Commercial crypto custody in Germany now falls under the EU Markets in Crypto-Assets Regulation (MiCA). Since 30 December 2024, providers offering custody as a regulated crypto-asset service have needed the MiCA authorisation route supervised by Germany’s Federal Financial Supervisory Authority (BaFin). The EU transition ended on 1 July 2026. A provider that did not obtain the required authorisation by then must stop ordinary EU services and carry out an orderly wind-down, while continuing to protect customers during the exit.
For a business selecting a custodian, the decisive questions are the provider’s current BaFin authorisation and service scope, how client assets and access credentials are segregated, which assets and stablecoins are permitted, how statements and withdrawals work, and what happens if the provider fails or migrates customers.
As an Amazon Associate I earn from qualifying purchases.
Which German crypto-custody rules apply in 2026?
MiCA is the current authorisation framework
MiCA’s rules for crypto-asset service providers (CASPs), including custody and administration of crypto-assets on behalf of clients, have applied since 30 December 2024. BaFin’s crypto-asset supervision team states that the authorisation and supervision requirements in MiCA Title V apply from that date. A business that provides custody commercially, or on a scale that requires a commercially organised undertaking, therefore needs regulatory permission rather than relying on an unregulated service model.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →In Germany, the current route is a MiCA CASP authorisation through BaFin. A licence or registration that was valid under an older German regime should not be assumed to cover the same services after the transition. Check the provider’s present authorisation and the exact services listed, not just its marketing description.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
What the 1 July 2026 deadline changed
ESMA’s statement of 17 April 2026 confirmed that the MiCA transitional period expired across the EU on 1 July 2026. Legacy providers that qualified for the transition could operate only until that date or an earlier decision on their authorisation. After the applicable end date, an unauthorised provider cannot continue ordinary EU custody, exchange or related services. It must stop taking on normal business and wind down in an orderly way, with customer-protection obligations continuing during that process.
For investors, the date is not a guarantee that every platform closed on 1 July. It means that a platform without the required authorisation cannot lawfully continue its ordinary EU-facing activity merely because it operated before MiCA. A wind-down notice, restricted withdrawals or a proposed transfer to another provider may follow.
Passporting to other EU countries
An authorised German CASP can offer its authorised services in other EU member states after completing the required notification for EU passporting. Passporting does not expand the services or assets beyond the scope of the German authorisation. A customer should verify both the home-state authorisation and the service being used.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What a MiCA-authorised custodian must provide
A written custody agreement
MiCA Article 75 requires a client agreement that explains the service and the provider’s custody policy. It should set out how the provider holds or controls assets, how clients communicate instructions, the security systems used, fees, and the applicable law. Read the agreement before depositing assets and keep the version that applied when the account was opened; amendments can change withdrawal, liability or transfer arrangements.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Position records and regular statements
The custodian must maintain a client-level position register. The register is meant to identify what belongs to each customer rather than recording only an aggregate wallet balance. The provider must issue a statement at least once every three months and whenever the client requests one. Statements should be checked against the customer’s own transaction history and any on-chain information the provider makes available.
Access to assets and client rights
Article 75 requires the provider to facilitate clients’ rights in the crypto-assets and to return the assets, or the means of access to them, promptly when the custody relationship ends or a valid request requires return. The practical method varies: a provider may control keys in a multi-party arrangement, use segregated addresses, or maintain another documented control model. The agreement should explain who can authorise a transaction, how withdrawal approval works, and what verification or waiting periods apply.
Segregation from the provider’s property
Client holdings and the access means used to control them must be kept separate from the custodian’s own assets. Segregation is important if the provider becomes insolvent: the firm should not be able to treat customer property as its own operating capital. Ask whether assets are held in individually identifiable addresses or in a pooled structure with a reliable client-allocation ledger, and how reconciliation is performed. A hardware or software wallet product by itself is not evidence that these regulatory duties are met; the authorised legal entity and its controls are what matter.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow client money and crypto-assets are safeguarded
Article 70 protection against misuse and insolvency
MiCA Article 70 requires safeguards against the provider’s insolvency and against proprietary use of client assets. The custodian must not use customer property for its own account unless the legal arrangement and the client’s instructions expressly permit an activity that MiCA allows. Ask whether the provider lends, rehypothecates, stakes or otherwise deploys assets, and request the contractual basis and risks for any such activity.
