Austria

AT schema world-payments-v1 trajectory: not yet assessed

Last updated 2026-10-21 · 14 modules · 77 sourced findings · 131 sources in the cumulative register

14Modulesbaseline.modules[]

77Findingsmodules[].findings[]

68Tier-1 sourcesrun_metadata.t1_source_count

Confidence mix (sums to 14 rendered modules; click to filter)

No modules moved this cycle.

Law made at European Economic Area level that applies in Austria is covered once, on the European Economic Area page. This page covers Austria’s own layer: implementation, national authorities, national options and local enforcement.

Jurisdiction brief

Latest update · 18 October 2026

Lead Signal

Austria's FMA issued two unauthorised-provider warnings within a single week, finding Bull Trade24 Ltd unauthorised to execute client orders and Vantex Bank unauthorised to conduct licensable banking business in Austria. The Bull Trade24 warning, published 12 October 2026, cites section 3(2)(6) of the Wertpapieraufsichtsgesetz 2018 (WAG 2018) as the basis for the finding that the firm, which claims a London registration, is not authorised to execute client orders, with publication grounded in section 92(11) WAG 2018. The Vantex Bank warning, published 9 October 2026, found the firm unauthorised to conduct deposit-taking or lending business in Austria, and was issued in parallel with a matching warning from Germany's BaFin the same day, indicating coordinated cross-border regulatory attention to the same unauthorised entity.

Taken together, the two warnings continue a well-established FMA enforcement pattern against unauthorised cross-border providers claiming foreign registrations, whether in securities execution or deposit-taking. The coordination with BaFin on the Vantex Bank matter is notable: a single unauthorised entity attracting near-simultaneous public warnings from two separate national regulators signals either a cross-border solicitation campaign targeting both markets or sufficiently close supervisory cooperation between the FMA and BaFin to produce coordinated public responses within the same reporting window.

Other Developments

Bitpanda pursues a bank-distribution partnership while its IPO remains stalled. Bitpanda GmbH and Fibank, Bulgaria's First Investment Bank, announced a strategic partnership on 12 October 2026 under which Bitpanda Enterprise will become the sole crypto-asset-services provider embedded within the My Fibank mobile app, with a consumer-facing launch planned for early 2027. Fibank's chief executive, Nikola Bakalov, was quoted stating that the arrangement is being realised "alongside an established European technology partner and in compliance with applicable regulatory requirements," though neither party disclosed financial terms. This commercial move comes as Bitpanda's previously reported Frankfurt listing, with a target valuation in the region of four to five billion euros, remains halted with no new date set as of 16 October 2026, and as the company's chief executive, Lukas Enzersdorfer-Konrad, has confirmed he will leave the role in the first quarter of 2027.

A pattern of bank-distribution partnerships as an alternative growth channel. The Fibank arrangement is consistent with a broader strategic posture in which Bitpanda is pursuing distribution partnerships with established banks as a growth channel while its public-market listing plans remain on hold and its leadership transitions. Whether this represents a durable pivot in growth strategy or a parallel track pursued alongside a resumed IPO process once market conditions or leadership questions settle is not resolvable from this cycle's evidence alone.

Cross-Monitor Connections

The unauthorised-provider warnings against Bull Trade24 and Vantex Bank sit squarely within the financial-integrity domain's enabler-jurisdiction and unauthorised-solicitation tracking, where the same underlying pattern of unlicensed cross-border offers into the Austrian market is tracked from a financial-crime-risk perspective rather than the conduct and market-access perspective applied here. The Bitpanda-Fibank partnership and the stalled Bitpanda IPO are both relevant to the crypto monitor's commercial-activity tracking for Austria, since the same underlying corporate developments evidence Bitpanda's commercial trajectory as a licensed Austrian crypto-asset service provider independent of the payments-market framing applied in this brief.

Outlook

The FMA's enforcement posture against unauthorised providers, evidenced by two warnings in a single week, is likely to remain a routine and recurring feature of Austria's payments conduct landscape rather than a signal of any structural change in the underlying regulatory framework. On the commercial side, Bitpanda's pursuit of bank-distribution partnerships while its IPO remains stalled and its leadership transitions suggests the company is actively diversifying its growth and revenue channels during a period of corporate uncertainty; whether the My Fibank integration proceeds to its planned early-2027 consumer launch, and whether further similar bank-distribution partnerships follow, are the two developments most likely to clarify the durability of this strategic pivot in coming cycles.

4 earlier updates not shown here.

Standing brief · as of 17 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Austria's Financial Market Authority (FMA) has assumed full competence for monitoring international financial sanctions, taking over the function from the Oesterreichische Nationalbank (OeNB) effective 1 January 2026. The transfer expands the supervised population beyond payment institutions to crypto-asset service providers and investment firms, consolidating sanctions oversight under a single authority responsible for both prudential and conduct supervision. This is a structural change to Austria's financial-sanctions architecture rather than a routine update, and it sits at the centre of this cycle's Austria file.

Other Developments

At EU level, the PSD3/PSR package reached provisional political agreement on 27 November 2025, with formal adoption expected in the first half of 2026. Once transposed, the package will consolidate payment institution and e-money institution authorisation into a unified framework; it has not yet been transposed into Austrian law, so the current national licensing regime for non-bank payment institutions and e-money institutions remains in place for now. Separately, the Digital Operational Resilience Act has applied to Austrian payment institutions since 17 January 2025, and FMA guidance confirms that incident-reporting readiness and registers of ICT third-party providers are now live items on the supervisory file for both bank and non-bank payment institutions. On payment corridors, the EU Instant Payments Regulation is fully live in Austria: instant euro credit transfers execute in under ten seconds, twenty-four hours a day, seven days a week, with an automatic IBAN-payee verification check, and the regime has been compulsory across the EEA since 2025. FMA guidance permits payment service providers to screen instant transfers against sanctions lists at least once daily rather than in real time, and providers must submit a report to the OeNB every twelve months covering price developments and payments refused under the Regulation.

Cross-Monitor Connections

The consolidation of sanctions-monitoring competence into the FMA, together with the reduced daily sanctions-screening cadence permitted for instant transfers, has been flagged as directly relevant to the Financial Integrity Monitor's tracking of AML/CTF architecture and sanctions-screening practice; the two developments together bear on how sanctions obligations are enforced across both traditional and crypto-asset payment channels.

Outlook

Formal adoption of PSD3/PSR is expected in the first half of 2026, which will in due course consolidate payment institution and e-money institution authorisation into a single supervisory framework once transposed in Austria. More broadly, Austria's pairing of tightened sanctions-monitoring competence with a relaxed screening cadence for instant transfers reflects a wider EU pattern of calibrating sanctions rigour against the commercial pressure for payment speed, a balance likely to remain under scrutiny as further instant-payments volumes migrate onto the reduced-cadence screening regime.

trust tier: ai_unverified

Latest update · 18 October 2026

Regulatory Status

Austria's payments and financial-services conduct environment saw two unauthorised-provider warnings from the FMA this reporting period: one against Vantex Bank for unauthorised deposit-taking and lending activity, published 9 October 2026 in parallel with a matching BaFin warning in Germany, and one against Bull Trade24 Ltd, which claims a London registration, for unauthorised execution of client orders under section 3(2)(6) WAG 2018, published 12 October 2026. Both warnings were issued under the FMA's standing statutory authority to publish findings of unauthorised activity under section 92(11) WAG 2018, and both continue the FMA's established enforcement pattern against cross-border providers claiming foreign regulatory standing without the corresponding Austrian authorisation.

On the commercial side, Bitpanda GmbH, the Austrian-based crypto-asset service provider, announced a strategic distribution partnership with Fibank, Bulgaria's First Investment Bank, on 12 October 2026, under which Bitpanda Enterprise will become the sole crypto-asset-services provider embedded in the My Fibank mobile app ahead of a planned early-2027 consumer launch. This commercial development comes as Bitpanda's own previously reported Frankfurt listing, targeting a valuation in the region of four to five billion euros, remains halted with no new date set as of 16 October 2026, and as the company's chief executive has confirmed his departure for the first quarter of 2027.

Outlook

The FMA's enforcement activity against unauthorised providers is expected to continue as a routine feature of Austria's payments conduct landscape. On the commercial front, Bitpanda's pursuit of the Fibank distribution partnership, set against its stalled IPO and confirmed leadership transition, positions bank-distribution partnerships as an active alternative growth channel; whether the My Fibank integration reaches its planned early-2027 launch will be the most direct indicator of this strategy's traction.

1 earlier update not shown here.

