DeFi protocol frontend in Austria

Currently (Pre-MiCA Full Implementation): Partial, primarily AML/CFT-focused. Austria has a framework that primarily addresses anti-money laundering and counter-terrorist financing (AML/CFT) aspects, along with existing securities and tax laws that apply depending on the classification of the crypto asset. This means many crypto activities are not specifically regulated as financial services unless they fall under traditional definitions (e.g., a token classified as a security).

Finanzmarktaufsicht (FMA) – Austrian Financial Market Authority:

Crypto Involvement: The FMA is responsible for the registration of Virtual Asset Service Providers (VASPs) under AML/CFT laws and will be the competent authority for licensing and supervising crypto-asset service providers (CASPs) under MiCA. It also provides guidance on the classification of crypto assets.

Geldwäsche- und Terrorismusfinanzierungsgesetz (GWG) – Anti-Money Laundering and Counter-Terrorist Financing Act (as amended):

Services covered (as per the FMA): Exchange between virtual currencies and fiat currencies, exchange between one or more virtual currencies, transfer of virtual currencies, safekeeping and administration of virtual currencies or instruments enabling control over virtual currencies, and financial services in connection with the issuance/sale of virtual currencies.

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):

Applicability: Stablecoin-related provisions (Asset-Referenced Tokens and E-Money Tokens) will apply from June 30, 2024. All other provisions (covering most other crypto-assets and crypto-asset service providers) will apply from December 30, 2024.

VASP Registration: There is no dedicated "custody license" per se. Instead, entities providing custody of virtual assets are classified as Virtual Asset Service Providers (VASPs) and are required to register with the Austrian Financial Market Authority (FMA).

Scope: The FM-GwG defines "providers of services related to virtual currencies" to include "the safekeeping of virtual currencies for third parties" (i.e., custody).

Requirements for Registration:

Fit and Proper Management: Key persons involved in the management must demonstrate their suitability and reliability.

Robust AML/KYC Framework: Implementation of comprehensive policies and procedures for customer due diligence (KYC), transaction monitoring, risk management, and reporting of suspicious activities to the Financial Intelligence Unit (FIU).

Internal Controls: Establishment of internal controls and risk management systems to prevent money laundering and terrorist financing.

Designated AML Officer: Appointment of a dedicated officer responsible for AML compliance.

Finanzmarkt-Geldwäschegesetz (FM-GwG): § 2 Z 22 FM-GwG defines virtual currency and § 32a FM-GwG outlines the registration requirements for providers of services related to virtual currencies.

The remaining provisions of MiCA for other crypto-assets and crypto-asset service providers will apply from 30 December 2024.

EU-Wide Authorization: Custodians will need to obtain authorization as a CASP from the FMA. Once authorized, they can "passport" their services across the EU.

MiCA introduces robust requirements beyond AML, but Austrian regulator action (banning KuCoin EU from new business) shows that enforcement was still needed to address gaps, with KuCoin subsequently hiring a new AML chief and expanding compliance in Vienna

Organizational Requirements: Clear governance arrangements, effective risk management, internal controls, and operational resilience.

Fit and Proper Requirements: For management and shareholders.

Prudential Safeguards: Capital requirements (see below).

Complaint Handling: Procedures for client complaints.

Titles III (ARTs) and IV (EMTs) of MiCA, covering stablecoins, will apply from 30 June 2024.