On-shore VASP in Austria

Currently (Pre-MiCA Full Implementation): Partial, primarily AML/CFT-focused. Austria has a framework that primarily addresses anti-money laundering and counter-terrorist financing (AML/CFT) aspects, along with existing securities and tax laws that apply depending on the classification of the crypto asset. This means many crypto activities are not specifically regulated as financial services unless they fall under traditional definitions (e.g., a token classified as a security).

Future (Post-MiCA Full Implementation): Comprehensive. With the phased implementation of MiCA, Austria's approach will become fully comprehensive, covering licensing, operational requirements, consumer protection, market integrity, and environmental aspects for a broad range of crypto-assets and service providers.

Finanzmarktaufsicht (FMA) – Austrian Financial Market Authority:

Geldwäsche- und Terrorismusfinanzierungsgesetz (GWG) – Anti-Money Laundering and Counter-Terrorist Financing Act (as amended):

Wertpapieraufsichtsgesetz 2018 (WAG 2018) – Securities Supervision Act 2018 & Kapitalmarktgesetz (KMG) – Capital Market Act (as amended):

VASP Registration: There is no dedicated "custody license" per se. Instead, entities providing custody of virtual assets are classified as Virtual Asset Service Providers (VASPs) and are required to register with the Austrian Financial Market Authority (FMA).

Robust AML/KYC Framework: Implementation of comprehensive policies and procedures for customer due diligence (KYC), transaction monitoring, risk management, and reporting of suspicious activities to the Financial Intelligence Unit (FIU).

Fit and Proper Management: Key persons involved in the management must demonstrate their suitability and reliability.

Evidence fact at.aml.designated-aml-officer not found (may have been renamed).

Internal Controls: Establishment of internal controls and risk management systems to prevent money laundering and terrorist financing.

Finanzmarkt-Geldwäschegesetz (FM-GwG): § 2 Z 22 FM-GwG defines virtual currency and § 32a FM-GwG outlines the registration requirements for providers of services related to virtual currencies.

Custodians of crypto assets in Austria are required to hold professional indemnity insurance or equivalent capital reserves specifically covering the loss of client crypto assets.

EU-Wide Authorization: Custodians will need to obtain authorization as a CASP from the FMA. Once authorized, they can "passport" their services across the EU.

Prudential Safeguards: Capital requirements (see below).

Organizational Requirements: Clear governance arrangements, effective risk management, internal controls, and operational resilience.

Complaint Handling: Procedures for client complaints.

Current: The FM-GwG, being an AML law, does not explicitly mandate prudential segregation of client crypto assets from the custodian's own assets.

Implicit Expectation: While not a specific legal mandate for crypto, general principles of good business conduct and the FMA's supervisory expectations would lean towards ensuring customer assets are identifiable and protected from insolvency of the custodian to the extent possible, though this is not as robust as under a prudential financial services license.

Current: Austrian regulation does not explicitly mandate the use of cold storage for crypto assets.

General Security Requirements: The FMA expects VASPs to have robust IT security measures and operational resilience to protect client assets from theft, loss, or unauthorized access. This implicitly encourages the use of secure storage solutions, which commonly include cold storage for a significant portion of assets.

MiCA introduces robust requirements beyond AML, but Austrian regulator action (banning KuCoin EU from new business) shows that enforcement was still needed to address gaps, with KuCoin subsequently hiring a new AML chief and expanding compliance in Vienna

EU MiCA Regulation (EU 2023/1114) has replaced fragmented national VASP regimes with a harmonized CASP (Crypto-Asset Service Provider) authorization framework across all EU member states, including Austria. The 5th Anti-Money Laundering Directive (5AMLD/T5AMLD) VASP registration system is now superseded by MiCA's single EU-wide licensing regime, effective December 30, 2024.

Short‑term holdings (≤ 12 months) in Austria are taxed at a flat rate of 27.5 %, not at the highest marginal rate of up to 55 %.

Long‑term holdings (> 12 months): Taxed at a reduced rate (up to 31%).

The remaining provisions of MiCA for other crypto-assets and crypto-asset service providers will apply from 30 December 2024.

However, if a crypto-asset (even if attempting to be stable) does not meet MiCA's definitions for ARTs or EMTs and exhibits characteristics of a financial instrument, it could still be regulated under existing Austrian securities law (e.g., WAG 2018) or capital market law (KMG). MiCA has a clear scope exclusion for financial instruments already regulated under existing EU legislation like MiFID II.