Standing brief · as of 17 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Regulatory Status

Austria's payments regulatory environment tightened this cycle on two fronts. First, full competence for monitoring international financial sanctions transferred from the OeNB to the FMA effective 1 January 2026, expanding the supervised population to crypto-asset service providers and investment firms in addition to banks and payment institutions. Second, the EU Instant Payments Regulation is now fully live: instant euro transfers execute in under ten seconds, 24/7, with an automatic IBAN-payee check, and FMA guidance permits sanctions-list screening of instant transfers at least once daily rather than in real time, alongside a standing obligation for payment service providers to report to the OeNB every twelve months on price developments and refused payments. In parallel, the Digital Operational Resilience Act has applied to Austrian payment institutions since 17 January 2025, with incident-reporting readiness and ICT third-party provider registers now live supervisory-file items. At EU level, the PSD3/PSR package reached provisional political agreement on 27 November 2025, with formal adoption expected in the first half of 2026; it has not yet been transposed into Austrian law.

Outlook

Austria's regulatory direction is assessed as tightening, driven by the sanctions-competence consolidation and the live Instant Payments Regulation regime. Formal adoption of PSD3/PSR in the first half of 2026 is the principal forward horizon item, which would in due course reshape non-bank PI/EMI authorisation once transposed domestically.

14 of 14 modules

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

Austria runs a function-based licensing regime under the Payment Services Act 2018 (ZaDiG 2018, transposing PSD2), the Banking Act (BWG) and the Electronic Money Act 2010 (E-GeldG). The FMA is sole licensing/supervisory authority for payment institutions, PISPs and AISPs; CRR credit institutions are licensed via the ECB/SSM with FMA as national conduit. MiCAR CASP authorisation is now layered on top for crypto-asset firms. No sub-national licensing tier exists; this is a unitary federal-level regime.

Standing sub-brief · as of 17 August 2026158 words · last cycle 2026-10-11

Licensing, Authorisation & Market Access

Effective 1 January 2026, full competence for monitoring international financial sanctions transferred from the Oesterreichische Nationalbank (OeNB) to the FMA, expanding the supervised population to cover crypto-asset service providers and investment firms alongside payment institutions and banks. Separately, at EU level the PSD3/PSR package reached provisional political agreement on 27 November 2025, with formal adoption expected in the first half of 2026. The package will, once transposed, consolidate payment institution and e-money institution authorisation into a single framework; it has not yet been transposed into Austrian law, so distinct national licensing tracks for banks and for non-bank PI/EMI licensees continue to apply in the interim.

Periodic update · new data 2026-10-11

Licensing, Authorisation & Market Access

Austria's licensing and market-access picture this cycle was dominated by routine lifecycle activity rather than new-entrant authorisation. The FMA published two licence-lapse notices within the current window. An individual licence held by Peter Arlits lapsed effective 1 October 2026. Separately, a lapsing-of-licence notice was published for Raiffeisenbank Kreuzenstein, a bank-type payment service provider. Both are confirmed directly from the FMA's own primary notices, and both appear to represent ordinary licence-lifecycle management — a licence ceasing to be held — rather than a withdrawal for cause or an enforcement-driven revocation; no indication of a disciplinary basis for either lapse was located this cycle.

The broader licensing context for the window includes the Bybit Payments GmbH EMI authorisation under the E-Geldgesetz 2010 (tracked in the Stablecoins & Digital Money domain), which illustrates that new market-access activity in Austria this cycle concentrated on the e-money/crypto-adjacent licensing route rather than on traditional payment-institution or bank-PSP authorisations. The two lapses recorded here, by contrast, touch the more traditional bank-PSP and individual-licence population, underscoring that licence-lifecycle churn (entries and exits) continues within Austria's established payment-services and banking population even while the more novel authorisation activity is concentrated in the crypto-and-stablecoin-adjacent segment.

Outlook

Neither lapse was accompanied by a successor-firm announcement or market-exit commentary within this window, so whether either lapse reflects a business wind-down, a licence consolidation into another group entity, or a straightforward administrative lapse is not resolvable from the evidence available this cycle. Continued monitoring of FMA licence notices would clarify whether this is an isolated pair of lapses or the start of a broader churn pattern in Austria's licensed-PSP population.

3 earlier distinct update(s)

Periodic update · new data 2026-10-05

Licensing, Authorisation & Market Access

Austria's licensing and market-access architecture tightened materially this cycle through a single legislative vehicle: the FMA-independence bill (621 d.B.), which the Finanzausschuss approved on 29 September 2026 and forwarded to the Nationalrat. The bill transposes CRD VI, specifically Directive 2013/36/EU as amended by (EU) 2024/1619, and its headline governance measures are mandatory cooling-off periods for FMA board members moving between regulated industry and the supervisor, annual interest declarations intended to surface conflicts of interest, and a 14-year cap on board tenure. These are institutional-integrity measures aimed at the supervisor itself rather than at licensed entities directly, but they have downstream relevance for every bank and payment institution the FMA licenses, since they shape the independence and continuity of the authority that grants and reviews those licences.

The more operationally significant element for licensed credit institutions is the bill's new notification duty: credit institutions must notify the FMA before executing a transaction that qualifies as prudentially relevant, and the FMA must then assess that transaction for money-laundering and terrorist-financing risk before it is permitted to proceed. This is materially different from the periodic reporting obligations credit institutions are accustomed to; it inserts the supervisor into the transaction-execution chain at the point of decision for a defined category of prudentially significant activity. The precise scope of what counts as prudentially relevant is not established on the evidence available this cycle, and firms will need the Nationalrat's final text, or subsequent FMA guidance, to determine which transactions trigger the duty in practice.

This legislative activity sits on top of an already-consolidated institutional structure. Since 1 January 2026, the FMA has held consolidated supervision and enforcement of national and EU/UN financial sanctions, a mandate absorbed from the Oesterreichische Nationalbank under the Sanktionengesetz 2024. That consolidated mandate extends across banks and insurers to payment institutions, e-money institutions and crypto-asset service providers. The practical effect is that the same authority responsible for sanctions screening across the payments sector will, once the CRD VI bill is enacted, also receive advance notice of prudentially relevant transactions from credit institutions specifically. For banks operating in Austria, this concentrates two related but distinct compliance touchpoints, sanctions screening and prudential transaction notification, within a single supervisory authority, which may in principle streamline cross-referencing between the two functions, though no evidence located this cycle describes how such integration would operate mechanically.

For non-bank payment institutions and e-money institutions, the direct impact of the CRD VI bill is more limited on current evidence: the pre-transaction notification duty as described applies to credit institutions, and no equivalent duty for non-bank payment service providers has been identified in the sources reviewed this cycle. Non-bank licensees should nonetheless track the FMA's broader institutional-independence reforms, since governance changes at the supervisor level can affect licensing-review timelines, supervisory priorities, and the character of ongoing dialogue with the authority across all licence types the FMA administers, not solely credit institutions.

The bill has not yet reached the Nationalrat floor, so its provisions remain prospective rather than in force. The committee vote itself, however, is a strong signal of likely passage: the measure proceeded through the Finanzausschuss alongside a related beneficial-ownership-register novelle on the same date, indicating a coordinated legislative push on institutional-integrity measures this autumn.

Outlook

The FMA-independence bill now moves to the Nationalrat, where enactment would bring both the board-governance reforms and the credit-institution notification duty into force. Firms should watch for the Nationalrat's final text to clarify the prudential-relevance threshold that triggers the new notification duty, since that threshold determines the operational burden the measure will impose on affected credit institutions. Given the consolidated sanctions-supervision mandate the FMA already holds across the broader payments sector, the direction of travel is toward a single supervisory authority with an increasingly integrated view of both sanctions exposure and prudential/AML risk across licensed entities, though the full operational contours of that integration remain to be clarified in subsequent legislative or guidance detail.

Periodic update · new data 2026-09-28

Licensing, Authorisation & Market Access

The FMA granted Bybit Payments GmbH a licence as an e-money institution under Section 3(1) in conjunction with Section 4(4) of the E-Geld Act 2010 on 4 August 2026. This authorisation is legally and functionally distinct from Bybit EU GmbH's separate MiCAR crypto-asset-service-provider authorisation, reflecting Austria's ZaDiG 2018 payments licensing architecture operating alongside, but separately from, the MiCAR crypto-licensing track.

The grant illustrates a market-access pattern in which crypto-native firms increasingly pursue dual FMA authorisations, pairing a MiCAR CASP licence for crypto-asset activity with a ZaDiG/E-GeldG payment or e-money institution licence for fiat rails. This dual-track approach brings both sides of a crypto-native firm's business onto Austrian-licensed infrastructure, with the FMA acting as the single supervisory point of contact across both authorisation tracks.

Austria's existing ZaDiG 2018 licensing architecture, which supports EEA-wide passporting for payment and e-money institutions, provides the underlying legal basis for this licensing activity. The Bybit Payments GmbH grant is a confirmed, high-tier-sourced market-access event evidencing this architecture in active operation.

