Bitpanda's €70K Fine: What MiCAR Enforcement Means for Investors

Austria's Financial Market Authority fined Bitpanda GmbH 70,000 euros in August. The reason sounds technical: a crypto-asset white paper reached the regulator late, and marketing went out before the document had been published. For an investor, it raises the most practical question in the EU's new crypto rulebook. Every token offered to the public in the EU must come with a mandatory document you can read before you buy. We checked whether that document can actually be retrieved, and called up all 972 white papers held in the European register to find out.

The FMA published the sanction on August 14, 2026. It concerns Bitpanda GmbH, based in Vienna, and rests on several breaches of Regulation (EU) 2023/1114 on markets in crypto-assets, known as MiCAR. The fine is 70,000 euros and the penalty decision is final. The FMA notice sits on the regulator's website; automated requests are turned away, while the page loads normally in a browser.

What stands out is less the amount than the fact that the authority published the case at all. By its own account, this is the first final MiCAR penalty decision the FMA has made public. The regulator attaches a message to it about the phase the regulation has reached. MiCAR has moved beyond licensing and supervision and now extends to enforcement. The FMA states explicitly that being the first published case gives neither the company concerned nor the breaches identified any special standing.

Bitpanda has commented publicly. According to the company, the objections related solely to timing and to formal requirements around the publication of the white paper and an accompanying information document. Customer funds, platform security and the financial interests of clients were not affected, and the points were remedied once the regulator raised them.

The notice lists three points, and all three concern the same mechanism: the white paper and how it was advertised.

The FMA does not name the token or the specific white paper the sanction relates to. That reticence is standard practice and it holds here too. The published material supports no inference about any particular offering, and the regulator has confirmed nothing on the point.

According to the FMA, the proceedings were concluded on an accelerated basis under Section 22(2b) of the Financial Market Authority Act. That provision allows a company to waive its right of appeal with binding effect before the decision is issued, provided it knows the operative wording at that point. The reasoning behind the decision may then be omitted, and the penalty becomes final immediately.

This matters for how the case should be read, and it cuts both ways. On one side, the sanction will no longer be contested and the matter is closed. On the other, administrative practice does not treat a waiver of appeal as an admission of guilt on the substance. It shortens the procedure, and nothing further follows from it. Anyone reading the fine as evidence of broader misconduct is going beyond what the notice actually says.

Measured against the size of the company, the amount barely registers. The penalty range MiCAR sets for breaches of the white paper and marketing rules by legal persons runs well above it. The value of this case for you lies elsewhere. It shows which obligations the supervisor genuinely enforces, and those obligations exist for your benefit.

MiCAR distinguishes three groups of crypto-assets. Asset-referenced tokens and e-money tokens fall under separate, stricter regimes. If you want to know which stablecoin issuers are authorised in the EU, you will find them in the MiCA register of stablecoin issuers. All other crypto-assets, meaning the overwhelming majority of the market from bitcoin down to a small project token, fall under Title II of the regulation. For those, the rule is straightforward. Anyone offering them to the public in the EU, or seeking their admission to trading on a trading platform, must draw up a white paper, submit it to the competent supervisor and publish it.

The white paper is neither a sales brochure nor a project paper the offeror writes for itself. Its content is prescribed by the regulation. Details of the offeror and the issuer, a description of the project and of the crypto-asset, the terms of the offering, the rights and obligations attached to the asset, the underlying technology, the risks, and information on adverse climate and environmental impacts. That structure is the real advance on the years before MiCAR, when every project decided for itself what it disclosed.

Nor are these obligations new. MiCAR entered into force on June 29, 2023 and became applicable in stages. Titles III and IV on asset-referenced tokens and e-money tokens from June 30, 2024. Title II with Articles 4 to 15, which governs here, from December 30, 2024. Article 143(1) MiCAR contains a grandfathering rule for offerings that had already closed before that date. For everything offered to the public afterwards, the white paper obligation applies with no transition period.

The deadline that set off the Bitpanda case looks at first like administrative routine. It has a function all the same. Those 20 working days give the competent authority time to look at the document before it reaches the market. No substantive review is attached to this, and certainly no approval. What the supervisor can establish in that window is whether an offering is coming, who stands behind it and whether the mandatory disclosures are formally present.

Miss the deadline and the supervisor loses that lead time. Add marketing before the white paper is published and the intended sequence inverts. The buying decision then forms on the basis of the advertising, while the document setting out risks and rights is not yet available. That sequence is exactly what Article 7(2) MiCAR protects, and it is exactly what was not observed in the case under review.

The FMA's third charge concerns the part you meet most often in daily life: the advertising itself. Article 7 MiCAR requires a marketing communication to be clearly identifiable as such, the information in it to be fair, clear and not misleading, and its content to be consistent with the white paper. On top of that come the mandatory disclosures that were missing in the case at hand.

Three of them you can check for yourself in seconds when an advertisement, a newsletter or a social media post pushes a token at you. The statement that no authority has reviewed the document and that the offeror bears sole responsibility. The location where the white paper can be obtained. A reference to the right of withdrawal in Article 13 MiCAR.

If all of this is missing, the advertising is not automatically an attempted fraud. The notice fails the requirements MiCAR sets for a lawful offering in the EU, and that is a usable first warning sign. If you would rather stay with supervised firms in any case, our overview of regulated crypto exchanges lists the providers that can actually show a MiCAR authorisation.

The white paper is the precondition for a right that many investors know nothing about. Article 13 MiCAR gives retail holders who acquire a crypto-asset in a public offering, either directly from the offeror or through a service provider involved in it, a right of withdrawal lasting 14 calendar days. Withdrawal is free of charge, no reason has to be given, and the period starts when you agree to the purchase. All sums paid, including any fees, must be reimbursed. The white paper has to point this right out expressly.

The limitation matters at least as much as the right itself. The withdrawal right does not apply where the crypto-asset was already admitted to trading on a trading platform before you bought it. For the typical purchase of a listed coin through an exchange, then, it does not bite. It applies to initial offerings, to sale phases ahead of a listing, and to tokens an offeror sells to you directly. That is also the area where disputes most often arise later on.