Mica CASP Authorisation in Austria (FMA): How to Apply, Requirements, Timeline and Estimated Costs

Get MiCA CASP authorisation in Austria at a glance

Austria has positioned itself as a credible gateway for crypto-asset firms seeking to operate across the European Economic Area. The MiCA CASP Austria authorisation route, administered by the Financial Market Authority (FMA), gives successful applicants a single licence that can be passported throughout the EU. This guide sets out precisely what the FMA expects, which documents and capital floors you must satisfy, how long the process realistically takes, and what budget to plan for drawing exclusively on primary regulatory and legislative sources.

Introduction: What is MiCA CASP and why Austria?

Brief definition of CASP under MiCA

A Crypto-Asset Service Provider (CASP) is any legal entity that provides one or more crypto-asset services to third parties on a professional basis. Under Regulation (EU) 2023/1114 the Markets in Crypto-Assets Regulation (MiCA), crypto-asset services include custody and administration of crypto-assets on behalf of clients, operation of a trading platform, exchange services (crypto-to-fiat and crypto-to-crypto), execution of orders, placing, transfer services, reception and transmission of orders, and portfolio management. Article 59 MiCA requires any entity wishing to provide these services in the EU to obtain authorisation from the competent authority of the Member State in which it is established.

Why Austria and the FMA statutory designation and MiCA-VVG

Austria enacted the MiCA-Verordnung-Vollzugsgesetz (MiCA-VVG), the national enforcement law that designates the FMA as the competent authority for CASP authorisation and ongoing supervision. The MiCA-VVG also specifies ancillary national rules, administrative procedures and penalty regimes that complement MiCA’s directly applicable provisions.

Austria’s appeal for crypto-asset firms is practical. The FMA has a track record of engaging constructively with fintech applicants, the DACH region provides a deep talent pool, and the country’s geographic and legal proximity to major EU markets makes it a natural hub. Importantly, the FMA has already begun granting CASP authorisations during 2025–2026, creating real precedent and demonstrating that the process is operational not theoretical. For founders, compliance officers and advisors evaluating an Austria crypto licence, early movers benefit from clearer supervisory expectations and faster feedback cycles.

How the FMA supervises CASPs

FMA expectations: roadmap, bilateral briefings, recommended procedure

The FMA has published detailed guidance for CASP applicants and encourages early, structured engagement. Prospective applicants are expected to contact the dedicated CASP team (casp@fma.gv.at) before filing, participate in bilateral briefings, and follow the published roadmap. This pre-application dialogue allows the FMA to flag potential gaps early, reducing the risk of protracted clarification rounds after formal submission.

Interaction with European Supervisory Authorities

The FMA does not operate in isolation. It applies convergence tools published by ESMA and EBA, including the ESMA Supervisory Briefing on Authorisation of CASPs (January 2025), which harmonises the assessment methodology for management suitability, qualifying holdings and operational resilience across all national competent authorities. Applicants should treat these ESA guidelines as binding in practice; the FMA cross-references them routinely during assessment. The FMA also aggregates relevant ESMA and EBA guidelines on its website for ease of reference.

Process: step-by-step application timeline for MiCA CASP in Austria

Step 0 Pre-application scoping and legal form

Determine the appropriate corporate vehicle. MiCA requires the applicant to be a legal person established in an EU Member State. Non-EU groups must either incorporate an Austrian subsidiary or, where permitted, establish a branch. At this stage, map the specific crypto-asset services you intend to offer against MiCA’s service catalogue (Article 3(1)(16)) and identify the corresponding capital and governance requirements. Owner: founders, corporate counsel.

Step 1 Early engagement with the FMA

Submit an expression of interest to casp@fma.gv.at and request an initial meeting. Use the FMA CASP Roadmap to structure your preparation. Typical timeframe: 2–4 weeks to secure a bilateral briefing slot. Owner: Head of Compliance / external regulatory counsel.

Step 2 Prepare statutory documents

Draft the detailed business plan, programme of operations, governance framework (management body composition, committees, reporting lines), AML/CTF manual, prudential capital projections, IT and operational resilience policies, outsourcing register and continuity/wind-down plan. Each document must demonstrate compliance with MiCA’s substantive requirements and FMA supervisory expectations. Owner: compliance, legal, IT security and finance teams working in parallel. Typical timeframe: 2–4 months.

