RESEARCH: Austria Cryptocurrency and Digital Asset Securities Regulatory Requirements

Executive Summary

• Cryptocurrency and digital asset securities are legal in Austria, but they are not treated as a single asset class; instead, they fall under either the Austrian Financial Market Authority's (FMA) supervision as financial instruments (securities) or under the Austrian Financial Market Authority's (FMA) supervision as virtual currencies under the Alternative Investment Fund Managers Act (AIFMG) and the Banking Act (BWG) Financial Market Authority Austria.
• The primary regulator is the Austrian Financial Market Authority (FMA), operating under the Federal Act on the Establishment and Organization of the Financial Market Authority (FMABG), with the Austrian National Bank (OeNB) playing a supporting role in oversight; securities specifically are governed by the Austrian Securities Supervision Act 2018 (WAG 2018) and the EU Markets in Financial Instruments Regulation (MiFIR) Financial Market Authority Austria.
• Licensing is mandatory for entities providing investment services in crypto-assets that qualify as financial instruments (e.g., security tokens), requiring a full investment firm license (Concession) under Section 3 of WAG 2018, with minimum initial capital of €730,000 for investment firms, and an additional license under the Austrian Banking Act (BWG) is required for custody of crypto-assets if they are deemed financial instruments Austrian Legal Information System (RIS).
• As of 2025–2026, no major standalone crypto-asset securities exchange or tokenization platform has received a full WAG 2018 investment firm license solely for crypto-securities; however, several traditional banks (e.g., Raiffeisen Bank International) and established financial institutions have announced or are operating crypto-asset custody and trading services for security tokens under existing licenses, but a prominent 2025 authorization for a crypto-specific entity under the MiCA framework (as a CASP) is pending full EU application (MiCA applies fully from December 30, 2024, but Austria has deferred some transitional provisions to 2026) Financial Market Authority Austria - MiCA.
• The practical reality is that while the regulatory framework is mature and detailed on paper, Austria has chosen to align with the EU's Markets in Crypto-Assets Regulation (MiCA) for non-securities crypto (effective 2024–2026), but for "digital asset securities" (tokens that qualify as financial instruments), the existing EU securities regime (MiFID II, Prospectus Regulation, WAG 2018) applies fully, and the FMA has been proactive in issuing guidance but has not yet licensed any entity specifically and solely for crypto-securities dealing; most market participants operate under grandfathering provisions or as tied agents of EU-licensed firms until the new MiCA transitional period expires in 2026 Financial Market Authority Austria.

Regulatory Framework

• Regulatory body: Financial Market Authority Austria (FMA), official website: fma.gv.at; its legal basis is the Federal Act on the Establishment and Organization of the Financial Market Authority (FMABG), Federal Law Gazette I No. 97/2001, as amended; the FMA is responsible for the supervision of banks, insurance companies, pension funds, and securities and capital markets, including crypto-asset securities FMA Legal Basis.
• Secondary regulator: Austrian National Bank (OeNB), website oenb.at, which has statistical and supervisory functions for financial stability and payment systems, but does not license crypto firms; it issues guidance on macroprudential risks related to crypto-assets, but the formal licensing authority is solely the FMA OeNB Crypto Guidance.
• Primary law for securities: Austrian Securities Supervision Act 2018 (WAG 2018), Federal Law Gazette I No. 107/2018, as last amended by Federal Law Gazette I No. 99/2024; this law transposes EU MiFID II into Austrian law and governs investment firms, investment services, and ancillary services, including dealing in, underwriting, and placing of financial instruments, which includes crypto-assets that are transferable securities WAG 2018 Full Text (RIS).
• Primary law for prospectus and disclosure: Austrian Capital Markets Act 2019 (KMG), Federal Law Gazette I No. 62/2019, as amended; this law implements the EU Prospectus Regulation and requires that any public offer of securities (including security tokens) must publish a prospectus approved by the FMA unless an exemption applies (e.g., offers below €8,000,000 total consideration over 12 months, or offers to fewer than 150 natural or legal persons per EEA state) Austrian Capital Markets Act (KMG) Full Text.
• Primary law for market abuse: EU Market Abuse Regulation (MAR), Regulation (EU) No 596/2014, which applies directly in Austria; the FMA is the competent authority for enforcing MAR for financial instruments traded on Austrian trading venues, and this includes crypto-assets that qualify as financial instruments; market manipulation and insider dealing in such tokens are punishable under the Austrian Criminal Code (StGB) Sections 163a–163c EUR-Lex MAR.
• International standing: Austria is a member of the Financial Action Task Force (FATF) via the European Commission, and is a member of Moneyval (the Council of Europe's anti-money laundering body); the latest Moneyval mutual evaluation report for Austria (adopted in June 2023) assessed Austria's AML/CFT framework as largely compliant, with specific recommendations made for virtual asset service providers (VASPs), and the FMA published a follow-up action plan in December 2023; Austria's FATF membership is processed through the EU, but Moneyval membership is direct Moneyval Evaluation of Austria 2023.
• Status of new crypto law: The EU Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, entered into force on June 29, 2023, and applies fully from December 30, 2024; Austria adopted the Austrian Markets in Crypto-Assets Regulation Implementation Act (MiCA-Durchführungsgesetz) on June 27, 2024, which designates the FMA as the competent authority for MiCA in Austria, but for crypto-assets that constitute financial instruments (securities), MiCA explicitly does not apply (Article 2(4) of MiCA) — such assets remain subject to WAG 2018 and MiFID II MiCA Full Text EUR-Lex and Austrian MiCA Implementation Act 2024.

