Financial Integrity Monitor

Austria AT

Domains (D1–D6)

Sources

Role actions

Horizon <90d

Jurisdiction profile

Largely CompliantTier ARisk: StableMixed

Austria's AML/CFT/CPF regime rests on the FMA (financial supervision), the police-based A-FIU, and the WiEReG beneficial-ownership register.

The FATF's April 2026 5th-round MER found clear progress on BO transparency and supervision but placed Austria in enhanced follow-up over FIU resourcing, restrictive ML-offence interpretation, weak asset recovery, and fragmented DNFBP supervision.

Key deficiencies

A-FIU under-resourced with limited budgetary/recruitment independence, narrowly focused on predicate offences rather than complex/cross-border ML
Restrictive judicial interpretation of the money-laundering offence limits investigation and prosecution volume
DNFBP supervision (beyond casinos, lawyers, notaries) suffers fragmentation, resource shortages and few remedial actions
No comprehensive national asset-recovery strategy; confiscation and victim restitution levels low
Historical precedent of delayed EU AML directive transposition (CJEU referral in 2020 over AMLD4)

Recent developments (18m)

FATF published Austria's 5th-round Mutual Evaluation Report (30 April 2026); Austria placed in enhanced follow-up with a 3-year roadmap of Key Recommended Actions
Raiffeisen Bank International's continued large-scale Russia exposure and Austria's October 2025 stalling of the EU's 19th Russia sanctions package to secure compensation via unfreezing Deripaska-linked Rasperia assets
Rene Benko/Signa insolvency-fraud prosecution culminating in a Supreme Court-confirmed 2-year sentence (2 July 2026)
FMA MiCA transition: only 4 of 13 grandfathered crypto-asset service providers retained authorization by the 31 December 2025 deadline
EU AMLA became operational (Frankfurt seat, chair appointed) with AMLR/6AMLD implementation pipeline advancing toward 2027 application

Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Austria's Finanzmarktaufsicht (FMA) became, as of 1 January 2026, the sole supervisor for both anti-money laundering/counter-terrorist-financing (AML/CFT) and financial sanctions across the country's financial market participants, under the newly adopted Sanctions Act 2024 (Sanktionengesetz 2024), which replaces the Sanctions Act 2010. The consolidation extends explicit supervisory coverage to credit and financial institutions, payment institutions, investment firms, alternative investment fund managers, insurers, and crypto-asset service providers, closing an institutional seam that previously distributed sanctions and AML/CFT oversight across separate structures. This is an architecture story, not an incident: the significance lies in the structural closing of a fragmentation gap rather than in any single enforcement action.

The consolidation's timing is notable against a second development this cycle: Austria's 2026 FATF mutual evaluation found clear progress in strengthening the country's AML/CFT legal and regulatory framework, yet placed Austria in enhanced follow-up. The unresolved issue is not architecture but capacity — the operational resources of the Financial Intelligence Unit, law enforcement, and prosecution services need to be increased, a gap independently corroborated by an IMF publication of the same underlying assessment. Austria has therefore closed a structural seam at the supervisory level while an unresolved capacity gap in investigation and prosecution — flagged since 2016 — persists at the enforcement-delivery level.

Other Developments

Sparkasse Oberösterreich Bank AG fine. The FMA imposed a EUR 60,000 fine on Sparkasse Oberösterreich Bank AG for breach of AML/CFT due-diligence obligations. This is a routine, single-source enforcement action rather than evidence of a systemic control gap on its own, but it sits within the same due-diligence framework the FATF evaluation and IMF assessment scrutinised at the national level, illustrating that individual-institution enforcement continues alongside the structural consolidation described above.

Crypto-asset service providers folded into unified sanctions supervision. The FMA's expanded sanctions-supervision mandate under the Sanctions Act 2024 explicitly integrates crypto-asset service providers into the same unified sanctions-screening architecture used for banks and payment institutions. This is a deliberate extension of the consolidated supervisory perimeter to a sector that, in many jurisdictions, sits outside mainstream sanctions-screening obligations; Austria's approach brings CASPs inside the one-stop-shop framework from the outset rather than layering crypto-specific rules on afterward.

Cross-Monitor Connections

The FMA's sanctions/AML consolidation and the CASP integration into that same architecture both carry direct relevance for institutions operating payment rails and crypto infrastructure in Austria, a natural point of connection to payments-monitor findings on Austrian licensing activity this cycle. The FATF enhanced-follow-up placement, grounded in unresolved investigation and prosecution capacity rather than in the supervisory architecture itself, is the kind of structural, capacity-level finding that connects to broader conflict-finance and enabler-jurisdiction analysis elsewhere in the fleet, even though no AT-specific enabler-jurisdiction or conflict-finance material surfaced independently this cycle.

