Obtain an Austria MiCA license for CASP activities under FMA supervision. RUE supports exchanges, custody providers, brokers, and platforms from structuring to authorization and EU passporting.
Prepared by RUE editorial team · Reviewed by Milana · Updated 20 October 2026
Schedule Free ConsultationAustria is a credible EU base for serious crypto businesses that need regulatory depth, banking credibility, and access to the DACH market. RUE helps founders build an Austria MiCA license application that is legally coherent, operationally defensible, and ready for FMA scrutiny.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
RUE provides end-to-end support for MiCA License in Austria projects: regulatory scoping, Austrian company formation, governance design, application dossier drafting, AML/CFT framework, DORA and outsourcing documentation, and regulator-facing support.
We also coordinate banking strategy, tax and reporting workstreams, and post-authorization readiness so your Austria MiCA license is built for approval and for sustainable operation after launch.
The Austrian Financial Market Authority (FMA) is viewed as a serious prudential supervisor with strong expectations on governance, AML, and operational resilience.
A properly authorized Austrian CASP can passport eligible services across the EU, subject to MiCA notification mechanics and host-state non-prudential rules.
Austria is strategically relevant for businesses targeting German-speaking markets and counterparties that value regulatory credibility over speed alone.
Austria suits founders prepared to invest in substance, internal controls, safeguarding, Travel Rule implementation, and DORA-ready ICT governance.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
An Austria MiCA license is a full CASP authorization, not a light AML registration. In 2026, the FMA expects applicants to prove that the business is properly classified, adequately capitalized, governed by fit and proper management, operationally resilient, and able to protect client assets and client data in practice.
The legal core is Regulation (EU) 2023/1114 (MiCA), but a viable filing in Austria also sits inside a wider stack that includes Regulation (EU) 2023/1113 for the crypto Travel Rule, DORA for ICT risk and resilience, Austrian AML/CFT rules, company law, tax reporting architecture, and data protection. The FMA does not assess your business plan in isolation; it assesses whether your operating model can survive real supervisory scrutiny.
Below are the core requirements founders usually need to solve before filing for a MiCA license in Austria.
You normally need an Austrian legal entity, typically a GmbH, entered in the Firmenbuch, with genuine operational substance in Austria. The FMA will look beyond registered address formalities and assess whether strategic decision-making, control functions, records, and outsourced oversight are actually anchored in the jurisdiction.
A common mistake is assuming that one nominal local director solves substance. It does not. Substance is a combination of premises + governance + people + records + control over outsourced providers.
MiCA prudential safeguards must equal at least the higher of the applicable service-class amount (€50,000, €125,000 or €150,000) and one quarter of annual fixed overheads. Providers in their first year use projected overheads for the first 12 months. These safeguards must be maintained continuously, not only when applying.
RUE generally advises founders to budget using a simple prudential formula: regulatory own funds + 12 months operating burn + contingency reserve + remediation buffer. This is more realistic than focusing on the legal minimum alone.
The FMA will assess the suitability of the management body and the transparency of the ownership chain. Shareholders with qualifying holdings of 10% or more trigger enhanced scrutiny, including reputation, financial soundness, and source-of-funds review.
One underappreciated issue is that the regulator may challenge not only who owns the company, but also whether the ownership structure makes supervision harder. Over-layered offshore chains, nominee-heavy structures, and unexplained intercompany flows are classic red flags.
A CASP in Austria must implement a business-specific AML/CFT framework aligned with Austrian law and the EU Travel Rule under Regulation (EU) 2023/1113. The FMA expects operational controls, not generic policy templates.
In practice, many applications weaken here because the applicant cannot explain how its ledger, wallet infrastructure, compliance tooling, and case-management process connect end to end. The FMA will care about that architecture.
MiCA authorization in 2026 sits inside the DORA environment. You must show that your ICT framework is governed, documented, tested, and capable of incident handling, continuity, and outsourced provider oversight.
A strong Austria MiCA license file usually includes more than policy PDFs. It includes architecture diagrams, vendor maps, control matrices, and evidence that management understands its own operational dependencies.
