On August 19, 2026, BaFin published a consumer notice covering the websites zafiroco(.)cr/de and ncwallet(.)net/de as well as the NC Wallet app. According to the regulator’s findings, the operators offer financial services there without the required authorisation, and the authority says it is investigating the unknown operators behind the sites. If you have the app on your phone or hold a balance in it, the practical question is not who eventually prevails in law. It is whether you can reach your money if something goes wrong. That is what this article deals with.
One distinction matters up front, because reports of this kind tend to blur it. A BaFin consumer notice is neither a judgment nor proof of a criminal offence. It is the regulator informing the public that, on its findings, an activity requiring authorisation is being offered without one. What follows from that for you depends less on the legal assessment than on a technical property of the app that many users are unaware of. We come to it below.
What BaFin said about NC Wallet and ncwallet.net on August 19, 2026
The wording of the notice is brief and repays close reading. BaFin warns against offerings on the websites zafiroco(.)cr/de and ncwallet(.)net/de and in the NC Wallet app. It states that, on its findings, the operators there provide financial services without authorisation, and it adds that the operators are not supervised by BaFin. The authority is investigating the operators, whom it describes as unknown.
Three things are therefore established, and nothing beyond them. First, the authority classifies the offering as requiring authorisation. Second, it sees no authorisation in place. Third, it does not supervise the operators, which means the usual supervisory controls do not apply to this provider. On the safety of the balances held, on the intentions of the operators, or on any loss suffered, the notice says nothing at all. It is a statement about authorisation status, and it stops there.
The original notice sits on the regulator’s own pages and is freely readable: BaFin consumer notice of August 19, 2026. Anyone who reads it directly will see at once how restrained the language of such an announcement is.
Zafiro Innovation Systems LLC: why BaFin calls the operators unknown
One detail of the notice is regularly compressed in summaries, and the compression changes the meaning. BaFin writes that the operators of the sites present themselves as a company by the name of Zafiro Innovation Systems LLC, which operates the NC Wallet app. That is a different statement from a finding that this company is the operator. The regulator expressly describes the actual operators as unknown and treats the company name as the self-description of whoever stands behind the sites.
For you as a user this is not a point of legal polish. It is the heart of the matter. A provider whose true identity a supervisory authority cannot establish is a provider against whom you have no address in a dispute. You cannot serve a claim, set a deadline, or approach an insolvency administrator if you do not know who sits on the other side. That reasoning holds regardless of how BaFin’s proceedings end.
The name appears in publicly available product descriptions of the app in varying spellings, sometimes as Zafiro Innovation Systems LLC, sometimes as Zafiro International Limited. We do not resolve that spread here, because the diverging entries cannot be evidenced from a primary source. What can be evidenced is this: BaFin names exactly one company designation and classifies it as a self-description.
Section 10(7) KMAG: the legal basis for a BaFin warning
BaFin names the provision it relies on in the notice itself: Section 10(7) of the Crypto Markets Supervision Act, known in German as the Kryptomärkteaufsichtsgesetz or KMAG. The KMAG is the German statute that anchors the European regulation on markets in crypto-assets in national law and assigns BaFin supervision over crypto-asset service providers. The provision cited is the enabling rule that allows the regulator to inform the public about providers which, on its findings, operate without the required authorisation.
That legal basis also explains the tone of the notice. An announcement under this provision interferes with the rights of the party concerned and is therefore tied to conditions. The authority names the rule it considers to have been breached and the responsible party, so far as it knows who that is. Here the second half breaks down, because by the regulator’s own account the operators are not known to it. What remains is the warning against the offerings themselves.
How systematically the authority uses this instrument is shown by an analysis cryptoticker.io published on August 14, 2026: for 2026 it arrived at 24 platform series covering 639 individual domains against which the regulator had warned. That figure comes from our own count and should be read as an order of magnitude, not as external evidence. It makes clear that a single consumer notice is routine in the regulator’s working day.