Outlook

Whether additional crypto-native firms pursue the same dual-authorisation pattern — a MiCAR CASP licence paired with a ZaDiG/E-GeldG payments licence — is the key market-access signal to track. Continued growth in this pattern would confirm Austria's positioning as a jurisdiction where crypto and payments licensing regimes are converging under unified FMA supervision.

Periodic update · new data 2026-09-08

Licensing, Authorisation & Market Access

Austrian payment institutions are authorised and supervised by the FMA under ZaDiG 2018, the national transposition of PSD2, with EU-wide passporting rights. This remains the operative authorisation framework as of this cycle, confirmed at Probable confidence from a Tier 4 vendor summary. The more significant development is at the EU level: the PSD3/PSR legislative package reached provisional political agreement on 27 November 2025, and would, once transposed nationally, consolidate payment-institution and e-money-institution authorisation under a single supervisory framework. National transposition is expected across 2026-2027, meaning Austrian PIs and EMIs currently operating under ZaDiG 2018 should anticipate a framework transition within this window, though the primary EU legislative text and any FMA-specific transposition guidance were not independently re-verified this cycle — this detail rests on a single Tier 4 source and is held at Probable confidence pending stronger corroboration.

Carrying the bank-PSP versus non-bank payment-institution/e-money-institution distinction explicitly: both bank and non-bank payment institutions in Austria currently operate under the same ZaDiG 2018 authorisation framework, and both categories fall within scope of the PSD3/PSR consolidation once transposed, per this cycle's evidence.

Outlook

The key marker to watch is confirmation of Austria's specific PSD3/PSR transposition timeline and mechanism, ideally sourced directly from the FMA or from the EU legislative text rather than from vendor commentary. Given the provisional political agreement dates from November 2025 and transposition is expected across 2026-2027, this cycle sits early in that transposition window; expect firmer, higher-tier sourcing to become available as national implementing measures are published.

Sources and findings (6)

T1https://www.fma.gv.at/en/financial-service-providers/payment-institutions/licencing-and-registration-of-payment-services/retrieved 2026-07-04
T1https://www.fma.gv.at/en/financial-service-providers/payment-institutions/retrieved 2026-07-04
T1https://www.fma.gv.at/en/banks/licensing-notification/retrieved 2026-07-04
T3https://vlolawfirm.com/tpost/austria-banking-financeretrieved 2026-07-04
T1https://www.fma.gv.at/en/fma-takes-over-casp-supervision-in-austria/retrieved 2026-07-04
T1https://www.fma.gv.at/en/financial-service-providers/payment-institutions/services-exempted-from-the-scope-of-zadig-2018/retrieved 2026-07-04

#

Safeguarding of payment-service-user and e-money-holder funds is anchored in ZaDiG 2018 Art.18/19 and the E-GeldG 2010. Conduct supervision of banks, payment institutions and e-money institutions has been centralised since 2025 in a dedicated FMA division alongside IT-risk (DORA) oversight. Consumer-facing distance-sales conduct is layered on via the Distance Financial Services Act (FernFinG), with FMA acting only for collective consumer protection, not individual redress.

Standing sub-brief · as of 4 July 2026222 words · last cycle 2026-10-18

Conduct, Safeguarding & Financial Promotions

Austrian payment and e-money institutions carry safeguarding obligations as a condition of their FMA licence rather than as a freestanding rulebook. ZaDiG 2018 Article 18 requires safeguarding of payment-service-user funds, with organisational and due-diligence conditions under Article 20 and outsourcing conditions under Article 21 attached directly to the licence. In 2025 the FMA centralised a dedicated Conduct and IT Risk Supervision division, covering DORA oversight for banks, payment institutions and e-money institutions, and from April 2025 extending to conduct supervision of credit servicers under the KKG. Litigation has sharpened the safeguarding picture on the e-money side: in OGH 4 Ob 207/22b the Supreme Court held that clauses causing gradual erosion of prepaid and voucher-card balances are subject to full content review and violate E-GeldG sections 18 and 19, which permit redemption fees only where proportionate to actual costs. On the distance-sales side, the Distance Financial Services Act (FernFinG) generally grants a fourteen-day right of cancellation for distance-sold banking, payment and insurance products, though carve-outs apply to certain foreign-exchange and payment-adjacent products.

Periodic update · new data 2026-10-18

Conduct, Safeguarding & Financial Promotions

The FMA issued two unauthorised-provider warnings in close succession this reporting period, each addressing a different licensable activity but both consistent with the regulator's standing enforcement posture against cross-border providers operating in Austria without the required authorisation. On 9 October 2026 the FMA found Vantex Bank unauthorised to conduct licensable banking business, specifically deposit-taking and lending activity, in Austria. Notably, Germany's BaFin issued a parallel warning against the same entity on the same day, indicating either a coordinated cross-border solicitation campaign by Vantex Bank targeting both the German and Austrian markets, or close supervisory coordination between the two regulators in response to a shared concern.

Three days later, on 12 October 2026, the FMA published a second warning, this time against Bull Trade24 Ltd, an entity claiming a London registration, finding it unauthorised to execute client orders in Austria. This warning rests on section 3(2)(6) of the Wertpapieraufsichtsgesetz 2018 (WAG 2018), the specific provision governing the authorisation requirement for execution of client orders, distinct from the deposit-taking and lending authorisation at issue in the Vantex Bank matter. Publication of the warning is grounded in section 92(11) WAG 2018, the FMA's standing statutory basis for naming unauthorised providers in public warnings.

The two warnings, while addressing distinct licensable activities, both correctly fall under the Bull Trade24 and Vantex Bank pattern of foreign-registration claims paired with an absence of the corresponding Austrian authorisation. Bull Trade24's claimed London registration and Vantex Bank's apparent cross-border reach into both the German and Austrian markets both illustrate a recurring conduct-risk typology: entities claim or imply foreign regulatory standing, whether through a claimed home-jurisdiction registration or an implied banking charter, while in fact holding no authorisation to provide the specific regulated activity to Austrian clients. The FMA's response in both cases, a public warning citing the specific statutory basis for the authorisation gap, is the standard tool available to the regulator; it does not, by itself, prevent continued solicitation of Austrian clients from outside the jurisdiction's direct enforcement reach, which remains a structural limitation on this form of conduct enforcement regardless of how promptly or clearly the warning is issued.

No further Austria-specific conduct, safeguarding, or financial-promotions development was identified this cycle beyond these two warnings. The pattern is consistent with the FMA's routine, well-resourced enforcement activity under WAG 2018 against unauthorised providers rather than any shift in the underlying conduct or safeguarding regulatory framework itself.

Outlook

The FMA's issuance of two unauthorised-provider warnings within a single week is consistent with routine enforcement throughput rather than a signal of escalating risk in the Austrian payments and investment-services market specifically. The coordination evident in the Vantex Bank matter, where BaFin issued a matching warning the same day, is worth monitoring: if further instances of same-day coordinated warnings between the FMA and other EU national regulators emerge in subsequent cycles, this would suggest a more structured cross-border supervisory cooperation mechanism is in active use against entities soliciting across multiple EU markets simultaneously, rather than coincidental parallel discovery by separate regulators.

Sources and findings (5)

T1https://fma.gv.at/wp-content/plugins/dw-fma/download.php?d=3569retrieved 2026-07-04
T1https://www.fma.gv.at/en/banks/conduct-and-it-risk-supervision-of-banks/retrieved 2026-07-04
T2https://www.unger-rechtsanwaelte.at/en/news/detail/supreme-court-decision-on-voucher-cards-value-cards-ogh-4-ob-207-22bretrieved 2026-07-04
T2https://finanznavi.gv.at/en/topics/consumer-protection/financial-advice-and-consumer-protectionretrieved 2026-07-04
T1https://www.fma.gv.at/en/the-latest-edition-of-the-fmas-consumer-information-series-lets-talk-about-money-explains-how-complaints-about-financial-service-providers-can-be-solved-quickly-and-satisfactorily/retrieved 2026-07-04

#

Austria's digital-money regime combines the long-standing E-Geld Gesetz 2010 for traditional e-money with MiCAR, now fully in force for crypto-asset service providers and issuers (including stablecoin EMTs/ARTs) with the FMA as competent authority. Uptake remains modest but growing, and domestic crypto/stablecoin players (notably Bitpanda) are extending into MiCA-compliant stablecoin distribution.

Standing sub-brief · as of 4 July 2026212 words · last cycle 2026-10-11

Stablecoins & Digital Money

MiCAR is now the dominant framework shaping Austria's digital-money perimeter, layered on top of the existing E-GeldG e-money regime. The FMA became Austria's designated competent authority under the national MiCAR implementing legislation from 30 December 2024, covering CASP authorisation and supervision, issuer transparency obligations, and investor and market-abuse protection. WB-Shield Innovations GmbH became one of Austria's first crypto-asset service providers to be authorised under MiCAR Article 63, an early marker of how the new authorisation track is bedding in. Underlying retail demand looks modest but non-trivial: an OeNB study found around 3% of the Austrian population holds crypto-assets, typically a few thousand euro each and skewed toward young males, while roughly 300,000 customers were registered with just two FM-GwG-registered VASPs ahead of MiCAR's introduction in 2023. On the commercial side, domestic exchange Bitpanda joined the Global Dollar Network in February 2026, bringing MiCA-compliant USDG stablecoin distribution to European markets and giving Austria a visible foothold in the emerging regulated-stablecoin distribution layer.

