BaFin Crypto Custody Guidance under the Banking Act

The guidance focused on the statutory definition in section 1 (1a) sentence 2 no. 6 KWG as it applied from 2020. It addressed whether a provider was acting “for others,” whether the provider held or controlled cryptoassets or relevant private keys, and how custody, management and protection should be distinguished from purely technical services. The guidance was especially relevant for wallet providers, exchanges, institutional custody providers and service models involving access to client private keys.

• Regulatory perimeter: BaFin described crypto custody business as a regulated financial service under the Banking Act when the statutory elements were met.
• Private-key control: The guidance treated access to, or control over, private cryptographic keys as a central scoping issue.
• Technical-service limits: Services such as self-operated hardware or software wallets were generally treated differently where the provider did not control client assets or keys.
• Authorisation context: The KWG licensing framework remained relevant for businesses that carried out regulated financial services in Germany.

Germany’s 2020 crypto custody regime was later reshaped by the EU Markets in Crypto-Assets Regulation. The Bundesbank states that MiCAR entered into force on 29 June 2023 and that Title V rules for crypto-asset service providers apply from 30 December 2024. Germany implemented the national supervisory layer through the KMAG and the Financial Market Digitalisation Act.

Under the current KWG, section 1 (1a) sentence 2 no. 6 refers to qualified crypto custody business, covering custody and administration of cryptographic instruments for others and the safeguarding of private cryptographic keys used for certain DLT-based instruments or securities. This means the 2020 BaFin guidance should not be read as a complete statement of the current German custody framework for ordinary MiCAR crypto-assets.

The profile is jurisdiction-specific to Germany, with BaFin as the supervisory actor and the KWG as the domestic banking statute. It should also be linked to European Union MiCAR coverage because the EU framework now supplies the main authorisation architecture for crypto-asset service providers, while Germany’s national laws allocate supervisory powers and preserve specific KWG treatment for qualified crypto custody involving cryptographic instruments.

• BaFin English guidance notice
• BaFin German guidance notice
• Current KWG consolidation
• Current KMAG consolidation