Insurance & Insurtech Compliance in Austria

Austria is open to digital insurance distribution. Insurers are licensed and supervised by the FMA, which is also the AML supervisor and the sanctions authority for financial market participants, including insurers. Suspicious transaction reports go to the Financial Intelligence Unit (A-FIU) at the Federal Criminal Police Office.

The main obstacle for a new digital entrant selling life or investment-linked cover is not licensing but onboarding design: Austria prescribes in detail how remote identification must work, and the in-person ID check can be replaced only by the safeguards the law lists.

1. Who regulates this sector

Intermediaries, including those passporting from other EEA countries, are listed in the insurance and credit intermediaries register of the Gewerbeinformationssystem Austria (GISA).

2. Licensing and authorisation

Under § 6(1) of the Versicherungsaufsichtsgesetz 2016 (VAG 2016, Insurance Supervision Act), carrying on insurance business in Austria requires a licence (Konzession) from the FMA. Insurers may operate only as a stock corporation, a European Company (SE) or a mutual insurance association (§ 8(1)), and the absolute floor of the minimum capital requirement is EUR 4 million for life insurers and EUR 2.7 million for non-life insurers, or EUR 4 million where any of classes 10 to 15 (liability, credit and suretyship) are covered (§ 193(2)). EEA insurers may provide services cross-border without an Austrian licence once their home supervisor has notified the FMA (§ 22(1)).

Under § 137(1) GewO 1994, insurance distribution includes comparing or ranking policies on a website through which the customer can conclude a contract. Distributors need a trade licence, competent responsible persons (§ 137b) and EU-wide professional indemnity cover (§ 137c).

Embedded insurance can fall under the ancillary intermediary regime (§ 137(3)).

3. AML, KYC and customer due diligence

Who is in scope

The Financial Markets Anti-Money Laundering Act (FM-GwG) applies to insurers "in the operation of life insurance", meaning classes 19 to 22 of Annex A to the VAG 2016: life, marriage and birth insurance, unit-linked and index-linked life insurance, and tontines (§ 2 Z 2 lit. b), including Austrian branches of EEA and non-EU life insurers (lit. h). The FMA supervises compliance (§ 25). Intermediaries active in life insurance and other investment-related services are covered by the parallel AML regime in §§ 365m1 ff GewO 1994, except insurance agents who neither collect premiums nor handle customer money and either do not sell competing products or act only as a side business (§ 365m1(2) Z 4); the district administrative authority supervises them and sanctions breaches (§ 365m1(3), § 333).

Customer due diligence

Life insurers must identify and verify the customer, identify the beneficial owner and take reasonable steps to verify their identity, obtain information on the purpose and nature of the relationship and the source of funds, and monitor the relationship (§ 6(1)). Identification must be completed before the business relationship starts (§ 7(1)); verification may finish during onboarding only where necessary not to interrupt normal business and the risk is low (§ 7(2)). Beneficial owners are natural persons who hold more than 25% of shares, voting rights or participation, or who exercise control (§ 2 of the Beneficial Owners Register Act, WiEReG).

Beneficiaries

Named beneficiaries must be recorded; beneficiaries designated by class need enough information to identify them at payout. Their identity must be verified before payout (§ 7(4)).

Politically exposed persons

Reasonable measures to establish whether a beneficiary (or its beneficial owner) is a politically exposed person (PEP), at the latest before payout or assignment. Higher risk means informing senior management before payout and enhanced scrutiny of the whole relationship (§ 11(2)).

Assignment

When a policy is taken over or claims are assigned, the new customer or beneficial owner is identified at that point (§ 7(4)); according to the FMA, pledges securing loans are not covered.

Simplified and enhanced due diligence

The Life Insurance Due Diligence Regulation (LV-SoV) treats certain policies as low risk and allows simplified due diligence: annual premiums of no more than EUR 1,200; a single premium of no more than EUR 2,500; annuity contracts with no surrender clause that cannot serve as loan collateral; occupational pension contracts; and two tax-favoured retirement products (§ 2(1)). Simplified measures are not allowed where information suggests the risk is not low (§ 2(2)). Enhanced due diligence applies where risk is higher, taking account of the Annex III factors (§ 9(1)).

Reporting, sanctions and records

Suspicious transactions are reported to the A-FIU without delay (§ 16(1)) through its goAML application. Since 1 January 2026, obliged entities must have policies, procedures and controls against the non-implementation and evasion of all targeted financial sanctions (§ 23a), having applied to proliferation-related sanctions since 14 December 2024. Under the Sanctions Act 2024, insurers count as financial market participants for all classes of insurance, not only life, and need written, board-approved sanctions strategies, controls and procedures (§ 1(4), § 7). Customer due diligence records, including those from remote identification, and transaction records are kept for ten years after the relationship ends (§ 21(1)).