Your application must explain exactly what services you will provide, to whom, through which channels, with which controls, and with what economics. The program of operations is the backbone of the dossier because every other document should align with it.
One practical nuance: if your revenue model depends on activities that may fall outside MiCA, such as payment services, financial instruments, or yield products, the FMA will expect that perimeter issue to be addressed before authorization, not after.
If your model includes custody or transfer-related functions, safeguarding is central. The regulator will want to see how client crypto-assets and client funds are segregated, reconciled, protected, and recoverable.
Founders often underestimate reconciliation. In regulated crypto, reconciliation is not only an accounting matter; it is a safeguarding control that links prudential supervision, complaints handling, and insolvency preparedness.
Compare Austria with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
A MiCA license in Austria is a prudential and conduct authorization, not a tax ruling. In 2026, founders must separate three layers: (1) licensing and supervision by the FMA, (2) Austrian corporate and indirect tax treatment, and (3) crypto tax reporting readiness under emerging international and EU transparency frameworks such as OECD CARF and DAC8.
For Austrian CASPs, the practical issue is not only the headline tax rate. The real issue is whether your platform architecture captures the data needed for tax, compliance, and audit simultaneously. If your onboarding, wallet attribution, order management, and ledger systems are fragmented, you can become reporting-noncompliant even while remaining formally licensed.
RUE coordinates Austrian legal, accounting, and reporting workstreams so the licensing file, finance stack, and tax data model do not contradict each other. For related support, clients often combine this work with our accounting services, Austria Crypto Tax, and bank account in Austria services.
An Austria MiCA license is the start of supervision, not the end of the project. CASPs must maintain prudential, AML, operational, ICT, and conduct compliance on a continuous basis.
An Austria MiCA license is the authorization required for a business that provides regulated crypto-asset services in or from Austria under Regulation (EU) 2023/1114. In Austrian practice, the competent authority is the FMA, and the license is relevant for businesses such as custodians, exchanges, brokers, trading platforms, and firms providing crypto advice or portfolio management within MiCA perimeter.
The key point for 2026 is simple: the old idea of a generic “crypto registration” is no longer enough for most serious operating models. If your business receives or transmits client orders, executes exchange transactions, holds client crypto-assets, operates a platform, or transfers crypto-assets on behalf of clients, you should assess whether you need a full CASP authorization rather than relying on legacy AML-era assumptions.
Austria is not a fast-track jurisdiction. It is a credible one. That matters if your target audience includes institutional clients, banking partners, payment providers, auditors, or counterparties that will diligence your governance stack before they diligence your product.
RUE structures MiCA License in Austria projects around one principle: first classify the model correctly, then build the company, governance, documentation, and operational controls around that classification. This avoids the most expensive mistake in crypto licensing—preparing a beautiful application for the wrong regulatory perimeter.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Define the exact CASP services, token types, client flows, and overlap risks with MiFID II, EMI, PSD2 or other regimes. This is the highest-value stage because wrong classification causes later rework. Duration: 2-6 weeks.
Incorporate the Austrian entity, usually a GmbH, prepare ownership chain disclosures, secure registered and operational presence, and align governance with the intended license scope. Duration: 2-5 weeks.
Appoint directors and key function holders, define reporting lines, outsourcing model, conflicts framework, and control ownership. Build the management and substance model before drafting the final dossier. Duration: 2-4 weeks.
Prepare the full application package: program of operations, business plan, financial projections, AML/CFT framework, Travel Rule workflow, safeguarding, outsourcing, ICT and DORA-ready documentation. Duration: 6-12 weeks.
Run internal consistency checks across legal, financial, AML and ICT documents. Resolve contradictions in service scope, revenue assumptions, staffing, and vendor dependencies before filing. Duration: 1-3 weeks.
Submit the complete CASP application to the FMA with supporting corporate and fit-and-proper documentation. The quality of the first filing materially affects the later review timeline. Duration: 1-2 weeks.