Outlook

The FATF's roadmap for Austria runs through a multi-year follow-up period in which the country must report progress against the recommended actions identified in the 2026 mutual evaluation, with supervisory and prosecutorial resourcing expected to increase over that period. Whether the FMA's newly consolidated architecture translates into improved ML investigation and prosecution outcomes — the specific gap that kept Austria in enhanced follow-up despite the acknowledged progress on the legal and regulatory framework — is the central question to track. The CASP integration into unified sanctions supervision is also worth monitoring for how it interacts with Austria's broader crypto-asset licensing activity under MiCA.

weekly_brief_draft · JID AT

Domain intelligence (D1–D6)

D1 Sanctions Architecture and Evasion

Sanctions Architecture and Evasion

Austria has closed a significant institutional seam in its sanctions-supervision architecture. As of 1 January 2026, the Finanzmarktaufsicht (FMA) became the sole supervisor for financial sanctions and AML/CFT across the country's financial market, under the newly adopted Sanctions Act 2024, which replaces the Sanctions Act 2010. Prior to this consolidation, sanctions and AML/CFT supervision sat across a more fragmented set of arrangements; the new architecture brings credit and financial institutions, payment institutions, investment firms, alternative investment fund managers, insurers, and crypto-asset service providers under a single supervisory roof for both functions simultaneously.

The architectural significance of this move should be read against Austria's 2026 FATF mutual evaluation, which found clear progress in strengthening the country's AML/CFT legal and regulatory framework but nonetheless placed Austria in enhanced follow-up. The follow-up placement did not turn on sanctions architecture as such, but on unresolved capacity in ML investigation and prosecution — a gap independently corroborated by an IMF publication of the same underlying assessment, and one that has persisted since at least 2016. The consolidation therefore represents genuine progress on the architecture side of the sanctions-and-AML equation, but it has not yet been shown to resolve the capacity-side gap that FATF specifically flagged.

A further extension of this architecture brings crypto-asset service providers explicitly within the unified sanctions-screening framework alongside banks and payment institutions, rather than leaving CASPs to a separate or delayed sanctions-compliance track. This positions Austria among jurisdictions treating crypto infrastructure as a first-class citizen within mainstream sanctions supervision from the outset of a consolidated framework, rather than retrofitting crypto-specific sanctions rules after the fact.

No AT-specific evidence of sanctions-evasion typologies, autonomous-listing divergence, or enforcement actions specifically tied to sanctions breaches (as distinct from AML/CFT due-diligence breaches) surfaced this cycle. The Sparkasse Oberösterreich fine, discussed under the AML/CFT domain, pertains to due-diligence obligations rather than sanctions screening specifically, and should not be read as a sanctions-architecture finding.

Outlook

The key question for the sanctions-architecture domain going forward is whether the FMA's consolidated supervisory mandate produces measurable improvement in the capacity gaps FATF identified, particularly around ML investigation and prosecution resourcing, over the multi-year follow-up period FATF has set. The integration of CASPs into the unified framework is also worth tracking as Austria's crypto-licensing activity under MiCA continues; how sanctions screening interacts with that separate regulatory track will be a useful signal of the consolidated architecture's practical reach.

D2 Beneficial Ownership

Austria: enhanced follow-up (FATF MER 2026-04-30); WiEReG praised but fee-gated; Privatstiftung opacity exposed by Benko/Laura insolvency; AMLR/6AMLD 2027 application, AMLA operational Frankfurt; trajectory improving.

D3 Enabler Jurisdictions

Austria: A-FIU under-resourced, narrow predicate-offence focus; DNFBP supervision fragmented outside casinos/lawyers/notaries; trajectory stable.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto, Digital Assets, and Financial Innovation

Crypto, Digital Assets, and Financial Innovation

Austria's crypto-asset sector has been brought explicitly within the FMA's newly consolidated sanctions-supervision mandate this cycle. Under the Sanctions Act 2024, which took effect 1 January 2026 and replaces the Sanctions Act 2010, crypto-asset service providers (CASPs) are integrated into the same unified sanctions-screening architecture that now covers banks, payment institutions, investment firms, alternative investment fund managers, and insurers. Rather than treating crypto infrastructure as a downstream or delayed addition to sanctions compliance, Austria's consolidated framework folds CASPs in as a first-class category from the outset.

