Austria

Crypto Licensing

Austria's crypto-licensing regime registered its most significant enforcement activity to date this cycle. The FMA issued what is reported as its first published legally-binding penalty decision under MiCA in the jurisdiction, fining Bitpanda GmbH €70,000. The finding concerned a failure to submit the firm's crypto-asset white paper the required number of working days ahead of publication, together with premature or non-compliant marketing communications. The decision is dated 14 August 2026 and was published 16 August 2026. This is a probable-confidence finding drawn from a single Tier-3 secondary source; the FMA's own primary decision text was not independently retrieved this cycle, so the precise statutory basis and penalty calculation detail should be read with that sourcing limitation in mind.

Separately, Kurant GmbH was fined €45,000 under the FM-GwG for deficient written customer due diligence policies on occasional transactions and suspected money-laundering or terrorist-financing cases. This is the second fine against Kurant within roughly a year, following a €70,000 penalty in October 2025 for unwritten ongoing-monitoring procedures. The recurrence across related but distinct compliance failings — unwritten monitoring procedures in the first instance, deficient CDD documentation in the second — suggests either a persistent compliance-resourcing gap at the firm or a supervisory programme that is systematically working through the full range of FM-GwG documentation requirements rather than a single remediated issue recurring.

The FMA also published consumer warnings against three entities — Coinmindz, BeHappy Exchange, and STIG International Trading & Gemstone FZCO — for operating without the required authorisation, within the current research window. These warnings are confirmed directly from the FMA's own notices and represent the regulator's continuing use of public warnings as a market-perimeter tool distinct from the substantive penalty decisions against already-licensed firms.

Austria's national MiCA transitional (grandfathering) period for entities previously registered under the FM-GwG closed on 30 December 2025, a twelve-month window under MiCA Article 143(3). This is probable-confidence: the primary FMA or Bundesgesetzblatt text setting the exact Austrian transitional end-date was not independently retrieved this cycle, and the finding relies on a Tier-3 secondary legal source. The closure of this window means firms that had been operating under grandfathered FM-GwG status needed, by that date, to have secured full MiCA authorisation or an alternative licensing route.

Outlook

The FMA's enforcement activity against Bitpanda and Kurant, taken together with its continuing use of consumer warnings against unauthorised entities, points to active and multi-pronged supervision of the crypto-licensing perimeter in Austria — spanning MiCA-authorised firms' ongoing compliance, FM-GwG documentation requirements, and unauthorised market entrants. Whether further enforcement decisions follow in the coming reporting arcs, and whether the exact statutory basis for Austria's MiCA transitional end-date can be confirmed against primary legislative text, are the two open items most likely to be resolved by continued monitoring.

Crypto Licensing

Austria's crypto-licensing regime operates under MiCAR, Regulation (EU) 2023/1114, with the FMA (Finanzmarktaufsicht) designated as the national competent authority under MiCAR Art.93(1) via the national implementing act, the MiCA-VVG (BGBl. I Nr. 111/2024). Under this framework, FMA authorisation as a CASP, or passporting from another home Member State under MiCA's EU-wide passporting mechanism, is required to provide any of the ten crypto-asset services enumerated in MiCA Art.3(1)(16) on a professional basis within Austria. This is a directly enforceable licensing perimeter: providing an in-scope service without authorisation or valid passporting is not permitted.

Austria's transitional arrangements for pre-MiCA operators have now fully run their course. Firms that were registered as virtual-asset service providers under the prior national regime, the FM-GwG, were permitted to continue operating without full CASP authorisation only during a transitional window. Austria elected the maximum transitional period permitted under MiCAR's transitional provisions, an 18-month window, which closed on 30 June 2026. From that date, operating as a crypto-asset service provider in Austria without CASP authorisation, whether granted directly by the FMA or via passporting, is prohibited. This closure is a significant regime-maturation milestone: it marks the point at which Austria's crypto sector moved definitively from a dual-track transitional regime (legacy FM-GwG registration plus emerging MiCAR authorisation) to a single-track MiCAR-only authorisation regime.

The most consequential development within the licensing module this cycle is the FMA's publication, on 14 August 2026, of its first legally final enforcement decision under MiCAR. The decision fined Bitpanda GmbH EUR 70,000 under MiCAR Art.111 for three distinct failures: a late whitepaper notification, a premature marketing communication (meaning marketing activity that preceded the point at which it was permitted under MiCAR's sequencing rules), and missing mandatory disclosures. Each of these is a conduct-level or disclosure-level failure rather than a failure to hold authorisation at all, which is a meaningful distinction: it indicates the FMA is actively monitoring and enforcing the granular procedural requirements of MiCAR, not merely policing the authorisation perimeter itself. As the first published precedent of its kind, the Bitpanda decision gives the market its first concrete indication of how the FMA calibrates penalties for this category of compliance failure, though a single data point of EUR 70,000 does not yet establish a reliable penalty benchmark across the range of possible MiCAR infringements.

Capital requirements for CASPs operating in Austria follow the MiCA Annex IV framework directly, with initial-capital floors set by service class: EUR 50,000 for Class 1 services, EUR 125,000 for Class 2, and EUR 150,000 for Class 3. These figures are EU-wide and directly applicable; no Austria-specific uplift to these floors has been located, though this has not been independently verified against the Official Journal text this cycle, and firms should treat the absence of a located uplift as provisional rather than conclusive.

