The curated handbook for Austria is in review. The obligation register below accounts for the retained units described in its scope statement.
61 retained records are accounted for within this scope. The default view shows only mapped obligations; use the disposition filter to inspect mapped, contextual, outside-scope and unresolved retained records. This register does not establish full-instrument or complete national coverage.
Finanzmarkt-Geldwäschegesetz (FM-GwG): dated RIS OGD principal records and implementation notes
Bundeskanzleramt / RIS OGD
61 provisions accounted for · 50 independently reviewed
Rights pending independent review; no public or commercial redistribution approval asserted.
Finanzmarkt-Geldwäschegesetz (FM-GwG): dated RIS OGD principal records and implementation notes
Bundeskanzleramt / RIS OGD
SourceRights pending independent review; no public or commercial redistribution approval asserted.
Download register PDFDownload register CSV
27 provisions match this filter
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Before launching new products, practices or technology, an in-scope firm must assess its money-laundering, terrorist-financing and targeted-sanctions implementation/circumvention risks. The assessment must cover the actual customer, geographic, product, transaction and channel exposure and consider national and Commission risk findings. Keep an auditable, updated assessment and supply it electronically when FMA requests it. Proportionality affects the work, not an automatic exemption; only an FMA regulation can remove the recording requirement for specified clearly understood sector risks.
Before launching new products, practices or technology, an in-scope firm must assess its money-laundering, terrorist-financing and targeted-sanctions implementation/circumvention risks.
Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
A bank, payment or investment firm within the Act must apply section 6 due diligence when opening a relationship, not only when a transaction exceeds a threshold. Outside a relationship, the triggers include evidently linked transactions totalling at least EUR 15,000 and funds transfers strictly above EUR 1,000. Savings movements have their own EUR 15,000 trigger. Suspicion and doubts over identification trigger diligence irrespective of those amounts. Where an occasional transaction amount was unknown, the EUR 15,000 check becomes due once it is known and meets the threshold.
A bank, payment or investment firm within the Act must apply section 6 due diligence when opening a relationship, not only when a transaction exceeds a threshold.
Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Diligence must establish the customer, representatives, beneficial owners and any fiduciary relationship, understand ownership, relationship purpose and funds, and continue through monitoring and updates. A register extract is a reasonable beneficial-owner check, not a substitute for understanding control. Customers must disclose relevant fiduciary and ownership information and changes. The fiduciary itself requires physical identification, excluding third-party identification. Ordinary remote identification is allowed only through one of the listed safeguards and its conditions. Give every customer a risk class and be able to justify the measures to FMA; discretion over extent is not permission to omit the enumerated checks.
Diligence must establish the customer, representatives, beneficial owners and any fiduciary relationship, understand ownership, relationship purpose and funds, and continue through monitoring and updates.
Collect information Verify Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Complete the initial identification, purpose and funds checks before the relationship or occasional transaction, and obtain the specified beneficial-owner registration evidence for new entity relationships. A low-risk, business-continuity exception permits prompt completion during establishment; an account may be opened before completion only with transactions effectively blocked until the listed checks are fulfilled. Update existing clients when risks or material facts change. Failure of initial diligence blocks transactions and new relationships, requires ending existing relationships and consideration of a suspicious report; monitoring failures have a different holding rule. Insurance, trust beneficiaries and historic securities, savings and anonymous-box holdings have expressly specified timing or blocking requirements.
Complete the initial identification, purpose and funds checks before the relationship or occasional transaction, and obtain the specified beneficial-owner registration evidence for new entity relationships.
Verify Prohibited action Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
A firm choosing AI or advanced monitoring must show how its scenarios, parameters and thresholds meet the ordinary monitoring and unusual-transaction requirements at both enterprise and customer risk levels. Maintain and adjust it using FIU feedback and relevant data, and document its operation sufficiently for FMA to understand it. The provision permits automation; it does not require AI or authorise unrelated reuse of public or customer data.
