Austria Payments & Fintech Regulation

Licensing, Authorisation & Market Access

Austria's licensing and market-access architecture tightened materially this cycle through a single legislative vehicle: the FMA-independence bill (621 d.B.), which the Finanzausschuss approved on 29 September 2026 and forwarded to the Nationalrat. The bill transposes CRD VI, specifically Directive 2013/36/EU as amended by (EU) 2024/1619, and its headline governance measures are mandatory cooling-off periods for FMA board members moving between regulated industry and the supervisor, annual interest declarations intended to surface conflicts of interest, and a 14-year cap on board tenure. These are institutional-integrity measures aimed at the supervisor itself rather than at licensed entities directly, but they have downstream relevance for every bank and payment institution the FMA licenses, since they shape the independence and continuity of the authority that grants and reviews those licences.

The more operationally significant element for licensed credit institutions is the bill's new notification duty: credit institutions must notify the FMA before executing a transaction that qualifies as prudentially relevant, and the FMA must then assess that transaction for money-laundering and terrorist-financing risk before it is permitted to proceed. This is materially different from the periodic reporting obligations credit institutions are accustomed to; it inserts the supervisor into the transaction-execution chain at the point of decision for a defined category of prudentially significant activity. The precise scope of what counts as prudentially relevant is not established on the evidence available this cycle, and firms will need the Nationalrat's final text, or subsequent FMA guidance, to determine which transactions trigger the duty in practice.

This legislative activity sits on top of an already-consolidated institutional structure. Since 1 January 2026, the FMA has held consolidated supervision and enforcement of national and EU/UN financial sanctions, a mandate absorbed from the Oesterreichische Nationalbank under the Sanktionengesetz 2024. That consolidated mandate extends across banks and insurers to payment institutions, e-money institutions and crypto-asset service providers. The practical effect is that the same authority responsible for sanctions screening across the payments sector will, once the CRD VI bill is enacted, also receive advance notice of prudentially relevant transactions from credit institutions specifically. For banks operating in Austria, this concentrates two related but distinct compliance touchpoints, sanctions screening and prudential transaction notification, within a single supervisory authority, which may in principle streamline cross-referencing between the two functions, though no evidence located this cycle describes how such integration would operate mechanically.

For non-bank payment institutions and e-money institutions, the direct impact of the CRD VI bill is more limited on current evidence: the pre-transaction notification duty as described applies to credit institutions, and no equivalent duty for non-bank payment service providers has been identified in the sources reviewed this cycle. Non-bank licensees should nonetheless track the FMA's broader institutional-independence reforms, since governance changes at the supervisor level can affect licensing-review timelines, supervisory priorities, and the character of ongoing dialogue with the authority across all licence types the FMA administers, not solely credit institutions.

The bill has not yet reached the Nationalrat floor, so its provisions remain prospective rather than in force. The committee vote itself, however, is a strong signal of likely passage: the measure proceeded through the Finanzausschuss alongside a related beneficial-ownership-register novelle on the same date, indicating a coordinated legislative push on institutional-integrity measures this autumn.

Outlook

The FMA-independence bill now moves to the Nationalrat, where enactment would bring both the board-governance reforms and the credit-institution notification duty into force. Firms should watch for the Nationalrat's final text to clarify the prudential-relevance threshold that triggers the new notification duty, since that threshold determines the operational burden the measure will impose on affected credit institutions. Given the consolidated sanctions-supervision mandate the FMA already holds across the broader payments sector, the direction of travel is toward a single supervisory authority with an increasingly integrated view of both sanctions exposure and prudential/AML risk across licensed entities, though the full operational contours of that integration remain to be clarified in subsequent legislative or guidance detail.

Licensing, Authorisation & Market Access

The FMA granted Bybit Payments GmbH a licence as an e-money institution under Section 3(1) in conjunction with Section 4(4) of the E-Geld Act 2010 on 4 August 2026. This authorisation is legally and functionally distinct from Bybit EU GmbH's separate MiCAR crypto-asset-service-provider authorisation, reflecting Austria's ZaDiG 2018 payments licensing architecture operating alongside, but separately from, the MiCAR crypto-licensing track.