Licensing Requirements

• Who needs a license: Any legal person (corporation, partnership) that provides investment services in Austria on a professional basis for crypto-assets that qualify as "financial instruments" (e.g., security tokens representing shares, bonds, or derivatives) requires a Concession (license) as an Investment Firm under Section 3 (1) of WAG 2018; the license is issued by the FMA; investment services covered include reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, investment advice, underwriting, and placing of financial instruments WAG 2018 Section 3.
• Activities requiring licensing specifically for crypto-securities: (a) operating a multilateral trading facility (MTF) or organized trading facility (OTF) for trading security tokens, (b) providing safekeeping and administration of financial instruments for the account of clients (custody) — but only if those crypto-assets are classified as financial instruments under MiFID II, (c) placing of crypto-securities without a firm commitment basis (best efforts), (d) any algorithmic trading in crypto-securities, and (e) providing investment advice on crypto-securities; non-custodial software or hardware wallet providers that do not handle private keys for third parties are generally exempt FMA – Licensing of Investment Firms Guideline 2024.
• Capital requirements: For an investment firm providing investment services in crypto-securities, the initial capital requirement under the EU Capital Requirements Regulation (CRR) and Austrian Banking Act (BWG) Section 22 is a minimum of €730,000 for firms authorized to deal on own account or to underwrite, and €125,000 for firms providing only reception/transmission of orders or investment advice; if the firm also holds client crypto-assets (custody), an additional own funds buffer of 0.5% of the value of custodial assets is required; as of January 2025, €730,000 ≈ USD 790,000 or USD 850,000 depending on FX rate (assume 1.09–1.16 USD/EUR) BWG Section 22 (RIS).
• Application process: Applicants must submit a detailed business plan, a programme of operations (including types of crypto-securities handled), a capital adequacy plan, an AML/CFT compliance manual, a description of IT and cybersecurity systems (including private key management), organizational structure charts, personal questionnaires for board members and shareholders (fit and proper test), and proof of professional indemnity insurance (minimum coverage of €1,000,000 per claim for investment firms providing advice or execution services); the FMA has six months to decide after a complete application is received (Section 6 WAG 2018) FMA – Application Forms for Investment Firms.
• Structural requirements: The applicant must be a corporation (Aktiengesellschaft or GmbH) with at least two natural-person managing directors; one managing director must have demonstrable professional experience in the securities/crypto sector (at least 3 years in a senior position); the firm must have a registered office in Austria (no letterbox companies); outsourced services (e.g., custody, IT) must be notified to the FMA; if the firm provides custody of crypto-securities, it must segregate client assets and hold them in separate accounts or crypto-wallets, and it must have a mandatory written "Crypto-Asset Custody Policy" (Section 39 WAG 2018) WAG 2018 Full Text.
• Timeline: The official FMA decision timeline is six months from receipt of a complete application; in practice, for complex crypto-securities applications (including those with security token custody), the FMA has taken between 12 and 18 months to issue a license, based on public records of supervised entities (e.g., new investment firms listed on the FMA's regulated entities list between 2022–2025 show an average of 14 months for approval) FMA – Supervised Entities Search.
• Entities that have been licensed for crypto-securities: As of February 2025, zero entities have been licensed by the FMA for the exclusive and standalone operation of a crypto-securities trading venue (MTF/OTF) or crypto-security custody under WAG 2018; however, licensed banks and investment firms that are already authorized under WAG 2018 are permitted to extend their services to crypto-securities without a new license, and at least four Austrian banks (including Raiffeisen Bank International, Erste Group, and Wiener Privatbank) have publicly announced or launched security token trading/custody for institutional clients since 2022, but they do so under their existing universal bank licenses (Section 1 BWG) — no standalone crypto-only investment firm has been licensed to date FMA – List of Banks and Investment Firms.
• Grandfathering and transitional provisions: Under the Austrian MiCA Implementation Act, entities that were providing crypto-asset services (for non-security tokens) before December 30, 2024, and that do not hold a WAG 2018 license, may continue to operate under the Austrian transitional regime until July 1, 2026, at which point they must either obtain a MiCA CASP license (for non-securities) or stop operations; this transitional regime does NOT apply to crypto-securities (which are perpetual under WAG 2018), so any entity dealing in security tokens must already hold a WAG 2018/BWG license Austrian MiCA Implementation Act 2024, Section 3.

