Complaining About a Crypto Exchange: the Deadlines Article 71 MiCAR Sets and Why BaFin Will Not Decide Your Case

A withdrawal has been sitting at “in progress” for days. A fee shows up on the statement that is not in the price list. An account is frozen, and the justification consists of a reference to the terms of use. In all three cases, most customers write a message to support, receive a ticket number and wait.

In legal terms, since the MiCA transition period expired on July 1, 2026, this is a different process from what it feels like. Anyone holding an authorisation in the EU as a crypto-asset service provider operates a formal complaints procedure that is bound to verifiable deadlines. A support enquiry is not a complaint. It only becomes one once you label it as such and take the route provided for it.

The basis is set out in Article 71 of Regulation (EU) 2023/1114 on markets in crypto-assets. It is fleshed out by Delegated Regulation (EU) 2025/294, published in the Official Journal of the European Union on February 13, 2025 and, under its Article 9, in force twenty days later. This piece explains what your provider owes you, within what time it has to respond, which details belong in a complete complaint, and where the matter goes if nothing happens.

Article 71 MiCAR: the complaints procedure an authorised crypto provider has to run

Article 71(1) MiCAR obliges crypto-asset service providers to establish and maintain effective and transparent procedures for the prompt, fair and consistent handling of customer complaints, and to publish descriptions of those procedures. Three duties sit in that single sentence: the procedure has to exist, it has to be operated on a lasting basis, and it has to be publicly described.

Paragraph 3 adds to this. The provider informs its customers of the possibility of submitting a complaint, makes a template available for it, and keeps records of all complaints received together with the measures taken in response. Paragraph 4 requires a timely and fair investigation of all complaints and communication of the outcome within a reasonable period.

What counts as a reasonable period was initially left open by the regulation. Paragraph 5 mandated ESMA, in close coordination with the EBA, to draw up regulatory technical standards. The result is Delegated Regulation 2025/294, and it answers the question with a number.

Delegated Regulation 2025/294: what the description of the complaints procedure must contain

Article 1(2) of the Delegated Regulation lists what a complaints procedure has to contain. The list is the practical yardstick against which you can check your provider's page.

Required are: the conditions for a complaint to be admissible; the express statement that submission and handling are free of charge; a detailed description of the form in which complaints are to be submitted, including a reference to the template in the annex, the information to be supplied by the complainant, the identity and contact details of the responsible person or department, the platform, e-mail address or postal address for submission, and the permitted languages. Added to that is the description of how the procedure runs and, as its centrepiece, the provider's deadlines for each step: acknowledgement of receipt, request for additional information, investigation, and communication of the decision.

Article 1(3) sets out where all of this has to be found. The provider publishes on its website an up-to-date description of the procedure together with the standard template from the annex, and ensures that both are easily accessible, including on all other digital devices through which customers access the services. An app in which the complaints procedure cannot be found does not satisfy this requirement.

Under paragraph 4, the description and the template are published in all languages the provider uses to market its services or to communicate with customers. A provider that advertises in German and corresponds with you in German owes the complaints procedure in German as well.

Who is responsible internally

Article 2 of the Delegated Regulation requires adequate, dedicated resources for handling complaints. The person responsible reports directly to the management body on the implementation and effectiveness of the procedure. Under Article 1(6), the management body itself has to establish and approve the procedures. A complaint is therefore not a pure support matter but something reported all the way up to senior management.

Free of charge and no forced form: two limits your provider may not move

Article 71(2) MiCAR is terse: customers can submit complaints to providers free of charge. There is no handling fee, no paid premium support as a precondition, and no obligation to pay in advance.

The second limit is in Article 1(7) of the Delegated Regulation and is easily overlooked. The conditions for a complaint to count as admissible and complete have to be fair and reasonable and must not unduly restrict the right to complain. And, expressly: those conditions do not include mandatory use of the template in the annex.

In practice, that means a provider may not pin you down to one particular web form. The template is an offer that makes it easier for your complaint to be complete. An informal e-mail that is clearly labelled as a complaint and contains the necessary details triggers the same duties.

Two months to a decision: the hard deadline in Article 6 of the Delegated Regulation

Article 6(2) is the provision that matters. The provider communicates its decision to the complainant promptly, within the deadline it has set in its own complaints procedure, but in any event within two months of receipt of the complaint.

This construction has two tiers. The first is the provider's self-imposed deadline, which under Article 1(2)(e) has to be published. That self-imposed deadline can be shorter than two months, and where it is shorter, it applies. The second tier is the ceiling in the regulation, which nobody can extend.

Article 6(3) governs the exceptional case. If the decision genuinely cannot be taken in time, the provider informs you without delay of the reasons for the delay and states the date on which the decision will be issued. Silence is therefore not a permissible option even in the exceptional case. Anyone who, after two months, holds neither a decision nor a reasoned notice of delay has a documented breach of the Delegated Regulation on their hands, and that is the point at which going to the supervisor becomes worthwhile.