Step 3 Compile required attachments

Prepare KYC and KYB documentation for all qualifying shareholders, evidence of management suitability (CVs, police clearance, regulatory references), technical security assessments, legal opinions on custody arrangements, and audited or projected financial statements. Owner: compliance officer, company secretary. Typical timeframe: runs concurrently with Step 2.

Step 4 Submit formal application under Article 62 MiCA

File the complete application package with the FMA. The filing must include all items prescribed by Article 62, the accompanying delegated and implementing technical standards, and any national supplements required by the MiCA-VVG. Incomplete filings will be returned; the statutory assessment clock does not start until the FMA confirms completeness. Owner: external regulatory counsel. Typical timeframe: filing day.

Step 5 Completeness review and clarifications

Expect the FMA to issue one or more rounds of follow-up questions, particularly on governance arrangements, AML/CTF processes and IT architecture. Responding promptly is critical delays here extend the overall timeline. Typical timeframe: 4–8 weeks for initial completeness confirmation, followed by iterative queries.

Step 6 Suitability assessments

The FMA conducts fit-and-proper assessments for each member of the management body and qualifying shareholder, applying joint EBA/ESMA methodology and the ESMA Supervisory Briefing. Reference checks, criminal record reviews and assessment of relevant experience are standard. Typical timeframe: 2–4 months (runs partly in parallel with Step 5).

Step 7 Decision, conditions and EU passporting

If the FMA is satisfied, it issues the authorisation potentially subject to conditions (e.g., phased service launch, enhanced reporting). Post-authorisation, the newly licensed CASP can notify the FMA of its intention to passport services into other EEA Member States. Owner: compliance, business development. Typical timeframe from complete filing to decision: 6–12 months.

Step 8 If refused: rights and remedies

Where the FMA refuses an application, the decision must be reasoned. Applicants have the right to appeal under Austrian administrative law within prescribed deadlines. Common grounds for refusal include inadequate capital, governance deficiencies and unresolved suitability concerns. Early engagement and thorough preparation substantially reduce refusal risk.

Key requirements and eligibility for a CASP licence in Austria

Minimum governance and suitability floors

The management body must comprise individuals who collectively possess sufficient knowledge, skills and experience in crypto-assets, financial services, technology and risk management. MiCA requires that managers be of good repute and that no member has been convicted of offences related to money laundering, terrorist financing or financial crime. A local contact point in Austria is advisable to facilitate supervisory interactions.

Prudential and capital requirements

MiCA prescribes minimum initial capital floors that vary by service type. For example, firms offering only advisory or order-reception services face lower thresholds, while those operating trading platforms or providing custody face higher requirements. Additionally, CASPs must maintain own-funds equal to at least the higher of a fixed floor or a proportion of fixed overheads. Applicants must prepare detailed prudential projections and demonstrate an ability to absorb losses over a planning horizon. Specific floors are set out in Title V of Regulation (EU) 2023/1114 and refined by delegated acts.

Operational resilience and custody rules

• Safekeeping of client assets: CASPs providing custody must segregate client crypto-assets from proprietary holdings and implement multi-layered security controls (cold storage, key management, disaster recovery).
• IT resilience: Incident response, penetration testing and business continuity plans must meet standards aligned with DORA and ESMA expectations.
• Outsourcing governance: Material outsourcing arrangements must be documented, risk-assessed and subject to contractual audit rights.

AML/CTF responsibilities

CASPs must implement risk-based AML/CTF policies, customer due diligence (including enhanced due diligence for high-risk scenarios), ongoing transaction monitoring and sanctions screening. The FMA supervises sanctions compliance for CASPs, reinforcing the expectation of robust screening infrastructure. Compliance officers must have direct reporting lines to the management body.

Documents checklist

The core application documents include:

• Detailed business plan: services, target markets, revenue model, three-year projections.
• Governance framework: organisational chart, committee terms of reference, internal controls.
• AML/CTF manual: risk assessment, CDD procedures, suspicious-transaction reporting.
• IT and security policies: architecture diagrams, key management, incident response, penetration testing schedule.
• Outsourcing register: material service providers, contractual safeguards, exit strategies.
• Shareholder structure: ultimate beneficial owners, qualifying holdings declarations.
• Financial statements or projections: audited where available; otherwise reviewed projections.
• Fit and proper evidence: CVs, criminal records, regulatory references for all directors and qualifying shareholders.