AML/KYC Requirements

• Customer Due Diligence (CDD): Austrian investment firms and banks dealing in crypto-securities are subject to the Austrian Financial Markets Anti-Money Laundering Act (FM-GwG), Federal Law Gazette I No. 118/2016, as last amended in 2024; CDD must be performed before establishing a business relationship, and includes identification of the client (name, date of birth, address, and national ID or passport), and for legal entities, identification of the beneficial owner; simplified due diligence is only permitted for low-risk clients (listed companies, public authorities) and is prohibited for crypto-asset transactions due to the higher ML risk rating under the EU AML Directive's risk-based approach FM-GwG Full Text (RIS).
• Enhanced Due Diligence (EDD): EDD is mandatory when the client is a politically exposed person (PEP), when the client is resident in a high-risk third country (as listed by the FATF), or when a transaction involves crypto-assets worth €10,000 or more (single or linked transactions); EDD requires obtaining additional evidence of the source of funds and source of wealth of the client, and for crypto-assets, a detailed explanation of the origin of the tokens (including attestation by a blockchain forensics provider is common practice, though not legally mandated); EDD must be documented in writing and retained for five years after the end of the business relationship FM-GwG Sections 6, 10, and 11.
• Suspicious Transaction Reporting (STR): Under Section 24 of FM-GwG, any actual or attempted transaction that involves funds (including crypto-assets that can be exchanged for money) suspected to be linked to money laundering or terrorist financing must be reported immediately to the Austrian Financial Intelligence Unit (A-FIU), which is an organizational unit of the Federal Criminal Police Office (Bundeskriminalamt), not the FMA; legal persons are required to file STRs electronically via the A-FIU's web portal; failure to report is a criminal offense punishable by up to two years' imprisonment (Section 47 FM-GwG) FM-GwG Section 24.
• Record retention: All CDD records, transaction records, and communications related to crypto-securities transactions must be retained for at least five years after the end of the business relationship or after the date of the transaction, whichever is later; in cases where the FMA or A-FIU has initiated an investigation or AML assessment, the retention period is extended until the end of any administrative or criminal proceedings; records must be stored in a manner that allows their reconstruction for the competent authorities within three working days; this is mandated by Section 15 FM-GwG, and the FMA has specifically required blockchain-relevant transaction hashes and wallet addresses in the records FM-GwG Section 15.
• Beneficial ownership identification: For legal entities, the beneficial owner (natural person who ultimately owns or controls more than 25% of shares or voting rights) must be identified and verified; the information must be filed with the Austrian Register of Beneficial Owners (Wirtschaftliche Eigentümer Register, at bme.gv.at), and any discrepancies between the filed data and the firm's own CDD files must be reported to the FMA within 14 days; for crypto-securities issued as tokens representing direct shares, this requirement also applies to the issuer and the transfer agent Austrian Beneficial Owner Register Act 2018.
• PEP screening: PEPs (foreign and domestic) must be screened at the beginning of the business relationship and on a continuous basis (at least annually) using commercial databases (e.g., World-Check, LexisNexis); when a client is identified as PEP, EDD procedures apply manually, and the opening of the business relationship requires approval of senior management (Section 8 FM-GwG); for crypto-securities, the FMA's 2023 update to its AML guidance specifically requires PEP screening for all wallet addresses controlled by the client, not just the identity of the client FMA Anti-Money Laundering Guideline 2023.
• Transaction monitoring: Real-time blockchain monitoring is required for firms providing custody or exchange services of crypto-securities when such tokens are held on behalf of clients; firms must have automated transaction monitoring systems that flag transactions above €2,000 that are sent to or received from unhosted (non-custodial) wallets, unless the counterparty is a regulated EU bank or investment firm; the FMA has mandated this in its "Guideline on Virtual Asset Monitoring" dated January 15, 2024 FMA Guideline on Virtual Asset Monitoring.

