Germany (DE)

Scope: This law enables the issuance of securities in electronic form, including crypto securities (Kryptowertpapiere) registered on a DLT. It establishes the legal framework for creating and transferring these dematerialized assets.

Gap or ambiguity: The act delegates specific technical and operational requirements for crypto securities registers to subsequent ordinances (§ 23). This creates an opportunity for certifiers to define best practices for register integrity and security.

Scope: This ordinance regulates crypto fund units and the entities responsible for maintaining the register for them. It specifies which legal provisions are applicable.

Gap or ambiguity: The provided text is only a table of contents. The substantive articles of the regulation are missing, making it impossible to assess specific requirements or ambiguities.

Scope: This regulation specifies the content, format, and transmission method for notifications to BaFin regarding the disclosure of inside information for crypto-assets. It also covers notifications for delaying such disclosures.

Gap or ambiguity: The regulation requires notifications be sent via an electronic channel to be announced on BaFin's website. The specific technical standards and protocols for this reporting system are not yet defined.

Scope: This is Germany's Federal Data Protection Act, which complements the GDPR. It governs the processing of personal data, impacting crypto services during KYC and client onboarding.

Gap or ambiguity: The act mandates general principles like 'data protection by design' (§ 71) but lacks specific technical standards for crypto systems. This allows certifiers to define and audit best practices for privacy on blockchain.

Scope: This regulation establishes a comprehensive framework for digital operational resilience in the EU financial sector. It sets harmonized rules for ICT risk management, incident reporting, resilience testing, and managing ICT third-party risk.

Gap or ambiguity: The regulation relies heavily on future Regulatory Technical Standards (RTS) from the ESAs to specify key details, such as incident reporting thresholds and testing methodologies. This creates an opportunity for certifiers to help firms implement the high-level principles ahead of the final detailed rules.

Scope: The provided text is metadata for the German Trade Tax Act of 2002 and does not contain substantive regulatory details.

Scope: This directive establishes a framework for the mandatory automatic exchange of tax-relevant information on crypto-assets among EU Member States. It requires crypto-asset service providers to perform due diligence on users and report their transaction data to national tax authorities.

Gap or ambiguity: The directive requires providers to determine on a case-by-case basis if a crypto-asset is reportable, creating ambiguity for assets like certain NFTs or utility tokens. A certifier could offer a standardized framework for classifying assets to ensure consistent reporting.

Scope: The German Civil Code (BGB) provides the general legal framework for contracts, obligations, and consumer protection. These principles apply to the contractual relationship between crypto-asset service providers and their customers.

Gap or ambiguity: The BGB is technology-neutral and lacks specific rules for crypto-assets, such as smart contract defects or digital asset custody standards. Certifiers can help bridge this gap by establishing best practices that demonstrate compliance with general duties of care under the code.

Scope: This act governs the requirement to prepare, have approved by the regulator, and publish a prospectus for public offerings of securities, including security tokens.

Gap or ambiguity: The law requires full disclosure in the prospectus but does not specify technical standards for security tokens. This creates a gap regarding the expected level of technical due diligence and disclosure for smart contracts and underlying protocols.

Scope: This act appears to be a tax law concerning a solidarity surcharge and does not contain any provisions related to crypto-assets.

Gap or ambiguity: The provided text is not a regulation for crypto-assets, so no specific gaps or ambiguities related to the sector can be identified.

Scope: This is Germany's central Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) law. It defines obliged entities, including crypto-asset service providers, and mandates risk management, customer due diligence (KYC), monitoring, and reporting obligations.

Gap or ambiguity: The law is principles-based, requiring risk analysis and internal safeguards (§4, §6) without specifying technical standards for crypto firms. This creates an opportunity for independent certifiers to audit the adequacy of AML/KYT systems and risk assessment methodologies, especially concerning transfers to/from self-hosted wallets (§15a).

Scope: This regulation establishes enhanced due diligence requirements for the transfer of crypto-assets. It focuses on anti-money laundering (AML) obligations.

Gap or ambiguity: The provided text is a high-level notice, lacking the specific technical standards for complying with the Travel Rule. This creates an opportunity for providers of AML/KYT compliance solutions to define best practices.

Scope: This act governs corporate income tax in Germany. As applied to crypto-assets, it subjects corporate entities to taxation on all gains, without the one-year holding period exemption available to individuals.

Scope: This act is the German implementation of MiFID II. It governs the trading of securities, including security tokens, and establishes rules for market conduct, market abuse, and organizational requirements for investment firms.

