Key Takeaways
- • Germany's Crypto Markets Supervision Act (KMAG), enacted December 27, 2024, implements the EU's Markets in Crypto-Assets Regulation (MiCA) and eliminates the licensing grey zone for crypto service providers operating in the country.
- • BaFin, Germany's Federal Financial Supervisory Authority, published nine consumer warnings for unauthorised business activities between late September and early October 2026, with five explicitly citing KMAG violations—signaling the regulator's shift from licensing review to enforcement and public naming of non-compliant providers.
- • All crypto-asset service providers operating in Germany now require explicit BaFin licensing; the expiration of the transitional period means no exemptions or grey-area operations remain legally permissible.
- • Five of the nine BaFin warnings reference Section 10(7) of the KMAG and Section 37(4) of the Banking Act, indicating enforcement is based on the law's specific supervisory and sanctions provisions.
Summary
The Crypto Markets Supervision Act (KMAG) represents Germany's national implementation of the EU's Markets in Crypto-Assets Regulation (MiCA). First published in the Federal Law Gazette on December 27, 2024, the law grants Germany's Federal Financial Supervisory Authority (BaFin) the legal basis to supervise and enforce compliance with crypto-asset market rules. The legislation was last amended on March 25, 2026, and its core function is to establish mandatory licensing requirements for all entities offering crypto-asset services within Germany's jurisdiction.
The practical implications of KMAG became evident in the final weeks of September 2026, when the regulatory transition period expired and BaFin began aggressive enforcement action. Within four days at the end of September and into early October, BaFin issued nine public consumer notices naming unauthorised providers. Five of these warnings specifically concerned crypto-asset services and explicitly cited KMAG enforcement provisions. This marks a critical threshold: BaFin has transitioned from passive licensing administration to active public enforcement, naming non-compliant firms as a regulatory deterrent.
The five KMAG-related warnings cite Section 10(7) of the Crypto Markets Supervision Act and Section 37(4) of the Banking Act—provisions that authorize BaFin to publicly identify operators lacking required licences. For crypto firms and their customers in Germany, the message is unambiguous: no grey area remains. Any entity providing crypto-asset services without explicit BaFin authorisation now faces immediate reputational and legal consequences through public naming. The law's enforcement apparatus has shifted from preventive licensing review to punitive disclosure, reflecting the EU's broader commitment to harmonised crypto-asset supervision under MiCA.
The practical implications of KMAG became evident in the final weeks of September 2026, when the regulatory transition period expired and BaFin began aggressive enforcement action. Within four days at the end of September and into early October, BaFin issued nine public consumer notices naming unauthorised providers. Five of these warnings specifically concerned crypto-asset services and explicitly cited KMAG enforcement provisions. This marks a critical threshold: BaFin has transitioned from passive licensing administration to active public enforcement, naming non-compliant firms as a regulatory deterrent.
The five KMAG-related warnings cite Section 10(7) of the Crypto Markets Supervision Act and Section 37(4) of the Banking Act—provisions that authorize BaFin to publicly identify operators lacking required licences. For crypto firms and their customers in Germany, the message is unambiguous: no grey area remains. Any entity providing crypto-asset services without explicit BaFin authorisation now faces immediate reputational and legal consequences through public naming. The law's enforcement apparatus has shifted from preventive licensing review to punitive disclosure, reflecting the EU's broader commitment to harmonised crypto-asset supervision under MiCA.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.