Austria publishes the first MiCAR penalty, over a late white paper

What happened

The Austrian Financial Market Authority published two notices on the morning of 14 August 2026. The first records a fine of 70,000 euros on Bitpanda GmbH for breaches of Regulation (EU) 2023/1114 on markets in crypto-assets, ended on an expedited basis under section 22(2b) of the Financial Market Authority Act, and states that the penalty decision is legally final. Three grounds are given. Contrary to article 8(1) and (5), Bitpanda did not send a crypto-asset white paper to the authority at least twenty working days before the day of its publication. Contrary to article 7(2), it circulated a marketing communication before the required white paper had been published. And in a marketing communication it omitted the statement required by article 7(1)(e), that no competent authority has reviewed or approved the document and that the offeror alone is responsible for its content, together with the telephone number and email address required by article 7(1)(d). The authority does not name the token or the white paper. The second notice sets the case in context and is the one the reports have made less of: it says the publication makes visible that the regulation is 'nicht mehr nur ein Konzessions- und Aufsichtsthema' but has arrived in enforcement, that innovation and consistent enforcement are not a contradiction, and, in terms, that 'Der Umstand, dass es sich um den ersten veröffentlichten MiCAR-Fall handelt, begründet für sich genommen keine Sonderstellung des betroffenen Unternehmens oder der festgestellten Verstöße', which is to say that being the first published case gives neither the firm nor the breaches any special standing. Both notices return a challenge page to this desk and both were read in full in the authority's own feed at fma.gv.at, which carries their complete text. Bitpanda told CoinDesk the findings 'related exclusively to timing and formal specifications surrounding the publication of the whitepaper and an accompanying information document', that for the token launch in question it prepared a white paper in accordance with the regulation, submitted it and coordinated the process with the authority throughout, and that it chose a swift and consensual conclusion; it told BTC-ECHO that customer funds, platform security and the integrity of its ecosystem were never affected.

Why it matters

The first published penalty under the Union's crypto rulebook, in the market of the first firm Austria licensed under it, is a disclosure-timing case. Nothing in it concerns reserves, custody, segregation, conflicts or the conduct of a trading venue. What has been proved enforceable is the rule governing the document and the advertisement, which is the part of the regime a large firm is least likely to think of as risk. The size makes the same point from the other end. Trending Topics, reading Bitpanda's own white paper, puts the company's 2024 net profit at about 61.7m euros on a balance sheet of about 1.03bn, so a 70,000 euro penalty is roughly a thousandth of one year's profit and well below what the regulation allows for these articles against a legal person. It is a marker rather than a deterrent priced on the breach. The mechanism matters more than the money. Under section 22(2b) a firm can waive its appeal with legal effect before the decision is handed down, provided it already knows the operative part; the decision then requires no statement of reasons and is final at once. That is how a first case can establish that a rule bites without establishing how the authority reads it, and it leaves the Union's newest financial regulation with a precedent that carries no reasoning. The authority's own second notice reads as though it understands the difficulty, which is why it says that being the first published case confers nothing.

What is not settled

Which white paper is not stated. The authority does not name it and Bitpanda's answer refers to the token launch in question without naming it either. Trending Topics sets out a timeline that fits, without confirmation: the white paper for Vision, the token that replaced BEST and Pantos, records notification on 6 June 2025 and publication and the start of the public offer on 9 July 2025, while a non-binding Vision Paper is dated 10 June 2025 and the launch was announced on 12 June, which would put marketing ahead of publication. The reports do not agree on how many breaches there were. BTC-ECHO counts four and Trending Topics three; the notice sets out one late submission and two failings in marketing communications, the second of which covers two missing items, and BTC-ECHO also renders the deadline as twenty days where the notice says twenty working days. Whether any other national authority has imposed a penalty under the regulation that has not been published is unknown: the authority claims only a first for itself, while several reports have written the case up as a first outright. And whether the expedited route becomes the normal one is the question underneath all of it, because a rulebook enforced through decisions that carry no reasons produces no case law for anyone else to comply with.