4. Identity verification and onboarding

The baseline method is the personal presentation of an official photo ID: a document issued by a state authority with a non-replaceable photo, name, date of birth, signature and issuing authority (§ 6(2) FM-GwG). Without personal contact, the firm must know at least the customer's name, date of birth and address, and may replace the in-person check only with one of the four safeguards listed in § 6(4). The FMA treats the list as exhaustive.

• 1. Video identification under the Online Identification Regulation (Online-IDV), agent-led or, under § 4(6) Online-IDV, fully biometric.
• 2. A statutory electronic ID procedure that reliably provides the same information as an official photo ID; the FMA names ID Austria in full function as an example and expects audit-proof storage of the identification data.
• 3. A qualified electronic signature or registered post: the customer signs with a qualified electronic signature (eIDAS), or the insurer sends its declaration by registered post, in each case with further conditions: a seat statement from legal persons, an ID copy before the contract unless it is signed with a qualified signature, and a bank confirmation for non-EU customers.
• 4. A first payment from an account in the customer's name at a qualifying credit institution, plus document copies or the bank's written confirmation that it identified the customer.

Insurers may rely on qualifying third parties but remain responsible (§ 13(1)). Life insurance intermediaries registered in GISA count as qualified third parties, whether they hold an Austrian trade licence or operate under EEA freedom of establishment or services (FMA Circular 01/2022, margin nos. 15 to 17).

5. Digital channels: what's different

Bottom line: the AML duties are the same in every channel, but a remote life insurance sale must use one of four statutory identification safeguards, each with its own technical and evidence rules, and online consumer contracts now need a built-in withdrawal function.

Remote onboarding is a higher-risk factor unless a safeguard is used

Annex III of the FM-GwG lists relationships "without personal contact and without certain safeguards" as a potentially higher-risk factor. The FMA states that using a § 6(4) safeguard does not by itself require enhanced due diligence, and that video identification is not limited to customers in Austria or the EU (Circular 01/2022, margin nos. 246 to 253).

How video and biometric identification must work

The Online-IDV requires trained, reliable staff working in a separate room with access control (§ 3). The whole identification conversation is audio-recorded, with screenshots of the face and both sides of the ID. The customer moves their head, reads out the ID serial number or a random string of at least four characters and enters a one-time code sent by email or SMS, while the agent checks holograms (§ 4(2) to (5)). The process must be stopped on any inconsistency (§ 5).

The FMA expects firms using a provider to check that recordings are clear, that only the customer appears on video, and that device fingerprinting confirms details such as location, and warns against mixing elements of different safeguards (FMA, Reden wir über Aufsicht No. 3, December 2024).

A fully automated biometric procedure is allowed if it is state of the art, at least as secure as agent-led identification, uses only IDs whose content is electronically signed by the issuing authority (with the signature verified), and includes a presence check based on a video recording, which may be passive (§ 4(6)). The insurer stays responsible for providers (§ 6).

Withdrawal function for online contracts

Since 1 October 2026, non-life insurance contracts concluded at a distance with consumers follow the withdrawal rules of the Distance and Off-Premises Contracts Act (FAGG, §§ 13a, 18b and 18c) instead of § 5c of the Insurance Contract Act (VersVG); distance-sold life insurance keeps the 30-day VersVG right and additionally becomes subject to § 13a FAGG (§ 5c(7) VersVG). Where a contract is concluded through an online interface, the firm must provide a withdrawal function labelled "Vertrag widerrufen" or with equally clear wording, available throughout the withdrawal period and prominently displayed (§ 13a FAGG).

From 10 July 2027 [Adopted, applies from 10 Jul 2027] the EU Anti-Money Laundering Regulation also accepts eIDAS electronic identification at "substantial" or "high" assurance (Article 22(6)).

6. Data protection and biometrics

Under the GDPR, remote AML identification data are processed on the legal basis of § 6(4) FM-GwG for preventing money laundering (§ 4(1) Online-IDV), and the audio recording is mandatory.

Fully biometric procedures are allowed only where processing of biometric data is permissible under Article 9(2)(a) GDPR (explicit consent) and the insurer applies technical and organisational measures appropriate to the risk under Article 32 GDPR (§ 4(6) Online-IDV). Recordings are kept as due diligence records for ten years (§ 4(6) Z 2 Online-IDV, § 21(1) FM-GwG).

7. Sector-specific obligations

Payout as the second due diligence point

Beneficiary verification and the beneficiary PEP check must be completed before money leaves the insurer (§ 7(4), § 11(2) FM-GwG). Life insurers may limit routine updates of customer data to trigger events such as premium increases, top-up payments and payouts, if their risk analysis supports it (Circular 01/2022, margin no. 240).

Oversight of intermediaries

An insurer relying on an intermediary's checks must obtain the due diligence information immediately and ensure copies of documents are available on request (§ 13(2) FM-GwG).

