Your Volksbank's Crypto Licence: Why You Have to Check Custody Separately

If your Volksbank or Raiffeisenbank has recently started offering crypto, it holds a BaFin authorisation for it. In most cases that authorisation covers exactly one service: the execution of your buy and sell orders. It does not cover the custody of your coins. Who holds the key to your holdings is not stated in your bank's authorisation, and that is precisely the question you should settle before your first purchase.

The occasion is a shift in the European register that has become clear over recent weeks. Between August 12 and September 10, 2026, according to an analysis by the trade service The Industry Spread published on September 10, 16 new entries were added to the CASP register of the European securities regulator ESMA. Fourteen of them were German cooperative banks. The specialist service MiCA Watch arrives at the same picture for the same period and now counts 31 local banks with a MiCA authorisation, each with a single service and each for Germany only.

What a CASP authorisation under MiCAR actually permits

CASP stands for crypto-asset service provider: a company that commercially offers one of the crypto services listed in the EU's MiCAR regulation and needs an authorisation from the national supervisor to do so. MiCAR is the EU regulation on markets in crypto-assets, in force since the end of 2024; the competent authority in Germany is BaFin.

One property of this authorisation is decisive and tends to get lost in everyday use: an authorisation of this kind never applies across the board. MiCAR lists ten individual services, from custody through the operation of a trading platform to investment advice on crypto-assets. An institution applies for each of them separately, and the register then states exactly which ones it received. A bank can therefore be authorised and still not be entitled to hold your coins.

The second point concerns reach. The authorisation applies EU-wide in principle, but only for the countries into which the institution has notified it. With the cooperative banks this field is set throughout to a single country, namely Germany. For you as a customer in Germany that changes nothing, but it explains why these institutions look different in the European register from an international exchange.

Cooperative banks are filling the ESMA register: 14 of 16 new entries

The figures from the two analyses are unambiguous. For the window from August 12 to September 10, 2026, The Industry Spread gives a share of 14 of the 16 new register entries, so 87.5 percent. MiCA Watch gives 15 of 17 new entries for August, and therefore 88.2 percent. Both services name ESMA's machine-readable register file as their source. The names appearing there belong to local banks throughout: Raiffeisenbank Schwaben Mitte, Volksbank Euskirchen, VR-Bank Mittelfranken Mitte, Volksbank Raiffeisenbank Dachau, Frankfurter Volksbank Rhein/Main and others.

Differing values exist for the overall size of the register, and we are not smoothing them over: the MiCA Crypto Alliance arrives at 294 entries after the 14 new additions, while the service CASP Tracker gives 338 authorised crypto-asset service providers for September 7, 2026. The spread is likely down to the services counting differently, for instance entries against institutions, or with and without notified branches. Only the direction is reliable at this point, and that is unambiguous.

What this movement means can be described soberly. German crypto access is migrating out of the specialist-provider space and into bank distribution. Anyone who previously had to open an account at an exchange now finds the offering in the app of their own high-street bank. How the costs of that route compare with the fees of an exchange is something we calculated in a separate analysis of the commission at Sparkasse and Volksbank.

Execution only: why order execution does not include custody

The service that all the local banks concerned have registered is called "execution of orders for crypto-assets on behalf of clients" in the register. Exactly one process is meant: your bank accepts your order and passes it on for execution, buying in your name and selling in your name.

Custody is a separate service of its own under MiCAR, with the register name "custody and administration of crypto-assets on behalf of clients". What that means is the holding of the means of access, namely the private keys with which a crypto holding is disposed of. A private key is the secret sequence of numbers that can move a crypto holding; whoever holds it actually controls the coins.

For you as a customer, a concrete checking task follows from that. If your bank covers only the execution, then your holdings sit with a third party, and that third party matters just as much to your risk as the bank with which you place the order. Which custody models exist and where the differences lie is set out in our hardware wallet comparison, which describes self-custody as the counter-model.

Our own count: 66 crypto-asset service providers in the BaFin database

So as not to depend on other people's counts alone, we collected the German side ourselves. The basis is BaFin's public company database, queried through the category "crypto-asset service provider". This assessment was carried out by cryptoticker.io on September 13, 2026.

The method in one sentence: on September 13, 2026, we retrieved the "crypto-asset service provider" category of the BaFin company database in full, alphabetically, because the result list breaks off at 50 entries, and evaluated each institution's category designation.

The result across 66 institutions checked:

• BaFin lists 66 institutions in the crypto-asset service provider category.
• 21 of them belong to the cooperative sector, meaning Volksbanken, Raiffeisenbanken, VR-Banken, the Westerwald Bank and DZ BANK as the central institution.
• 33 of the 66 are also credit institutions; 23 are investment firms.
• Ten of the 66 additionally carry the crypto custodian designation.
• Not a single one of the 21 cooperative institutions carries the crypto custodian designation.
• Three institutions are additionally registered as crypto securities registrars.

The last line is the core of it. The cooperative sector accounts for a third of Germany's crypto-asset service providers and not one custodian.

Crypto custodians under section 32 of the KWG: which ten institutions hold the permission

The crypto custodian designation in the BaFin database refers to crypto custody business under the German Banking Act, a national permission that existed before MiCAR and has since been continued alongside the European authorisation. This designation is not identical to the MiCAR custody service, but it covers the same business: holding crypto-assets for others.

According to our count of September 13, 2026, these ten institutions carry the designation: BitGo Europe, Boerse Stuttgart Digital Custody, Bullish Europe, Commerzbank, Crypto Finance Deutschland, DekaBank, Hauck Aufhäuser Digital Custody, Tangany, Tradevest Digital Assets and V-Bank. That is a short list for a market with 66 authorised service providers, and it shows how heavily custody is concentrated on a few addresses.