A downloadable FMA CASP application checklist (Austria) is available to help applicants track each deliverable against the FMA’s expectations.

Comparison: VASP registration (FM-GwG) vs MiCA CASP authorisation in Austria

The difference is fundamental. VASP registration under the FM-GwG was an AML-focused registry requirement with no prudential oversight and no cross-border effect. MiCA CASP authorisation is a comprehensive licence that imposes capital, governance, conduct-of-business and operational-resilience obligations but grants the powerful benefit of an EU-wide passport. Firms currently holding a VASP registration that wish to continue operating must plan their transition to MiCA CASP authorisation proactively. A transition guide: VASP → CASP can help registered VASPs map compliance gaps and manage deadlines.

Costs and realistic timeline estimates for MiCA CASP Austria

One-time application costs

Total initial outlay varies significantly by scope and complexity. The following ranges reflect external advisory fees, IT audits, independent attestations and initial regulatory capital contributions:

• Small start-up (limited services, e.g., advisory or order reception): EUR 80,000–200,000.
• Medium (trading platform + custody): EUR 200,000–750,000.
• Large (exchange + custody + EMT/ART services): EUR 750,000+, with materially higher capital requirements.

Ongoing costs

Post-authorisation, CASPs should budget for regulatory reporting and supervision fees payable to the FMA, dedicated compliance headcount (minimum two FTEs for smaller operations), annual external audits, cyber and professional indemnity insurance, and periodic penetration testing and IT resilience assessments.

Timeline

Based on the FMA’s published CASP Roadmap and early authorisation precedents, the typical timeline from a complete filing to an FMA decision is 6–12 months. Well-prepared applications with thorough pre-application engagement, complete documentation and responsive management can achieve the shorter end of this range. Complex cases particularly those involving qualifying holdings reviews, group structures or novel custody models may exceed 12 months. Early and constructive engagement with the FMA remains the single most effective way to compress timelines.

Document checklist and downloadable pack

Applicants should assemble the following core documents before formal filing:

1. Detailed business plan and programme of operations
2. Governance framework and organisational chart
3. AML/CTF manual with risk assessment methodology
4. IT architecture, security and incident response policies
5. Outsourcing agreements and risk assessments
6. Shareholder structure and qualifying holdings declarations
7. Audited financial statements or reviewed financial projections
8. Fit and proper dossiers for all directors and qualifying shareholders
9. Prudential capital projections and solvency demonstration
10. Wind-down and business continuity plan

A comprehensive FMA CASP application checklist (Austria) is available as a downloadable document to support applicants through the preparation phase. A companion CASP capital and budget template (Austria) can assist with financial planning and prudential modelling.

Closing summary and next steps for applicants

Obtaining MiCA CASP authorisation in Austria is a rigorous but navigable process. The FMA is the designated competent authority under MiCA and the national MiCA-VVG, and it has demonstrated its willingness to grant authorisations to well-prepared applicants. The key pillars of a successful application are a robust governance framework with demonstrably suitable management, adequate regulatory capital and prudential projections, comprehensive AML/CTF and operational resilience arrangements, and a willingness to engage constructively with the FMA from the earliest possible stage. Firms that invest in thorough preparation and follow the FMA’s roadmap can realistically move from planning to an operational, EU-passported MiCA CASP Austria licence within 6–12 months of filing. For those exploring broader crypto licensing services (EU & Austria), this authorisation represents the most comprehensive path to pan-European market access.

Sources

• EUR-Lex Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation)
• FMA Information for CASP applicants
• FMA Roadmap for Crypto-Asset Service Providers (CASP)
• RIS (Bundesrecht) MiCA-Verordnung-Vollzugsgesetz (MiCA-VVG)
• ESMA Supervisory Briefing on Authorisation of CASPs (January 2025)
• FMA Public statement on CASP authorisations in Austria
• FMA ESMA Guidelines (aggregated)