The grant illustrates a market-access pattern in which crypto-native firms increasingly pursue dual FMA authorisations, pairing a MiCAR CASP licence for crypto-asset activity with a ZaDiG/E-GeldG payment or e-money institution licence for fiat rails. This dual-track approach brings both sides of a crypto-native firm's business onto Austrian-licensed infrastructure, with the FMA acting as the single supervisory point of contact across both authorisation tracks.

Austria's existing ZaDiG 2018 licensing architecture, which supports EEA-wide passporting for payment and e-money institutions, provides the underlying legal basis for this licensing activity. The Bybit Payments GmbH grant is a confirmed, high-tier-sourced market-access event evidencing this architecture in active operation.

Outlook

Whether additional crypto-native firms pursue the same dual-authorisation pattern — a MiCAR CASP licence paired with a ZaDiG/E-GeldG payments licence — is the key market-access signal to track. Continued growth in this pattern would confirm Austria's positioning as a jurisdiction where crypto and payments licensing regimes are converging under unified FMA supervision.

Licensing, Authorisation & Market Access

Austrian payment institutions are authorised and supervised by the FMA under ZaDiG 2018, the national transposition of PSD2, with EU-wide passporting rights. This remains the operative authorisation framework as of this cycle, confirmed at Probable confidence from a Tier 4 vendor summary. The more significant development is at the EU level: the PSD3/PSR legislative package reached provisional political agreement on 27 November 2025, and would, once transposed nationally, consolidate payment-institution and e-money-institution authorisation under a single supervisory framework. National transposition is expected across 2026-2027, meaning Austrian PIs and EMIs currently operating under ZaDiG 2018 should anticipate a framework transition within this window, though the primary EU legislative text and any FMA-specific transposition guidance were not independently re-verified this cycle — this detail rests on a single Tier 4 source and is held at Probable confidence pending stronger corroboration.

Carrying the bank-PSP versus non-bank payment-institution/e-money-institution distinction explicitly: both bank and non-bank payment institutions in Austria currently operate under the same ZaDiG 2018 authorisation framework, and both categories fall within scope of the PSD3/PSR consolidation once transposed, per this cycle's evidence.

Outlook

The key marker to watch is confirmation of Austria's specific PSD3/PSR transposition timeline and mechanism, ideally sourced directly from the FMA or from the EU legislative text rather than from vendor commentary. Given the provisional political agreement dates from November 2025 and transposition is expected across 2026-2027, this cycle sits early in that transposition window; expect firmer, higher-tier sourcing to become available as national implementing measures are published.

Stablecoins & Digital Money

Austria's stablecoin and digital-money supervisory posture showed escalating signal this cycle, anchored by two developments. First, the FMA published guidance reflecting ESMA's supervisory expectations regarding services related to non-MiCAR-compliant stablecoins and setting out how the FMA will implement those expectations in its own supervisory practice. The guidance is dated on or shortly before 6 October 2026 per the FMA's own homepage listing, though the exact publication date and the underlying ESMA document reference were not independently confirmed beyond that listing. The guidance matters because MiCA's stablecoin provisions (Titles III-IV) create a compliant category of asset-referenced and e-money tokens, and the existence of targeted supervisory guidance on non-compliant stablecoins signals that the FMA is actively policing the boundary between compliant and non-compliant stablecoin-adjacent activity rather than treating MiCA authorisation as the end of its stablecoin-related supervisory interest.

Second, Bybit Payments GmbH was granted an Austrian electronic-money-institution licence on 4 August 2026, under Article 3(1) in conjunction with Article 4(4) of the E-Geldgesetz 2010. Notably, this EMI licence is structured as a legally separate entity from Bybit EU GmbH's existing MiCA crypto-asset-service-provider (CASP) authorisation. This dual-entity, dual-licence structuring is a pattern worth naming explicitly: a single corporate group operating a crypto-asset exchange obtains one Austrian authorisation for its crypto-asset-service activities under MiCA, and a separate Austrian authorisation under the E-Geldgesetz for e-money-type payment activities, held by a distinct legal entity. This separation may reflect prudential, capital or licensing-scope reasons for not seeking to cover both activity types under a single authorisation, and it is the kind of structuring choice that other payment-token-adjacent firms operating in Austria may also adopt.