This is a confirmed, high-tier-sourced structural development rather than an enforcement incident: no CASP-specific sanctions breach or enforcement action was evidenced this cycle. The significance is architectural — a single supervisory authority now holds sanctions-screening oversight responsibility for the crypto sector on the same basis as traditional financial institutions, closing a gap that in other jurisdictions has left crypto-asset intermediaries outside mainstream sanctions-compliance perimeters or subject to a separately evolving compliance track.

This development should be read alongside, but kept analytically distinct from, Austria's broader AML/CFT and FATF-related findings this cycle. Austria's 2026 FATF mutual evaluation placed the country in enhanced follow-up over ML investigation and prosecution capacity, a finding that applies cross-sector rather than specifically to crypto-asset activity. The CASP sanctions-integration finding is a positive, forward-leaning architectural signal for the crypto-innovation domain specifically, even as the broader capacity gap identified by FATF remains unresolved at the national level.

No AT-specific evidence surfaced this cycle regarding crypto-specific sanctions-evasion typologies, virtual-asset transfer patterns used to circumvent sanctions, or enforcement actions against CASPs for sanctions breaches. The finding here is limited to the supervisory-architecture extension itself.

Outlook

The integration of CASPs into unified sanctions supervision is worth tracking for how it interacts with Austria's separate MiCA-based crypto-licensing activity, where the FMA has been actively licensing crypto-asset service providers. A convergence of sanctions-screening obligations with MiCA licensing conditions would represent a further architectural tightening; divergence or gaps between the two tracks would be the signal to watch for in coming cycles.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

AML/CTF Regime

Austria's 2026 FATF mutual evaluation found clear progress in strengthening the country's AML/CFT legal and regulatory framework, but placed Austria in enhanced follow-up. The evaluation's core unresolved concern is not the legal framework itself but operational delivery: the operational capacity and resources of the Financial Intelligence Unit (FIU), law enforcement, and prosecution need to be increased, a finding independently corroborated by an IMF publication of the same underlying assessment — two separate primary-tier sources converging on the identical capacity gap. This gap in ML investigation and prosecution capacity has persisted since at least 2016, indicating a structural rather than newly emergent weakness.

Against this backdrop, Austria has undertaken a genuine architectural improvement: as of 1 January 2026, the FMA became the sole supervisor for AML/CFT and financial sanctions across the country's financial market participants, under the Sanctions Act 2024, replacing the Sanctions Act 2010. The consolidation extends explicit coverage to credit and financial institutions, payment institutions, investment firms, alternative investment fund managers, insurers, and crypto-asset service providers. This closes an institutional fragmentation that previously separated sanctions and AML/CFT oversight, and represents a confirmed, high-confidence structural improvement to the supervisory architecture, even though it does not by itself resolve the FIU and prosecution capacity gap that kept Austria in enhanced follow-up.

At the individual-institution level, the FMA imposed a EUR 60,000 fine on Sparkasse Oberösterreich Bank AG for breach of AML/CFT due-diligence obligations. This is a routine enforcement action, single-sourced, and should not be read as evidence of a systemic control gap on its own; it sits within the same due-diligence framework the FATF evaluation examined at the national level, illustrating continuing institutional-level enforcement activity in parallel with the structural consolidation.

The pairing of these findings — architecture improving, capacity flagged, individual enforcement continuing — captures the current state of Austria's AML/CFT regime: progress that FATF itself acknowledges is real, alongside a specific, longstanding capacity gap that the architecture change alone has not yet closed.

Outlook

FATF has set a multi-year follow-up roadmap requiring Austria to report progress against the recommended actions from the 2026 mutual evaluation, with supervisory and prosecutorial resourcing expected to increase over the follow-up period. The central question for coming cycles is whether increased resourcing for the FIU and prosecution services materialises and whether it produces measurable improvement in Austria's ML investigation and prosecution outcomes — the specific unresolved item behind the enhanced follow-up placement.

Regulatory horizon

Adopted2029 · ±multi_year

FATF Key Recommended Actions (3-year roadmap post-2026 MER)

Austria must report back to FATF on progress against the roadmap; supervisory and prosecutorial resourcing is expected to increase over the follow-up period.

Source

1 dated · 3 pending date · baseline fim-2026-07-08

Role action cards

MLROHigh

FMA consolidates AML/CFT and sanctions supervision under the Sanctions Act 2024; FATF places Austria in enhanced follow-up over FIU/prosecution capacity.

