It has been BaFin's settled administrative practice for six years to classify cryptocurrencies, such as Bitcoin and other crypto tokens, as units of account from a supervisory point of view and therefore as financial instruments pursuant to the Banking Act. One of the consequences is that commercial trading in crypto tokens requires authorisation. In view of the strong price movements again seen in 2017, BaFin has received a large number of enquiries about business models in connection with crypto tokens, for example relating to Bitcoin ATMs. The installation of such ATMs is in all cases an activity subject to authorisation requirements under the Banking Act.

In February 2018, BaFin published another information document, in which it comments on the regulatory classification of tokens in the area of securities supervision. It applies to all market participants that provide services related to tokens, trade in tokens, or offer them to the public. In order to comply fully with any legal requirements, these market participants are required to examine carefully whether they are dealing with a regulated instrument, such as a security or financial instrument pursuant to the Banking Act. If there is any doubt, they should contact BaFin as soon as possible, either using the fintech company contact form or directly via the divisions responsible for the issue in question (see info box "New division focusing on innovations in financial technology").

BaFin warns about initial coin offerings

In November 2017, BaFin issued a warning about a whole range of risks associated with initial coin offerings (ICOs), a highly speculative form of corporate and project financing. Although new sources of financing, such as ICOs, are to be welcomed, especially for young, innovative companies, a situation should be avoided where existing regulation, which is in place to deal with risks in the interest of consumer protection and financial market integrity, is bypassed or frustrated.

Against this backdrop, BaFin made investors aware of risks such as the potential loss of all their invested capital, if they buy coins or tokens in an ICO.
The collective term "initial coin offering" refers firstly to the creation of crypto tokens on existing blockchains or blockchains created specifically for this purpose, and secondly to the associated development of smart contracts and distributed apps, which are stored on existing blockchains in the form of programme codes for the implementation of contracts. New digital units (tokens) are generated in this process, which are then sold to investors in exchange for another virtual currency or legal tender. The issuer decides freely what rights it grants to investors acquiring the respective tokens. The project and the way in which the tokens work are normally presented in a whitepaper; traditional contract terms and conditions are less common.

BaFin decides on a case-by-case basis, looking at the technical and contractual details of an ICO, whether the issuer requires authorisation under supervisory laws and is obliged to publish a prospectus.

Despite having a similar name, ICOs are not comparable to IPOs, which are initial public offerings of companies looking to list. In many cases, the tokens issued confer neither membership nor information, control or voting rights. Nor does the implementation of an ICO require a specific corporate form, or even actual business operations. It has so far been up to the investors themselves to check the identity, integrity and creditworthiness of the token issuer and to understand and assess the investment being offered. ICOs are often highly speculative, because they are typically implemented at a very early, mostly experimental stage of a company, when the business model is still untested. The systemic vulnerability of ICOs to fraud, money laundering and terrorist financing increases the risk of investors losing the capital invested.