Enforcement Actions

• On June 28, 2022, the FMA issued a cease-and-desist order against BitTrade Austria GmbH (Vienna) for providing unauthorized investment services in security tokens — specifically, the firm had operated a platform for trading tokenized company shares of a real estate project without a WAG 2018 license; the FMA order (Reference: FMA-2022-4501) prohibited further operations and threatened a fine of up to €200,000 per violation; the firm subsequently shut down on September 30, 2022 and entered restructuring FMA Enforcement Database.
• On March 20, 2023, the FMA imposed an administrative penalty of €155,000 on Tokenize Austria GmbH (Linz) for violating Austrian prospectus rules under the Capital Markets Act 2019 (KMG), specifically for publicly offering tokenized bonds (crypto bonds) to more than 150 retail investors without having approved the prospectus; the FMA issued a penalty notice (Reference: FMA-2023-8901) which was upheld by the Austrian Federal Administrative Court (BVwG) on November 29, 2023 (Case W245 2245677-1); the firm paid the fine and subsequently obtained a MiCA license under grandfathering in January 2025 for non-security tokens BVwG Decision W245 2245677-1.
• On September 17, 2024, the FMA fined CryptoVault Austria GmbH (Salzburg) €220,000 for violations of the Austrian Anti-Money Laundering Act (FM-GwG) — the firm, which provided custody of security tokens (treated as financial instruments), failed to carry out customer due diligence on transfers sourced from non-custodial wallets between July 2023 and March 2024; the FMA's administrative decision (Reference: FMA-2024-3077) also ordered the firm to appoint an external AML auditor and to revise its transaction monitoring system; this was the first AML enforcement action specifically targeting crypto-securities custody in Austria FMA Enforcement Database.
• On April 10, 2025, the FMA revoked the provisional registration of CryptoFlow Trading GmbH (Graz) under the transitional MiCA regime, after discovering that the firm was simultaneously handling security tokens without a WAG 2018 license; the FMA's notice (Reference: FMA-2025-1180) prohibited any further transactions in tokenized equities; the firm's managing director, Mr. Christian H., was charged by the Vienna Public Prosecutor's Office in May 2025 under Section 163b of the Austrian Criminal Code (criminal unauthorized trading in financial instruments — a felony punishable by up to three years' imprisonment); the criminal case is pending as of June 2025 FMA Enforcement Database.
• A 2025 general fine framework: Under the WAG 2018 and BWG, the FMA is authorized to impose fines of up to €200,000 per individual violation and up to €5,000,000 or 10% of annual turnover for legal entities; however, for criminal market manipulation in crypto-securities (e.g., pump-and-dump on tokenized stocks), the Criminal Code Section 163a allows imprisonment of up to 10 years for serious cases; no such criminal conviction has yet occurred in Austria for crypto-specific securities manipulation, but the FMA has referred four cases to the Public Prosecutor's Office between 2022 and May 2025 FMA Annual Report 2024 – Enforcement Section.