Sanctions across the whole book

Because the Sanctions Act 2024 covers every class, non-life insurers outside AML due diligence still need sanctions screening and approved controls at individual and group level (§ 7). The FMA monitors compliance by insurers (§ 12(2)), while the Interior Minister monitors other parties (§ 12(1)); the FATF reports that this includes insurance intermediaries.

Account security

Since 17 January 2025 the Digital Operational Resilience Act (DORA) has applied to insurers and to insurance intermediaries other than small and medium-sized enterprises, subject to exemptions for the smallest insurers (Article 2). Its ICT risk rules require policies and protocols for strong authentication mechanisms (Article 9(4)(d)).

8. Risk indicators and red flags

Life insurance typologies and risk factors (A-FIU, FM-GwG Annex III, FMA)

• High single premium: large one-off payments into a life policy, which the A-FIU's 2024 report names as well suited to laundering.
• Uneconomic surrender: cancelling a policy at a poor surrender value to obtain funds that appear legitimate because an insurer paid them.
• Policy as loan collateral: a policy pledged to secure a loan that then defaults, so the lender has little interest in examining it.
• Third-party payments: premiums paid by unknown or unconnected third parties (Annex III).
• Remote sale without safeguards: non-face-to-face onboarding without a statutory identification method (Annex III).
• New products and channels: new distribution mechanisms and new or developing technologies (Annex III).
• Weak source-of-funds checks: the ground for a 2025 FMA penalty against an insurer.
• Forged IDs in online identification: the A-FIU warned in March 2024 of a sharp rise in fully forged identity documents in online identification.

Insurers filed 34 suspicious transaction reports in 2025, against 11,100 from banks (A-FIU, Money Laundering Situation Report 2025).

9. Enforcement and penalties

The FMA fines the persons responsible within an obliged entity up to EUR 150,000 per breach of the risk analysis, due diligence, reliance, reporting, record-keeping, organisational or sanctions-control duties, including breaches of the Online-IDV (§ 34(1) FM-GwG). For serious, repeated or systematic breaches of the core duties, the fine rises to EUR 5,000,000 or twice the benefit gained, where it can be quantified (§ 34(4)).

The firm itself can be fined up to EUR 150,000, or for serious, repeated or systematic breaches up to EUR 5,000,000 or 10% of annual turnover (§ 35), and the FMA may publish the name and the breach (§ 37).

On 13 May 2025 the FMA published a final EUR 40,000 fine against Grazer Wechselseitige Versicherung AG because its strategies and procedures for verifying the source of customers' funds were not adequate (accelerated procedure, § 22(2b) Financial Market Authority Act).

10. Recent changes and what to watch

• 10 July 2027: EU Anti-Money Laundering Regulation (EU) 2024/1624 [Adopted, applies from 10 Jul 2027]. Its directly applicable rules include eIDAS-based remote verification and the beneficiary PEP check (Article 44).
• 10 July 2027: Beneficial Owners Register Act 2027 (WiEReG 2027), Federal Law Gazette I No. 94/2026 [Adopted, applies from 10 Jul 2027]. Replaces the current WiEReG, which ends on 9 July 2027, and aligns beneficial ownership with the EU regulation.
• 1 July 2027: EU Anti-Money Laundering Authority (AMLA) [Adopted, selection starts by 1 Jul 2027]. AMLA begins selecting financial institutions active in at least six Member States for direct supervision (Regulation (EU) 2024/1620, Article 13(4)).
• 30 October 2026: FM-GwG amendment, Federal Law Gazette I No. 94/2026 (published 29 October 2026, transposing Directive (EU) 2024/1640) [In force]. All its FM-GwG changes took effect that day (§ 43(8)); they mainly concern crypto-asset service providers and fine tiers, not life insurers' due diligence.
• 1 October 2026: amendments to the FAGG and VersVG, Federal Law Gazette I No. 59/2026 [In force]. Online consumer contracts need a "withdraw from contract" function.
• 30 April 2026: FATF publishes Austria's fifth-round mutual evaluation [Published]. One high, two substantial and eight moderate effectiveness ratings, with no low rating; assessors placed low importance on the insurance sector, citing its small share of the market and no identified increased risk.
• 1 January 2026: Sanctions Act 2024, Federal Law Gazette I No. 5/2025, and extended FM-GwG § 23a [In force]. Sanctions duties now cover insurers for all classes.

11. What this means for identity verification

• Separate product flows: life and investment-linked products need full FM-GwG due diligence; non-life products need sanctions screening.
• Statutory remote method: build the remote journey on one of the four § 6(4) safeguards; automated flows must verify the signed chip data of the ID and run a presence check.
• Re-verification triggers: payout, assignment or takeover of a policy, and events such as premium increases and top-up payments.
• July 2027: design flows that can also accept eIDAS electronic identification at "substantial" or "high" assurance.