Austria fines Bitpanda €70,000 in first published MiCA enforcement decision

The penalty is notable not simply because of its size, but because it is the FMA’s first published final sanction under MiCA. The regulator said the proceedings were completed through an expedited procedure and that the decision is legally final.

White paper timing becomes the center of the case

At the heart of the MiCA breach was a failure involving the timing of a crypto-asset white paper.

According to the FMA, Bitpanda did not submit a required white paper to the regulator at least 20 working days before the document was due to be published. MiCA establishes specific disclosure procedures for crypto assets, with the white paper serving as a key source of information for prospective users and investors.

The regulator also found that Bitpanda distributed a marketing communication before the required white paper had been published.

A separate marketing communication created additional compliance problems. The FMA said it did not include the mandatory statement that the material had not been reviewed or approved by a competent authority. It also failed to make clear that the crypto-asset provider was solely responsible for the communication.

The same material was missing required contact information, specifically a telephone number and email address, according to the Austrian regulator.

The findings demonstrate how MiCA’s compliance framework extends beyond obtaining authorization. Firms must also ensure that individual disclosures and promotional materials comply with prescribed requirements.

Bitpanda’s regulatory credentials add weight to the penalty

The MiCA breach comes against the backdrop of Bitpanda’s aggressive push to establish itself as one of Europe’s most heavily regulated crypto platforms.

Bitpanda received a MiCAR license from Germany’s Federal Financial Supervisory Authority (BaFin) in January 2025. The company said the authorization allowed it to expand its crypto services throughout the European Union through the passporting framework.

Bitpanda now says it holds three MiCAR licenses, including authorizations in Germany, Austria and Malta. Its Austrian entity is authorized as a crypto-asset service provider under MiCAR by the FMA.

That regulatory footprint makes the Austrian enforcement action particularly relevant for the wider industry. The case shows that MiCA authorization does not represent the end of compliance obligations; instead, it places firms under an ongoing framework in which marketing, disclosures and operational conduct can face supervisory scrutiny.

When Bitpanda secured its first major MiCAR license in 2025, CEO and co-founder Eric Demuth described the approval as a new standard for the crypto industry.

“With the first MiCAR licence for a major crypto player, Bitpanda is setting a new standard for the crypto industry,” Demuth said at the time, adding that the framework would support regulated services across Europe.

The latest action illustrates the other side of that regulatory equation: companies seeking the credibility of regulated status must also meet the detailed obligations that come with it.

Austria’s penalty sends a wider warning to crypto firms

The MiCA breach also arrives at a pivotal moment for European crypto regulation.

MiCA was designed to replace the fragmented national approaches that previously governed much of the continent’s crypto sector with a common EU framework. Its requirements cover areas including authorization, investor protection, disclosures, market conduct and communications.

The end of the remaining transitional period on July 1, 2026, has further increased pressure on firms to operate within the new regime. Bitpanda itself described the date as the end of Europe’s previous period of regulatory fragmentation, emphasizing that MiCA passporting enables authorized crypto-asset service providers to operate across EU member states under a common framework.

That shift means regulators are increasingly moving beyond questions of who has a license and examining how licensed businesses conduct themselves.

For crypto companies, the lesson from the FMA decision is straightforward: regulatory compliance does not stop once authorization is secured. The deadlines attached to white papers, the wording used in advertising and even basic contact information can become enforcement issues.

The MiCA breach therefore carries significance well beyond Bitpanda’s €70,000 penalty. It is an early example of European regulators demonstrating that the bloc’s crypto rulebook has real enforcement teeth.

As more firms transition fully into the MiCA framework, the Austrian action could become a reference point for how national authorities interpret and enforce disclosure and marketing requirements across Europe.

For Bitpanda, the financial penalty is relatively modest compared with the company’s broader European operations. For the crypto industry, however, the message is considerably larger: MiCA compliance is no longer merely a licensing exercise—it is an ongoing regulatory obligation with consequences for firms that miss the details.