Periodic update · new data 2026-10-11

Stablecoins & Digital Money

Austria's stablecoin and digital-money supervisory posture showed escalating signal this cycle, anchored by two developments. First, the FMA published guidance reflecting ESMA's supervisory expectations regarding services related to non-MiCAR-compliant stablecoins and setting out how the FMA will implement those expectations in its own supervisory practice. The guidance is dated on or shortly before 6 October 2026 per the FMA's own homepage listing, though the exact publication date and the underlying ESMA document reference were not independently confirmed beyond that listing. The guidance matters because MiCA's stablecoin provisions (Titles III-IV) create a compliant category of asset-referenced and e-money tokens, and the existence of targeted supervisory guidance on non-compliant stablecoins signals that the FMA is actively policing the boundary between compliant and non-compliant stablecoin-adjacent activity rather than treating MiCA authorisation as the end of its stablecoin-related supervisory interest.

Second, Bybit Payments GmbH was granted an Austrian electronic-money-institution licence on 4 August 2026, under Article 3(1) in conjunction with Article 4(4) of the E-Geldgesetz 2010. Notably, this EMI licence is structured as a legally separate entity from Bybit EU GmbH's existing MiCA crypto-asset-service-provider (CASP) authorisation. This dual-entity, dual-licence structuring is a pattern worth naming explicitly: a single corporate group operating a crypto-asset exchange obtains one Austrian authorisation for its crypto-asset-service activities under MiCA, and a separate Austrian authorisation under the E-Geldgesetz for e-money-type payment activities, held by a distinct legal entity. This separation may reflect prudential, capital or licensing-scope reasons for not seeking to cover both activity types under a single authorisation, and it is the kind of structuring choice that other payment-token-adjacent firms operating in Austria may also adopt.

Both developments sit against the backdrop of Austria's own national MiCA transitional window, which closed 30 December 2025 for firms previously registered under the FM-GwG. This is Austria's own deadline, distinct from the EU-wide 1 July 2026 backstop that some commentary conflates with national transitional arrangements. A firm that relied on Austrian FM-GwG registration and did not secure MiCA authorisation, or an alternative licence such as Bybit Payments' EMI route, by 30 December 2025 would, as of this cycle, already be operating outside its grandfathered window.

Outlook

The FMA's stablecoin guidance is the item most likely to generate near-term follow-on activity, since guidance aligned with ESMA's supervisory expectations typically precedes more concrete enforcement against identified non-compliant stablecoin activity rather than remaining purely advisory. The Bybit dual-licence structure is also worth watching as a template: if other crypto-exchange groups follow the same separation of EMI and CASP authorisations into distinct legal entities when operating in Austria, that would indicate the structure is being treated as a viable and replicable compliance pathway rather than a one-off arrangement specific to Bybit's own corporate structure.

Sources and findings (5)

T1https://www.fma.gv.at/en/fma-takes-over-casp-supervision-in-austria/retrieved 2026-07-04
T1https://www.fma.gv.at/en/retrieved 2026-07-04
T2https://ceelegalmatters.com/banking-2023/banking-austria-2023retrieved 2026-07-04
T1https://www.fma.gv.at/en/fma-takes-over-casp-supervision-in-austria/retrieved 2026-07-04
T3https://tracxn.com/d/companies/bitpanda/__1DgHSfoxIMYJDSnj0kEMyX7sE2CeMPg68Mvd9_9yqQgretrieved 2026-07-04

#

DORA (Regulation (EU) 2022/2554) has applied to Austrian payment institutions since 17 January 2025, embedding ICT risk-management, incident-reporting and third-party-register obligations into the FMA's supervisory file.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2029 (±multi_year)Potential digital-euro first issuance (contingent on legislation)proposed · TT1

Horizon · 2026 (±year)EU digital-euro enabling Regulation legislative adoption expectedproposed · TT1

Horizon · 2027-Q2 (±multi_year)Digital euro pilot could start (contingent on 2026 legislative adoption)proposed · TT1

Horizon · 2029 (±multi_year)Potential digital-euro first issuance (contingent on legislation)proposed · TT1

Standing sub-brief · as of 17 August 202684 words · last cycle 2026-10-04

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act (Reg (EU) 2022/2554) has applied to Austrian payment institutions since 17 January 2025. FMA guidance confirms that incident-reporting readiness and registers of ICT third-party providers are now live items on the supervisory file, an obligation that applies to both bank and non-bank payment institutions alike.

Periodic update · new data 2026-10-05

Operational Resilience & Critical Infrastructure

Austria's operational-resilience framework for critical-infrastructure entities, including payment-sector operators, changes materially on 1 October 2026, when the principal provisions of NISG 2026 enter into force. The new law replaces the NISG 2018 regime, Austria's prior transposition of the original NIS Directive, and establishes a new body, the Bundesamt fur Cybersicherheit, as the law's central coordinating authority. This authority is structured as independent and reports to the Interior Minister, a different institutional arrangement from the prior regime's split structure across the Federal Chancellery and the Interior Ministry for NIS2 purposes.

The practical consequence for in-scope entities is a registration obligation with a defined deadline: approximately 4,000 entities, a category that includes payment-sector operators, must register via the nis.gv.at portal within three months of the law's entry into force, giving a deadline of 31 December 2026. This registration requirement is the first concrete compliance action payment-sector entities in scope of NISG 2026 need to take, and it arrives on a relatively short timeline given the law's 1 October 2026 commencement date.

Importantly for payments-sector entities already subject to sector-specific supervision, NISG 2026 preserves the existing supervisory mandates of six sector regulators rather than consolidating all NIS2 supervisory authority into the new Bundesamt fur Cybersicherheit alone. This means that, for a payment institution already supervised on operational-resilience matters by its existing sector regulator, day-to-day NIS2 compliance oversight is likely to continue running through that familiar regulator, while the Bundesamt fur Cybersicherheit serves as the overarching coordinating and registration authority at the national level. The precise division of labour between the Bundesamt fur Cybersicherheit and the six sector regulators, for instance which body handles incident reporting intake versus which handles registration processing, is not established in detail on the evidence available this cycle.

This development should be read as distinct from, but running in parallel with, the FMA-independence and CRD VI transposition bill moving through the Nationalrat this same period. Where that bill concerns prudential governance and AML/CFT transaction-notification duties, NISG 2026 concerns a different compliance domain entirely, namely cybersecurity and critical-infrastructure resilience obligations. Payment-sector entities operating in Austria are therefore facing two separate but concurrent regulatory-tightening tracks this quarter: one prudential and AML-focused, the other operational-resilience and cybersecurity-focused.

The scale of the registration requirement, roughly 4,000 entities nationally, suggests NISG 2026's reach extends well beyond large financial institutions to a broad cross-section of critical and important entities as defined under the NIS2 framework Austria is transposing. Payment-sector operators will need to determine their own in-scope status under the law's sectoral criteria, a determination not detailed further in the sources reviewed this cycle, and register accordingly ahead of the year-end deadline.

Outlook

The immediate compliance milestone for in-scope entities, including payment-sector operators, is the 31 December 2026 registration deadline with the Bundesamt fur Cybersicherheit via nis.gv.at, following the law's 1 October 2026 entry into force. Entities should expect further operational detail from the new authority, and potentially from the six sector regulators whose existing NIS2 mandates NISG 2026 preserves, regarding incident-reporting mechanics and ongoing supervisory expectations once the registration phase concludes. The coexistence of a new overarching coordinating authority alongside continuing sector-regulator supervision is a structural feature of the new regime that payment-sector entities will need to navigate as the practical division of responsibilities becomes clearer in subsequent guidance.

2 earlier distinct update(s)

Periodic update · new data 2026-09-28

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act (DORA) has applied to Austrian payment institutions and e-money institutions since 17 January 2025. Within the FMA, Department I/6 (Abteilung I/6) holds responsibility for ICT-risk supervision of Less Significant Institutions, payment institutions and e-money institutions, giving the operational-resilience framework a defined internal supervisory home rather than distributed responsibility. The FMA has published sector guidance titled "Reden wir über Aufsicht Nr. 5," described as drawing on experience from supervisory practice on ICT risk management under DORA — evidence that the framework has moved into active, guidance-generating implementation rather than remaining a newly-transposed rule awaiting first application.

