Austria’s Financial Market Authority has imposed a €70,000 fine on Bitpanda GmbH for violations of the European Union’s Markets in Crypto-Assets Regulation, marking the first time the regulator has published a legally binding MiCA penalty decision.
The Financial Market Authority, known as the FMA, said Bitpanda failed to submit a crypto-asset white paper at least 20 working days before its publication. The Vienna-based company also distributed marketing material before the related white paper was publicly available, according to the regulator’s decision.
The FMA said the marketing communication further failed to include disclosures and contact information required under MiCA. The penalty is legally binding, the authority said in a separate notice announcing the publication of its first final enforcement decision under the EU’s crypto rulebook.
The €70,000 sanction, equivalent to about $81,130 based on the figure provided in the announcement, is modest for a large European crypto business. Its publication nevertheless gives MiCA enforcement a more practical shape in Austria: compliance deadlines surrounding white papers and promotions can trigger penalties even where the breach concerns disclosure timing rather than custody or customer assets.
White paper rules move into enforcement
MiCA sets standardized requirements for crypto-asset issuers and service providers operating across the European Economic Area. White papers are intended to give users information about a crypto asset, its risks, the issuer, and related arrangements before it is marketed to the public.
The FMA’s decision centers on the sequencing of those disclosures. Under the regulator’s account, Bitpanda did not provide the white paper with the required 20-working-day lead time and marketed the crypto asset before publication. The finding puts attention on an operational area that can be easy to treat as administrative: coordinating regulatory filings, website publication and promotional campaigns.
Marketing communications under MiCA must also satisfy their own requirements. They must be clearly identifiable as marketing, presented fairly and not misleadingly, and consistent with information in the corresponding white paper. The FMA said Bitpanda’s communication omitted mandatory disclosures and contact details.
The case does not allege a loss of customer assets, market manipulation, or failures in the company’s custody operations. It concerns the disclosure framework around a crypto-asset publication. That distinction matters for readers assessing the decision: the regulator’s enforcement action addresses how information reached the public, rather than an allegation that Bitpanda mishandled client holdings.
Bitpanda operates under MiCA authorization
Bitpanda was founded in Vienna in 2014 and offers cryptocurrency services including custody, exchange and order execution. The company has grown from an Austrian retail-focused platform into a provider serving customers across parts of Europe.
Germany’s Federal Financial Supervisory Authority, BaFin, granted Bitpanda a MiCA license last year, allowing it to provide services across the European Economic Area under the regulation’s passporting framework. Austria’s FMA separately authorized Bitpanda GmbH in April 2025 for custody, exchange, order execution and other crypto-asset services.
That authorization remains relevant in the context of the fine. MiCA licensing gives approved firms a route to operate throughout the single market, but it also subjects them to detailed rules covering governance, customer protections, communications, conflicts, capital and conduct. The Bitpanda case shows that authorization does not insulate a provider from enforcement when regulators identify shortcomings in specific requirements.
According to the information supplied, Bitpanda acknowledged an internal error related to public filing dates, corrected the missing information and resolved the matter without contesting it. The FMA’s published decision did not change the company’s authorization status.
A test of the EU’s new crypto framework
The EU began applying major portions of MiCA in late 2024, replacing a patchwork of national rules with a shared regulatory regime for crypto-asset services. National authorities remain responsible for supervision and enforcement within their jurisdictions, making early cases useful indicators of how consistently the rules will be applied in practice.
Austria’s first published penalty arrives as regulated firms adjust internal processes to rules that can be highly prescriptive. A 20-working-day filing requirement, for example, requires legal, product and marketing teams to work to a timetable that may not match the faster launch cycles common in crypto markets.
The fine also places marketing practices under closer scrutiny. Promotional material has long been a concern for financial regulators because retail users may encounter advertisements before they read a prospectus, disclosure document or product explanation. Under MiCA, regulators can examine whether the promotional message appeared too early, whether it matched official disclosures and whether it contained required warnings and business details.
For crypto users, the enforcement decision offers a practical reminder that authorization can be checked through national regulators’ public registers. A provider’s legal entity, authorized services and country of supervision may differ from its brand name or mobile application. The FMA and BaFin maintain registers for supervised firms, while MiCA’s cross-border framework allows licensed providers to serve customers in other EEA states.
IPO plans add scrutiny to compliance record
The penalty comes as Bitpanda has reportedly been considering a public listing. Bloomberg reported in January that the company was exploring an initial public offering on the Frankfurt Stock Exchange at a valuation of €4 billion to €5 billion. Bloomberg said Goldman Sachs, Citigroup and Deutsche Bank had been hired to arrange the potential offering.
A €70,000 fine would be financially limited relative to the scale suggested by that reported valuation range. Yet public enforcement decisions can carry added weight for companies seeking to expand, win institutional partnerships or prepare for a listing, because compliance systems become part of the scrutiny applied by regulators, banks and prospective shareholders.
The FMA’s action does not establish a pattern on its own, and the regulator has not said whether further MiCA penalties involving other firms are imminent. It does provide Austria’s first public benchmark for enforcement under the regime: promotional and disclosure obligations are being treated as enforceable requirements, rather than as secondary paperwork around regulated crypto services.
To understand MiCA, whitepapers, and security obligations behind this Bitpanda case, read our guide here.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
