How to File a MiCAR Complaint: Deadlines, Language, and What BaFin Won't Do

For a provider active in Germany, Germany is a host member state. German is therefore a permitted complaint language, even if the platform runs its interface in English. Article 7(2) obliges the provider to reply in the same language in which the complaint was submitted. Article 7(1) requires clear, plain and easily understandable language in doing so.

The annex to Delegated Regulation 2025/294 contains the template for submitting complaints. Even though its use may not be made mandatory under Article 1(7), its structure is worth a look, because it shows what makes a complaint complete.

Section 1 records the complainant's details: name, national registration or identity number, customer number where available, address, telephone and e-mail. Section 2 is intended for a legal representative, whose appointment has to be evidenced by a power of attorney or another official document.

Section 3 carries the matter itself. What is required there is the full identification of the crypto-asset service concerned, together with a reference number or transaction references, the description of the subject of the complaint with supporting documents, the dates of the circumstances that led to the complaint, and a description of the damage, loss or disadvantage incurred. It closes with place, date, signature and a list of the documents attached.

The dates in section 3c are where informal complaints most often come apart. Anyone who sets out the time of the deposit or withdrawal, the time of the first support enquiry and the time of the last reply makes it hard for the provider to plead incompleteness.

If your claims are not met, or are met only in part, the provider gives clear reasons for its decision under Article 6(4) and provides information on the remedies available. This duty is frequently passed over in practice. A rejection with no indication at all of how matters can proceed is itself a starting point for the next step.

Anyone wanting to look up their provider's authorisation will find where the venues authorised in Europe stand in our overview of regulated crypto exchanges. The connection is direct: only a firm that holds an authorisation owes the complaints procedure under Article 71. A firm working without permission does not owe it, and that is one of the reasons why the authorisation belongs before the first deposit and not after the first dispute.

Closely related is the question of who actually owns the holdings in custody if the provider goes under. That is dealt with in our piece on segregation in the insolvency of a crypto exchange, and it picks up exactly where the complaints procedure ends.

If the provider stays inactive, the second level comes into play. Article 108(1) MiCAR obliges the competent authorities to set up procedures allowing customers and other interested parties, including consumer associations, to lodge complaints where providers are suspected of infringing the regulation. Such complaints are accepted in written form, including electronically, and in an official language of the member state in which they are submitted.

The decisive question is which authority is competent at all. What governs is the home member state of the authorisation, not your place of residence. Many of the large platforms serving German customers hold their authorisation in Ireland, Malta, the Netherlands or Luxembourg. For them, the route under Article 108 leads to the supervisor there.

Paragraph 2 requires information on these complaints procedures to be available on every competent authority's website and to be transmitted to the EBA and ESMA. ESMA then publishes hyperlinks to the complaints sections of the authorities' pages. That list is precisely what we looked at.

This analysis was carried out by cryptoticker.io itself on August 19, 2026. The method in one sentence: we read out the compilation “List of links for complaints-handling under Article 108” linked by ESMA on its MiCA page, recorded every entry in it, and retrieved each stored address individually with a browser identifier and redirect tracking. 30 entries were checked: the 27 EU member states plus Iceland, Liechtenstein and Norway.

The first finding concerns the list itself. Only 18 of the 30 entries carry an address at all. In twelve cases, the note “TBA”, meaning to be announced, stands in place of a link. The states affected are Denmark, Germany, Estonia, Spain, Italy, Cyprus, Poland, Portugal, Romania, Finland, Sweden and Iceland.

The second finding concerns the 18 stored addresses. Thirteen delivered the page with code 200. Four responded with 403, that is with an automated defence of the kind many public-authority sites use against machine retrieval; in a browser these pages are normally reachable for readers, and for the Austrian supervisor we cross-checked the content. One address returned code 404 with the page message “Page not found”: the link stored for Croatia to the complaints page of the supervisor there. The error is reproducible, three spellings of the address led to the same result, while the home page of the same authority responded without any problem.

The third finding concerns language. Of the thirteen pages delivered, eight declared English as the page language and five another national language, namely Bulgarian, French, Hungarian, Norwegian and Slovak. Not a single one of the pages retrieved was delivered in German. There is also an observation on the margins: the address stored for Slovakia redirects to an address other than the one in the list.

Three things could not be checked, and that belongs to the measurement as well. First, the content of the four pages blocked with 403, whose page language and complaints route we therefore did not include in the language count. Second, the question of whether a reachable page actually has a working complaints procedure behind it; what was measured is availability at the reported address, not the quality of the procedure. Third, whether an authority has since reported its complaints route without the published list being updated. The retrieval is a snapshot of that one day.

The entry for Germany deserves careful interpretation, so that the wrong conclusion is not drawn from it. In the list ESMA publishes under Article 108(2), and which it linked from its own MiCA page at the time of our retrieval, there is no link for Germany but the note “TBA”.

It does not follow from this that there is no complaints route in Germany. BaFin operates a complaints procedure on its consumer pages and accepts complaints through an online form. Complaints can also be addressed by e-mail, post or fax to Division IF in Bonn, and the authority runs a free consumer helpline. What is missing is the link between the two: an investor looking things up in the European list currently finds no reference to that route for Germany.

In practice this matters mostly in the other direction. Because most of the large trading venues do not hold their authorisation in Germany, a foreign supervisor is often competent for a complaint under Article 108 anyway. Anyone wanting to know where to turn first has to know where their provider is authorised. That detail is in the contract documents and in the legal notice.

This is where the biggest misunderstanding lies, and BaFin itself clears it up plainly on its complaints page. By its own account, the authority is responsible only for collective consumer protection, that is, it protects consumers in the financial market as a whole. It cannot help individual consumers obtain their rights in an individual case. The authority may not decide individual disputes, and it does not offer legal advice either.

On that account, only courts can settle disputes bindingly, since they can also compel a company to pay by judgment. For the protection of the individual, the authority points to ombudsmen, dispute resolution bodies and courts. And it examines a complaint only if it supervises the company concerned at all.

From this follows the right order of things. The complaint to the provider under Article 71 MiCAR is the route with an enforceable deadline attached, and at the end of it stands a reasoned decision in your case. The complaint to the supervisor under Article 108 is not a substitute for that but a signal to the supervisor that a provider is suspected of breaching its duties. Both have their place, but only the first is aimed at your money.

On the same page, BaFin expressly recommends turning to the company in writing first and asking for a written statement. Under MiCAR, that is more than a recommendation. It is the procedure that Article 71 and the Delegated Regulation equip with deadlines and formal requirements. The details are in the full text of Delegated Regulation (EU) 2025/294, and the route to the German supervisor is on the page “Complaining to BaFin”.

The rulebook is more detailed than everyday experience suggests. It says which language you may write in, which date counts, what has to be in the acknowledgement of receipt, and by when a decision has to be there at the latest. What it does not deliver is enforcement in the individual case. That remains with dispute resolution bodies and courts, and it becomes easier the more cleanly the matter is documented with the provider. That is exactly what a formal complaint is good for, even when it is turned down in the end.

(As of August 19, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)