Two gaps remain open in Austria's crypto-licensing picture. First, whether the FMA has published a formal grandfathering or fast-track process for VASPs that found themselves crossing the 30 June 2026 transitional deadline without completed CASP authorisation, and whether any firm in fact missed that deadline, has not been established this cycle. Second, whether Austria applies any jurisdiction-specific uplift to the MiCA Annex IV capital floors remains unverified against primary Official Journal text.

Outlook

With the transitional window closed and the FMA's enforcement capability now demonstrated through a first legally final decision, Austria's crypto-licensing regime should be expected to generate further enforcement precedent over coming cycles, particularly as more CASPs complete their first full year of operation under full MiCAR authorisation rather than legacy FM-GwG registration. The EUR 70,000 Bitpanda penalty, addressing notification-timing, marketing-sequencing and disclosure failures, may serve as an early reference point for how the FMA approaches similar procedural breaches going forward, though firms should not assume this figure represents a ceiling or a template, given it is a single published decision. Whether any firm failed to secure authorisation before the 30 June 2026 transitional deadline, and how the FMA would treat such a lapse, remains an open question on current evidence.

Crypto Licensing

Austria's crypto-asset licensing framework operates entirely under the EU's directly-applicable MiCA Regulation (Regulation (EU) 2023/1114), supervised nationally by the FMA. Any of the ten MiCA-defined regulated crypto-asset services provided professionally in or into Austria requires CASP authorisation from the FMA — a Confirmed, T1-sourced requirement via ESMA. This is the foundational licensing fact for the jurisdiction: there is no separate Austria-specific crypto-licensing statute operating alongside MiCA; the national implementing framework channels applicants into the harmonised EU authorisation process.

The most significant near-term mechanic is the closure of Austria's pre-MiCA transitional regime. Entities that were providing crypto-asset services under Austrian national law (the FM-GwG registration regime) before 30 December 2024 were permitted to continue operating only until 1 July 2026, or until the FMA granted or refused a MiCA authorisation, whichever occurred first. This is a Confirmed, T1-sourced deadline, and it is the operative compliance clock for any firm that had not yet secured full MiCA authorisation heading into mid-2026.

Against that deadline, the evidence shows the FMA has been an active licensor rather than a passive gatekeeper: it has granted full MiCA CASP authorisations during 2025-2026 to firms including Bitpanda and WhiteBIT, a Probable finding sourced from industry legal commentary. Underneath the authorisation itself sits a tiered capital-adequacy structure: reported own-funds requirements of EUR 50,000, EUR 125,000 or EUR 150,000 depending on the specific class of regulated service a CASP intends to provide — a Probable finding resting on a single T4 source and flagged for future corroboration against the FMA's own published applicant guidance, which this cycle's evidence surfaced but did not retrieve substantive content from.

Taken together, the picture is of a jurisdiction with a fully operative, EU-harmonised licensing regime, an active national regulator, and a transitional deadline that has now closed or is on the point of closing without evidence this cycle of a resulting supervisory gap. The principal open question — whether any residual population of legacy FM-GwG registrants failed to secure authorisation in time — was not resolved by this cycle's evidence.

Outlook

The FM-GwG transitional deadline of 30 June/1 July 2026 is the operative near-term milestone; whether any legacy-registered firms failed to transition, and what consequence follows if so, is the concrete item to track in a subsequent research cycle. Independently confirming the tiered capital-floor figures and the exact in-force date and penalty provisions of Austria's MiCA-VVG implementing act against a .gv.at or Bundesgesetzblatt primary source remains an outstanding research gap.

Consumer Protection

Austria's consumer-protection signal this cycle derives from the same Bitpanda enforcement decision tracked under Crypto Licensing, viewed here through its disclosure-to-retail-purchaser dimension. The FMA found Bitpanda GmbH in breach of MiCA's marketing-communication disclosure rules, specifically citing missing mandatory disclosures and missing contact information in the firm's marketing communications, alongside the separate finding that the firm's crypto-asset white paper was not submitted the required number of working days before publication. The combined penalty was €70,000, in a decision dated 14 August 2026. This is a probable-confidence finding from a single Tier-3 secondary source, and the FMA's own primary decision text was not independently retrieved this cycle.

The marketing-communication disclosure requirements under MiCA exist specifically to protect retail purchasers of crypto-assets by ensuring they receive adequate, complete disclosure — including contact information for the issuer or offeror — before being marketed to or before a purchase decision. A finding that these disclosures were missing from Bitpanda's marketing communications is therefore a direct consumer-protection finding, not merely a technical licensing-process failure, even though it was processed and penalised as part of the same enforcement decision covering the white-paper timing breach.

No additional Austria-specific consumer-protection development — such as a custody-rule finding, a market-abuse finding distinct from the Bitpanda marketing breach, or a new consumer-facing disclosure requirement — was located within the current research window. The deeper rule detail governing custody, market-abuse provisions, and prudential-capital requirements as they apply to consumer protection in Austria was not independently re-verified this cycle beyond what the Bitpanda decision itself establishes.

Outlook

Whether the FMA pursues further marketing-communication-disclosure findings against other MiCA-authorised firms in Austria, beyond Bitpanda, is the natural next signal to watch, since a single enforcement decision does not establish whether this is a systemic compliance gap across the authorised population or an isolated finding specific to one firm's marketing practices. Confirmation of the FMA's primary decision text, rather than reliance on secondary reporting, would also strengthen confidence in the precise scope of the disclosure deficiencies found.