BaFin — German Federal Financial Supervisory Authority

Overview

The Bundesanstalt fur Finanzdienstleistungsaufsicht (BaFin) supervises Germany’s financial sector, encompassing over 2,700 banks, 800 financial services institutions, and 700 insurance companies. BaFin’s core principle is technological neutrality — tokenized financial instruments remain regulated by MiFID II regardless of the technology used. Germany hosts the largest concentration of European crypto exchange-traded products (ETPs) on Deutsche Borse’s Xetra platform, and BaFin administers the Electronic Securities Act (eWpG) which enables blockchain-based securities issuance — including fund shares — without a traditional central securities depository. Key 2024-2025 developments include: the Financial Market Digitalisation Act (published December 27, 2024); revised AML guidance for CASPs and ART issuers (March 2025); increased due diligence requirements for crypto-asset transfers involving self-hosted addresses; and a March 2025 draft Guidance Note on investor influence on investment funds.

The Electronic Securities Act (eWpG)

The eWpG, effective June 2021, represents Germany’s primary legislative contribution to tokenized securities regulation. The Act introduces two categories of electronic securities that can be issued on distributed ledgers:

Zentralregisterwertpapiere (centrally registered electronic securities): Recorded on an electronic register maintained by a central securities depository. These securities are functionally similar to traditional CSD-held securities but exist in electronic rather than physical form.

Kryptowertpapiere (crypto securities): Recorded on a crypto securities register — a DLT-based register maintained by a BaFin-licensed entity. Crypto securities are fully dematerialized, with the blockchain register serving as the authoritative record of ownership. This category enables tokenized fund shares to exist entirely on-chain.

BaFin licenses crypto securities registrars (Kryptowertpapierregister-Fuhrer) under the eWpG, establishing operational and prudential requirements for entities maintaining DLT-based securities registers. Licensed registrars must demonstrate: technical resilience and cybersecurity standards; adequate organizational arrangements including compliance and risk management functions; smart contract governance procedures; and the ability to migrate securities to alternative registrars in the event of business failure.

As of March 2026, BaFin has licensed approximately 15 crypto securities registrars, providing the infrastructure for tokenized fund share issuance in Germany.

Crypto Custody Licensing

BaFin was one of the first European regulators to establish a dedicated licensing category for digital asset custody. The Fourth EU Money Laundering Directive’s transposition into German law (January 2020) created the “Kryptoverwahrgeschaft” — crypto custody business — as a regulated financial service requiring BaFin authorization.

Licensed crypto custodians in Germany include: Bitgo Deutschland, Tangany, Finoa, and divisions of traditional banks (Commerzbank, DZ Bank, Deutsche Bank) that have obtained crypto custody authorization. These custodians provide the qualified custody infrastructure that tokenized fund products require for institutional-grade asset safekeeping.

For tokenized fund products, Germany’s crypto custody licensing ensures that custodians holding tokenized fund shares and underlying digital assets meet BaFin’s operational standards — including segregation requirements, key management standards, and insurance obligations.

Xetra: Europe’s Crypto ETP Hub

Deutsche Borse’s Xetra electronic trading platform hosts the largest concentration of crypto exchange-traded products in Europe, with over 100 crypto ETPs listed — providing exposure to Bitcoin, Ethereum, and diversified crypto baskets. Total crypto ETP assets on Xetra exceeded EUR 30 billion at peak levels, though this figure fluctuates with crypto market valuations.

Xetra’s crypto ETP market demonstrates that BaFin and German exchange regulation can accommodate digital asset-linked fund products. For tokenized ETFs, Xetra provides a potential listing venue, though listing tokenized ETF shares (as opposed to traditional ETF shares providing crypto exposure) would require coordination between BaFin, Deutsche Borse, and potentially the EU DLT Pilot Regime framework.

Deutsche Borse’s Digital Asset Infrastructure includes: D7 digital post-trade platform (for digital securities issuance and settlement); Crypto Finance AG (acquired 2022, providing crypto asset trading and custody); and Clearstream’s DLT-based settlement capabilities. This infrastructure positions Deutsche Borse as a potential end-to-end provider of tokenized fund market infrastructure in Europe.

Deutsche Borse D7 Post-Trade Platform

Deutsche Borse’s D7 digital post-trade platform represents a critical piece of infrastructure for tokenized fund operations in Germany. D7 enables fully digital securities issuance and settlement, integrating with the eWpG’s crypto securities framework to allow end-to-end digitalization of the securities lifecycle. Since its launch, D7 has processed over EUR 20 billion in digital securities issuances, including digital bonds from KfW (Germany’s development bank) and commercial paper programs from major German corporates.

For tokenized fund products, D7 provides the post-trade infrastructure needed to issue, settle, and service Kryptowertpapiere fund shares at institutional scale. D7’s integration with Clearstream’s CSD infrastructure ensures that tokenized fund shares issued through D7 can interoperate with traditional European settlement systems, including Euroclear’s cross-border settlement links. The settlement infrastructure analysis examines D7’s technical architecture in the context of European tokenized fund settlement options.