A second operational-resilience development concerns payment-fraud controls at the transaction-rail level: since 9 October 2025, IBAN-name checking has been mandatory for SEPA Instant transfers under the Instant Payments Regulation. This requirement is set to extend to all payment transfer rails ahead of 2027, meaning the current SEPA-Instant-specific control is a precursor to a broader, cross-rail resilience and fraud-prevention requirement.

Taken together, these two developments show Austrian payment and e-money institutions operating under an increasingly mature and increasingly broad operational-resilience supervisory regime, spanning both ICT-risk management under DORA and transaction-level integrity controls under the Instant Payments Regulation.

Outlook

The scheduled extension of IBAN-name checking to all transfer rails ahead of 2027 is a defined near-term implementation milestone. Continued FMA guidance output under DORA, following the pattern set by "Reden wir über Aufsicht Nr. 5," is a further marker of the operational-resilience framework's maturing supervisory practice for Austrian payment and e-money institutions.

Periodic update · new data 2026-09-08

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act's obligations on operational-resilience standards and ICT-incident reporting have applied to Austrian payment institutions since 17 January 2025, per a Tier 4-sourced summary held at Probable confidence. This is confirmed this cycle as remaining a live supervisory file item rather than a settled, closed obligation: DORA compliance is an ongoing operational posture for Austrian PIs, not a one-time authorisation event, and it applies across both bank and non-bank payment institutions and e-money institutions operating in Austria.

No AT-specific DORA enforcement action, supervisory finding, or incident-reporting statistic was identified in sources reviewed this cycle; the finding here is limited to confirmation of continued applicability of the obligation itself.

Outlook

As DORA moves from its January 2025 applicability date into an established supervisory routine, watch for FMA supervisory statements, incident-reporting statistics, or any enforcement action specific to Austrian payment institutions that would upgrade this module's currently thin, single-source evidentiary basis.

Sources and findings (5)

T3https://vlolawfirm.com/tpost/austria-banking-financeretrieved 2026-07-04
T1https://www.fma.gv.at/wp-content/plugins/dw-fma/download.php?d=2144&nonce=279fcff0daaf52c9 Applies beyond this jurisdiction (EU)retrieved 2026-07-04
T1https://www.fma.gv.at/en/banks/conduct-and-it-risk-supervision-of-banks/retrieved 2026-07-04
T2https://www.cerhahempel.com/fileadmin/docs/publications/Knobl/Banking_Regulation_in_Austria_Overview.pdfretrieved 2026-07-04
T1https://www.globallegalinsights.com/practice-areas/banking-and-finance-laws-and-regulations/austria/retrieved 2026-07-04

#

Instant credit transfers in euro became mandatory across the EEA under Regulation (EU) 2024/886, with phased compliance deadlines from 9 January 2025 through 9 June 2028. Austrian PSPs must offer 24/7/365 instant SEPA credit transfers within 10 seconds, may not surcharge them relative to standard transfers, must run IBAN/name Verification-of-Payee checks, and must screen instant transfers against sanctions lists at least once daily; PSPs report annually to the OeNB on pricing and refused-payment statistics.

Standing sub-brief · as of 4 July 2026164 words · last cycle 2026-09-14

Scheme & Network Compliance

Austrian card-scheme compliance rests on the directly-applicable EU Interchange Fee Regulation 2015/751, which caps interchange at 0.3% for credit and 0.2% for debit four-party scheme transactions and prohibits territorial licensing restrictions, binding on Austria as an EU member state without any need for domestic transposition. Layered on top are PCI DSS obligations and scheme rulebook requirements enforced through acquirers rather than directly by the FMA. On the market side, Concardis and Worldline are named among Austria's major acquirers alongside domestic banks, and contactless is reported at 82% of card transactions, though this market-structure figure comes from a single T3 market-data source. No Austria-specific interchange or scheme-rule enforcement action or infringement decision was identified this cycle.

Periodic update · new data 2026-09-08

Scheme & Network Compliance

The EU Instant Payments Regulation (Regulation (EU) 2024/886) is fully in force for Austrian payment service providers this cycle, and this is the best-evidenced development in the entire Austrian payments file: two independent Tier 1 sources — the FMA and the EUR-Lex primary legislative text — corroborate the core obligation. Austrian PSPs must execute 24/7/365 instant SEPA credit transfers within ten seconds, with no surcharge relative to standard transfers, per FMA guidance. Verification of Payee checks are mandatory, and PSPs may run instant-transfer sanctions-list screening at a minimum daily frequency rather than per-transaction, alongside a new annual reporting obligation to the Oesterreichische Nationalbank on price developments and refused payments — both confirmed at Tier 1 from the FMA's own primary guidance.

Regulation (EU) 2024/886 amends Regulations (EU) 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and 2015/2366, and entered into force twenty days after its Official Journal publication. It carries phased PSP compliance deadlines that run through 9 June 2028, meaning the current live obligations for Austrian PSPs — transfer speed, VoP checks, sanctions-screening frequency, and OeNB reporting — are the first tranche of a longer implementation runway, with further phased deadlines still to come over the next two years. This module carries the bank-versus-non-bank distinction explicitly: the Instant Payments Regulation's obligations, including the sanctions-screening frequency flexibility and the OeNB reporting duty, apply uniformly to bank and non-bank PSPs operating in Austria, per FMA guidance.

Outlook

The clearest forward marker is the phased compliance schedule running through 9 June 2028 under Regulation (EU) 2024/886. Each subsequent phase deadline is a concrete point at which additional Austrian PSP obligations will crystallise; monitor FMA guidance updates as each phase approaches for AT-specific implementation detail.

Sources and findings (4)

T1https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751 Applies beyond this jurisdiction (EU)retrieved 2026-07-04
T1https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751retrieved 2026-07-04
T3https://interchangefeeseu.com/countries/interchange-fees-in-austriaretrieved 2026-07-04
T3https://www.pxp.io/payments-glossary/card-scheme-rulesretrieved 2026-07-04

#

Austria's core corridor is intra-SEPA, now fully instant-payments-enabled following the EU Instant Payments Regulation (2024/886), with PSA operating national instant-payment routing and Verification of Payee services connected to the ECB's TIPS settlement layer. A secondary Alpine mobile-wallet corridor (Bluecode-TWINT via Banking Circle) has emerged, while non-SEPA corridors (notably Austria-US) remain correspondent-banking-dependent with materially slower, costlier settlement.

Standing sub-brief · as of 17 August 2026126 words · last cycle 2026-08-17

Payment Corridor Dynamics

Instant payments became compulsory across the EEA from 2025, with transfers executing in under ten seconds, twenty-four hours a day, seven days a week, and an automatic IBAN-payee check. FMA guidance clarifies that payment service providers need only screen instant transfers against sanctions lists at least once daily, a reduced cadence relative to the prior expectation of real-time screening. Payment service providers must also submit a report to the OeNB every twelve months covering price developments and payments refused under Reg (EU) 2024/886.

no periodic updates on record for this sub-brief

Sources and findings (6)

T1https://www.oenb.at/en/Payment-Processing/cashless-payments/SEPA.htmlretrieved 2026-07-04
T1https://www.oenb.at/en/Payment-Processing/cashless-payments/SEPA-Payment-Instruments/sepa-instant-credit-transfer.htmlretrieved 2026-07-04
T1https://www.psa.at/en/payment-servicesretrieved 2026-07-04
T1https://www.ecb.europa.eu/paym/retail/instant_payments/html/index.en.htmlretrieved 2026-07-04
T2https://ffnews.com/newsarticle/banking-circle-supports-bluecode-and-twint-powering-interoperability-between-national-mobile-payment-systems/retrieved 2026-07-04
T3https://www.lightspark.com/knowledge/austria-instant-paymentsretrieved 2026-07-04

#

Austria's payments industry remains bank-centric (Erste Group, Raiffeisen Bank International, UniCredit Bank Austria dominate rails and infrastructure) but is increasingly overlaid with a fintech layer of roughly 200-300 firms spanning payments, wealthtech, regtech and blockchain, many using Austria as a base for CEE expansion. Digital-only entrants (Revolut) and bank-launched wallets (RaiPay) compete alongside BNPL providers, against a backdrop of a sharply cooling 2025 domestic startup-funding environment.

