Austria: The EU's Most Deliberate Regulator — Credible, Not Quick

Austria offers one of the EU's most credible crypto licences — but the FMA's thorough, 8-to-11-month review makes it a market for patient, well-capitalised operators, not first-timers.

● Orange

Operating a crypto ATM in Austria is fully legal, and Austria is already home to Kurant, Europe's largest single Bitcoin ATM operator with roughly 320 machines across Austria, Germany, and Spain.^1,2 Since MiCA's Austrian transitional period closed on 31 December 2025, any operator exchanging cash for crypto now needs a full Crypto-Asset Service Provider (CASP) authorisation from the Financial Market Authority (FMA), Austria's sole crypto supervisor.^3,4 The upside is genuine regulatory prestige: the FMA is widely described as structured, consistent, and well-reasoned, and an Austrian CASP authorisation already carries enough institutional weight that Bitpanda — one of Europe's largest retail exchanges — chose Austria as its home licence, later adding a second authorisation in Luxembourg.^5,6 The obstacle is exactly the flip side of that credibility: the FMA's review is detailed, formalised, and slow, realistic timelines run 8 to 11 months, and industry commentary explicitly describes Austria as unsuitable for early-stage projects and best suited to mature businesses that can support real local substance.^7,8 As in most markets on our legislation map, General Bytes as a hardware and software vendor is not itself performing a licensable activity; it is the in-country operator of the machines who must hold the CASP authorisation. For GENERAL BYTES, Austria reads as a credible but patience-intensive market — worth pursuing through an already-licensed, well-capitalised partner rather than a first-time applicant racing a deadline.

Last updated: July 2026

Regulatory Framework and Its Evolution

Austria regulated crypto businesses through a national VASP registration regime before MiCA existed, supervised by the FMA under standard AML rules. MiCA replaced that national framework outright: Austria implemented the regulation through its MiCA Enforcement Act (MiCA-VVG), which designates the FMA as the sole competent supervisor for CASPs and gives it enforcement powers including fines, suspension of operations, and public naming of violators.^9,10 Austria's transitional period for existing VASP-registered firms ran from MiCA's EU-wide entry into force on 30 December 2024 until 31 December 2025 — shorter than the full 18-month EU backstop, though not as aggressive as Germany's cutoff on the same date.^11,12 Transitioning from the old VASP registration to a full CASP licence is now mandatory for any firm that wants to keep operating, and the grandfathering window for that transition has already closed, meaning new entrants apply for a full CASP authorisation from a standing start.

Getting Licensed: Three Classes, One Demanding Regulator

Austria's CASP licence follows MiCA's standard three-tier structure. Class 1 (advice, order transmission, portfolio management) requires €50,000 minimum capital and a €3,000 government fee; Class 2 (custody and exchange of crypto for fiat or other crypto-assets — the category a cash-to-crypto ATM fits) sits at €125,000; Class 3 (adding operation of a trading platform) requires €150,000 and a €10,000 government fee.^13,14 Every applicant needs a genuine Austrian legal entity with a physically registered office — the FMA explicitly assesses whether the entity has real operational independence and local decision-making capacity rather than being a letterbox structure, with compliance, AML, and risk-management functions expected to have actual Austrian presence, not just a nameplate.^15,16

The process itself runs through a preliminary meeting with the FMA, submission of the full authorisation application, a detailed FMA review with likely follow-up questions, and — once satisfied — publication of the licence on the FMA's public register.¹⁷ Early, structured engagement with the FMA is treated as close to essential rather than optional: applicants who address supervisory expectations reactively, after submission, face materially longer review cycles than those who front-load the preparation.¹⁸ Realistic timelines across independent sources converge around 8 to 11 months, with total first-year setup costs (legal, capital, audit, local staff) typically estimated at €70,000–€100,000 on top of the capital requirement itself.^19,20

As with the rest of our legislation map, this authorisation sits with the in-country operator of the machines, not with General Bytes as hardware and software vendor.

AML and KYC

Austria applies MiCA's standard EU-wide AML/CFT baseline rather than a distinctly stricter or looser national add-on: documented AML/CFT policies, a formal risk assessment, and an appointed compliance officer are core licensing conditions, alongside FATF Travel Rule compliance and real-time transaction monitoring.^21,22 This places Austria firmly in the full-KYC, convenience-model category rather than the anonymity-premium model — verify current per-transaction thresholds directly with the FMA or a licensed local operator before assuming any low-KYC tier exists, since sources consulted for this article describe the compliance obligation as continuous and account-level rather than built around a specific cash threshold. From January 2026, Austria has also layered on OECD Crypto-Asset Reporting Framework (CARF) obligations, requiring CASPs to report detailed client transaction and holding data to tax authorities, with penalties for reporting failures reaching €200,000.

