2020-03-02
Issued by the German Federal Financial Supervisory Authority (BaFin), these guidelines clarify the statutory definition and authorization requirements for crypto custody business under Section 1(1a) Sentence 2 No. 6 of the German Banking Act (KWG). The framework establishes that providing custody, management, or protection of cryptoassets or private cryptographic keys for third parties triggers a commercial authorization requirement if conducted profitably and objectively necessitates a commercial enterprise, regardless of legal form or transaction volume. Providers must demonstrate direct access to public addresses via private keys, exclude mere storage space or hardware sales, and navigate priority rules with existing securities depositories while operating without a European passport for cross-border services.