Both developments sit against the backdrop of Austria's own national MiCA transitional window, which closed 30 December 2025 for firms previously registered under the FM-GwG. This is Austria's own deadline, distinct from the EU-wide 1 July 2026 backstop that some commentary conflates with national transitional arrangements. A firm that relied on Austrian FM-GwG registration and did not secure MiCA authorisation, or an alternative licence such as Bybit Payments' EMI route, by 30 December 2025 would, as of this cycle, already be operating outside its grandfathered window.

Outlook

The FMA's stablecoin guidance is the item most likely to generate near-term follow-on activity, since guidance aligned with ESMA's supervisory expectations typically precedes more concrete enforcement against identified non-compliant stablecoin activity rather than remaining purely advisory. The Bybit dual-licence structure is also worth watching as a template: if other crypto-exchange groups follow the same separation of EMI and CASP authorisations into distinct legal entities when operating in Austria, that would indicate the structure is being treated as a viable and replicable compliance pathway rather than a one-off arrangement specific to Bybit's own corporate structure.

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act (DORA) has applied to Austrian payment institutions and e-money institutions since 17 January 2025. Within the FMA, Department I/6 (Abteilung I/6) holds responsibility for ICT-risk supervision of Less Significant Institutions, payment institutions and e-money institutions, giving the operational-resilience framework a defined internal supervisory home rather than distributed responsibility. The FMA has published sector guidance titled "Reden wir über Aufsicht Nr. 5," described as drawing on experience from supervisory practice on ICT risk management under DORA — evidence that the framework has moved into active, guidance-generating implementation rather than remaining a newly-transposed rule awaiting first application.

A second operational-resilience development concerns payment-fraud controls at the transaction-rail level: since 9 October 2025, IBAN-name checking has been mandatory for SEPA Instant transfers under the Instant Payments Regulation. This requirement is set to extend to all payment transfer rails ahead of 2027, meaning the current SEPA-Instant-specific control is a precursor to a broader, cross-rail resilience and fraud-prevention requirement.

Taken together, these two developments show Austrian payment and e-money institutions operating under an increasingly mature and increasingly broad operational-resilience supervisory regime, spanning both ICT-risk management under DORA and transaction-level integrity controls under the Instant Payments Regulation.

Outlook

The scheduled extension of IBAN-name checking to all transfer rails ahead of 2027 is a defined near-term implementation milestone. Continued FMA guidance output under DORA, following the pattern set by "Reden wir über Aufsicht Nr. 5," is a further marker of the operational-resilience framework's maturing supervisory practice for Austrian payment and e-money institutions.

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act's obligations on operational-resilience standards and ICT-incident reporting have applied to Austrian payment institutions since 17 January 2025, per a Tier 4-sourced summary held at Probable confidence. This is confirmed this cycle as remaining a live supervisory file item rather than a settled, closed obligation: DORA compliance is an ongoing operational posture for Austrian PIs, not a one-time authorisation event, and it applies across both bank and non-bank payment institutions and e-money institutions operating in Austria.

No AT-specific DORA enforcement action, supervisory finding, or incident-reporting statistic was identified in sources reviewed this cycle; the finding here is limited to confirmation of continued applicability of the obligation itself.

Outlook

As DORA moves from its January 2025 applicability date into an established supervisory routine, watch for FMA supervisory statements, incident-reporting statistics, or any enforcement action specific to Austrian payment institutions that would upgrade this module's currently thin, single-source evidentiary basis.

Commercial Intelligence & Fintech

Bitpanda GmbH and Fibank, Bulgaria's First Investment Bank, announced a strategic partnership on 12 October 2026 under which Bitpanda Enterprise, Bitpanda's institutional and B2B arm, will become the sole crypto-asset-services provider integrated into the My Fibank mobile banking application. The partnership is structured as a B2B2C distribution arrangement: Bitpanda supplies the underlying crypto-asset infrastructure and services, while Fibank provides the retail distribution channel through its existing mobile-banking customer base. A consumer-facing launch is planned for early 2027; the event is accordingly announced rather than live, and financial terms of the arrangement were not publicly disclosed by either party.

Fibank's chief executive, Nikola Bakalov, was quoted framing the arrangement's significance partly in regulatory terms, stating that it was "particularly important that this new opportunity is being realized alongside an established European technology partner and in compliance with applicable regulatory requirements." This framing is consistent with a bank distribution partner seeking to offer crypto-asset access to its retail customers while relying on a regulated, EU-based crypto-asset service provider, namely Bitpanda, to supply the underlying service rather than building or licensing the capability independently.