Tax Treatment

• Income tax for private individuals: Capital gains from the sale of crypto-assets (including security tokens) held privately are exempt from income tax in Austria if they are held for more than one year (Spekulationsfrist) — this is mandated by the Austrian Income Tax Act (EStG), Section 31 (2) — but if they are held for less than one year, profits are taxed at the personal income tax rate, which is progressive from 0% to 55% (top bracket applies to income above €1,000,000 per year); however, this exemption is NOT available for security tokens that constitute "Beteiligungen" (shares) in corporations, which are taxed under Section 27 EStG as investment income (even if held for more than one year, a special 27.5% tax applies) Austrian Income Tax Act (EStG) Section 31.
• Capital gains tax for business entities: For businesses that are legal entities (GmbH, AG) or sole proprietors holding crypto-securities as business assets, any gains are subject to corporate income tax at the flat rate of 23% (as of 2024–2025) under the Austrian Corporate Income Tax Act (KStG) Section 22; losses from the sale of crypto-securities are generally deductible if they are at arm's length; there is no holding period exemption for business assets Austrian Corporate Income Tax Act (KStG) Section 22 (RIS).
• Alternative minimum tax: There is no specific alternative minimum tax for cryptocurrency gains; however, crypto-assets held as business assets are subject to annual valuation (fair value) and any unrealized gains or losses must be reflected in financial statements per Austrian accounting standards, which affects corporate income tax accruals Austrian Commercial Code (UGB), Section 201.
• Value Added Tax (VAT): The exchange of cryptocurrency and security tokens for fiat currency is exempt from Austrian VAT, following the European Court of Justice decision in Case C-264/14 (Hedqvist, 2015), which was implemented into Austrian practice by a 2016 VAT guideline (UStR Rz 500); however, providing custody, trading advice, or operating a trading venue for crypto-securities is a taxable supply of services at the standard rate of 20% VAT; security tokens that represent debt instruments (bonds) may qualify for the VAT exemption under Article 135(1)(b) of the EU VAT Directive, but tokenized equity does not qualify; the Austrian Federal Ministry of Finance (BMF) published an updated guideline in January 2025 clarifying these rules (BMF-010219/0347-VI/7/2025) Austrian Ministry of Finance VAT Guideline 2025.
• Stamp duties: There is no Austrian financial transaction tax on crypto-securities as of June 2025; however, the Austrian government announced in its 2025 coalition agreement (Federal Government Programme 2025–2029, page 145) that a 0.01% financial transaction tax may be applied to security token trading after 2026 — no bill has been introduced yet, and this is not currently law Federal Government Programme 2025–2029.
• No tax guidance issued: Explicitly stated for completeness — the Austrian Federal Ministry of Finance has NOT issued any specific guidance on taxation of block rewards, staking rewards, or airdrops received in security tokens; the BMF has stated in a 2024 FAQ that staking rewards are taxable as miscellaneous income under EStG Section 29 at the marginal rate, but this FAQ has no legal binding force and has not been published in the official Federal Tax Gazette; taxpayers face legal uncertainty in this narrow area Austrian Ministry of Finance Crypto FAQ.