The single-supervisor model simplifies which authority MLROs report to and are examined by, covering banks, PIs, investment firms, AIFMs, insurers and CASPs. The FATF enhanced-follow-up placement signals continuing national-level capacity concerns in ML investigation and prosecution that may affect how referrals from institutions are ultimately actioned downstream.

4 evidence refs

ComplianceHigh

FMA becomes sole AML/CFT and sanctions supervisor for Austrian financial market participants, including CASPs.

Compliance functions across bank, payment, investment, fund-management, insurance and crypto-asset sectors now answer to one consolidated supervisor for both sanctions and AML/CFT, replacing a more fragmented prior arrangement under the Sanctions Act 2010.

2 evidence refs

LegalPossible

No material change this cycle.

No material change for this persona this cycle

BoardAssessed

Austria's FATF enhanced-follow-up placement signals a persistent, board-relevant national capacity gap even as supervisory architecture improves.

The 2026 mutual evaluation found clear progress in Austria's AML/CFT legal and regulatory framework but flagged unresolved ML investigation and prosecution capacity, a gap dating to 2016. This is a reputational and strategic-level consideration for institutions operating in Austria, distinct from the positive architectural consolidation under the FMA.

2 evidence refs

CTOAssessed

Crypto-asset service providers in Austria are now explicitly integrated into the FMA's unified sanctions-screening architecture.

Technical infrastructure supporting sanctions-list screening for crypto-asset activity must now meet the same supervisory framework applied to banks and payment institutions, under the Sanctions Act 2024. This has implications for screening-system architecture and integration points for CASPs operating in Austria.

2 evidence refs

RiskAssessed

Structural sanctions/AML consolidation improves institutional coordination, but a longstanding FIU and prosecution capacity gap remains an unresolved national risk factor.

Risk functions should note that Austria's architecture-level risk profile has improved through supervisory consolidation, while the capacity-level risk identified by FATF (and independently corroborated by the IMF) persists unresolved, a structural gap since 2016.

3 evidence refs

OperationsPossible

No material change this cycle.

No material change for this persona this cycle

AuditPossible

FMA's consolidated supervisory mandate and the Sparkasse Oberösterreich fine both provide audit-relevant reference points for control-testing scope.

The Sparkasse Oberösterreich fine for AML/CFT due-diligence breaches is a documented enforcement precedent institutions can audit their own controls against; the FMA consolidation changes which single authority's expectations should now anchor internal audit's AML/CFT and sanctions control-testing scope.

2 evidence refs

Decision lens

MLRO

FMA consolidates AML/CFT and sanctions supervision under the Sanctions Act 2024; FATF places Austria in enhanced follow-up over FIU/prosecution capacity.

Compliance

FMA becomes sole AML/CFT and sanctions supervisor for Austrian financial market participants, including CASPs.

Legal

No material change this cycle.

Board

Austria's FATF enhanced-follow-up placement signals a persistent, board-relevant national capacity gap even as supervisory architecture improves.

CTO

Crypto-asset service providers in Austria are now explicitly integrated into the FMA's unified sanctions-screening architecture.

Risk

Structural sanctions/AML consolidation improves institutional coordination, but a longstanding FIU and prosecution capacity gap remains an unresolved national risk factor.

Operations

No material change this cycle.

Audit

FMA's consolidated supervisory mandate and the Sparkasse Oberösterreich fine both provide audit-relevant reference points for control-testing scope.

Shared evidence: 5 refs

Scenario sketches

AMLA transition and Austria's consolidated national supervision

Illustrative orientation only: as the AMLA Regulation (Reg (EU) 2024/1620) moves cross-border obliged entities toward direct or indirect EU-level supervision, alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition, a jurisdiction such as Austria that has just consolidated its own national sanctions and AML/CFT supervision under a single domestic authority (the FMA, under the Sanctions Act 2024) could face a layered supervisory landscape in which the newly unified national architecture must in turn interface with AMLA's supervisory perimeter for cross-border obliged entities. This could reshape how consolidated national supervisors coordinate with an EU-level authority, particularly for larger or cross-border institutions. This is illustration for analytical orientation, not a prediction of how AMLA's rollout will specifically affect Austria.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)

Tracker	Status	Note
T1 · Russian Sanctions-Evasion Architecture	no_change
T2 · EU AML Package / AMLA	watch	AT bound directly to AMLR (EU member state); no AT-specific 6AMLD transposition delta beyond the FMA sanctions-supervision consolidation.
T3 · FATF Grey List	material_change	Austria (not grey-listed) placed in enhanced follow-up after 2026 mutual evaluation.
T4 · Beneficial-Ownership Register Status	watch	FATF MER noted improved beneficial-ownership transparency; no independent registry-mechanics change verified this cycle.
T5 · Crypto & Digital-Asset Integrity	material_change	FMA's sanctions-supervision mandate extended explicitly to CASPs, integrating into one-stop-shop framework.
T6 · Sanctions Regime Divergence	no_change	No AT-specific EU/US/UK autonomous-listing divergence surfaced this cycle.

