Illustrative firm examples
Austria country research brief
Research dated 2026-10-11 · Reviewed 2026-10-11
Version b9467fd30cb9
b9467fd30cb99a20aa8377e5c1fa34fb44061ba823c911259bec3d53fbd519b6Scope: Illustrative firm examples. The selector is not an authorisation or legal-applicability determination. Source-check observations concern retrieval/access only and do not establish legal currentness; the research date is the content date boundary. Source health: review-required, checked 2026-10-12T06:35:21.928Z.
Framework and authorities
Financial-market scope
FM-GwG covers credit and financial institutions and defined crypto-asset service providers, not every Austrian profession. Section 2 includes payment, e-money and investment firms within its definitions; crypto advice is excluded from the CASP service definition. Austrian-headquartered bank/financial-institution branches in other Member States are excluded by section 1. Part 7 has its own FMA-supervision perimeter. Establish the entity, service and location before assigning duties.
Authorities and reporting
FMA supervises the specified financial-market entities. BMF coordinates the national risk analysis; A-FIU is within the Bundeskriminalamt and receives and analyses suspicious reports. Section 16 requires prompt reports through FIU secure electronic channels; section 17 governs restraint and its exceptions. BMI's January-February 2026 article describes goAML as the reporting portal, not proof of an actual firm registration or submission.
Dated evidence, not current-law approval
The RIS OGD request specified 6 October 2026 but the response did not echo that date. All returned principal bodies, index and annexes are accounted for, plus five implementation notes, not five full amendment Acts. Section 32b conflicts with the updated index/old registration regime; sections 37 and 44 record unimplemented amendments. Section 43a's operating transition ended by 31 December 2025. Exact October legal effect remains unverified.
Risk and sanctions context
National risk evidence
BMF's 294-page NRA is dated 14 May 2025. The selected executive-summary narrative highlights fraudulent/company structures, offshore arrangements, crypto, false invoices, real estate, life insurance and hawala (p. 6). It describes legitimate income/donations and self-financing in terrorist-financing cases (p. 8), and dual-use procurement exposure from industrial production (p. 10). These are dated risk findings, not an automatic rating of a customer, nationality or entire sector.
Sanctions are a separate legal regime
Sections 4 and 23a address risk-based targeted-sanctions controls; section 2(24) distinguishes freezing assets from prohibiting their availability to designated targets. FMA's 30 December 2025 notice states that financial-sector sanctions supervision moved from OeNB on 1 January 2026. BMF separates financial sanctions from goods/export and other enforcement. Underlying SanktG, EU/UN measures, applicable notifications and live designations still need separate verification; no person or transaction match is established.
FATF: a dated evaluation observation
FATF's official publication page dates the evaluation to 30 April 2026, based on a June-July 2025 visit, and describes enhanced follow-up after that assessment. Enhanced follow-up is not the increased-monitoring or call-for-action list. The bounded page observation is retained as an author record, not native report bytes; the precollection report download returned 403. No full-report analysis, later follow-up status or live classification is asserted.
Selected firm implications
Meaning: Section 4 requires assessment of AML/CFT and targeted-sanctions implementation/circumvention risks, including new products, practices and technology before introduction. Keep an updated traceable assessment for FMA.
Conditions: Entity within sections 1-2; assessment proportionate to nature and size.
Exceptions: Only an applicable FMA regulation can remove recording for qualifying clear-risk sector types; none is established here.
Suggested action: Review the launch assessment, evidence of national/Commission risk inputs and electronic record ownership.
National Legislation / Legislation / Retained legislation edition; current legal effect unverified · § 4Meaning: Section 5 triggers diligence including for relationships, linked occasional transactions of at least EUR 15,000, funds transfers above EUR 1,000, suspicion and identity doubts. Monetary triggers do not replace the relationship/suspicion tests.
Conditions: Qualifying obliged entity and any enumerated trigger; linked operations aggregate for the EUR 15,000 test.
Exceptions: Unknown occasional amounts trigger diligence once known and meeting the threshold; no amount exemption for suspicion or identity doubts.
Suggested action: Check relationship and occasional-transfer routes separately against section 6 checks and section 7 timing.
