General climate and trends

General innovation climate

What is the general state of fintech innovation in your jurisdiction, including any notable trends, innovations, innovators and future prospects?

A lively fintech scene is evolving in Vienna with notable accelerators, start-ups and innovation hubs. Vienna-based fintech companies can profit from an investor-friendly tax system and Austria’s links to both Central and Eastern Europe.

During the rise of fintech, many people believed that it had the potential not only to disrupt the financial market, but also to take down financial institutions. However, the latter perception is fading and traditional players in the financial market (eg, credit institutions) have started to embrace fintech companies by entering into partnerships and cooperations.

Given that the financial industry is one of the most regulated, fintech companies essentially have three options:

  • structure their business models in a way that avoids any licence requirements;
  • enter into partnerships with existing market players that hold all relevant licences; or
  • acquire the necessary licences.

Key technologies

Have there been any particular developments – regulatory or commercial – in any of the following fintech sectors?

Distributed ledger technology and digital currencies (eg, blockchain, smart contracts and Bitcoin)?

Many credit institutions are investigating how distributed ledger technology can be used to bring the organisation into the digital future. Present conditions suggest that blockchain technology will require further development in order to deal with a higher number of transactions in substantially shorter periods. A number of traditional market participants are reviewing areas of business which still involve substantial manual input with a view to improving and accelerating processes (eg, export financings and letters of credit).

While the technology underlying bitcoin (blockchain) is generally viewed as potentially market disrupting, market participants have mixed views on digital currencies. Given the volatility of the digital currency market, regulators have raised concerns and warned investors about a potential total loss of their investment. Further, legislation is being prepared that imposes anti-money laundering duties on digital currency platforms. It is widely expected that this will be just the first step and that more legislation subjecting digital currencies to regulation will follow.  

Bitcoins are viewed as digital assets by the regulator and therefore – unlike in other jurisdictions – are not subject to regulation. However, certain business model operations based on virtual currencies (including bitcoin) may be subject to licensing or prospectus requirements. Depending on the specific business model, a fintech company’s operations may be governed by:

  • the Banking Act – if they involve banking activities such as accepting third-party funds for management by investing in a virtual currency;
  • the Act on Alternative Investment Fund Managers – for example, collecting investors’ capital to invest in virtual currencies according to a pre-defined investment strategy; or
  • the Payment Services Act 2018 – for example, operating an online platform for purchasing virtual currencies which also processes payments in euros.

The public offer of coins and tokens (initial coin and initial token offerings) may also trigger the requirement to publish a (capital markets) prospectus pursuant to the Capital Market Act.

Alternative lending platforms?

Austrian-based alternative lending platforms are still rare. This is because, unlike in other jurisdictions, the platform operator may become subject to (banking) licence requirements.

Under Austrian law the connecting of potential lenders with potential borrowers requires either a banking licence under the Banking Act for the brokerage of loans or a trade licence under the Trade Act for the brokerage of mortgage or personal loans. The (sole) granting of loans – if provided on a commercial basis – is also subject to a licence requirement under the Banking Act (irrespective of whether the lender accepts deposits from the public).

Accordingly, both the lenders (ie, those providing loans via the platform) as well as the platform operators (in cases where the operators partly fund the loans) may require a banking licence for lending.

While Austrian law imposes rather strict requirements on lending and the brokerage of loans, lending platforms can be operated without triggering any banking licence requirement. This requires careful structuring of the contractual relations among lenders, borrowers and the platform operator, and usually the involvement of a licensed credit institution (bank partner).

Digital payments, remittances and foreign exchange?

In June 2018 the Second EU Payment Services Directive (PSD2) was implemented into national law (Payment Services Act 2018). PSD2 is a game changer in the field of digital payments, mainly for the following reasons:

  • PSD2 widens the scope of payment services regulation by covering new services and players. The collection and consolidation of information regarding different customer bank accounts in a single place (account information services) will fall within the scope of PSD2. These services typically aim to provide a global view on an individuals’ financial situation and spending patterns. Other providers facilitate the use of online banking to make internet payments (payment initiation services), which are also now regulated. These services:
    • initiate a payment from the user account to the merchant account by creating a virtual ‘bridge’ between these accounts;
    • fill in the information necessary for a transfer (eg, the transaction amount, account number and message); and
    • inform the merchant once the transaction has been initiated.
  • In order to facilitate the market entry of these third -party providers of account information services and payment initiation services, PSD2 requires banks to allow them secure access to customer data via an open application programming interface (API).

Depending on the business model, digital payment services may not only raise regulatory issues under the payment services regulations, but may also constitute:

  • issuance of electronic money (subject to the provisions of the Electronic Money Act, which implemented the EU Electronic Money Directive (2009/110/EC)); or
  • issuance and administration of payment instruments, such as credit cards or bank cheques (subject to the Banking Act).

