Austria
Austria has one financial supervisor: the Financial Market Authority (FMA) licenses banks, payment, e-money, crypto and insurance firms and supervises their anti-money laundering duties; the ECB licenses deposit-taking banks. Suspicious transactions go to the A-FIU at the Federal Criminal Police Office. Remote onboarding uses four statutory safeguards, including video identification and ID Austria, while telecoms, healthcare, travel and public services follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
The Financial Market Authority (FMA) supervises banks, payment and e-money institutions, crypto-asset service providers and life insurers, and monitors their sanctions controls. Suspicious transaction reports go to the A-FIU at the Federal Criminal Police Office. Gambling licence holders are supervised by the Tax Authority Austria, and traders and life insurance intermediaries by district administrative authorities under the Trade Act.
Yes. Banks, payment and e-money institutions, crypto providers and life insurers may replace an in-person ID check with one of four safeguards: video identification, an electronic ID such as ID Austria, a qualified electronic signature or registered post, or a first payment from the customer's own bank account. Fully automated selfie checks must read the ID document's signed chip data.
Not today. Under the federal gambling monopoly, only the single lottery licence holder, Österreichische Lotterien, may offer online casino-style games, through win2day.at, and a licence from another EU country gives no right to serve Austrian players. Government bill 594 d.B. would create unlimited online licences, but it is not law as of November 2026. Sports betting is licensed by the provinces.
In financial onboarding, yes: fully automated biometric identification is allowed only with explicit consent under Article 9(2)(a) GDPR, so firms should also offer agent-led video or ID Austria. Telecom operators must delete biometric data as soon as a SIM photo-ident check ends. Healthcare, travel and public services require no face match, and adding one needs its own GDPR legal basis.
Telecom operators, healthcare providers, hotels, travel agencies and public authorities, and online shops unless they take cash of EUR 10,000 or more. Their identity duties come from sector rules instead, such as SIM registration, ELGA identification, guest registers and Digital Services Act seller checks. Non-life insurers are outside customer due diligence but must still comply with sanctions.