MiCA Enforcement and BaFin’s Supervisory Mandate

With MiCA’s full enforcement in July 2026, BaFin’s supervisory responsibilities expand substantially. BaFin serves as the national competent authority for MiCA CASP authorization in Germany, processing applications from digital asset custodians, trading platforms, and service providers supporting tokenized fund operations. Germany’s existing crypto licensing framework — the Kryptoverwahrgeschaft and crypto securities registrar licensing under the eWpG — gives BaFin institutional experience that most EU NCAs lack.

BaFin has also implemented DORA (Digital Operational Resilience Act) requirements for financial entities under its supervision, including fund managers operating tokenized fund infrastructure. DORA’s ICT risk management, incident reporting, and third-party provider oversight requirements apply to all entities using blockchain platforms for fund operations, creating an additional layer of operational governance that BaFin supervises.

German Fund Market Context

Germany’s fund industry manages approximately EUR 2.9 trillion in assets, the second-largest in the EU. German-domiciled funds include Investmentfonds (mutual funds), Spezialfonds (institutional funds), and exchange-traded Indexfonds (ETFs). The German capital investment code (Kapitalanlagegesetzbuch — KAGB) governs fund management in Germany, implementing the UCITS Directive and AIFMD into German law.

For tokenized fund products, the KAGB requires adaptation to accommodate the eWpG’s crypto securities framework. BaFin has published guidance clarifying that KAGB-regulated investment funds may issue crypto securities (Kryptowertpapiere) as fund shares, subject to: the fund’s prospectus and investor information documents disclosing tokenization-specific risks; the appointed depositary exercising oversight functions over DLT-based fund operations; and compliance with the KAGB’s eligible asset rules for the fund’s portfolio.

European Crypto ETP Issuers on Xetra

Germany’s Xetra platform hosts the products of the leading European crypto ETP issuers, several of whom are actively exploring tokenized fund structures. 21Shares (headquartered in Zurich, listed on Xetra) manages over $3 billion in crypto ETP assets and has filed for tokenized fund vehicles in multiple jurisdictions. CoinShares (Jersey-domiciled, Xetra-listed) manages approximately $1.5 billion in crypto ETPs and has invested in DLT settlement infrastructure. ETC Group (now part of HANetf) launched EUTBL, an exchange-traded product tracking blockchain companies, with approximately $939.7 million in assets. The DWS/Galaxy partnership — combining DWS’s EUR 900 billion AUM with Galaxy Digital’s crypto infrastructure — represents the most significant institutional commitment to bringing tokenized fund products to the German market.

These issuers’ presence on Xetra demonstrates that BaFin’s regulatory environment can accommodate digital asset-linked fund products at scale. The European crypto ETF landscape analysis examines how these issuers navigate BaFin’s regulatory requirements and the MiFID II distribution rules governing cross-border sales of Xetra-listed products. The AMF in France and the Central Bank of Ireland are watching Germany’s experience with crypto ETP regulation closely, as the European crypto ETP market’s concentration on Xetra gives BaFin outsized influence on pan-European regulatory standards for digital asset fund products.

Coordination with ESMA and Peer Regulators

BaFin is a member of ESMA’s Board of Supervisors and contributes to ESMA’s work on tokenized fund regulation. Germany’s advanced domestic framework (eWpG, crypto custody licensing) gives BaFin credibility in ESMA deliberations on DLT-related policy.

BaFin coordinates bilaterally with the AMF (France), the CSSF (Luxembourg), and the Central Bank of Ireland on cross-border tokenized fund supervision. The SEC vs. ESMA comparison positions BaFin’s approach within the broader EU-US regulatory divergence on tokenized fund products.

Impact on Fund Sponsors

Fund sponsors considering Germany for tokenized fund operations benefit from: the eWpG’s explicit legal authority for tokenized securities; a licensed ecosystem of crypto securities registrars and custodians; Xetra as a potential listing venue with established crypto ETP infrastructure; Germany’s large domestic investor base (EUR 2.9T in fund assets); and BaFin’s demonstrated willingness to authorize innovative digital securities products.

Challenges include: BaFin’s thorough but sometimes slow authorization process; the interaction between KAGB fund regulation and eWpG securities regulation (requiring coordination across BaFin supervisory divisions); and the competition from Luxembourg and Ireland as the dominant UCITS domiciles.

DORA Operational Resilience Requirements

The Digital Operational Resilience Act (DORA), applicable from January 2025, imposes additional supervisory responsibilities on BaFin for all financial entities under its supervision — including fund managers, crypto securities registrars, and crypto custodians operating tokenized fund infrastructure. BaFin must ensure that these entities maintain ICT risk management frameworks covering DLT infrastructure, establish incident reporting procedures for blockchain platform disruptions, and manage concentration risk arising from dependence on specific DLT networks or oracle providers. BaFin has integrated DORA compliance reviews into its existing supervisory examination cycles, conducting targeted assessments of ICT third-party risk management for entities holding crypto custody licenses and crypto securities registrar authorizations. ESMA’s DORA implementing standards provide the baseline requirements that BaFin applies, with additional German-specific guidance published through BaFin’s supervisory practice communications.

BaFin publishes guidance and authorization requirements at bafin.de. The regulatory filing guide covers BaFin filing procedures, and the US-EU custody comparison examines how German crypto custody standards relate to US qualified custodian requirements. The institutional investor guide addresses BaFin compliance considerations for institutional allocators evaluating German-domiciled tokenized fund products.

For inquiries regarding this analysis: info@etftokenisation.com