The requirement as to the content of the decision itself is in paragraph 1: the provider addresses all points raised in the complaint and gives reasons for the outcome. The decision also has to be consistent with earlier decisions on similar complaints, unless the provider gives reasons for departing from them. A standard reply that leaves three out of four points unanswered does not meet that.

Acknowledgement of receipt under Article 4: four details your provider owes you immediately

Under Article 4(1) of the Delegated Regulation, the provider confirms receipt of a complaint and states without delay whether it is admissible. If it considers the complaint inadmissible, it has to state clearly under paragraph 2 why it is rejecting it.

Paragraph 3 lists what the acknowledgement has to contain. First, the name, identity and contact details, including e-mail address and telephone number, of the person or department you can address follow-up questions to. Second, the date on which the complaint was received. Third, a reference to the deadline from the published procedure. Fourth, if you used an electronic form, a copy of your complaint.

The date of receipt is the most important of those four points, because the two months run from it. Anyone who receives an acknowledgement without a date should ask for it straight away.

Investigation under Article 5: the documents your provider may not demand from you

Article 5(1) requires the provider to check without delay after receipt whether the complaint is clear and complete, and to request any missing information. Paragraph 2 adds a limit that saves time in practice: the provider does not request information from the complainant that is already in its possession or that legally has to be in its possession.

Transaction histories, statements of your own trading account, identity documents filed during verification: asking for these in order to slow the matter down is not what this provision envisages. The same paragraph also obliges the provider to keep you informed of all further steps and to answer legitimate follow-up questions without delay.

Language of the complaint: why you may write in German

Article 3(1) makes clear that complaints can be submitted electronically or on paper. Paragraph 2 governs the language, and does so more generously than many English-language help pages suggest. Permitted are the languages the provider uses to market its services or to communicate with customers, and in addition the official languages of the home member state and of the host member states, in so far as they are official languages of the Union.

For a provider active in Germany, Germany is a host member state. German is therefore a permitted complaint language, even if the platform runs its interface in English. Article 7(2) obliges the provider to reply in the same language in which the complaint was submitted. Article 7(1) requires clear, plain and easily understandable language in doing so.

The standard template in the annex: what a complete complaint contains

The annex to Delegated Regulation 2025/294 contains the template for submitting complaints. Even though its use may not be made mandatory under Article 1(7), its structure is worth a look, because it shows what makes a complaint complete.

Section 1 records the complainant's details: name, national registration or identity number, customer number where available, address, telephone and e-mail. Section 2 is intended for a legal representative, whose appointment has to be evidenced by a power of attorney or another official document.

Section 3 carries the matter itself. What is required there is the full identification of the crypto-asset service concerned, together with a reference number or transaction references, the description of the subject of the complaint with supporting documents, the dates of the circumstances that led to the complaint, and a description of the damage, loss or disadvantage incurred. It closes with place, date, signature and a list of the documents attached.

The dates in section 3c are where informal complaints most often come apart. Anyone who sets out the time of the deposit or withdrawal, the time of the first support enquiry and the time of the last reply makes it hard for the provider to plead incompleteness.

Rejection and remedies: what Article 6(4) requires when you are turned down

If your claims are not met, or are met only in part, the provider gives clear reasons for its decision under Article 6(4) and provides information on the remedies available. This duty is frequently passed over in practice. A rejection with no indication at all of how matters can proceed is itself a starting point for the next step.

Anyone wanting to look up their provider's authorisation will find where the venues authorised in Europe stand in our overview of regulated crypto exchanges. The connection is direct: only a firm that holds an authorisation owes the complaints procedure under Article 71. A firm working without permission does not owe it, and that is one of the reasons why the authorisation belongs before the first deposit and not after the first dispute.

Closely related is the question of who actually owns the holdings in custody if the provider goes under. That is dealt with in our piece on segregation in the insolvency of a crypto exchange, and it picks up exactly where the complaints procedure ends.

Article 108 MiCAR: how a complaint to the competent authority works

If the provider stays inactive, the second level comes into play. Article 108(1) MiCAR obliges the competent authorities to set up procedures allowing customers and other interested parties, including consumer associations, to lodge complaints where providers are suspected of infringing the regulation. Such complaints are accepted in written form, including electronically, and in an official language of the member state in which they are submitted.

The decisive question is which authority is competent at all. What governs is the home member state of the authorisation, not your place of residence. Many of the large platforms serving German customers hold their authorisation in Ireland, Malta, the Netherlands or Luxembourg. For them, the route under Article 108 leads to the supervisor there.

Paragraph 2 requires information on these complaints procedures to be available on every competent authority's website and to be transmitted to the EBA and ESMA. ESMA then publishes hyperlinks to the complaints sections of the authorities' pages. That list is precisely what we looked at.

Our own survey of August 19, 2026: 30 supervisory complaints links put to the test

This analysis was carried out by cryptoticker.io itself on August 19, 2026. The method in one sentence: we read out the compilation “List of links for complaints-handling under Article 108” linked by ESMA on its MiCA page, recorded every entry in it, and retrieved each stored address individually with a browser identifier and redirect tracking. 30 entries were checked: the 27 EU member states plus Iceland, Liechtenstein and Norway.