Regulated Crypto Exchanges Compared
Custodial wallet: why you do not hold the private key at NC Wallet
This is the point that makes the notice practical for users. NC Wallet is a custodial wallet according to the classification of the independent audit project WalletScrutiny. The project lists the app under the verdict that the provider holds the keys, and bases that on the app’s terms of use, which allow the operator to freeze accounts and block crypto-assets. The entry was last updated on August 16, 2026, three days before the BaFin notice and independently of it.
Custodial and non-custodial: the one-sentence definition
A wallet is custodial when a provider holds the private keys to the crypto-assets and you merely have an account with that provider; it is non-custodial when the keys sit exclusively on your own device and you can secure them yourself through a recovery phrase. The difference is not a matter of taste. With a custodial wallet, access to your balance depends on the provider letting you in.
The word wallet suggests the opposite. Many users picture a purse that belongs to them and carry that image across to every app bearing the name. In practice a custodial wallet sits closer to an account at an exchange than to a hardware wallet. If you want to see how the two designs differ in daily use, the software builds are set out in our software wallet comparison and the device variant in the hardware wallet comparison.
It is the combination of the two findings that separates this notice from any routine supervisory footnote. A provider whose identity the regulator does not know also holds the keys to its users’ balances. Anyone reading a warning about a non-custodial wallet can, in case of doubt, move their funds to another program using the recovery phrase, without asking the provider. With a custodial app that option does not exist.
No imprint, no provider name: what is missing on ncwallet.net
We opened the German-language home page ncwallet(.)net/de ourselves on August 20, 2026. The page responded normally and describes the product as the world’s first commission-free crypto wallet. It lists more than twenty supported crypto-assets on the Bitcoin, Ethereum, Polygon, BNB Smart Chain, Solana, Tron, TON, Arbitrum, Optimism and Litecoin networks, and advertises that the provider covers the network fees for transactions.
What the page we retrieved does not say carries more weight than what it does. We found no provider name, no address for service, no country of establishment and no reference to a licence or a competent supervisory authority. Nor does the home page state explicitly whether the wallet operates on a custodial basis. This is a check you can run yourself on any provider in two minutes, and it tells you something regardless of any regulatory announcement.
A provider directing a financial product at German users has to be identifiable. Where that information is absent, a more practical question arises before any assessment of the offering: whom do you turn to when a withdrawal stalls? In this case the answer is that there is nobody you can name.
Am I affected? How to check your NC Wallet balance step by step
You are affected if you have installed the app, hold an account there, or keep crypto-assets in it. An account with a different provider is untouched by this notice. Anyone who only tried the app and deposited no balance has little to settle, but should still avoid reusing those login details anywhere.
Four steps for the next few days
- Establish what you hold. Open the app and record outside it which crypto-assets are listed there and in what amounts. A dated screenshot will help later if you need to document the sequence of events.
- Test a small withdrawal. First move a modest amount to a wallet or account that is securely yours, and check that the transaction actually appears on the relevant blockchain. A transfer marked complete inside the app but carrying no transaction ID on the chain is not a withdrawal.
- If it works, move the rest. Once the test amount goes through, transfer the remaining balance in several steps. Keep the confirmations.
- Separate your login details. Do not use this account’s password anywhere else. If it has been reused, change it at the other sites first.
Expect a withdrawal to stall, and do not leave it to the last minute. If an identity check is demanded that you never had to pass before, that is a circumstance worth documenting. Whether a provider is entitled to require it cannot be answered in the abstract; recording what happened is possible in every case.
BaFin company database: how to look up a provider’s authorisation yourself
BaFin regularly points to its company database in its notices, and the reference is more useful than it sounds. The database records companies that are authorised in Germany, that have been notified into the country, or that maintain a branch here. You enter the provider’s name in the search field and see whether an authorisation exists and what it covers: BaFin company database.