Why this concentration counts for you

A custodian pools the holdings of many customers of many banks. Should it fail, that hits the customers of every institution attached to it, and not only the customers of a single house. This is no accusation against any individual institution but a property of the model, and it belongs in your risk assessment before you place a larger amount there. Anyone wanting to compare this route with a regulated exchange that has its own custody arrangement should therefore first establish how many stages lie between them and the coins.

meinKrypto at Atruvia and DZ BANK: who holds the keys in the background

The offering through which the local banks serve their customers is called meinKrypto. It was built by the cooperative sector's IT service provider Atruvia together with DZ BANK and, as IT-Finanzmagazin reports, has been available in the VR Banking app since January 2026. At launch, Bitcoin, Ethereum, Litecoin and Cardano were available to choose from. Of the roughly 700 affiliated cooperative banks, more than a third intended to go live in the months that followed, according to that report.

Two accounts of the division of labour in the background exist and do not fully agree, so we reproduce both. IT-Finanzmagazin writes that custody is handled by Boerse Stuttgart Digital and order execution by EUWAX AG. MiCA Watch describes the model as hub and spoke and assigns custody to DZ BANK, while the local banks take the order.

Our own count supports the first account, though only for the national permission: Boerse Stuttgart Digital Custody carries the crypto custodian designation, DZ BANK does not. EUWAX AG appears in BaFin's crypto-asset service provider category as an investment firm. What cannot be read off the BaFin database, however, is which of the ten MiCAR services DZ BANK has registered in the ESMA register. Both statements can therefore be correct at once, if DZ BANK holds the European custody service and outsources the technical custody to Boerse Stuttgart Digital. This can only be cleared up through DZ BANK's own register entry.

The question you can put to your bank

You do not have to unravel this chain yourself. A single question to your bank is enough, and it should be answered in writing: which company holds custody of my crypto-assets, and on what permission is that based? A bank that distributes crypto has to have a clear answer to that. If you do not get one, that in itself is a piece of information.

Hub and spoke: what the model means for your counterparty risk

In the hub-and-spoke model your holdings pass through three stations: the local bank with which you place the order, the entity that executes the order in the market, and the custodian where the coins sit. Every station is regulated, and every one is a separate point at which something can go wrong. The model is therefore no worse than the route through an exchange, it is simply cut differently, and you should know where the cuts lie.

One point that often gets confused with deposit protection deserves explicit mention: crypto-assets are not deposits. The statutory deposit guarantee and the protection scheme of the cooperative sector apply to balances in your account, not to coins in your portfolio. That holds at your own bank exactly as it does at an exchange, and the MiCA authorisation does not change it.

What MiCAR prescribes instead is a separation: a custodian must keep customer holdings apart from its own assets and is liable if it loses them. That is genuine progress compared with the unregulated state of affairs, but it is not a state guarantee on the value.

Transfer to your own wallet: what to settle before your first purchase

The practically most important consequence of the execution-only model concerns transfers. If your bank does not provide custody itself and the holdings sit in a pooled structure at the custodian, then paying out to a wallet address of your own is a function the provider either makes available or does not. Whether your institution offers it is not stated in the register but in the terms of the offering.

Four points are worth checking in the paperwork before you buy. First, the transfer: is a payout to an external address possible, for which coins, and what does it cost? Second, the tax records: do you receive a statement with the acquisition date and acquisition cost for each addition, one that is fit for the holding period? Third, the price at which settlement happens and the mark-up on it, because with bank offerings the cost frequently sits in the spread rather than in a stated fee. And fourth, because it counts when selling: how quickly is the order executed, and does a limit apply or only the next determinable price?

Which banks have already rolled the offering out at all is something our editorial team has gathered in the overview of crypto trading at Volksbanken.

What the registers do not show and where our count ends

Honesty requires stating the limits of one's own figures. BaFin's company database names one designation per institution, such as crypto-asset service provider or crypto custodian. What remains unnamed is which of the ten MiCAR services an institution has registered in the European register. Our count of 66 institutions therefore says with certainty who is listed in Germany as a crypto-asset service provider and who is additionally listed as a crypto custodian, and it says nothing about the precise scope of the MiCAR permission in an individual case.

The ESMA register does carry that scope, and that is where the statement comes from that the local banks hold order execution exclusively. That statement comes from the two specialist analyses named above and not from a measurement of our own: the ESMA register's search form could not be evaluated through an automated retrieval on September 13, 2026, as it serves the results page only to a browser. It is normally usable for readers, and we link to it for that reason.

DZ BANK's register entry likewise remains open, and it is the entry on which the contradictory assignment of custody would be decided. We have no measurement of our own on this and therefore reproduce both published accounts without declaring either one a fact.

Checking your Volksbank's crypto licence: your takeaways

1. Separate the two questions. The fact that your bank holds a crypto authorisation says nothing about who holds custody of your coins. Ask about the custodian and about its permission, and compare the answer with the providers in our overview of regulated crypto exchanges before you commit.
2. Settle the transfer question before buying. Holdings you cannot move to an address of your own are tied to the provider. Whether and how you can withdraw coins is stated in the terms; which counter-models exist is shown by our hardware wallet comparison.
3. Check the tax records while you can still choose. For the holding period you need the acquisition date and acquisition cost for each addition. Ask for a sample of the annual statement before your first purchase, and place the provider in the market with our overview of regulated crypto exchanges.

The sources for this article in the original: BaFin's public company database, in which you can query the crypto-asset service provider category yourself, and ESMA's CASP register, which lists the individual approved services for each institution.

(As of September 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)