How to Get a BaFin Licence in Germany: ZAG, MiCA, WpIG and KWG

Gregory Lutsenko

04.12.2025 | 6 min read

Updated: 15.10.2026

Where should a fintech founder from another country start? First, determine which law your business model falls under. Then build the application so that BaFin does not keep sending it back with questions for months.

In this article, we at COREDO walk through five types of authorisation. They are payment institution and e-money institution under the ZAG, crypto-asset service provider (CASP) under MiCA, investment firm under the WpIG and bank under the KWG. For each, we cover the requirements, how to apply, the capital and the periods set by law. How we support such projects is described on the page financial licensing in Germany.

Who grants a BaFin licence and who supervises fintech

Financial supervision in Germany rests on two institutions. BaFin grants authorisations and takes supervisory decisions. The Deutsche Bundesbank takes part in the ongoing supervision of institutions and receives copies of applications.

The roles of BaFin and the Bundesbank

When you need a BaFin licence

• Payment services on a commercial basis: payment institution authorisation under § 10 ZAG.
• Issuing e-money: e-money institution authorisation under § 11 ZAG.
• Crypto-asset services: CASP authorisation under MiCA, which has applied since 30 December 2024.
• Investment services: written authorisation under § 15 WpIG.
• Banking business, including deposits and loans: authorisation under § 32 KWG.

Types of BaFin licences for fintech

Choosing the authorisation is the key decision of the whole project. It determines the capital, the documents, the periods and even whether you can operate in other EU countries. Below are the five options a foreign founder usually chooses between.

Payment institution (§ 10 ZAG)

E-money institution (§ 11 ZAG)

Crypto-asset service provider (MiCA)

• Custody of crypto-assets, exchange for funds or other crypto-assets, a trading platform, order execution and advice are crypto-asset services under Regulation (EU) 2023/1114 (MiCA).
• They may be provided in the EU only with authorisation under Art. 63 MiCA or by a financial entity under Art. 60 MiCA.
• A bank or an investment firm may provide crypto-asset services after a notification filed at least 40 working days before starting. An investment firm may provide only services equivalent to its authorisation.
• Companies that worked with crypto-assets under a KWG authorisation before MiCA received a transitional regime and a simplified procedure (§ 50 KMAG). A new market entrant cannot use this route.

Investment firm (§ 15 WpIG)

• Brokerage, portfolio management, investment advice, placing and dealing on own account require a written authorisation from BaFin under the Investment Firm Act (WpIG).
• The capital depends on whether the firm holds client money and securities and whether it deals on its own account.

Bank (§ 32 KWG)

• A licence for a bank that takes deposits and grants loans is the heaviest option: initial capital of at least EUR 5 million, at least two managers and a decision of the ECB.
• If your project does not take deposits or grant loans, first check whether an authorisation under the ZAG, the WpIG or MiCA is enough.

How to get a BaFin licence step by step

The procedure is similar for all types of authorisation, but the details differ. Below are five steps in the order an applicant goes through them.

Step 1. Choosing the authorisation and first contact with BaFin

• Describe each service and map it to the ZAG, MiCA, the WpIG or the KWG.
• BaFin asks applicants to contact it before formally submitting an application. The first meeting covers the documents, the fees and the annual supervisory levy.

Step 2. Company and team in Germany

• For a ZAG authorisation, the head office must be in Germany, and at least part of the services must be provided here.
• For a bank, both the head office and the registered office must be in Germany (§ 33 KWG).
• A CASP needs a registered office in an EU country where it provides part of its services. It also needs its place of effective management in the EU and at least one director resident in the EU (Art. 59 MiCA).

Step 3. The document package

• Under § 10 ZAG, the application contains a description of the business model and a business plan with a budget for the first three years. It also needs proof of capital and a description of internal controls and outsourcing arrangements.
• A ZAG application names the managers and the holders of qualifying holdings and shows that the managers are reliable.
• For a CASP, Art. 62 MiCA sets the content: programme of operations, management, shareholders, ICT systems, AML/CFT, segregation of client assets and complaints handling.

Step 4. Submitting the application

• For a ZAG application, BaFin asks for two paper copies sent to its Bonn address or one copy each to BaFin and the Bundesbank. An electronic copy with all annexes is needed in addition.
• A CASP application goes to BaFin by post or electronically, with an electronic copy to the Bundesbank as well. The application form is set by Implementing Regulation (EU) 2025/306.
• A bank application is filed with BaFin, even when the ECB takes the decision.

