The FMA oversees the authorisation of firms carrying out regulated payment-related activities. The main legal basis is the ZaDiG 2018, which has applied since 1 June 2018 and implements the EU’s PSD2.
There is no single MSB authorisation covering every type of money-related activity. The correct route depends on what a firm intends to do, how it handles customers’ funds, and whether it already holds permission in another EEA country.
FMA Authorization under ZaDiG 2018
The ZaDiG 2018 sets out the requirements for firms performing specified operations involving customer accounts and electronic transfers. The FMA grants authorization upon finding the applicant to be the appropriate choice from both a legal and operational point of view.
The type of activities which are covered in the local regime are as follows:
- Carrying out money transfers between accounts;
- Processing direct debits, credit transfers, and card purchases;
- Issuing items utilized to effectuate electronic purchases;
- Processing and accepting card purchases on behalf of sellers;
- Transferring funds between parties without opening accounts;
- Initiating transactions on customer’s instruction;
- Offering account data through the electronic channels.
The legal classification of an activity is determined mainly by its content. Thus, the activity of a business entity which calls itself an MSB does not automatically imply that it is classified under ZaDiG 2018. However, it does come under it if it carries out one of the above-mentioned activities.
To make it more precise, the rules also distinguish kinds of authorizations. Companies performing transfer or card-related activities could require FMA authorization whereas an account information provider may follow a separate registration procedure. Permission covering one activity does not automatically imply permission for all other activities.
Main Criteria for Local Authorization
FMA looks into the question whether a given business model is sufficiently capitalized, professionally led, and that there are strong processes in place.
The main areas for assessment:
- Minimum starter’s capital;
- Directors and shareholders;
- Protection of customer money;
- Operational controls;
- Technological aspects and continuity.
How to Obtain Authorisation
Preparing for FMA review starts with a clear description of the planned activities. The submission should show how the proposed operation will function, who will oversee it, and how customer money and information will be protected.
| 1. Define the activity | Identify the intended operations and establish which category under ZaDiG 2018 applies. |
| 2. Prepare a business plan | Describe the target market, expected income, operating costs, and projected figures for the first three financial years. |
| 3. Demonstrate available funds | Provide evidence that the applicable starting-fund threshold can be met and explain how customer money will be safeguarded. |
| 4. Set out responsibilities | Identify the directors, describe their roles, and explain how supervision and day-to-day decisions will be handled. |
| 5. Compile supporting records | Prepare the required corporate, ownership, financial, technical, and procedural information. |
| 6. Submit the request to the FMA | File the materials through the applicable channel and respond to any follow-up questions from the authority. |
The FMA may seek further explanations if the proposed activities or supporting evidence are unclear. Applicants should therefore ensure that their business plan, projected figures, and operational procedures describe the same intended operation.
Payment initiation operators must also address the applicable professional indemnity insurance or equivalent guarantee rules. The exact conditions should be checked against the current legal provisions.
Obligations After Approval
Receiving authorisation does not end the FMA’s oversight. An authorised firm must continue meeting the conditions attached to its permission and notify the authority of relevant changes where the law requires it.
Ongoing duties may include:
- Maintaining sufficient funds.
- Protecting customers' money under the applicable safeguarding rules.
- Keeping accurate accounting records.
- Monitoring operational and security incidents.
- Providing supervisory information when required.
- Maintaining appropriate procedures for customer complaints and unauthorised operations.
Technology-related rules are particularly relevant in 2026. The EU DORA has applied since 17 January 2025 to entities within its scope. It establishes requirements for managing ICT risks, handling disruptions, and reporting certain incidents.
Firms should also review the applicable EU rules on strong customer authentication, customer disclosures, and liability for unauthorised transfers. The precise obligations depend on the activities performed and the rules applicable to the specific firm.
Can a Foreign MSB Operate in Austria?
An entity that has been allowed to operate in a different EU or EEA state could still offer its services to Austrian clients without taking additional licence locally provided they remain engaged in similar business ventures. The outcome would ultimately depend upon two factors: the extent of such a company’s permit and its successful accomplishment of the relevant cross-border notification procedure.
The passporting mechanism in Europe doesn’t guarantee immediate market entry to all foreign operators in Austria. The company has to prove that they are licensed for those businesses at least in one member country. Furthermore, the permission granted through that licensing must also allow carrying out all the intended operations in Austria.
FAQ
Is there a single MSB authorisation in Austria?
No. The country does not have one universal authorisation covering every activity involving money. Firms carrying out regulated operations may need approval under the ZaDiG 2018, while other activities can fall under different legal regimes.
Which authority oversees MSBs in Austria?
The FMA oversees firms subject to the country’s payment-related rules. It grants authorisations for applicable activities and maintains information about authorised and registered entities.
How long does the FMA procedure take?
The timeframe depends on the proposed activities, the completeness of the submission, and any questions raised during the review. Applicants should confirm the current procedure directly with the FMA rather than rely on a fixed estimate.
Can a foreign MSB serve Austrian customers?
An operator authorised in another EU or EEA country may be able to operate across borders after completing the applicable notification procedure. A foreign authorisation does not automatically cover activities outside its approved scope.
Can an authorised MSB accept bank deposits?
An authorisation under the ZaDiG 2018 does not permit a firm to accept deposits as a bank. Deposit-taking generally falls under a separate Austrian banking regime.
Do Austrian MSBs have to follow DORA in 2026?
DORA has applied since 17 January 2025. Firms within its scope must meet the applicable rules on ICT resilience, incident handling, and related oversight. The precise obligations depend on the entity’s legal category and activities.
Where can an Austrian authorisation be verified?
The FMA’s official website and company database allow users to check an entity’s status and the scope of its permission. Checking these details before entering into an arrangement helps establish whether the firm is authorised for the activities it advertises.
