The Bitpanda MiCA fine of €70,000 ($82,000) handed down by Austria’s Financial Market Authority (FMA) is now the first published final penalty under the EU’s Markets in Crypto-Assets Regulation (MiCAR), marking a concrete step in European regulators’ shift from authorisation to enforcement.
What the FMA Actually Cited
The FMA’s sanction announcement names three specific MiCAR articles. Bitpanda breached Article 7(2) by distributing a marketing communication before publishing the required crypto-asset white paper. It breached Article 7(1)(e) by omitting the mandatory disclosure that the communication had not been reviewed or approved by a competent authority and that the offeror bore sole responsibility for its contents. Article 7(1)(d) was also violated: a separate marketing communication lacked a required telephone number and email address.
The white paper filing breach is a timing infraction, not an approval failure. Under MiCA’s full text (Regulation (EU) 2023/1114), competent authorities are expressly barred from requiring prior approval of crypto-asset white papers. The 20-working-day notification window is a lead time only: issuers must notify before publication, not secure sign-off.
Bitpanda said the issues related exclusively to the timing and formal requirements surrounding the white paper and an accompanying information document. Customer funds and platform security were not affected, and the company said customers suffered no financial harm. It rectified the issues after receiving notice from the FMA and opted for a swift, consensual conclusion via an expedited procedure. The legal basis for that accelerated process was Article 22(2)(b) of the Financial Market Authority Act (FMABG). The penalty decision is final.
Bitpanda’s Regulatory Standing and the Broader MiCA Enforcement Picture
The fine lands against a licenced entity, not a fringe operator. Bitpanda GmbH (Commercial Register no. FN 569240v) received FMA authorisation as a crypto-asset service provider under Article 63 of MiCAR by administrative decision dated 9 April 2025. Authorised services include custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds and for other crypto-assets, execution of orders on behalf of clients, and placing of crypto-assets. Details are in the FMA’s authorisation grant.
A separate entity, Bitpanda Financial Services GmbH (FN 551181k), had its investment firm licence extended in April 2024 to cover receiving and transmitting of orders, trading on own account, and custody and management of financial instruments, including explicit authorisation for holding client funds.
The fine points to a pattern regulators across the EU are likely to encounter repeatedly. MiCA’s Article 7 disclosure rules apply to marketing communications, and the requirements around competent-authority disclaimers and contact details are procedural minimums that any compliance team should catch before a campaign goes live. That Bitpanda, one of Europe’s larger retail crypto platforms, tripped on them suggests the disclosure checklist was either incomplete or not integrated into the marketing review workflow.
ESMA maintains a central register of crypto-asset white papers, authorised service providers, and non-compliant entities under Articles 109 and 110 of MiCA, which was required to be operational by 30 December 2024. The interim register was last updated on 21 August 2026.
Meanwhile, the FMA is not waiting for Brussels to tighten the framework. Together with France’s Autorité des marchés financiers (AMF) and Italy’s CONSOB, the FMA published a joint position paper calling for targeted changes to MiCA’s supervisory architecture. The three authorities cited material differences in how national regulators have supervised crypto markets during the first months of MiCA’s application since 30 December 2024, referencing FSB and IOSCO recommendations from 2023.
The Bitpanda penalty is small in absolute terms. At €70,000 it will not move the balance sheet of a platform operating at that scale. What it does move is the reference point: enforcement is live, the expedited procedure works, and the FMA has now shown it will publish decisions. Every CASP running marketing campaigns across the EU should treat the Article 7 disclosure checklist as table stakes, not a compliance backlog item. The next published penalty will be harder to frame as a technicality.