A firm choosing AI or advanced monitoring must show how its scenarios, parameters and thresholds meet the ordinary monitoring and unusual-transaction requirements at both enterprise and customer risk levels.
Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Simplified diligence requires low risk in the particular relationship or transaction, not just a low-risk sector label. Keep evidence for that decision and continue enough monitoring to spot unusual or suspicious activity. Annex II factors and any applicable FMA rule inform the assessment. The domestic-payment carve-out from Regulation 2023/1113 is separate: the beneficiary provider must be AML-obliged, the payer must be traceable using the customer reference, and the transfer must be no more than EUR 1,000. It is not a blanket exemption from FM-GwG diligence.
Simplified diligence requires low risk in the particular relationship or transaction, not just a low-risk sector label.
Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Apply enhanced controls where the specific statutory cases or other evidence show elevated risk, using Annex III as a minimum risk-factor input. Investigate complex, unusually large, unusually patterned or apparently purposeless transactions as far as reasonably possible and intensify monitoring to decide whether they are suspicious. A fully group-compliant branch or subsidiary in a high-risk third country is not automatically subject to enhanced diligence solely for that location, but still needs a risk-based decision; this does not erase section 9a triggers for relationships or transactions.
Apply enhanced controls where the specific statutory cases or other evidence show elevated risk, using Annex III as a minimum risk-factor input.
Assess Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
For a relationship or transaction involving a high-risk third country as defined in section 2(16), obtain the six specified enhanced checks, including source-of-funds/financial-circumstances information, transaction reasons and senior approval to establish or continue the relationship. Increase monitoring. Additional restrictions, systematic reporting or establishment limits require the specified FMA or ministerial regulation; this section alone does not prove that a particular such regulation or current country designation applies.
For a relationship or transaction involving a high-risk third country as defined in section 2(16), obtain the six specified enhanced checks, including source-of-funds/financial-circumstances information, transaction reasons and senior approval to establish or continue the relationship.
Collect information Verify Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
A payment correspondent relationship with a third-country respondent requires banks and financial institutions to understand the respondent, assess its controls and supervision, secure senior approval, document responsibilities and check payable-through customer diligence and data access. CASPs have a different non-Union respondent rule, including authorisation/registration and targeted-sanctions controls. CASPs must also record policy-driven termination, refresh diligence regularly or when new risks appear, and use that information to set mitigation measures. The crypto-advice exception and the different third-country/non-Union wording must not be collapsed into one universal perimeter.
A payment correspondent relationship with a third-country respondent requires banks and financial institutions to understand the respondent, assess its controls and supervision, secure senior approval, document responsibilities and check payable-through customer diligence and data access.
Collect information Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Screen customers, beneficial owners and fiduciary principals for PEP status before establishing the relationship and periodically afterwards. For PEP relationships obtain senior approval, establish wealth and funds sources, and enhance monitoring. Family and known-close-associate cases are included. Leaving office does not automatically end treatment after one year: assess continuing risk for at least twelve months and retain appropriate measures until the PEP-specific risk is gone. The domestic exception concerns only point 2 and only the stated WiEReG senior-management beneficial-owner case without elevated-risk factors; it is not a general domestic-PEP exemption. Life insurance beneficiaries have separate pre-payout/assignment controls.
Screen customers, beneficial owners and fiduciary principals for PEP status before establishing the relationship and periodically afterwards.
Assess Verify Collect information
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
For transfers to or from self-hosted addresses, a CASP must assess AML/CFT and targeted-sanctions circumvention/implementation risks and maintain controls that mitigate the risks found. Use at least one of the listed mitigation types, such as risk-based identity checks, extra origin/destination information, enhanced monitoring or other relevant mitigation. The provision does not demand all four measures for every transfer and does not itself establish wallet ownership in a particular case.
For transfers to or from self-hosted addresses, a CASP must assess AML/CFT and targeted-sanctions circumvention/implementation risks and maintain controls that mitigate the risks found.