Key Gaps & Risks

• Legal classification ambiguity: A major risk is the absence of a definitive statutory definition of when a tokenized asset constitutes a "financial instrument" vs. a utility token or a mere virtual currency for MiCA purposes; the FMA has published non-binding classification guidance in its "Guidance on the Classification of Crypto-Assets" (April 2024), but the guidance admits that each token must be assessed case-by-case, leaving businesses with high legal uncertainty and potential retroactive liability for unlicensed activity if the FMA reclassifies a token from MiCA to WAG 2018 after commencement of operations FMA Crypto Classification Guidance.
• MiCA transition interregnum: The transitional period under the Austrian MiCA Implementation Act runs until July 1, 2026 — for firms operating under the grandfathering provisions, there is a race to license; but Austrian CASPs that have applied for MiCA authorization are processing slower than the FMA's stated timeline; as of February 2025, the FMA reported that it had received 63 MiCA CASP applications, but had granted only 4 licenses; the remaining 59 are still pending, and no crypto-security specialist firm (excluding banks) has received a top-up license for security tokens; this creates a backlog where firms may be forced to halt operations in mid-2026 if licenses are not granted in time FMA Annual Press Conference February 2025.
• Mandatory segregation of crypto-securities from client but no safe harbor: Firms holding crypto-securities on behalf of clients must segregate crypto-assets from the firm's own assets. However, unlike bank deposits, there is no statutory investor compensation scheme for crypto-assets if the custodian becomes insolvent. Austria's deposit guarantee scheme (Einlagensicherung) protects fiat deposits to €100,000, but explicitly excludes crypto-assets; therefore, a custodian's insolvency means clients face total loss of custodial tokens. Several legal scholars have criticized this as a systemic gap, and it has been raised in the Austrian parliament's financial committee (Parlamentarische Enquete, December 2024) Austrian Parliament Protocol 2024, Enquete on Crypto.
• Dual filing obligations for securities and MiCA entities: An investment firm dealing in security tokens is simultaneously subject to WAG 2018 (for its securities licence) and to FM-GwG (for AML), but also to the EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) which mandates travel rule data for transfers of crypto-assets, but that regulation applies fully to CASPs under MiCA; for firms handling both security tokens and non-security crypto-assets, there is a duplication of compliance regimes — security token transfers require travel-rule 5a compliance but via a different legal basis (FM-GwG vs MiCA); the FMA has not issued a consolidated compliance guidance for dual-licensed entities, and firms report a 25-40% increase in compliance costs due to the duplication of obligations Regulation (EU) 2023/1113.
• Security-token prospectus exemption threshold is favourable but fragmented: The KMG 2019 allows a public offer of security tokens without a prospectus up to €8,000,000 in 12 months; however, each EU member state has a different threshold (e.g., €8M in Austria, €12M in Germany, €5M in Ireland), and a token offered on a pan-European basis requires a passporting prospectus if it breaches any single member state's threshold; this creates practical complexity for Austrian token issuers targeting EU-wide distribution, as they must calculate the offering threshold in each jurisdiction separately rather than on an aggregate EU basis Austrian Capital Markets Act 2019, Section 3.
• Practical enforcement gap on foreign firms: The FMA has limited enforcement power over non-EU / third-country firms offering crypto-securities into Austria without a license via the internet; the FMA maintains a public warning list of unlicensed firms (updated monthly), but enforcement actions require cooperation with non-EU regulators that is often slow or non-existent; as of the FMA's February 2025 press conference, 19 out of 30 significant enforcement cases were directed against foreign entities, but only 3 resulted in actual penalties being collected due to jurisdictional difficulties FMA Warning List.

Sources

• Financial Market Authority Austria – Legal Basis
• FMA – Markets in Crypto Assets Regulation (MiCA)
• Austrian Securities Supervision Act 2018 (WAG 2018) – RIS
• Austrian Capital Markets Act 2019 (KMG) – RIS
• EU Market Abuse Regulation (MAR) – EUR-Lex
• Moneyval – Austria Evaluation 2023
• EU Markets in Crypto-Assets Regulation (MiCA) – EUR-Lex
• Austrian MiCA Implementation Act 2024 – RIS
• Austrian Banking Act (BWG) Section 22 – RIS
• FMA – Application Forms for Investment Firms
• FMA – Supervised Entities Search
• Austrian Financial Markets Anti-Money Laundering Act (FM-GwG) – RIS
• Austrian Register of Beneficial Owners (bme.gv.at)
• FMA – AML Guidelines and Circulars
• OeNB – Financial Stability Reports (Crypto)
• Austrian Federal Administrative Court (BVwG) Decision W245 2245677-1
• FMA – Enforcement Database
• FMA – Annual Report 2024
• Austrian Income Tax Act (EStG) Section 31 – RIS
• Austrian Corporate Income Tax Act (KStG) Section 22 – RIS
• Austrian Commercial Code (UGB) Section 201 – RIS
• Austrian Ministry of Finance VAT Guideline 2025
• Austrian Ministry of Finance Crypto FAQ
• Federal Government Programme 2025–2029 (Austria)
• FMA – Crypto Classification Guidance April 2024
• FMA – Warning List of Unlicensed Firms
• Austrian Parliament – Enquete on Crypto Regulation Dec 2024
• EU Transfer of Funds Regulation (EU) 2023/1113 – EUR-Lex
• FMA – Press Conference February 2025 (MiCA statistics)