Rank #3
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Where relevant client funds must be placed
Client funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the business day following receipt. ESMA’s current interpretation allows the account to be held in the CASP’s name or through another arrangement that legally satisfies segregation. This is a safeguarding requirement for relevant funds; it does not turn a crypto-asset balance into a bank deposit or create an automatic deposit-guarantee claim.
What happens if the custodian fails
Segregation is designed to support the return of client property, but recovery still depends on accurate records, enforceable arrangements and the administrator’s ability to identify assets. Before signing, ask which entity legally owns each wallet or account, where keys are controlled, how a customer claim is evidenced, and whether the provider has a documented transfer plan. A robust plan should allow transfer to another authorised CASP or return to a self-hosted wallet, subject to identity checks and applicable law.
AML, governance and supervision obligations
Customer due diligence and transaction monitoring
BaFin’s MiCA framework includes proper business organisation, supervision and investor-protection requirements. A custodian must maintain anti-money-laundering and counter-terrorist-financing controls. ESMA says a provider that is winding down must keep customer due diligence, transaction monitoring, sanctions screening, suspicious-activity reporting and record-keeping operating until its obligations are completed.
Expect onboarding questions about beneficial ownership, source of funds, intended use, jurisdictions and expected transaction volumes. Additional review can delay deposits or withdrawals when transactions trigger sanctions or risk rules. A business should ensure that its treasury and compliance teams can supply consistent ownership and source-of-funds documentation.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Governance and operational resilience
Authorisation is not only a wallet-security test. Supervisors assess management, internal controls, security arrangements, complaints handling and the ability to continue or close the service in an orderly manner. Ask for the provider’s incident-notification process, recovery objectives, access-control model and independent assurance information. The provider should explain who can approve key actions and how dual control, multi-party approval or equivalent safeguards limit a single insider’s ability to move assets.
Stablecoin and asset eligibility checks
MiCA-compliant assets only
A custodian’s authorisation does not make every token it lists permissible. The service scope and the asset’s legal classification both matter. Confirm which crypto-assets the provider may custody, transfer, execute or advise on, and whether restrictions differ by customer location.
ESMA’s 8 October 2026 stablecoin position
On 8 October 2026, ESMA said authorised CASPs should cease services involving non-MiCA-compliant asset-referenced tokens and e-money tokens. The statement covers custody, transfer, trading and advice. A provider may therefore remove a stablecoin from custody or trading even if the token was previously available. Check notices, deadlines and withdrawal routes immediately when a token is identified as outside the MiCA perimeter.
Free tools Windows power users keep installed
One-click scans. No signup required.
How investors should vet a German crypto custodian
- Verify the legal entity. Search the provider in BaFin’s company database and confirm that the entry is current. Match the registered entity, not merely the platform name, to the contract and payment instructions.
- Check the MiCA service scope. Confirm that custody and administration are authorised, and note any passporting notification relevant to your country. A licence for another crypto-asset service does not automatically include custody.
- List the assets you actually need. Obtain the provider’s permitted asset and stablecoin list, including any geographic or customer-category limits. Recheck it before adding a new token.
- Read the custody policy. Look for the key-control model, wallet structure, reconciliation process, access approvals, security controls, incident communications and the treatment of forks or network events.
- Test reporting. Request a sample position statement and ask how often statements are issued. Confirm that the register identifies your holdings and that you can obtain records in a usable format.
- Understand withdrawals and recovery. Ask about address whitelisting, approval thresholds, processing times, travel-rule information, identity rechecks and the procedure for returning access means.
- Examine insolvency and wind-down terms. Identify the transfer agent, notice process, claim evidence and deadline if the provider loses authorisation or enters insolvency. Confirm whether assets can move to another authorised CASP or a self-hosted wallet.