Standing sub-brief · as of 4 July 2026185 words · last cycle 2026-07-04

Industry Structure & Commercial Dynamics

Austria's payments industry remains a bank-fintech hybrid. An estimated 200-plus firms operate across payments, digital banking, wealthtech, regtech and blockchain, with many using Austria as a base for wider central and eastern European expansion. Digital-first entrants have made visible inroads into a market historically dominated by Erste, Raiffeisen and UniCredit Bank Austria: Revolut began operating as a licensed bank in Austria in October 2021, offering euro-denominated accounts, debit cards and P2P payments, while Raiffeisen Bank responded with its own RaiPay mobile wallet in March 2023. That competitive dynamic sits against a sharply cooling funding backdrop: Austrian startups raised just EUR253 million in 2025 according to EY's Barometer, down 56% year on year to the lowest annual total since 2019, with no individual round exceeding EUR50 million.

no periodic updates on record for this sub-brief

Sources and findings (6)

T3https://thefintechtimes.com/the-fintech-and-wider-digital-landscape-of-austria-in-2026/retrieved 2026-07-04
T3https://thefintechtimes.com/the-fintech-and-wider-digital-landscape-of-austria-in-2026/retrieved 2026-07-04
T3https://www.researchandmarkets.com/reports/5614912/austria-cards-and-payments-opportunities-and
T3https://techfundingnews.com/austria-vc-253m-2025-late-stage-slowdown/retrieved 2026-07-04
T3https://www.globaldata.com/store/report/austria-cards-and-payments-market-analysis/retrieved 2026-07-04
T1https://grokipedia.com/page/financial_market_authority_austriaretrieved 2026-07-04

#

Austrian payments-adjacent litigation in the current cycle centres on the Supreme Court's (OGH) reversal of long-standing precedent on bank fee clauses, driven by ECJ case law, alongside an e-money-specific ruling on prepaid/voucher card redemption fees. Separately, the FMA's sanctions-enforcement mandate expanded sharply from 1 January 2026, creating a new administrative-penalty exposure line for payment institutions and CASPs.

Standing sub-brief · as of 4 July 2026174 words · last cycle 2026-07-04

Legal & Litigation

Austrian courts delivered two consequential reversals on bank fee structures in 2025. In OGH 7 Ob 169/24i, decided 19 February 2025, the Supreme Court reversed its own 2016 precedent and held percentage-based loan-processing fees in standard bank terms and conditions to be grossly disadvantageous and inadmissible, following the ECJ's Caixabank line of rulings. The Court reinforced this in OGH 2 Ob 52/25y, decided 23 October 2025, ordering a bank to repay processing fees found to grossly exceed its actual expected costs. Separately, from 1 January 2026 FMA sanctions supervision expands to cover all Austrian financial market participants, including payment institutions, investment firms, AIFMs, insurers and crypto-asset service providers, under the SanktG 2024 sanctions law, with the possibility that penalties may be published naming the sanctioned entity.

no periodic updates on record for this sub-brief

Sources and findings (5)

T2https://www.dlapiper.com/en-us/insights/publications/2025/05/coup-de-theatre-the-austrian-supreme-court-s-180-degree-shift-on-loan-processing-feesretrieved 2026-07-04
T2https://www.unger-rechtsanwaelte.at/en/news/detail/refund-of-excessive-loan-processing-fees-ogh-23102025-2-ob-52-25yretrieved 2026-07-04
T2https://www.unger-rechtsanwaelte.at/en/news/detail/supreme-court-decision-on-voucher-cards-value-cards-ogh-4-ob-207-22bretrieved 2026-07-04
T2https://www.mondaq.com/austria/financial-services/1799420/austria-centralises-financial-sanctions-oversight-fma-assumes-new-powers-in-2026retrieved 2026-07-04
T1https://www.globallegalinsights.com/practice-areas/banking-and-finance-laws-and-regulations/austria/retrieved 2026-07-04

#

Austrian merchant acquiring operates within the EU's directly-applicable interchange and unbundled-pricing rules, with Concardis and Worldline named among the acquirers active alongside domestic banks. Dispute exposure is shaped by SEPA Direct Debit's consumer-friendly eight-week refund right and by PSD2 SCA requirements; European acquirer consolidation (Worldline-SIX, Nexi-Nets/SIA) forms the competitive backdrop, though no Austria-specific high-risk-MCC instrument was identified.

Standing sub-brief · as of 4 July 2026136 words · last cycle 2026-07-04

Merchant Acquiring & Risk

Austrian merchant acquiring operates within the EU's interchange and unbundled-pricing framework rather than any Austria-specific acquiring rulebook. The SEPA Direct Debit scheme gives Austrian and euro-area consumers an eight-week no-questions-asked refund right, structurally raising merchant chargeback and dispute exposure relative to card rails. The acquiring landscape itself has been reshaped by European consolidation: Worldline acquired SIX Payment Services, Bambora and Ingenico, while Nexi Payments acquired Nets and SIA, narrowing the set of independent acquirer options available to Austrian merchants. No Austria-specific high-risk-merchant-category-code regulatory instrument was identified beyond generic EU and scheme acquiring practice.

no periodic updates on record for this sub-brief

Sources and findings (5)

T3https://interchangefeeseu.com/countries/interchange-fees-in-austriaretrieved 2026-07-04
T1https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751retrieved 2026-07-04
T3https://gr4vy.com/posts/how-european-merchants-can-reduce-chargebacks-and-protect-revenue-in-2026/retrieved 2026-07-04
T3https://gr4vy.com/posts/how-european-merchants-can-reduce-chargebacks-and-protect-revenue-in-2026/retrieved 2026-07-04
T3https://www.ixopay.com/blog/payment-service-providers-and-the-difficult-choices-merchantsretrieved 2026-07-04

#

Product innovation in Austria is concentrated in instant-payments/Verification-of-Payee rollout, PSD2 open banking (led early by UniCredit Bank Austria), the FMA's 2020 regulatory sandbox, and the ECB's digital-euro preparation phase. Domestic crypto-native player Bitpanda is the standout product-innovation story, extending from crypto into regulated securities trading ahead of a planned IPO.

Standing sub-brief · as of 4 July 2026155 words · last cycle 2026-09-21

Product Innovation & Market Development

Product innovation in Austria concentrates around instant-payments infrastructure, open banking and a small but growing regulated-securities push from crypto-native players. The FMA introduced a regulatory sandbox in 2020, giving fintech companies a controlled way to test new product ideas before full licensing. The standout product story this cycle is Bitpanda, which launched stock and ETF trading covering roughly 8,000 stocks and 2,500 ETFs from 29 January 2026, integrated into its existing crypto and metals app under its EEA and UK licences. On the open-banking side, Unzer and Mastercard formed a partnership in November 2024 to enhance open-banking-based account-to-account payments across Austria, Germany and Denmark.

Periodic update · new data 2026-09-28

Product Innovation & Market Development

Crypto-native firms operating in Austria are increasingly acquiring dual FMA authorisations — a MiCAR crypto-asset-service-provider licence alongside a ZaDiG/E-GeldG payment-institution or e-money-institution licence — as a route to bring fiat payment rails onto Austrian-licensed platforms alongside their crypto-asset activity. Bybit's structure illustrates this pattern directly: Bybit Payments GmbH received an e-money-institution licence on 4 August 2026, complementing Bybit EU GmbH's separate MiCAR CASP authorisation.

This product-development pattern reflects a broader market logic in which crypto-native firms find commercial advantage in operating both fiat and crypto-asset rails under authorisations from the same national supervisor, rather than relying on a crypto-only licence and third-party payment-rail partnerships. The FMA's dual role as supervisor for both MiCAR CASP authorisation and ZaDiG/E-GeldG payments authorisation positions Austria as a jurisdiction where this kind of vertically-integrated licensing structure is achievable under a single regulatory relationship.

This is a market-development and industry-structure signal distinct from any single firm's individual product launch; the pattern itself, of dual crypto-and-payments authorisation-seeking, is the substantive market-development finding this cycle.

Outlook

The key indicator to watch is whether additional crypto-native firms beyond Bybit adopt the same dual-authorisation approach in Austria. A growing pattern would confirm this as an established market-development trend rather than a single-firm strategic choice, with implications for how other jurisdictions' crypto-native firms might view Austria's licensing environment.

Sources and findings (6)

T3https://noda.live/articles/open-banking-in-austriaretrieved 2026-07-04
T3https://www.yapily.com/blog/open-banking-austria-instant-paymentsretrieved 2026-07-04
T1https://www.psa.at/en/payment-servicesretrieved 2026-07-04
T2https://www.cerhahempel.com/fileadmin/docs/publications/Knobl/Banking_Regulation_in_Austria_Overview.pdfretrieved 2026-07-04
T3https://www.trendingtopics.eu/bitpanda-launches-stock-and-etf-trading-expanding-beyond-crypto-assets/retrieved 2026-07-04
T3https://www.globaldata.com/store/report/austria-cards-and-payments-market-analysis/retrieved 2026-07-04

#

Consumer protection for Austrian payments is split between the FMA (financial-product complaints, collective protection only) and the BMASGPK/VKI (general consumer law, representative actions). Fraud-prevention has been strengthened structurally via mandatory Verification of Payee under the Instant Payments Regulation, while the FMA runs an active public-facing fraud-warning programme and names 'bolstering collective consumer protection against investment fraud' among its 2025/2026 supervisory priorities.