Assess Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Do not maintain shell-bank correspondent relationships or knowingly provide indirect shell-bank access, and do not maintain anonymous accounts, savings books or boxes. The separate non-cooperative-state regime depends on designation by government regulation, not automatically on an analyst reading a FATF list. For designated-state customers the specified original-document, personal-appearance and copy-retention controls apply, and banks/financial institutions must report linked qualifying transfers at EUR 100,000 or above. Licensing and qualifying-shareholding restrictions have their own stated presumption or proof rules.
Do not maintain shell-bank correspondent relationships or knowingly provide indirect shell-bank access, and do not maintain anonymous accounts, savings books or boxes.
Prohibited action Verify Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Third-party diligence does not transfer responsibility away from the relying firm. Obtain the necessary information promptly and ensure supporting copies can be supplied promptly on request, including electronic identification evidence. Only the defined eligible providers can qualify; currency-exchange-only authorisation is excluded. Third-country providers need equivalent diligence, retention and supervision. High-risk-third-country reliance is prohibited except for the specified fully group-compliant branches and subsidiaries. Ongoing transaction monitoring under section 6(1)(6) is not in the list of delegable diligence here.
Third-party diligence does not transfer responsibility away from the relying firm.
Collect information Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
An intragroup diligence programme can meet section 13 only if the information provider belongs to the same group, the group has compliant or equivalent diligence/retention/AML programmes, and a competent home-state or third-country authority supervises effective group-level implementation. Common ownership alone is not enough to rely on another group member.
An intragroup diligence programme can meet section 13 only if the information provider belongs to the same group, the group has compliant or equivalent diligence/retention/AML programmes, and a competent home-state or third-country authority supervises effective group-level implementation.
Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Report knowledge, suspicion or reasonable grounds promptly through FIU secure electronic channels, covering attempted and completed events, assets alone, undisclosed fiduciary relationships and the listed criminal/terrorist links. Answer FIU information requests even without a prior report. Banks have a separate unidentified-savings payout notification and seven-calendar-day minimum hold for balances of at least EUR 15,000, subject to a longer FIU order. FIU-provided monitoring data may be used only as appropriate and necessary for AML/CFT; its access and five-year deletion powers are public-body rules, not a new firm record-retention period.
Report knowledge, suspicion or reasonable grounds promptly through FIU secure electronic channels, covering attempted and completed events, assets alone, undisclosed fiduciary relationships and the listed criminal/terrorist links.
Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
After a suspicious report, stop further related execution and follow FIU instructions. If stopping is impossible or would impede pursuit of the beneficiaries, report immediately after execution instead. In doubt, incoming instructions may proceed but outgoing instructions must stop. A firm can seek an FIU objection decision and use the next-banking-day silence rule, but that is not permission to disregard an actual blocking order. Formal FIU orders have notification, challenge, lifting and expiry safeguards.
After a suspicious report, stop further related execution and follow FIU instructions.
Prohibited action Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Protect internal and FIU reporters, including employees and representatives, against threats, retaliation, hostility and employment disadvantage. FMA must provide a safe escalation route for those facing such treatment. The damages exclusion concerns delayed or refused transactions based on a suspicion negligently believed to be true; it is not blanket immunity for all conduct or deliberately false reports.
Protect internal and FIU reporters, including employees and representatives, against threats, retaliation, hostility and employment disadvantage.
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Keep FIU reporting and transaction-restraint activity confidential. If doing customer diligence would reasonably prejudice pursuit of a suspected transaction's beneficiaries, suspend those checks and report promptly instead. After FIU customer notification, refer an enquiring customer to FIU, or communicate the order yourself only with FIU consent. Permitted authority, law-enforcement, qualifying group and same-customer/same-transaction exchanges are defined exceptions, not a general licence to tell clients or all external counterparties.
Keep FIU reporting and transaction-restraint activity confidential.