National Legislation / Legislation / Retained legislation edition; current legal effect unverified · § 5Meaning: Section 11a requires a CASP to assess transfers to/from self-hosted addresses and apply risk-corresponding mitigation, covering AML/CFT and targeted-sanctions implementation/circumvention.
Conditions: CASP within section 2(22) and a self-hosted transfer under section 2(23).
Exceptions: At least one listed mitigation type is required, not automatically all four; product exposure alone does not establish statutory scope.
Suggested action: Check the risk assessment and chosen identification, origin/destination, monitoring or other mitigation evidence.
National Legislation / Legislation / Retained legislation edition; current legal effect unverified · § 11aNotices and limitations
- Illustrative bank, payments and crypto examples, not an assessed firm profile.
- Product/customer exposure alone is not statutory applicability. This is not a licensing guide.
- Local entity / domestic activity selected.
- 3 representative dated legislation examples; see the full register for other duties.
- Legislation from a retained reviewed edition; later amendments, commencement and current legal effect are not verified. These are dated examples, not confirmed current obligations.
- Source observations are unavailable, stale, failed or review-required. This dated brief does not confirm today's legal position.
- Independent review accepts this dated brief and 50 own-analysis units, including all 27 mapped duties. Eleven unsampled units remain withheld; three legal-effect questions remain unresolved. Originals, full translations and evidence remain private analysis-only pending rights review.
- Not yet covered: complete Austrian jurisdiction, authentic later-amendment reconciliation, underlying sanctions measures and sector guidance.
- Next action: check actual statutory actor and transaction facts, then verify the applicable edition and exceptions before changing controls. The public register distinguishes reviewed dated analysis from withheld units; it is not current-law approval.
Evidence sources
Original source documents are not reproduced in this brief. Retained originals are private research evidence; use the official-source links.
- Generated Custody Of Official Native Xml · RIS / BKA · Requested 6 Oct 2026; not echoed or certified · Whole principal set; examples sections 4, 5, 11a
- Official National Risk Assessment Original · BMF · 14 May 2025; whole 294-page PDF retained · Executive-summary narrative pp. 6, 8, 10; selected claims only
- Official Information Page Original · BMI · Öffentliche Sicherheit 1-2/2026 · A-FIU organisation and goAML narrative
- Official Information Page Original · FMA · 30 December 2025 notice; transition 1 January 2026 · Opening and financial-sector supervision context
- Official Information Page Original · BMF · Official information page retained 11 October 2026 · Financial, goods/export and other authority roles
- Generated Primary Page Observation Not Native Original · FATF · 30 April 2026 publication; observed 11 Oct 2026 · Publication paragraph and Further action; no native report
FM-GwG dated native set
Requested 6 Oct 2026; not echoed or certified · Whole principal set; examples sections 4, 5, 11a
Source record
Retrieved 2026-10-11T02:18:52Z. SHA-256: 37116d0caff6d6e1a4e54e5d7f85a378156787bb9bc87abeeb0f28153946811a
Source retrieval check
failed · Checked 2026-10-12T06:35:14.569Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
NRA 2025
14 May 2025; whole 294-page PDF retained · Executive-summary narrative pp. 6, 8, 10; selected claims only
Source record
Retrieved 2026-10-11T02:00:40Z. SHA-256: bbbfb1f05f5ce1e31f91991520cb8bc444be02748aab171dc9d23cf766ffb025
Source retrieval check
observed · Checked 2026-10-12T06:35:15.322Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
BMI / A-FIU
Öffentliche Sicherheit 1-2/2026 · A-FIU organisation and goAML narrative
Source record
Retrieved 2026-10-11T02:00:49Z. SHA-256: d88784342a56e6f16e6ded4a64018bd56d851f02b71e74dfe698b83c196583eb
Source retrieval check
observed · Checked 2026-10-12T06:35:18.563Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
FMA notice 30 Dec 2025
30 December 2025 notice; transition 1 January 2026 · Opening and financial-sector supervision context
Source record
Retrieved 2026-10-11T02:00:50Z. SHA-256: d8fed6b475b67f0a4b0736b70eb6eec06d23b44ae5ae7fbf72bf1aadfa7ac849
Source retrieval check
review-required · Checked 2026-10-12T06:35:19.476Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
BMF sanctions context
Official information page retained 11 October 2026 · Financial, goods/export and other authority roles
Source record
Retrieved 2026-10-11T02:00:47Z. SHA-256: 394964c99b20403be953963ca38f03694181cac5415ae5664ae520ea2ee9dd71
Source retrieval check
review-required · Checked 2026-10-12T06:35:20.338Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
FATF publication observation
30 April 2026 publication; observed 11 Oct 2026 · Publication paragraph and Further action; no native report
Source record
Retrieved 2026-10-11. SHA-256: 36259c04f365a77148470e9e55133e2224e47e5bb5e260238e8a63b225989d2e
Source retrieval check
failed · Checked 2026-10-12T06:35:21.928Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
Retail bank
Meaning
Section 4 requires assessment of AML/CFT and targeted-sanctions implementation/circumvention risks, including new products, practices and technology before introduction. Keep an updated traceable assessment for FMA.
