BaFin’s Bitpanda Shockwave: Vienna’s MiCA Ambitions Put Austria’s FMA in the Spotlight

A BaFin special audit uncovered 16 deficiencies at Bitpanda’s German arm, exposing weaknesses in governance, IT, and outsourcing. At the same time, Austria’s Financial Market Authority (FMA) is positioning Vienna as a leading MiCA licensing hub—authorizing Bitpanda and other high-risk crypto players—while Austrian lawyer Oliver Stauber emerges as a central figure in this regulatory ecosystem.

Key Facts at a Glance

• In 2023, Germany’s financial watchdog BaFin carried out a special audit of Bitpanda Asset Management GmbH (BAM), the licensed German subsidiary of Bitpanda, roughly one year after issuing its licence.
• The audit identified 16 deficiencies: five classified as severe, four significant, six medium, and one minor—primarily affecting risk management, IT systems, and outsourcing, all critical for investor protection.
• BAM had delegated key functions, including crypto custody and KYC processes, back to Bitpanda group entities in Vienna, raising structural concerns extending beyond Germany’s jurisdiction.
• Subsequent internal audits pointed to information-security gaps, weak documentation, and insufficient regulatory expertise—issues later mirrored in the International Consortium of Investigative Journalists “Coin Laundry” collaboration.
• Despite these findings, Bitpanda GmbH received a full MiCA CASP licence from Austria’s Financial Market Authority in April 2025, placing it at the core of an emerging Vienna MiCA hub.
• In September 2025, the same FMA co-signed a joint paper with France’s Autorité des marchés financiers and Italy’s Commissione Nazionale per le Società e la Borsa, warning against jurisdiction shopping and urging direct supervision of major CASPs by European Securities and Markets Authority.
• Vienna now hosts MiCA-licensed entities including KuCoin EU, Bybit EU, AMINA, and others. Former Bitpanda Chief Legal Officer Oliver Stauber has played a visible role in KuCoin’s authorisation and now advises Bitget on its EU MiCA strategy, alongside EY Law.

Short Analysis

From a compliance standpoint, the Bitpanda episode serves as a real-world test of how the EU’s MiCA framework interacts with established prudential supervision.

BaFin’s audit of BAM was not a routine checklist exercise. It targeted the core of the control environment—risk governance, IT resilience, and oversight of outsourced functions—many of which traced directly back to Vienna. Internal audit findings reinforced these concerns, highlighting shortcomings in information security and regulatory competence. Bitpanda maintains that all deficiencies have since been addressed. Still, the broader pattern—rapid growth, extensive reliance on group outsourcing, and corrective action after regulatory intervention—is precisely what MiCA aims to discipline through harmonised standards.

This is where Austria’s FMA comes into focus. As Bitpanda’s home supervisor, the FMA has become the MiCA gatekeeper for a growing cluster of CASPs using Vienna as their EU entry point. Exchanges such as KuCoin EU, Bybit EU, AMINA, and others have selected Austria as their passporting base, a choice frequently promoted by industry media and the firms themselves. Paradoxically, the FMA simultaneously argues—together with AMF and Consob—that national authorities lack the capacity to oversee global platforms effectively and that only ESMA-level supervision can curb regulatory arbitrage.

Both positions cannot comfortably coexist. If Vienna is marketed as a high-integrity MiCA hub while licensing platforms that have faced criticism or sanctions elsewhere, the FMA must demonstrate robust, hands-on supervision—beyond policy statements and joint declarations.

The human dimension adds another layer. Oliver Stauber, who oversaw legal and licensing matters at Bitpanda during the period when BAM’s structures were established, has since become a prominent MiCA adviser to other large exchanges—first KuCoin EU and now Bitget EU—with EY Law closely involved in authorisation processes. While such a career trajectory is not unlawful, it raises a substantive question: is Austria exporting regulatory expertise, or is it absorbing unresolved risks and enforcement legacies into the EU single market?

For investors and counterparties, the decisive evidence will not come from speeches or press releases, but from future inspection reports—this time issued under the FMA’s authority.

Call for Information

Scam-Or Project invites current and former employees of Bitpanda, BAM, KuCoin EU, Bitget EU, EY Law, and other Vienna-based CASPs—as well as regulators and service providers with insight into MiCA licensing and supervision—to contact us confidentially via the Scam-Or Project whistleblower section.
Documents, internal risk assessments, and correspondence related to BaFin findings, FMA MiCA approvals, or the structuring of the “Vienna hub” are of particular interest.