Prohibited action Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Keep diligence evidence and transaction records for ten years from relationship termination or the occasional transaction, not five years from creation. Afterwards delete AML-only personal data unless another federal law supports longer retention, and preserve it through known relevant pending proceedings. Do not reuse AML-only data commercially. Give new customers the required privacy information before opening or transacting. The secrecy/public-interest rule is tied to protected AML functions and proceedings; it is not a blanket suspension of privacy rights.
Keep diligence evidence and transaction records for ten years from relationship termination or the occasional transaction, not five years from creation.
Retain records Prohibited action
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Build secure, confidential systems to answer FIU/FMA relationship enquiries completely and quickly, covering current relationships and the preceding five years. The five-year lookback is an enquiry scope, not a replacement for section 21's ten-year retention. Appropriate necessary AML exchanges about the same customer or transaction may include specified foreign institutions subject to eligibility/equivalence conditions. Section 20's tipping-off exception uses the narrower same-customer-and-same-transaction wording, so the exchange permission should not be treated as an unlimited disclosure exception.
Build secure, confidential systems to answer FIU/FMA relationship enquiries completely and quickly, covering current relationships and the preceding five years.
Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Put written, management-approved AML controls into continuing operation, with independent risk-based testing and a qualified, reliable special officer who reports directly to the board and has full access and enforcement powers. Also designate a responsible board member, train relevant staff continuously and check staff/supervisory-board reliability. Where internal audit is not mandatory, an independent review is still required if business nature and extent warrant it. Foreign e-money/payment providers with non-branch Austrian establishments need an Austrian central contact point only when the referenced delegated criteria are met.
Put written, management-approved AML controls into continuing operation, with independent risk-based testing and a qualified, reliable special officer who reports directly to the board and has full access and enforcement powers.
Appoint a role Train staff Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Targeted-sanctions compliance has its own written, board-approved control framework: assess non-implementation/circumvention risk, identify warning signs, manage exposure and cover the relevant notifications/reports. A special officer, staff training and risk-based independent testing are required, with corresponding section 23 officer safeguards. Group implementation and information/data safeguards apply too. The provision anchors the control duty but does not supply all underlying asset-freeze measures, reporting recipients or a verified match for any person.
Targeted-sanctions compliance has its own written, board-approved control framework: assess non-implementation/circumvention risk, identify warning signs, manage exposure and cover the relevant notifications/reports.
Assess Appoint a role Train staff Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Groups need written, effective AML and data-sharing policies across branches and subsidiaries. Other Member State branches obey local implementing law; third-country establishments with weaker minimum rules apply FM-GwG where local law permits. If local law blocks group implementation, notify FMA and add mitigation; insufficient mitigation can lead to supervisory limits or withdrawal from that country. Share suspicious-report information within the group unless an FIU instructs otherwise. The lawful sharing permission remains purpose-limited, not an unrestricted group data pool.
Groups need written, effective AML and data-sharing policies across branches and subsidiaries.
Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
When FMA requests information or documents within its remit, respond and produce or permit inspection of the material in the form it specifies. The power also reaches relevant insurance intermediaries and other persons. Other statutory secrecy remains protected in the general enquiry limb, but the entity's auditor cannot invoke that secrecy defence. The provision is not a standing instruction to upload every record absent a request.
When FMA requests information or documents within its remit, respond and produce or permit inspection of the material in the form it specifies.
Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
During an authorised on-site examination, provide needed records, information, premises access during usual hours, suitable facilities and readable reproductions of electronic records at the entity's expense. Examiners can question employees directly within their responsibilities. Normally there is one week's notice and a written mandate, but notice can be omitted to preserve the examination's purpose; findings are written and the entity can comment. Outsourced functions remain examinable irrespective of transfer-approval requirements, with host/FMA consent arrangements for cross-border examinations.
During an authorised on-site examination, provide needed records, information, premises access during usual hours, suitable facilities and readable reproductions of electronic records at the entity's expense.
Report