Gap or ambiguity: The act's application to novel crypto-assets depends on their classification as 'financial instruments,' which can be ambiguous. Detailed technical standards for organizational and conduct rules (e.g., Sections 80, 89) are often set by ordinances, creating a need for interpretation and certification.

Scope: This section of the German Penal Code defines the criminal offense of money laundering. It criminalizes concealing, transferring, or using assets derived from unlawful acts to obscure their illicit origin.

Gap or ambiguity: The law's application to crypto-assets hinges on proving knowledge or negligent ignorance of illicit origins. This creates an opportunity for blockchain analysis and compliance tools to establish a standard of care for market participants.

Scope: This section of the German Income Tax Act defines the tax treatment for 'other income'. It is interpreted to cover income from crypto-asset activities like staking and lending under the category of income from services.

Gap or ambiguity: The law does not explicitly mention crypto-assets, staking, or lending. The classification of such income under this section relies on administrative and judicial interpretation, creating ambiguity for taxpayers.

Scope: This act establishes the prudential and licensing framework for investment firms in Germany. It includes specific provisions for firms providing crypto-asset services, such as qualified crypto custody.

Gap or ambiguity: The law mandates risk management (§ 45) and asset segregation for crypto custody (§ 69a) but does not specify detailed technical standards. This leaves room for interpretation on acceptable IT security controls and key management practices, creating an opportunity for certifiers.

Scope: This law governs the management, administration, and distribution of investment funds (UCITS and AIFs) in Germany. It sets out authorization and operational requirements for fund managers and depositaries.

Gap or ambiguity: The KAGB establishes general duties for asset safekeeping (§ 72, § 81) but lacks specific technical standards for crypto-asset custody. This creates an opportunity for certifiers to establish best practices for private key management and secure storage solutions under this framework.

Scope: This act implements the EU's MiCA regulation in Germany, designating BaFin as the competent authority. It defines supervisory powers, authorization procedures, and transitional rules for existing crypto service providers.

Gap or ambiguity: The act references high-level requirements like 'Digital Operational Resilience' (§26) and 'reserve assets' (§28) without specifying detailed technical standards. This creates a gap for independent certifiers to audit against best practices or forthcoming EU technical standards.

Scope: This law defines the tax treatment for private sales of assets, including crypto-assets. Gains are taxable if the asset is held for less than one year and tax-free if held for more than one year.

Gap or ambiguity: The law does not explicitly mention crypto-assets. The conditions that extend the tax-free holding period to ten years for assets used to generate income create ambiguity for staking or lending activities.

Scope: This is an umbrella law implementing the EU's MiCA, TFR, and DORA regulations in Germany. It creates the KMAG (Crypto Markets Supervision Act) and amends various existing financial laws.

Gap or ambiguity: As an implementation of broad EU regulations, specific technical standards and supervisory expectations from the German regulator (BaFin) are not yet fully detailed. This creates an opportunity for certifiers to help establish best practices for compliance.

Scope: This is Germany's primary Banking Act, which defines crypto-assets (Kryptowerte) and establishes a licensing regime for financial services. It specifically regulates crypto-asset custody (Kryptoverwahrgeschäft) as a licensed activity.

Gap or ambiguity: The act establishes high-level obligations for crypto custody and risk management but does not specify detailed technical standards. This creates an opportunity for independent certifiers to audit against industry best practices to demonstrate compliance.

Scope: This act regulates payment services and e-money business in Germany. It establishes a licensing and supervision framework for payment and e-money institutions, which applies to crypto-asset models that fall under these definitions.

Gap or ambiguity: The act provides general principles for operational and security risk management (Sec. 53) but lacks specific technical standards for crypto-assets. This creates an opportunity for certifiers to establish best practices for IT security and risk management in a crypto context.

Scope: This regulation harmonizes the rules for the prospectus to be drawn up, approved, and published when securities are offered to the public or admitted to trading on a regulated market in the EU.

Gap or ambiguity: The regulation is technology-neutral and does not address risks specific to crypto-assets, such as smart contract vulnerabilities or blockchain protocol risks. This creates a gap for technical assurance and certification services.

Scope: This act establishes a regime for non-securities capital investments, requiring issuers to publish an approved sales prospectus and an information sheet before a public offering. It focuses on investor protection through disclosure.

Gap or ambiguity: The act is a general capital markets law and does not contain specific technical requirements for crypto-assets. How its disclosure and auditing rules apply to the technical specifics of investment tokens is not defined, leaving a gap for technical standards.

Scope: This act regulates the electricity and gas supply in Germany. The provided text does not contain any provisions related to crypto-assets.

Gap or ambiguity: This legislation does not apply to crypto-assets, so there are no specific regulatory gaps or ambiguities concerning them within this text.