The partnership announcement lands against the backdrop of continued uncertainty in Bitpanda's own public-market plans. As of 16 October 2026, Bitpanda's previously reported Frankfurt listing, which had carried a target valuation in the region of four to five billion euros, remains halted with no new date set. Compounding this, the company's chief executive, Lukas Enzersdorfer-Konrad, has confirmed he will leave the role in the first quarter of 2027. The confluence of a stalled listing and a confirmed leadership departure, set against an active pursuit of new bank-distribution partnerships, suggests Bitpanda is treating commercial distribution expansion as a growth channel that does not depend on resolution of its public-listing timeline or on leadership continuity.

The Fibank partnership is notable as a cross-border commercial development: Fibank is domiciled in Bulgaria while Bitpanda operates from its Austrian base, meaning the underlying crypto-asset-services component of the partnership will be delivered across an intra-EU border under whatever passporting or cross-border service arrangement applies to Bitpanda's existing Austrian authorisation. No details of that cross-border servicing structure were disclosed in the sources available this cycle.

Outlook

Whether the My Fibank crypto integration proceeds on schedule to its planned early-2027 consumer launch is the most direct near-term marker of whether this partnership develops into a material revenue channel for Bitpanda or remains at the announcement stage. More broadly, further bank-distribution partnership announcements in subsequent cycles, were they to occur, would strengthen the reading of this arrangement as part of a deliberate strategic pivot toward B2B2C distribution during a period in which Bitpanda's IPO plans remain unresolved and its executive leadership is in transition, rather than as an isolated commercial agreement.

Commercial Intelligence & Fintech

The only commercial-perimeter event located for Austria this cycle was a set of FMA consumer warnings against three entities operating without authorisation: Coinmindz, STIG International Trading & Gemstone FZCO, and BeHappy Exchange. These warnings were issued within the current delta window and are confirmed directly from the FMA's own primary notices. A consumer warning of this kind typically indicates that the FMA has identified an entity soliciting or marketing financial or crypto-asset-adjacent services to the Austrian public without holding the required authorisation, rather than confirming a fraud or money-laundering finding; the warning itself is a perimeter-control measure, not a completed enforcement decision against the named entities.

No disclosed deal values, funding rounds, or product-launch events specific to Austria's payments or fintech sector were located within this window beyond the licensing activity already tracked under Licensing and Stablecoins. The commercial-events picture for Austria this cycle is therefore narrow: a cluster of three unauthorised-entity warnings rather than a broader set of discrete M&A, investment or product-launch events.

Outlook

Whether the three named entities cease marketing to the Austrian public following the warnings, or whether the FMA escalates to a more formal enforcement step, is the natural next signal to watch. The narrowness of this cycle's commercial-events picture for Austria — limited to unauthorised-entity warnings — also suggests that broader commercial and investment activity in the Austrian payments sector was either genuinely quiet this window or fell outside the current research pass's reach; the evidence available does not distinguish between those two possibilities.

Commercial Intelligence & Fintech

The FMA granted Bybit Payments GmbH an e-money-institution licence under Section 3(1) in conjunction with Section 4(4) of the E-Geld Act 2010 on 4 August 2026. This is a discrete, dateable commercial and licensing event, distinct from the structural market-development pattern of crypto-payments dual-licensing discussed elsewhere: a specific named entity, Bybit Payments GmbH, received a specific named authorisation on a specific date, complementing its affiliate Bybit EU GmbH's separate MiCAR crypto-asset-service-provider authorisation.

No deal value, investment amount, or transaction size attaches to this event, as it is a regulatory licensing grant rather than an M&A transaction or funding round; amount_disclosed considerations accordingly do not apply here. The event is nonetheless a material commercial-intelligence data point: it marks Bybit's formal entry into Austria's e-money-institution licensing regime, layered onto its existing MiCAR crypto-asset authorisation via its affiliate entity.

Outlook

Further commercial-intelligence tracking should watch for additional named-entity licensing events in Austria following the same dual-authorisation pattern, as well as for any subsequent commercial activity (partnerships, product launches, or funding events) building on Bybit Payments GmbH's newly granted e-money-institution licence.