The first finding concerns the list itself. Only 18 of the 30 entries carry an address at all. In twelve cases, the note “TBA”, meaning to be announced, stands in place of a link. The states affected are Denmark, Germany, Estonia, Spain, Italy, Cyprus, Poland, Portugal, Romania, Finland, Sweden and Iceland.

The second finding concerns the 18 stored addresses. Thirteen delivered the page with code 200. Four responded with 403, that is with an automated defence of the kind many public-authority sites use against machine retrieval; in a browser these pages are normally reachable for readers, and for the Austrian supervisor we cross-checked the content. One address returned code 404 with the page message “Page not found”: the link stored for Croatia to the complaints page of the supervisor there. The error is reproducible, three spellings of the address led to the same result, while the home page of the same authority responded without any problem.

The third finding concerns language. Of the thirteen pages delivered, eight declared English as the page language and five another national language, namely Bulgarian, French, Hungarian, Norwegian and Slovak. Not a single one of the pages retrieved was delivered in German. There is also an observation on the margins: the address stored for Slovakia redirects to an address other than the one in the list.

Three things could not be checked, and that belongs to the measurement as well. First, the content of the four pages blocked with 403, whose page language and complaints route we therefore did not include in the language count. Second, the question of whether a reachable page actually has a working complaints procedure behind it; what was measured is availability at the reported address, not the quality of the procedure. Third, whether an authority has since reported its complaints route without the published list being updated. The retrieval is a snapshot of that one day.

Germany is listed as “TBA”: what is missing from the ESMA list and what BaFin offers anyway

The entry for Germany deserves careful interpretation, so that the wrong conclusion is not drawn from it. In the list ESMA publishes under Article 108(2), and which it linked from its own MiCA page at the time of our retrieval, there is no link for Germany but the note “TBA”.

It does not follow from this that there is no complaints route in Germany. BaFin operates a complaints procedure on its consumer pages and accepts complaints through an online form. Complaints can also be addressed by e-mail, post or fax to Division IF in Bonn, and the authority runs a free consumer helpline. What is missing is the link between the two: an investor looking things up in the European list currently finds no reference to that route for Germany.

In practice this matters mostly in the other direction. Because most of the large trading venues do not hold their authorisation in Germany, a foreign supervisor is often competent for a complaint under Article 108 anyway. Anyone wanting to know where to turn first has to know where their provider is authorised. That detail is in the contract documents and in the legal notice.

Collective consumer protection: why BaFin does not decide your individual case

This is where the biggest misunderstanding lies, and BaFin itself clears it up plainly on its complaints page. By its own account, the authority is responsible only for collective consumer protection, that is, it protects consumers in the financial market as a whole. It cannot help individual consumers obtain their rights in an individual case. The authority may not decide individual disputes, and it does not offer legal advice either.

On that account, only courts can settle disputes bindingly, since they can also compel a company to pay by judgment. For the protection of the individual, the authority points to ombudsmen, dispute resolution bodies and courts. And it examines a complaint only if it supervises the company concerned at all.

From this follows the right order of things. The complaint to the provider under Article 71 MiCAR is the route with an enforceable deadline attached, and at the end of it stands a reasoned decision in your case. The complaint to the supervisor under Article 108 is not a substitute for that but a signal to the supervisor that a provider is suspected of breaching its duties. Both have their place, but only the first is aimed at your money.

On the same page, BaFin expressly recommends turning to the company in writing first and asking for a written statement. Under MiCAR, that is more than a recommendation. It is the procedure that Article 71 and the Delegated Regulation equip with deadlines and formal requirements. The details are in the full text of Delegated Regulation (EU) 2025/294, and the route to the German supervisor is on the page “Complaining to BaFin”.

A sober interim assessment

The rulebook is more detailed than everyday experience suggests. It says which language you may write in, which date counts, what has to be in the acknowledgement of receipt, and by when a decision has to be there at the latest. What it does not deliver is enforcement in the individual case. That remains with dispute resolution bodies and courts, and it becomes easier the more cleanly the matter is documented with the provider. That is exactly what a formal complaint is good for, even when it is turned down in the end.

Complaining about a crypto exchange: what to take away

1. Find the published complaints procedure before you need it. Under Article 1(3) of the Delegated Regulation it has to be easily accessible on the website together with the standard template, and under Article 1(2)(e) it has to state the provider's deadlines. If it is missing or cannot be found, that is already a finding. Where the venues authorised in Europe stand is shown in our overview of regulated crypto exchanges.
2. Write a complaint, not a support enquiry, and note the date of receipt. Label the matter expressly as a complaint, set out the dates of the incidents along the lines of section 3c of the template, and keep the acknowledgement of receipt with its date. The two months under Article 6(2) run from that date. If you want to compare before opening an account, the venues are in our crypto exchange comparison.
3. Once the matter is settled, move what you do not need day to day. A complaints procedure resolves the individual dispute, but it changes nothing about the fact that holdings on a trading platform depend on that platform's operation. Whatever stays put long term belongs in your own custody; the devices for that are in the hardware wallet comparison.

(As of August 19, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)