Standing sub-brief · as of 4 July 2026174 words · last cycle 2026-07-04

Consumer Protection & APP Fraud

Austrian consumer protection in payments is structurally split between collective and individual redress. The FMA cannot obtain individual redress for complainants; it refers them instead to alternative-dispute-resolution bodies such as the Joint Conciliation Board and the customer ombud, and acts only for collective consumer protection. Fraud prevention has been strengthened at the EU level: Verification of Payee became mandatory under the Instant Payments Regulation for SEPA credit transfers and instant credit transfers from 9 October 2025, designed to prevent misdirected transfers and detect fraudulent payment attempts early across the Eurosystem. The FMA's 2025 supervisory priorities explicitly name bolstering collective consumer protection against investment fraud, alongside DORA and MiCAR implementation and sanctions-oversight strengthening.

no periodic updates on record for this sub-brief

Sources and findings (6)

T1https://www.fma.gv.at/en/complaints-and-points-of-contact/retrieved 2026-07-04
T2https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/austria Applies beyond this jurisdiction (EU)retrieved 2026-07-04
T1https://www.fma.gv.at/en/spotting-financial-fraudsters/the-latest-tricks-being-used-by-financial-fraudsters/retrieved 2026-07-04
T1https://www.ecb.europa.eu/paym/retail/instant_payments/html/instant_payments_regulation.en.htmlretrieved 2026-07-04
T2https://finanznavi.gv.at/en/topics/consumer-protection/protection-against-financial-fraudretrieved 2026-07-04
T1https://grokipedia.com/page/financial_market_authority_austriaretrieved 2026-07-04

#

Sentinel-fed payments-context position: Austria's AML/CFT architecture rests on the FM-GwG (FMA as competent supervisor for credit/financial institutions, payment institutions, EMIs, CASPs, AIFMs, insurers), with the FIU housed at the Criminal Intelligence Service Austria. The Sanctions Act 2024 (SanktG 2024) transferred sanctions monitoring/enforcement from the OeNB to the FMA effective 1 January 2026, extending scope to all obliged entities partly in response to FATF evaluation findings; EU Travel Rule obligations apply to CASPs.

Standing sub-brief · as of 4 July 2026200 words · last cycle 2026-07-04

AML/CFT & Financial Crime

This module carries Sentinel.gi's payments-context AML/CFT surface for Austria rather than original illicit-finance analysis; readers seeking substantive illicit-finance assessment should consult the Sentinel feed and the Financial Intelligence Monitor directly. Per that feed, the FM-GwG designates the FMA as AML/CFT competent authority for credit and financial institutions, payment institutions, e-money institutions, AIFMs, insurers, and pension and severance funds under the BWG. Effective 1 January 2026, the SanktG 2024 sanctions law transferred sanctions monitoring and enforcement from the OeNB to the FMA, extending scope beyond credit and payment institutions to crypto-asset service providers, investment firms, AIFMs and insurers, a change that responds in part to FATF effectiveness-evaluation findings. Austrian crypto-asset service providers must also comply with the EU Transfer of Funds/Travel Rule Regulation (2023/1113), clarified by EBA Travel Rule Guidelines (EBA/GL/2024/11), including originator and beneficiary information requirements for transfers involving self-hosted wallets.

no periodic updates on record for this sub-brief

Sources and findings (7)

T1https://www.globallegalinsights.com/practice-areas/banking-and-finance-laws-and-regulations/austria/retrieved 2026-07-04
T?FIM (sentinel.gi) per-JID baseline profile — Austria — Austria's AML/CFT/CPF regime rests on the FMA (financial supervision), the police-based A-FIU, and the WiEReG beneficial-ownership register. The FATF's April 2026 5th-round MER found clear progress on BO transparency and supervision but placed Austria in enhanced follow-up over FIU resourcing, restrictive ML-offence interpretation, weak asset recovery, and fragmented DNFBP supervision.
T2FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004) — Enforcement: Austrian Supreme Court (Oberster Gerichtshof) — Rene Benko
T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: enforcement-absence
T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: capacity-deficit
T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: political-constraint
T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness

#

Domestic payment-system oversight sits with the OeNB until 1 January 2026 when it transfers to the FMA alongside sanctions competence. TARGET2/T2 remains the euro settlement backbone underpinning TIPS instant settlement, with the Settlement Finality Act and ZaDiG's bank-access provisions forming the domestic legal plumbing; non-SEPA corridors such as Austria-US remain correspondent-banking dependent.

Standing sub-brief · as of 4 July 2026185 words · last cycle 2026-07-04

Correspondent Banking, Settlement & Access

Correspondent banking and settlement access in Austria sits on a domestic legal architecture that is itself changing. Effective 1 January 2026, oversight of Austria's payment systems transfers from the OeNB to the FMA, alongside the sanctions-monitoring transfer covered in W11. On bank access, ZaDiG 2018 Article 6 obliges credit institutions to provide payment-account access to payment institutions on an objective, non-discriminatory and proportionate basis, and requires a credit institution to notify the FMA in writing with justification if it refuses access, an explicit domestic anti-de-risking safeguard for non-bank payment firms. On settlement architecture, all cash settling euro transactions in the ECB's TARGET Instant Payment Settlement system is drawn from TARGET2/T2 accounts, and TIPS accounts opened by the OeNB for Austria remain within the T2 legal perimeter.

no periodic updates on record for this sub-brief

Sources and findings (5)

T2https://www.cerhahempel.com/fileadmin/docs/publications/Knobl/Banking_Regulation_in_Austria_Overview.pdfretrieved 2026-07-04
T1https://www.ecb.europa.eu/paym/target/target-professional-use-documents-links/tips/shared/pdf/TIPS_UHB_v.2.1.1_191025_rev.pdfretrieved 2026-07-04
T1https://fma.gv.at/wp-content/plugins/dw-fma/download.php?d=3569 Applies beyond this jurisdiction (EU)retrieved 2026-07-04
T1https://fma.gv.at/wp-content/plugins/dw-fma/download.php?d=3569 Applies beyond this jurisdiction (EU)retrieved 2026-07-04
T3https://www.lightspark.com/knowledge/austria-instant-payments Applies beyond this jurisdiction (EU)retrieved 2026-07-04

#

Trailing-12-month Austrian payments commercial activity is dominated by Bitpanda's build-out ahead of a planned Frankfurt IPO (stock/ETF product launch, Bitpanda Enterprise B2B platform, Global Dollar Network stablecoin distribution, Deutsche Börse cooperation), set against a broader Austrian startup-funding contraction in 2025.

Standing sub-brief · as of 4 July 2026306 words · last cycle 2026-10-18

Commercial Intelligence (M&A, Investment & Product)

Bitpanda is the dominant Austrian commercial story this cycle, with a cluster of announced and completed events ahead of a planned Frankfurt listing. Bitpanda reported EUR371 million (roughly USD430 million) in adjusted 2025 revenue, up 16% year on year, with 7.4 million registered users, up 25%, and is preparing a potential Frankfurt IPO for the first half of 2026 targeting a EUR4-5 billion valuation. On the product side, Bitpanda launched 'Bitpanda Enterprise', a business-to-business platform offering crypto infrastructure, custody and tokenization services for banks and fintechs, as part of its global-expansion strategy ahead of the planned listing; deal terms were not applicable as this is a product launch rather than a transaction. Bitpanda also joined the Global Dollar Network in February 2026, a partnership bringing MiCA-compliant USDG stablecoin distribution to European markets, with financial terms not publicly disclosed. Separately, Bitpanda announced a cooperation with Deutsche Börse Group in early February 2026, deepening its institutional infrastructure positioning ahead of the planned listing; the terms of this cooperation are not publicly disclosed. Bitpanda additionally completed the launch of stock and ETF trading, covering roughly 8,000 stocks and 2,500 ETFs, from 29 January 2026, with Goldman Sachs, Citigroup and Deutsche Bank engaged as arranging banks for the planned Frankfurt listing. Against this cluster of Bitpanda activity, the broader Austrian startup funding market contracted sharply: EUR253 million was raised in total across 2025 per EY's Barometer, a 56% year-on-year drop and the lowest annual total since 2019, with no individual round exceeding EUR50 million.

Periodic update · new data 2026-10-18

Commercial Intelligence & Fintech

Bitpanda GmbH and Fibank, Bulgaria's First Investment Bank, announced a strategic partnership on 12 October 2026 under which Bitpanda Enterprise, Bitpanda's institutional and B2B arm, will become the sole crypto-asset-services provider integrated into the My Fibank mobile banking application. The partnership is structured as a B2B2C distribution arrangement: Bitpanda supplies the underlying crypto-asset infrastructure and services, while Fibank provides the retail distribution channel through its existing mobile-banking customer base. A consumer-facing launch is planned for early 2027; the event is accordingly announced rather than live, and financial terms of the arrangement were not publicly disclosed by either party.