- Compare all fees. Request custody, transaction, withdrawal, network, conversion and extraordinary-event charges in writing. Do not infer costs from a trading-fee page.
What businesses should document before appointing a custodian
Regulatory and contractual due diligence
- Record the provider’s authorisation number, legal entity, permitted services and passporting notifications at the date of approval.
- Map each business activity—long-term holding, employee payments, client assets, staking or treasury transfers—to the provider’s permitted scope.
- Have legal counsel review applicable law, liability limits, dispute procedures, termination rights and data-retention clauses.
Control and accounting design
- Define who may instruct transfers, who approves them, and how emergency access is granted without creating a single point of failure.
- Reconcile the provider’s position register with internal books at a set frequency and investigate breaks promptly.
- Keep a separate record of wallet addresses, transaction identifiers, valuation times and the evidence needed to prove ownership.
Compliance and continuity
- Prepare beneficial-owner, source-of-funds and sanctions information before onboarding to reduce delays.
- Set thresholds for enhanced review and define who responds to a suspicious-activity or sanctions query.
- Maintain a tested exit plan with an alternative authorised CASP and, where appropriate, a controlled self-hosted-wallet procedure.
Comparing custodians on the issues that matter
| Comparison point | Questions to ask | Why it matters |
|---|---|---|
| Authorisation and passporting | Which legal entity is authorised, for which MiCA services, and in which countries is passporting notified? | Prevents reliance on an expired or unrelated permission. |
| Asset and stablecoin coverage | Which tokens are currently eligible, and what happens when a token becomes non-compliant? | Determines whether the custody arrangement fits the portfolio. |
| Segregation and key control | Are holdings pooled or separately identifiable? Who controls keys and approvals? | Shows how ownership and recovery would be established after a failure. |
| Reporting | Are statements available at least quarterly and on demand? What fields do they contain? | Supports reconciliation, tax work and proof of a claim. |
| Withdrawal and recovery | What checks, limits and time frames apply, and can access means be returned? | Reveals whether liquidity matches operational needs. |
| Insolvency and wind-down | How are customers notified and transferred, and who handles claims? | Tests the plan for loss of authorisation or bankruptcy. |
| AML/KYC burden | Which ownership, source-of-funds and transaction documents are required? | Predicts onboarding effort and the risk of transaction delays. |
| Fees | What recurring and event-based charges apply? | Allows a like-for-like total-cost comparison. |
Common failure scenarios and the right response
The provider cannot show current authorisation
Pause new deposits and ask for the legal entity and scope recorded in BaFin’s database. Do not treat a former national permission, a technology vendor’s security certification or a familiar brand as a substitute. If the provider is winding down, follow its verified withdrawal or transfer instructions and retain statements and transaction records.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
A stablecoin is being removed
Confirm whether the change follows the token’s MiCA status or a provider-specific risk decision. Check the final withdrawal date, network supported for redemption or transfer, and any conversion charges. Move only after verifying the destination address and the provider’s identity checks.
Withdrawals are delayed during an exit
Read the wind-down communication for the stated process and deadline. Submit the requested identity or ownership evidence, keep the case number, and download the latest position statement. If a transfer to another authorised CASP is offered, compare its asset scope and custody terms before accepting.
Records do not match the account balance
Reconcile the provider statement, transaction history and internal ledger. Report the discrepancy through the contractual complaints channel, preserve timestamps and transaction identifiers, and avoid further transfers until the ownership record is clear.
Recommended Free Tools
What the rules do not guarantee
MiCA authorisation does not guarantee a token’s value, uninterrupted market liquidity or recovery from a blockchain error. Segregation and safeguarding are legal and operational protections, not a promise that every loss will be reimbursed. A custodian can also restrict activity to meet sanctions, AML or stablecoin requirements. The protection you receive depends on the authorised entity, its documented controls and your ability to follow the withdrawal and claims process.
For German businesses and investors in 2026, the practical standard is straightforward: use a provider whose MiCA custody authorisation is current, keep assets within its permitted scope, demand transparent segregation and reporting, and maintain a tested route out if the provider fails or its authorisation ends.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
