Austria's financial market authority FMA has fined Bitpanda GmbH EUR 70,000 for formal MiCA violations. The Bitpanda MiCA penalty is also the first legally binding penalty decision of this kind that the authority has published.
Bitpanda is a crypto trading platform founded in Vienna in 2014. The company offers custody, trading and order execution for cryptocurrencies. According to earlier statements, it serves more than 7 million users in Europe. The FMA supervises the Austrian financial market and also enforces MiCA there, the EU-wide rulebook for crypto service providers. That same authority originally granted Bitpanda its MiCA license for custody, trading and order execution in April 2025. Earlier, in January 2025, Germany's BaFin had issued a license that opened access to the entire European Economic Area. The supervisor objected to three points: a late whitepaper notification, a premature marketing communication and missing mandatory disclosures. The authority finally made the case public on 14 August.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
The three violations behind Bitpanda's MiCA penalty
For simple cryptocurrencies, MiCA follows a notification and publication principle. It applies to tokens that are neither asset-referenced tokens nor e-money tokens. Anyone offering such a token to the public must first prepare a whitepaper covering the issuer, the technology and the risks. The supervisor neither reviews the content of this document nor approves it. For these tokens, the regulation provides no formal approval procedure comparable to a securities prospectus. Article 8 does require a notification at least 20 working days before publication, however. Bitpanda missed that deadline. As a result, the FMA treated it as the first violation.
The second point concerns sequence. The platform distributed a marketing communication before the corresponding whitepaper appeared. MiCA instead requires advertising for a token offering to follow the publication of the document. Prospective buyers should therefore be able to read the material before they see an advertisement. The marketing rules in Article 9 consequently link directly to the whitepaper. The third violation concerns a marketing communication that lacked several of these mandatory disclosures.
Those include the notice that no authority has reviewed or approved the content. Furthermore, the material omitted the provider's statement of responsibility as well as contact details with a telephone number and email address. Such disclosures look formal, yet they serve a clear function in investor protection. They are meant to prevent an advertisement from creating the impression of official endorsement. The supervisor bundled all three points into a single penalty decision. Overall, the case stays entirely within the scope of the disclosure rules. Neither trading practices nor product design came into question.
Bitpanda's license and client funds remain untouched
The FMA made clear that the objections relate exclusively to timing and formal requirements. They concern Bitpanda GmbH, the Austrian entity of the group. The penalty decision contains no findings on client assets or on custody. Withdrawals likewise played no role in the proceedings. A withdrawal of the license was never at stake. The authorization from April 2025 covers custody, trading and order execution as well as further crypto services. It therefore stays fully in place. For customers of the platform, the decision changes nothing.
The heavier point is that the supervisor published the case at all. In Austrian administrative penal law, a Straferkenntnis is the formal penalty ruling of an authority. The FMA publishes such legally binding decisions to create transparency for market participants and investors. At the same time, it rejects any special status for the first MiCAR case.
"Publishing sanctions is part of the legal system and serves transparency for market participants and investors. The fact that this is the first published MiCAR case does not in itself justify any special status for the company concerned or for the violations identified." - FMA, statement on its publication practice
For the industry, that is exactly where the informational value lies. The decision shows which deadlines and formalities the supervisor actually enforces in the notification process. Moreover, the FMA visibly measures marketing material against the formal requirements of the regulation. The publication reaches well beyond the individual case. Competitors in the EEA can consequently read it as a checklist for their own token offerings.
End of the MiCA transition period brings tighter checks
The transition period for crypto service providers in the EU ended on 1 July 2026. Since then, only licensed providers may operate in the European Economic Area. The cut-off date closed the national transitional regimes for firms without a MiCA license. Anyone who did not apply in advance lost market access. National supervisors have widened their checks accordingly. Of 1,343 registered crypto service providers in the EEA, only 281 held a license at the cut-off date, according to TRM Labs. Around 1,062 providers thus remained without approval. A wide gap still separates registration from authorization.
Other enforcement cases came earlier. Germany's BaFin ordered the wind-down of Ethena GmbH in April 2025 and imposed a penalty payment of EUR 600,000. The order concerned the USDe token. That case, however, targeted the issuance rather than its promotion. The Austrian decision nevertheless remains the country's first published legally binding MiCAR sanction.
For providers with an EEA passport, the risk perspective shifts. Anyone serving the whole single market with one license stays subject to home-state supervision for every product communication. Bitpanda has also held the German license for EEA distribution since January 2025. The FMA itself had authorized the company only about 16 months before the fine. Proceedings ran in accelerated form under section 22(2b) FMABG, and the decision is final. Legal force and publication thus followed each other quickly.
Bitpanda pushes ahead with its Frankfurt listing
The sanction hits a company in the middle of listing preparations. Bloomberg reported in January 2026 that Bitpanda was seeking a listing on the Frankfurt Stock Exchange. The targeted valuation stood at EUR 4 billion to 5 billion, according to the report. For the offering, the group mandated Goldman Sachs, Citigroup and Deutsche Bank. Initially the group also examined London, but dropped that venue because of lower liquidity on the exchange there. Bloomberg named the first half of 2026 as the window, which has since passed. So far, the company has not given a date for the listing.
By comparison: in 2021 Bitpanda raised USD 263 million at a valuation of USD 4.1 billion. That equals roughly EUR 3.5 billion. The target for the listing sits well above that level. Converted, the fine amounts to around USD 81,000. At that scale, such a sum carries no weight. Its significance does not lie in the amount.
The timing matters more. Anyone seeking a listing on a regulated exchange must meet prospectus and disclosure duties reliably. Underwriting banks examine regulatory records closely beforehand. A published penalty decision on exactly these formal duties stays publicly visible later on. The BaFin license from January 2025 continues to secure the platform's access to the entire EEA. Its Austrian authorization likewise remains the basis of the domestic business. The FMA decision changes little about the growth trajectory. Internal approval processes for whitepapers and advertising, in contrast, move to the foreground.