Registers

Enforcement actions

Austrian anti-corruption prosecutors arrested Rene Benko on suspicion of insolvency fraud tied to the EUR23 billion collapse of his Signa property and retail empire, citing risk of collusion and obstruction. 23 Jan 2025
Benko was formally charged with insolvency fraud after the collapse of his EUR23 billion Signa property empire, accused of funneling assets away from creditors. 15 Jul 2025
Austrian judges found Benko guilty in a second set of insolvency-fraud charges relating to concealment of luxury watches from creditors, while clearing him of hiding other assets. 10 Dec 2025
Austria's Supreme Court rejected Benko's attempt to annul an earlier insolvency-fraud verdict, finalizing a two-year jail sentence — the first criminal case to reach a final verdict following one of Europe's largest recent corporate insolvencies. 2 Jul 2026
The FMA enforced the end of the MiCA grandfathering transition period, requiring all existing CASPs to obtain full MiCA authorization or cease regulated services; only 4 of 13 previously operating CASPs retained authorization. 31 Dec 2025

Sanctions changes

The EU adopted its 19th package of Russia sanctions, listing 69 additional individuals/entities and targeting shadow-fleet vessels, the ruble-backed A7A5 stablecoin, third-country banks and Lukoil's shadow-fleet enabler Litasco Middle East DMCC — measures with direct relevance to Austrian-headquartered financial institutions' Russia-linked exposure. 23 Oct 2025
Austria delayed EU consensus on the 19th sanctions package, seeking to condition its support on unfreezing Deripaska-affiliated Rasperia Trading's Strabag stake so that Raiffeisen Bank International could be compensated for a Russian court-ordered payment — a national divergence from collective EU sanctions posture driven by a domestic banking interest. 8 Oct 2025
OFAC and OFSI designated entities tied to the Russian ruble-backed A7A5 token, its affiliated exchange Grinex (successor to the sanctioned Garantex), and Kyrgyzstani issuer Old Vector, part of a coordinated Western effort against crypto-based sanctions evasion infrastructure with cross-border relevance to EU member-state exposure including Austria's MiCA-regulated CASP sector. 1 Aug 2025

Regulatory horizon (register)

Austria's FATF enhanced follow-up progress report due
AMLR (Reg 2024/1624) direct-application date across EU incl. Austria
6AMLD transposition deadline for Austria

Active schemes

[CRITICAL] Raiffeisen Bank International Russia exposure & wind-down friction
[HIGH] Rasperia/Deripaska-Strabag sanctions circumvention & Austrian carve-out lobbying
MiCA transition gap exposes unlicensed CASP residue
[HIGH] Privatstiftung foundation vehicles shielding insolvent-estate assets
ISKP crypto-enabled cell financing touching Austrian territory

Sources

Coverage gaps

Austria's Financial Intelligence Unit (A-FIU) suffers from i…

Austria's Financial Intelligence Unit (A-FIU) suffers from insufficient resources and limited budgetary/recruitment independence, focusing too narrowly on predicate offences rather than complex or cross-border money-laundering cases, per FATF's April 2026 MER.

Except for casino supervision and, to some extent, lawyers a…

Except for casino supervision and, to some extent, lawyers and notaries, Austrian DNFBP (designated non-financial businesses and professions) supervision suffers from major shortcomings including fragmentation, resource shortages, and few remedial actions.

Austria leveraged its EU Council veto to delay the bloc's 19…

Austria leveraged its EU Council veto to delay the bloc's 19th Russia sanctions package, conditioning support on unfreezing Deripaska-linked Rasperia assets to compensate Raiffeisen Bank International — a national financial interest overriding collective sanctions solidarity.

Public-facing access to Austria's WiEReG beneficial-ownershi…

Public-facing access to Austria's WiEReG beneficial-ownership register requires a per-search fee (approx. EUR4 per statement), which Global Witness identifies as a paywall limiting practical accessibility despite nominal public availability; independent open-source verification of BO data quality beyond FATF's own praise is comparatively thin.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.