BaFin Cracks Down on Unauthorized Wallet Offerings: Custody Control Triggers Authorization Requirement

The German financial regulator BaFin has issued two consumer notices regarding wallet offerings that are operating without authorization. On August 19, 2026, BaFin published two notices, one concerning a website and another concerning a website along with an app.

According to the notices, the operators of these wallet offerings are conducting unauthorised business, as stated in Section 10(7) of the German Crypto Markets Supervision Act (KMAG). This provision allows BaFin to inform the public about companies that may be operating without authorization, with a built-in correction mechanism if later found to be incorrect.

The question remains: at what point does a wallet need an authorisation? The answer is not obvious, as millions of people use wallet software without an authorized company behind it. However, a key distinction lies in the control over access, not necessarily the holding of the assets themselves.