The authority reviews whether the file is complete. A commonly referenced benchmark under MiCA is up to 25 working days for completeness review, subject to the file being truly complete. Incomplete files trigger delay. Duration: 3-5 weeks.
After completeness, the authority proceeds with substantive assessment. A commonly referenced MiCA benchmark is up to 40 working days, but requests for information, interviews, and remediation rounds can extend the practical timeline significantly. Duration: 2-5 months.
After approval, finalize banking, operational controls, staff training, reporting routines, and passporting notifications where relevant. Authorization is not the finish line; it is the start of live compliance. Duration: 2-6 weeks.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
The difference is that a MiCA license is a full CASP authorization, while the old VASP model was primarily AML-centered. Under MiCA, the FMA reviews governance, own funds, safeguarding, outsourcing, complaints handling, conduct, and ICT resilience in addition to AML/CFT.
For a founder, the practical consequence is major: MiCA is not just about onboarding and monitoring. It is about whether your entire operating model is licensable and supervisable.
The Austrian Financial Market Authority (FMA) is the competent authority for CASP authorization in Austria. The legal basis is Regulation (EU) 2023/1114, supported by related EU and Austrian rules.
In practice, the FMA will assess the applicant’s legal structure, management, shareholders, AML framework, safeguarding, outsourcing, and ICT governance before granting authorization.
A realistic timeline is usually around 6 to 12 months, depending on service complexity, dossier quality, local substance, and how quickly the applicant answers follow-up questions.
Typical stages include:
Complex models, weak source-of-funds evidence, poor outsourcing controls, or perimeter uncertainty can push the process beyond 12 months.
The required prudential safeguards are the higher of the applicable Annex IV amount (€50,000, €125,000 or €150,000) and one quarter of annual fixed overheads. New providers use projected overheads. Article 67 permits qualifying own funds, compliant insurance or a comparable guarantee, or a combination; the service-class figures alone are not the complete requirement.
Do not confuse:
For multi-service models, founders should usually plan against the higher applicable threshold and maintain additional operational funding.
In practice, applicants typically use an Austrian legal entity, usually a GmbH, with real local substance. The FMA will expect more than a mailing address. It will assess whether the Austrian entity has effective management, records, governance, and oversight over outsourced functions.
Pure letterbox structures are a red flag. The stronger the service scope, the more important substance becomes.
Yes, an authorized Austrian CASP can passport eligible MiCA services across the EU through the MiCA notification framework. This is one of the main reasons founders choose an EU home state such as Austria.
However, passporting does not eliminate all local obligations. You still need to consider:
Passporting covers the regulated service authorization. It does not erase every host-state legal issue.
Not automatically. Staking, lending, yield products, and tokenized securities often require separate perimeter analysis. Some models may fall partly outside MiCA or trigger other regimes such as MiFID II, EMI, PSD2, banking, or fund rules.
This is why regulatory classification should be done before the application is drafted. A wrong perimeter assumption can invalidate the whole filing strategy.
Ongoing obligations include capital maintenance, governance, AML/CFT, Travel Rule compliance, safeguarding, outsourcing oversight, complaints handling, and ICT resilience. In 2026, DORA is also part of the operating environment for regulated crypto firms.
A CASP must remain able to evidence its controls through logs, reconciliations, incident records, board reporting, and updated policies. Authorization is not a one-time event.
CARF and DAC8 affect data capture and tax reporting readiness rather than the MiCA authorization itself. They matter because a CASP may need to identify reportable users, collect tax-relevant due-diligence data, and maintain structured transaction records.
The practical implication is architectural: your onboarding, wallet attribution, ledger, and reporting stack should be designed from day one with reporting fields in mind.
Yes, Austria can be an excellent jurisdiction for institutional-grade crypto businesses that are prepared for a serious compliance build. It is especially attractive for DACH-focused strategies, custody-heavy models, and founders who value regulatory credibility with banks, investors, and enterprise counterparties.
It is less suitable for teams looking for the cheapest or lightest-touch route. Austria is a premium compliance jurisdiction, and that is precisely its strategic value.