Step 5. Review, decision and launch

• BaFin first checks that the application is complete, then assesses it on the merits and requests any missing information.
• Once authorised, you can start operating in Germany and prepare the notification for operating in other EU countries.

Financial and operational requirements

Insufficient capital is one of the statutory grounds for refusing an authorisation. You need not only the right amount but also the right proof of it.

Initial capital

CASP capital: the higher of two amounts

BaFin fees

• Applications for authorisation are subject to a fee. It is set by the fee ordinance FinDAGebV and paid by the applicant.
• Under the KWG and MiCA, the fee is charged even if the application is withdrawn or rejected. For a MiCA application, the amount depends on the time BaFin spends on it.

Compliance requirements: management, AML and IT

BaFin assesses not only the documents but also the people and systems that will run the business.

Managers and shareholders

• Managers must be reliable and professionally qualified. Under the ZAG, this means sufficient theoretical and practical knowledge and management experience (§ 12 ZAG).
• BaFin refuses if there are grounds to consider a holder of a qualifying holding unreliable.
• A payment institution or an e-money institution appoints at least two managers; for a small company, one is enough (§ 10, § 11 ZAG).
• A bank needs at least two managers who do not work for it only on an honorary basis (§ 33 KWG).

AML: the money laundering officer

• Payment institutions, e-money institutions, CASPs, investment firms and banks are obliged entities under the GwG (§ 2 GwG).
• As a general rule, they appoint an AML officer (money laundering officer) at management level and a deputy (§ 7 GwG). The AML officer must work in Germany.
• A CASP application describes internal controls, including AML/CFT procedures (Art. 62 MiCA).

IT, DORA and outsourcing

• The DORA Regulation (EU) 2022/2554 applies to banks, payment institutions, e-money institutions, investment firms and CASPs.
• BaFin requires proof of DORA compliance already in the application, as its pages on banking and crypto authorisations state expressly.
• Outsourcing arrangements are described in the application under § 10 ZAG.

EU passport: operating beyond Germany

A BaFin authorisation opens the whole EU market, but not automatically. Before entering another country, you must notify BaFin.

Payment institutions and e-money institutions

• The institution notifies BaFin and the Bundesbank of its plans to open a branch or use agents in another EEA country (§ 38 ZAG).
• BaFin passes the information to the other country's supervisor within one month of receiving the complete notification. The decision on registration is taken within three months (§ 38 ZAG, Art. 28 PSD2).
• The branch or agents start operating after entry in the register of institutions.

Crypto-asset service providers

• A CASP tells BaFin in which countries it will provide which services (Art. 65 MiCA). BaFin passes the information on within 10 working days.
• Services may start as soon as BaFin confirms the communication, and at the latest from the 15th calendar day after the information was submitted. No physical presence in the other country is required (Art. 59 MiCA).
• A KWG authorisation for qualified crypto custody does not give a European passport: only an authorised CASP has one.

Common mistakes and how to avoid them

Below are the mistakes that delay the procedure or lead to refusal, and how to avoid them.

Incomplete application

• Under the ZAG, BaFin rejects the application if the information is still missing 12 months after submission, although BaFin asked for it to be completed within one month (§ 10 ZAG).
• Under MiCA, BaFin may set a four-week deadline for missing documents and will reject the application if it remains incomplete.

The wrong type of authorisation

• A project plans to operate across the EU but obtains a KWG authorisation for crypto custody, which has no passport.
• Solution: before applying, map each service to the law and to your plans for other markets.

An office on paper only

• Under the ZAG and the KWG, the head office must be in Germany, and the AML officer must work here too.
• Solution: plan management, staff and premises in Germany in advance.

Capital without a buffer

• For a CASP, one quarter of fixed overheads may turn out to be higher than the Annex IV minimum.
• Solution: calculate the capital from the business plan, not only from the table of minimums.

BaFin licence timelines: the law and practice

Important: the statutory period for the decision itself starts only once the application is complete. Under MiCA, the assessment may be suspended to request information for no more than 20 working days, and the decision is notified within 5 working days. In COREDO's experience, the whole project from the start of preparation to authorisation takes from 6 to 18 months.

Practical recommendations and checklist

• Start with an analysis of the business model: which services, for which clients and in which EU countries.
• Choose the authorisation by the services, not by its name: ZAG, MiCA, WpIG or KWG.
• Arrange a first meeting with BaFin before submitting the application.
• Prepare the head office, the managers and the AML officer in Germany.
• Calculate the capital from the business plan and keep the proof ready.
• Plan time for BaFin's questions and for the passport notifications.