Two limits are worth knowing. A missing hit does not prove that an offering is unlawful, because pure software without custody and without an exchange function does not require authorisation at all. And a hit under a similar-sounding name does not prove that it belongs to the app you have just opened. Which activities trigger a licence in the first place is set out in detail in our explainer on the authorisation requirement for wallet apps.
For everyday use a simpler rule of thumb will do. If an app holds your crypto-assets for you, if it offers a built-in exchange, or if it accepts euros, it is operating in territory that requires a licence in the EU. If you then find neither a provider name nor an entry in any register, you have reason enough to keep your balance elsewhere. Anyone taking that route will find the houses authorised in Germany in our overview of regulated crypto exchanges.
Hardware Wallets Compared
Three warnings in one day: Crendel, basiswallet and NC Wallet
The NC Wallet notice did not stand alone on August 19, 2026. The regulator published two further consumer notices from the same category on the same day: one on the Crendel app, behind which, on the authority’s account, stands 805 Water Pro’s LLC and where BaFin sees financial and securities services offered without authorisation alongside crypto-asset services, and one on the website basiswallet(.)co. The Crendel notice additionally relies on Section 37(4) of the German Banking Act.
Three notices in a single day, two of them on wallet apps, form a pattern rather than a coincidence. Distribution through app stores and messengers lowers the barrier for an offering aimed at German users without being licensed here. The regulator responds with an instrument that is fast and requires no enforcement abroad: a public warning.
What a BaFin warning means and what it does not mean
A consumer notice blocks neither an app nor an account. It does not force an app store to remove the offering, and it freezes no balances. Nor does it establish that anyone has been defrauded. What it achieves is limited and still worth having: it makes public that a supervisory authority considers an offering to require authorisation and sees none in place.
From that follows a consequence that is often overlooked. Without authorisation there is also no supervisory accompaniment: no ongoing review of own funds, no requirements on the segregation of client assets from the firm’s own holdings, no complaints route an authority can enforce. With an authorised provider you can turn to the competent regulator in a dispute; what that route looks like in practice is described in our guide to complaining about a crypto exchange. With an unauthorised provider that route falls away.
One question remains open here, because we could not evidence it: how many people in Germany actually use the app. Reliable figures on German users are published neither by the regulator nor by the provider, and an estimated figure would be an invented figure. The notice addresses everyone affected, whatever that number turns out to be.
Regulated alternative instead of an unlicensed wallet app: what to look for when you switch
If you move your balance, the obvious question is where to. Three tests carry further than any recommendation list. The first is identity: a provider with a name, a registered seat and a supervisory authority can be reached in a dispute, an anonymous one cannot. The second is custody: with your own wallet and a recovery phrase you are independent of any company’s consent, with an account at an exchange you are not. The third is whether the provider settles withdrawals verifiably on the blockchain.
For larger holdings you intend to keep for a while, device-bound custody is the more consistent answer; for amounts you move regularly, an authorised provider with a proper withdrawal process is usually the more practical one. The two do not exclude each other. What suits you depends on the amount and how often you trade, not on a question of principle. For the market side itself, our running Bitcoin price prediction offers context and is independent of the custody question.
A final word on expectations. An authorisation is not a promise of safety. It does not protect against price losses, against phishing, or against your losing a recovery phrase. What it does is ensure that there is a nameable responsible party and a competent authority. That is less than many expect, and considerably more than what BaFin sees at the offerings named on August 19.
BaFin warning on NC Wallet: what to take away
- Check first whether you are affected, and test a small withdrawal. Only a transaction that becomes visible on the blockchain counts as a withdrawal. If the test amount goes through, move the rest to a provider from our overview of regulated crypto exchanges.
- Establish for every app who holds the keys. If there is a recovery phrase known only to you, you are independent; if there is none, your access hangs on the provider. The designs and their consequences are set out in the software wallet comparison.
- Move long-term holdings to custody that works without anyone else’s consent. For amounts meant to sit still, the device-bound solution is the more robust one; the devices and their differences are in the hardware wallet comparison.
(As of August 20, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
Be the first to comment