Banking

Banking due diligence is listed as a standard, expected part of the FMA authorisation process rather than a separate obstacle to solve afterward — applicants are expected to present a banking strategy with identified partners as part of the licence application itself.²³ Austria's sophisticated banking infrastructure and the FMA's institutional credibility work in an applicant's favour here: a bank evaluating a CASP applicant with a credible FMA pathway is evaluating a business the regulator has already vetted to a high standard, which is a materially different conversation than banking an unlicensed crypto business.

The Next 24 Months: Institutional Depth, Not Speed

The EU-wide numbers put Austria's difficulty in context: of more than 1,200 firms that held national crypto registrations across the EU, only around 210 — roughly 17% — secured full CASP authorisation by the 1 July 2026 EU deadline, and Austria's own process is on the more demanding end of that distribution even among successful applicants.²⁴ That said, Austria's credibility premium is real and already proven: OSL Group, a Hong Kong-listed digital asset platform, deliberately chose Austria's FMA as its EU gateway in 2026 specifically for its EEA-wide passporting rights, while already holding a Netherlands MiCAR licence — evidence that sophisticated multi-jurisdictional operators view an Austrian licence as worth the extra time.²⁵

The market itself is proven at the ATM level too: Kurant, headquartered in Austria, is the largest single crypto ATM operator in Europe by machine count and has been expanding for close to a decade before pausing to complete its own MiCAR transition.^1,2 For GENERAL BYTES, the sensible read is that Austria is not a market to develop from zero with a first-time applicant — the FMA's own guidance and independent legal commentary both steer early-stage projects elsewhere — but it is exactly the kind of market where supporting an already-licensed operator, or facilitating a passported entry from a CASP authorised faster elsewhere in the EU, captures the opportunity without absorbing the 8-to-11-month FMA timeline directly.

Sources and references

1. Kurant scale and Austrian headquarters — de.kurant.net
2. Kurant as European market leader by ATM count — de.kurant.net
3. Austria's MiCA transitional period closing 31 Dec 2025 — enterworld.io
4. FMA as sole competent CASP supervisor — legalbison.com
5. FMA described as structured, consistent, well-reasoned — sb-sb.com
6. Bitpanda's Austrian FMA authorisation plus Luxembourg dual-rail — paybis.com
7. Realistic FMA timeline (8-11 months) — gofaizen-sherle.com
8. Austria unsuitable for early-stage projects per industry commentary — sb-sb.com
9. MiCA-VVG as Austria's MiCA enforcement act — legalbison.com
10. FMA enforcement powers (fines, suspension, naming) — legalbison.com
11. Austria transitional window (30 Dec 2024 - 31 Dec 2025) — enterworld.io
12. Comparative national transition timing across EU — gofaizen-sherle.com
13. MiCA capital tiers (€50k/125k/150k) and Austrian government fees — enterworld.io
14. Class 2 scope covering custody and exchange for fiat — enterworld.io
15. Local substance requirements and letterbox-structure scrutiny — gofaizen-sherle.com
16. Real Austrian presence for compliance/AML/risk functions — gofaizen-sherle.com
17. FMA application process steps — enterworld.io
18. Cost of reactive vs. structured FMA engagement — gofaizen-sherle.com
19. Timeline convergence around 8-11 months — gofaizen-sherle.com
20. First-year setup cost estimate (€70,000-100,000) — sb-sb.com
21. MiCA AML/CFT baseline requirements (policies, risk assessment, compliance officer) — tangle.ee
22. Travel Rule and real-time transaction monitoring — scorechain.com
23. Banking strategy as part of FMA readiness assessment — tangle.ee
24. EU-wide CASP approval rate (~210 of 1,200+, ~17%) — cryptobriefing.com
25. OSL Group choosing Austria FMA for EEA passporting — cryptobriefing.com

Legal Disclaimer: This article by GENERAL BYTES is for informational purposes only and does not constitute formal legal, financial, or investment advice. Austria's MiCA transitional arrangements have already closed and FMA supervisory practice continues to evolve through 2026; always consult specialised local legal counsel and confirm current FMA requirements before considering market entry.