Centralized exchange in Austria

Currently (Pre-MiCA Full Implementation): Partial, primarily AML/CFT-focused. Austria has a framework that primarily addresses anti-money laundering and counter-terrorist financing (AML/CFT) aspects, along with existing securities and tax laws that apply depending on the classification of the crypto asset. This means many crypto activities are not specifically regulated as financial services unless they fall under traditional definitions (e.g., a token classified as a security).

Finanzmarktaufsicht (FMA) – Austrian Financial Market Authority:

Crypto Involvement: The FMA is responsible for the registration of Virtual Asset Service Providers (VASPs) under AML/CFT laws and will be the competent authority for licensing and supervising crypto-asset service providers (CASPs) under MiCA. It also provides guidance on the classification of crypto assets.

Geldwäsche- und Terrorismusfinanzierungsgesetz (GWG) – Anti-Money Laundering and Counter-Terrorist Financing Act (as amended):

Services covered (as per the FMA): Exchange between virtual currencies and fiat currencies, exchange between one or more virtual currencies, transfer of virtual currencies, safekeeping and administration of virtual currencies or instruments enabling control over virtual currencies, and financial services in connection with the issuance/sale of virtual currencies.

VASP Registration: There is no dedicated "custody license" per se. Instead, entities providing custody of virtual assets are classified as Virtual Asset Service Providers (VASPs) and are required to register with the Austrian Financial Market Authority (FMA).

Scope: The FM-GwG defines "providers of services related to virtual currencies" to include "the safekeeping of virtual currencies for third parties" (i.e., custody).

Fit and Proper Management: Key persons involved in the management must demonstrate their suitability and reliability.

Robust AML/KYC Framework: Implementation of comprehensive policies and procedures for customer due diligence (KYC), transaction monitoring, risk management, and reporting of suspicious activities to the Financial Intelligence Unit (FIU).

Internal Controls: Establishment of internal controls and risk management systems to prevent money laundering and terrorist financing.

Designated AML Officer: Appointment of a dedicated officer responsible for AML compliance.

Finanzmarkt-Geldwäschegesetz (FM-GwG): § 2 Z 22 FM-GwG defines virtual currency and § 32a FM-GwG outlines the registration requirements for providers of services related to virtual currencies.

Current: The FM-GwG, being an AML law, does not explicitly mandate prudential segregation of client crypto assets from the custodian's own assets.

Implicit Expectation: While not a specific legal mandate for crypto, general principles of good business conduct and the FMA's supervisory expectations would lean towards ensuring customer assets are identifiable and protected from insolvency of the custodian to the extent possible, though this is not as robust as under a prudential financial services license.

Current: There are no explicit, dedicated insurance or bonding requirements specifically for crypto custodians under the current FM-GwG VASP registration.

Custodians of crypto assets in Austria are required to hold professional indemnity insurance or equivalent capital reserves specifically covering the loss of client crypto assets.

Current: Austrian regulation does not explicitly mandate the use of cold storage for crypto assets.

General Security Requirements: The FMA expects VASPs to have robust IT security measures and operational resilience to protect client assets from theft, loss, or unauthorized access. This implicitly encourages the use of secure storage solutions, which commonly include cold storage for a significant portion of assets.

As of Austria's 2025 MiCA implementation, 'qualified custodian' for crypto assets has a distinct regulatory definition: only licensed MiCA-compliant CASPs authorized for 'custody and administration of crypto-assets' with specific prudential, capital, and custody requirements (beyond just AML/CTF) qualify.

EU-Wide Authorization: Custodians will need to obtain authorization as a CASP from the FMA. Once authorized, they can "passport" their services across the EU.

MiCA introduces robust requirements beyond AML, but Austrian regulator action (banning KuCoin EU from new business) shows that enforcement was still needed to address gaps, with KuCoin subsequently hiring a new AML chief and expanding compliance in Vienna

Organizational Requirements: Clear governance arrangements, effective risk management, internal controls, and operational resilience.

Fit and Proper Requirements: For management and shareholders.

Prudential Safeguards: Capital requirements (see below).

Complaint Handling: Procedures for client complaints.

EU MiCA Regulation (EU 2023/1114) has replaced fragmented national VASP regimes with a harmonized CASP (Crypto-Asset Service Provider) authorization framework across all EU member states, including Austria. The 5th Anti-Money Laundering Directive (5AMLD/T5AMLD) VASP registration system is now superseded by MiCA's single EU-wide licensing regime, effective December 30, 2024.

The remaining provisions of MiCA for other crypto-assets and crypto-asset service providers will apply from 30 December 2024.

However, if a crypto-asset (even if attempting to be stable) does not meet MiCA's definitions for ARTs or EMTs and exhibits characteristics of a financial instrument, it could still be regulated under existing Austrian securities law (e.g., WAG 2018) or capital market law (KMG). MiCA has a clear scope exclusion for financial instruments already regulated under existing EU legislation like MiFID II.

Wertpapieraufsichtsgesetz 2018 (WAG 2018) – Securities Supervision Act 2018 & Kapitalmarktgesetz (KMG) – Capital Market Act (as amended):

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):