Crypto-funded debit card in Austria

Finanzmarktaufsicht (FMA) – Austrian Financial Market Authority:

Geldwäsche- und Terrorismusfinanzierungsgesetz (GWG) – Anti-Money Laundering and Counter-Terrorist Financing Act (as amended):

Services covered (as per the FMA): Exchange between virtual currencies and fiat currencies, exchange between one or more virtual currencies, transfer of virtual currencies, safekeeping and administration of virtual currencies or instruments enabling control over virtual currencies, and financial services in connection with the issuance/sale of virtual currencies.

VASP Registration: There is no dedicated "custody license" per se. Instead, entities providing custody of virtual assets are classified as Virtual Asset Service Providers (VASPs) and are required to register with the Austrian Financial Market Authority (FMA).

Requirements for Registration:

Fit and Proper Management: Key persons involved in the management must demonstrate their suitability and reliability.

Robust AML/KYC Framework: Implementation of comprehensive policies and procedures for customer due diligence (KYC), transaction monitoring, risk management, and reporting of suspicious activities to the Financial Intelligence Unit (FIU).

Designated AML Officer: Appointment of a dedicated officer responsible for AML compliance.

EU-Wide Authorization: Custodians will need to obtain authorization as a CASP from the FMA. Once authorized, they can "passport" their services across the EU.

As of Austria's 2025 MiCA implementation, 'qualified custodian' for crypto assets has a distinct regulatory definition: only licensed MiCA-compliant CASPs authorized for 'custody and administration of crypto-assets' with specific prudential, capital, and custody requirements (beyond just AML/CTF) qualify.

Custodians of crypto assets in Austria are required to hold professional indemnity insurance or equivalent capital reserves specifically covering the loss of client crypto assets.

E-money Tokens (EMTs) (Title IV of MiCA):

EMTs are considered e-money under the E-Money Directive (2009/110/EC) and its Austrian implementation, the E-Geldgesetz 2010. MiCA effectively extends the existing e-money framework to crypto-assets.

Issuers of EMTs must be authorized as a credit institution (under the EU Capital Requirements Directive/Regulation) or as an e-money institution (under the EU E-Money Directive/Austrian E-Geldgesetz 2010).

Funds received in exchange for EMTs must be protected and held by the issuer in a credit institution or invested in secure, low-risk assets (e.g., deposits with central banks or credit institutions, highly liquid government bonds).

Issuers must ensure that the reserve assets are at all times equal to or greater than the amount of EMTs in circulation (1:1 backing).

The remaining provisions of MiCA for other crypto-assets and crypto-asset service providers will apply from 30 December 2024.

MiCA introduces robust requirements beyond AML, but Austrian regulator action (banning KuCoin EU from new business) shows that enforcement was still needed to address gaps, with KuCoin subsequently hiring a new AML chief and expanding compliance in Vienna

Short‑term holdings (≤ 12 months) in Austria are taxed at a flat rate of 27.5 %, not at the highest marginal rate of up to 55 %.

Current: There are no explicit, dedicated insurance or bonding requirements specifically for crypto custodians under the current FM-GwG VASP registration.