 2026, 773.