Full public provision explanation
Before launching new products, practices or technology, an in-scope firm must assess its money-laundering, terrorist-financing and targeted-sanctions implementation/circumvention risks. The assessment must cover the actual customer, geographic, product, transaction and channel exposure and consider national and Commission risk findings. Keep an auditable, updated assessment and supply it electronically when FMA requests it. Proportionality affects the work, not an automatic exemption; only an FMA regulation can remove the recording requirement for specified clearly understood sector risks.
Suggested action
Review the launch assessment, evidence of national/Commission risk inputs and electronic record ownership.
Conditions
Entity within sections 1-2; assessment proportionate to nature and size.
- Assess existing exposure and new activity before introduction; maintain the evidence and respond to FMA requests.
Exceptions
Only an applicable FMA regulation can remove recording for qualifying clear-risk sector types; none is established here.
- An FMA regulation may exempt specified sector entity types from recording where the statutory clear-risk conditions are met; no such regulation is established here.
Payments and e-money
Meaning
Section 5 triggers diligence including for relationships, linked occasional transactions of at least EUR 15,000, funds transfers above EUR 1,000, suspicion and identity doubts. Monetary triggers do not replace the relationship/suspicion tests.
Full public provision explanation
A bank, payment or investment firm within the Act must apply section 6 due diligence when opening a relationship, not only when a transaction exceeds a threshold. Outside a relationship, the triggers include evidently linked transactions totalling at least EUR 15,000 and funds transfers strictly above EUR 1,000. Savings movements have their own EUR 15,000 trigger. Suspicion and doubts over identification trigger diligence irrespective of those amounts. Where an occasional transaction amount was unknown, the EUR 15,000 check becomes due once it is known and meets the threshold.
Suggested action
Check relationship and occasional-transfer routes separately against section 6 checks and section 7 timing.
Conditions
Qualifying obliged entity and any enumerated trigger; linked operations aggregate for the EUR 15,000 test.
- Any listed trigger is sufficient; combine evidently linked operations for point 2(a); the transfer threshold is more than, not at least, EUR 1,000.
Exceptions
Unknown occasional amounts trigger diligence once known and meeting the threshold; no amount exemption for suspicion or identity doubts.
- No monetary exemption is stated for business relationships, suspicion or identification doubts; unknown point 2(a) amounts defer the threshold trigger only until known.
Crypto and digital assets
Meaning
Section 11a requires a CASP to assess transfers to/from self-hosted addresses and apply risk-corresponding mitigation, covering AML/CFT and targeted-sanctions implementation/circumvention.
Full public provision explanation
For transfers to or from self-hosted addresses, a CASP must assess AML/CFT and targeted-sanctions circumvention/implementation risks and maintain controls that mitigate the risks found. Use at least one of the listed mitigation types, such as risk-based identity checks, extra origin/destination information, enhanced monitoring or other relevant mitigation. The provision does not demand all four measures for every transfer and does not itself establish wallet ownership in a particular case.
Suggested action
Check the risk assessment and chosen identification, origin/destination, monitoring or other mitigation evidence.
Conditions
CASP within section 2(22) and a self-hosted transfer under section 2(23).
- Crypto-asset transfer to or from a self-hosted address defined in section 2(23).
Exceptions
At least one listed mitigation type is required, not automatically all four; product exposure alone does not establish statutory scope.
- The minimum is one or more mitigation types, not necessarily all four; suitability still follows the risks identified.