BaFin Issues Warnings on Unauthorized Cryptocurrency Services in Germany

The German government has implemented a new law, the Crypto Markets Supervision Act (KMAG), to regulate the cryptocurrency market in the country. The law, which came into effect on December 27, 2024, is an implementation of the European Union's MiCA regulation. The law requires cryptocurrency providers to obtain a license to operate in Germany, and the Federal Financial Supervisory Authority (BaFin) is responsible for enforcing the law.

Between September 28 and October 1, 2026, BaFin published nine consumer notices on unauthorized business, five of which concerned cryptocurrency-asset services. The notices stated that there was a suspicion that the companies were providing unauthorized services, and that BaFin had informed the public of the suspicion. The law allows BaFin to name a company in public if there is a suspicion that it is providing unauthorized services.

The law also covers companies that do not provide services but create a corresponding impression in public. This includes sham platforms that only collect contact details. BaFin has warned about several cases of identity misuse, where companies have been using borrowed corporate identities to operate.

The most interesting case is that of bitbucks(.)space, where BaFin warned that there was a suspicion that the unknown operators were offering financial and securities services as well as cryptocurrency-asset services without authorization. The website was using a borrowed corporate identity, and BaFin established that there was no connection with a genuine company in Stuttgart.

BaFin has also warned about a series of sites that were offering cryptocurrency-asset services without a license. The sites had no legally valid imprint, and interested parties were asked to enter their details in a contact form. The customer records were then sent to operators of unauthorized online trading platforms.