Fibank's chief executive, Nikola Bakalov, was quoted framing the arrangement's significance partly in regulatory terms, stating that it was "particularly important that this new opportunity is being realized alongside an established European technology partner and in compliance with applicable regulatory requirements." This framing is consistent with a bank distribution partner seeking to offer crypto-asset access to its retail customers while relying on a regulated, EU-based crypto-asset service provider, namely Bitpanda, to supply the underlying service rather than building or licensing the capability independently.

The partnership announcement lands against the backdrop of continued uncertainty in Bitpanda's own public-market plans. As of 16 October 2026, Bitpanda's previously reported Frankfurt listing, which had carried a target valuation in the region of four to five billion euros, remains halted with no new date set. Compounding this, the company's chief executive, Lukas Enzersdorfer-Konrad, has confirmed he will leave the role in the first quarter of 2027. The confluence of a stalled listing and a confirmed leadership departure, set against an active pursuit of new bank-distribution partnerships, suggests Bitpanda is treating commercial distribution expansion as a growth channel that does not depend on resolution of its public-listing timeline or on leadership continuity.

The Fibank partnership is notable as a cross-border commercial development: Fibank is domiciled in Bulgaria while Bitpanda operates from its Austrian base, meaning the underlying crypto-asset-services component of the partnership will be delivered across an intra-EU border under whatever passporting or cross-border service arrangement applies to Bitpanda's existing Austrian authorisation. No details of that cross-border servicing structure were disclosed in the sources available this cycle.

Outlook

Whether the My Fibank crypto integration proceeds on schedule to its planned early-2027 consumer launch is the most direct near-term marker of whether this partnership develops into a material revenue channel for Bitpanda or remains at the announcement stage. More broadly, further bank-distribution partnership announcements in subsequent cycles, were they to occur, would strengthen the reading of this arrangement as part of a deliberate strategic pivot toward B2B2C distribution during a period in which Bitpanda's IPO plans remain unresolved and its executive leadership is in transition, rather than as an isolated commercial agreement.

2 earlier distinct update(s)

Periodic update · new data 2026-10-11

Commercial Intelligence & Fintech

The only commercial-perimeter event located for Austria this cycle was a set of FMA consumer warnings against three entities operating without authorisation: Coinmindz, STIG International Trading & Gemstone FZCO, and BeHappy Exchange. These warnings were issued within the current delta window and are confirmed directly from the FMA's own primary notices. A consumer warning of this kind typically indicates that the FMA has identified an entity soliciting or marketing financial or crypto-asset-adjacent services to the Austrian public without holding the required authorisation, rather than confirming a fraud or money-laundering finding; the warning itself is a perimeter-control measure, not a completed enforcement decision against the named entities.

No disclosed deal values, funding rounds, or product-launch events specific to Austria's payments or fintech sector were located within this window beyond the licensing activity already tracked under Licensing and Stablecoins. The commercial-events picture for Austria this cycle is therefore narrow: a cluster of three unauthorised-entity warnings rather than a broader set of discrete M&A, investment or product-launch events.

Outlook

Whether the three named entities cease marketing to the Austrian public following the warnings, or whether the FMA escalates to a more formal enforcement step, is the natural next signal to watch. The narrowness of this cycle's commercial-events picture for Austria — limited to unauthorised-entity warnings — also suggests that broader commercial and investment activity in the Austrian payments sector was either genuinely quiet this window or fell outside the current research pass's reach; the evidence available does not distinguish between those two possibilities.

Periodic update · new data 2026-09-28

Commercial Intelligence & Fintech

The FMA granted Bybit Payments GmbH an e-money-institution licence under Section 3(1) in conjunction with Section 4(4) of the E-Geld Act 2010 on 4 August 2026. This is a discrete, dateable commercial and licensing event, distinct from the structural market-development pattern of crypto-payments dual-licensing discussed elsewhere: a specific named entity, Bybit Payments GmbH, received a specific named authorisation on a specific date, complementing its affiliate Bybit EU GmbH's separate MiCAR crypto-asset-service-provider authorisation.

No deal value, investment amount, or transaction size attaches to this event, as it is a regulatory licensing grant rather than an M&A transaction or funding round; amount_disclosed considerations accordingly do not apply here. The event is nonetheless a material commercial-intelligence data point: it marks Bybit's formal entry into Austria's e-money-institution licensing regime, layered onto its existing MiCAR crypto-asset authorisation via its affiliate entity.

Outlook

Further commercial-intelligence tracking should watch for additional named-entity licensing events in Austria following the same dual-authorisation pattern, as well as for any subsequent commercial activity (partnerships, product launches, or funding events) building on Bybit Payments GmbH's newly granted e-money-institution licence.

Sources and findings (6)

T3https://www.coindesk.com/business/2026/03/14/crypto-broker-bitpanda-bets-on-banks-and-tokenization-to-expand-globally-ahead-of-ipo-plansretrieved 2026-07-04
T3https://www.trendingtopics.eu/bitpanda-launches-stock-and-etf-trading-expanding-beyond-crypto-assets/retrieved 2026-07-04
T3https://tracxn.com/d/companies/bitpanda/__1DgHSfoxIMYJDSnj0kEMyX7sE2CeMPg68Mvd9_9yqQgretrieved 2026-07-04
T3https://www.coindesk.com/business/2026/03/14/crypto-broker-bitpanda-bets-on-banks-and-tokenization-to-expand-globally-ahead-of-ipo-plansretrieved 2026-07-04
T3https://tracxn.com/d/companies/bitpanda/__1DgHSfoxIMYJDSnj0kEMyX7sE2CeMPg68Mvd9_9yqQgretrieved 2026-07-04
T3https://techfundingnews.com/austria-vc-253m-2025-late-stage-slowdown/retrieved 2026-07-04

No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Austria
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {"legal_accessibility": {"per_product": {"account_to_account": "regulated", "cards": "regulated", "prepaid_emoney": "licensed-emi", "stablecoin": "emerging-regime"}}}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band.

Orphan deltas: 4 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 77 finding(s), 131 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 29 Sep 2026: not upheld (14 confirmed against the cited source; 1 contradicted by the cited source; 9 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

Austria

Jurisdiction brief

Latest update · 18 October 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 17 August 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 18 October 2026

Regulatory Status

Outlook

Standing brief · as of 17 August 2026

Regulatory Status

Outlook

W1aLicensing, Authorisation & Market Accesslimited signalConfirmedconfirmed 2026-07-04▾#

Licensing, Authorisation & Market Access

Outlook

Licensing, Authorisation & Market Access

Outlook

Licensing, Authorisation & Market Access

Outlook

Licensing, Authorisation & Market Access

Outlook

Licensing, Authorisation & Market Access

Outlook

W1bConduct, Safeguarding & PromotionsConfirmedconfirmed 2026-07-04▾#

Conduct, Safeguarding & Financial Promotions

Outlook

Conduct, Safeguarding & Financial Promotions

Outlook

W2Stablecoins & Digital MoneyConfirmedconfirmed 2026-07-04▾#

Stablecoins & Digital Money

Outlook

Stablecoins & Digital Money

Outlook

W3Operational Resilience & Critical InfrastructureConfirmedconfirmed 2026-07-04▾#

Operational Resilience & Critical Infrastructure

Outlook

Operational Resilience & Critical Infrastructure

Outlook

Operational Resilience & Critical Infrastructure

Outlook

Operational Resilience & Critical Infrastructure

Outlook

W4Scheme & Network ComplianceProbableconfirmed 2026-07-04▾#

Scheme & Network Compliance

Outlook

Scheme & Network Compliance

Outlook

W5Payment Corridor DynamicsConfirmedconfirmed 2026-07-04▾#

Payment Corridor Dynamics

Outlook

W6Industry Structure & CommercialProbableconfirmed 2026-07-04▾#

Industry Structure & Commercial Dynamics

Outlook

W7Legal & LitigationProbableconfirmed 2026-07-04▾#

Legal & Litigation

Outlook

W8Merchant Acquiring & RiskProbableconfirmed 2026-07-04▾#

Merchant Acquiring & Risk

Outlook

W9Product Innovation & Market DevelopmentProbableconfirmed 2026-07-04▾#

Product Innovation & Market Development

Outlook

Product Innovation & Market Development

Outlook

W10Consumer Protection & APP FraudConfirmedconfirmed 2026-07-04▾#

Consumer Protection & APP Fraud

Outlook

W11AML/CFT & Financial CrimeSourced from Sentinel.gi ↗Confirmedconfirmed 2026-07-04▾#

AML/CFT & Financial Crime

Outlook

W12Correspondent Banking, Settlement & AccessProbableconfirmed 2026-07-04▾#

Correspondent Banking, Settlement & Access

Outlook

W13Commercial Intelligence (M&A, Investment & Product)Probableconfirmed 2026-07-04▾#

#

#

#

#

#

#

#

#

#

#

#

#

#

#