Fintech 2026

AUSTRIA Law and Practice Contributed by: Oliver Völkel and Philipp Ley, CERHA HEMPEL

under MiCA. In these cases, the issuer or platform could fall within the regulatory framework, depending on the structure and functionality of the tokens. 10.13 Stablecoins Stablecoins in Austria are regulated under MiCA. At their core, stablecoins are digital instruments pegged to legal tender or other assets. Buyers obtain a right to redeem them at par value. Unlike volatile crypto- assets such as Bitcoin, stablecoins are not designed for speculation but for stability. MiCA distinguishes between two types of stablecoins. E-money tokens are crypto-assets designed to main - tain a stable value by referencing a single official cur - rency (eg, US dollar or euro). Meanwhile, an asset- referenced token is a crypto-asset that is explicitly not an e-money token and purports to maintain a stable value by referencing another value or right (such as gold, securities, other crypto-assets), or a combina - tion thereof, including one or more official currencies. Under MiCA, the supervisory treatment of stablecoins depends on the role performed: either as a CASP offering services related to the tokens, or as the issu - er responsible for their creation and circulation. Both perspectives trigger distinct regulatory obligations, governance expectations, and prudential standards. Stablecoins generally trigger a white paper obligation under MiCA. Before making any offer to the public in the EU or before admitting such tokens to trading, a white paper must be submitted to the competent authority. While for ARTs the white paper forms part of a formal authorisation process and must be approved, for EMTs, prior notification to the competent authority is sufficient. The regulatory treatment of EMTs reflects the institutional supervision already applicable to their issuers.

PSD2 promotes competition, innovation and con - sumer choice by enabling new fintech services such as account aggregation and payment initiation. The FMA supervises compliance and banks must ensure API access and strong customer authentication (SCA). 11.2 Concerns Raised by Open Banking Banks and technology providers address data privacy and security concerns in open banking through SCA, secure APIs and full compliance with the GDPR. They must obtain explicit customer consent, implement encryption and access controls, and ensure secure data processing. Regulatory oversight is shared between the FMA for PSD2 compliance and the Data Protection Authority for GDPR enforcement. Fraud in the context of financial services and fintech is governed by Section 146 of the Austrian Crimi - nal Code. Fraud occurs when a person intentionally deceives another about facts in order to obtain unlaw - ful financial gain for themselves or a third party. The deception must cause the victim to act, refrain from acting or tolerate something, resulting in a financial loss to themselves or another. In the context of financial instruments, fraud may also fall under capital market laws, for example, misrepre - sentations in investment advice or securities offerings may constitute investment fraud, triggering additional penalties under criminal and administrative law (eg, under the Capital Markets Act or MAR). The FMA may also take enforcement action in cases involving mis - leading conduct in regulated financial services. 12.2 Areas of Regulatory Focus The FMA closely monitors financial fraud types that are especially relevant in the fintech and digital asset space. A key focus is on fraudulent online trading platforms, particularly those involving crypto-assets. These scams often involve fake websites posing as legitimate brokers, promising high returns on invest - ments in cryptocurrencies, foreign exchange or stocks. These platforms simulate trading activity but misappropriate client funds. 12. Fraud 12.1 Elements of Fraud

11. Open Banking 11.1 Regulation of Open Banking

Open banking in Austria is supported by the PSD2, which mandates banks provide licensed third-party providers with access to customer account data with the customer’s consent via secure APIs.

49 CHAMBERS.COM