Crypto ATM / kiosk operator in Germany
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Germany with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer identification (KYC) required under GwG for all transaction parties before service provision
- Travel rule compliance under KryptoWTransferV — originator and beneficiary information must be collected and transmitted for all crypto transfers
- Cash transaction reporting: cash transactions (incl. cash-in) above EUR 10,000 trigger suspicious activity reporting obligations under GwG
- Ongoing transaction monitoring required under GwG
- AML/CFT compliance program required per § GwG including a money laundering prevention officer, risk assessment, and internal safeguards
- Reporting to FIU (Financial Intelligence Unit Germany) for suspicious transactions under GwG
- Fit-and-proper verification of managing directors (reliability, qualifications, experience in crypto custody)
- Customer asset segregation required — complete separation of client and proprietary crypto assets
Key Restrictions
- Must establish a German legal entity (GmbH, AG, or bank) with proper corporate governance
- Must obtain CASP authorization under MiCA (or pre-MiCA Kryptoverwahrgeschaeft license) from BaFin — 6-12 month processing timeframe
- Minimum capital of EUR 125,000 for crypto custody license (Kryptoverwahrgeschaeft under KWG); EUR 150,000 for exchange/trading platform services
- Professional liability insurance of at least EUR 1,000,000 required
- IT security procedures per BAIT (BaFin IT Requirements) mandatory — including encryption, access controls, incident response
- Detailed business plan and technology/security documentation required for licensing
- No anonymous cash-to-crypto transactions permitted — cash-in at kiosks requires full KYC identity verification
Key Risks
- High regulatory scrutiny by BaFin on cash-intensive crypto operations — kiosk operators are high-risk for AML enforcement
- Transition period risk: MiCA CASP authorization replaces/supplements pre-existing KWG licensing framework, creating regulatory overlap and potential gaps during transition
- Cash transaction reporting thresholds may attract frequent FIU inquiries given the physical cash nature of kiosks
- Operational complexity: BAIT IT security compliance for kiosk infrastructure (self-service devices, remote management) is demanding
- BaFin known for thorough/slow licensing processes — 6-12 months with potential for delays, impacting time-to-market
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BaFin — CASP authorization (MiCA), crypto custody licensing (Kryptoverwahrgeschaeft) — pioneer since Jan 2020, ~40 entities hold/applied
MiCA Regulation (EU) (2023) — CASP authorization, comprehensive crypto regulation
Kreditwesengesetz (KWG) — Banking Act (2020) — Crypto custody license (Kryptoverwahrgeschaeft) — EUR 125,000 minimum
VASP: CASP authorization under MiCA via BaFin. Pre-MiCA crypto custody license also in effect. BaFin 12-month transition period. 6-12 months (BaFin known for thoroughness/slower processing). Requires detailed business plans and IT security concepts (BAIT/DORA).
CUSTODY: Crypto custody license (Kryptoverwahrgeschaeft) under KWG — EUR 125,000 minimum capital. ~40 entities hold or have applied.
EXCHANGE: CASP authorization under MiCA — EUR 150,000 minimum capital for trading platforms
Federal Financial Supervisory Authority (BaFin): Germany's primary financial regulator responsible for licensing and supervising all crypto-asset service providers, including exchanges and custodians. BaFin enforces compliance with national laws and EU regulations, focusing on consumer protection and anti-money laundering measures.
German Banking Act (KWG): Since January 2020, crypto custody has been regulated as a financial service requiring a BaFin license.
Markets in Crypto-Assets Regulation (MiCAR): Applies EU-wide as of the end of 2024, establishing harmonized licensing requirements for crypto-asset service providers throughout the EU.
Fit-and-proper requirements: At least one managing director must be reliable, sufficiently qualified, and experienced in crypto custody business.
Professional liability insurance: Minimum €1,000,000 covering custody service operation risks.
IT security procedures: Per BAIT (BaFin Guidance on IT Requirements), including encryption, access controls, and incident response.
Customer asset segregation: Complete separation of client and proprietary crypto assets required.
AML/CFT compliance: Full adherence to the German Money Laundering Act (GwG) with customer identification and transaction monitoring.
Know Your Customer (KYC): Verification of all transaction parties' identities.
Establishing a German legal entity (GmbH, AG, or bank) with proper corporate governance
Preparing a comprehensive business plan describing crypto custody offerings, technology platform, and security procedures
Documenting capital adequacy with €125,000 minimum through bank accounts and audited financial statements
GwG (Money Laundering Act): Core national law incorporating EU AML Directives (e.g., AMLD5), covering obliged entities like CASPs for ML/TF prevention.
KWG (Banking Act): Requires BaFin licensing (section 32) for crypto custody business, exchange services, and related financial activities.
KMAG (Crypto Markets Supervision Act): Implements MiCAR domestically, granting BaFin powers for CASP licensing, supervision, and public warnings.
KryptoWTransferV (Crypto Asset Transfer Regulation): Enforces the EU "travel rule" for crypto transfers, requiring originator/beneficiary identification.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — crypto ATM/kiosk operators may serve residents in Germany only after obtaining BaFin CASP authorization (MiCA) or a crypto custody license (Kryptoverwahrgeschaeft under KWG), establishing a German legal entity, meeting EUR 125,000–150,000 minimum capital, implementing full KYC/AML/travel-rule compliance, and adhering to BAIT IT security requirements, all under BaFin supervision.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?