Alternative financing (including crowdfunding)?

Before the Act on Alternative Financing came into force in 2015, crowdfunding raised a number of regulatory concerns. The Act on Alternative Financing aimed to create a legal framework for alternative financings and, in particular, to meet the needs of newly established and innovative companies and citizen participation projects.

The Act on Alternative Financing sets out the instruments that are available in a crowdfunding (eg, shares, bonds, profit-sharing rights, silent partnership rights and subordinated loans). Its application is currently confined to small and medium-sized enterprises and crowdfundings that meet certain thresholds (eg, received subordinated loans not exceeding €1.5 million). Crowdfunding exceeding these thresholds or crowdfunding by large entities (ie, not small or medium-sized entities) do not benefit from the eased rules under the Act on Alternative Financing and require careful structuring to avoid regulatory pitfalls such as triggering a banking licence or capital markets prospectus requirements, or being qualified as an alternative investment fund.

Note however that currently legislation is on the way (which should become effective in Q3 of 2018) according to which the scope of application of the Act on Alternative Financing will be extended (application not limited to small and medium-sized enterprises) and the applicable thresholds will be raised.

Investment, asset and wealth management?

Fintech companies may revolutionise investment, asset and wealth management in two major ways:

  • developing technology and artificial intelligence that supports established market players with portfolio management; and
  • offering asset management technology directly to investors or managing their assets in accordance with certain pre-defined (and automatically executed) investment strategies (robo-advice). Thus, a wider public gains access to (digitised) asset and wealth management, which was formerly reserved for wealthy individuals.

While fintech companies with a business model as per the first point above are generally not subject to regulatory licensing requirements, those pursuing a business model as per the second point are likely to provide investment advice and/or portfolio management, which are subject to the EU Directive on Markets in Financial Instruments (implemented into Austrian law by the Securities Supervision Act 2018).

Robo-advice and artificial intelligence?

Trading in financial instruments is subject to a banking licence under the Banking Act. However, providing investment advice, portfolio management, reception and transmission of orders and multilateral trading facility operations are subject to a licence as an investment firm or as an investment service provider under the Act on Securities Supervision 2018.

The licence requirements apply irrespective of the technology used. Accordingly, the licence requirements apply regardless of whether the respective activities are performed manually by humans or in an automated way by a computer system (eg, robo-advice, robo-trading and automated portfolio management).

Any other technologies?

Fintech also provides solutions in the insurance market (insurtech).

Regulatory issues

Regulatory approach

How would you describe the regulatory policy for fintech products and services in your jurisdiction?

Austrian law and the Austrian regulator are neutral as to which technology is used. Accordingly, fintech products and services operate in the same regulatory environment as ‘traditional’ market participants. If and to what extent the financial regulatory regime applies to them primarily depends on their actual business activities. In addition, supplementary provisions might apply depending on clientele (particularly in the case of business with consumers).

The Austrian regulator is open to new technology and has therefore established a fintech contact point, which handles all fintech-related questions and can be contacted by fintech companies planning to become active in the Austrian market. However, no regulatory sandbox is currently available.

Have any fintech-specific laws or regulations been enacted in your jurisdiction? Are any envisaged?

No fintech-specific laws have been enacted in Austria. The Ministry of Finance has established an advisory board and proclaimed that it aims to foster growth in the fintech sector.

Regulatory authorities

Which government authorities regulate the provision of fintech products and services?

The Financial Market Authority (FMA) is responsible for banking, insurance, securities and pension company supervision. Accordingly, a fintech company will be supervised by the FMA, provided that it conducts activities subject to financial market regulation.

Financial regulatory framework

Which laws and regulations governing the provision of financial services apply to fintech businesses?

The use of a particular product or technique (eg, an app, interface or distributed ledger technology) does not restrict the applicability of laws and regulations governing the provision of financial services. Relevant for the applicability of those regulations is always the activity being conducted by the respective fintech company.

Depending on the specific business model, fintech company operations may be subject to regulatory licensing requirements and governed by:

  • the Banking Act – if the business operations involve banking activities such as accepting third-party funds for management by investing in a virtual currency, when loans are brokered or granted or when payment instruments are issued);
  • the Payment Services Act 2018 – for example, where money is received and transferred to third parties, information of several accounts is consolidated or payments are initiated;
  • the Securities Supervision Act 2018 – for example, if providing investment advice or portfolio management, receiving or transmitting orders or operating a multilateral trading facility;
  • the Act on Alternative Investment Fund Managers – for example, when collecting investors capital to invest in virtual currencies according to a pre-defined investment strategy;
  • the Electronic Money Act – when issuing electronic money;
  • the Insurance Supervision Act – when offering contract insurance; and
  • the Act on Anti-Money Laundering in the Financial Market.

Further, public offers of securities or investments will usually trigger a prospectus requirement pursuant to the Capital Market Act; although, the Capital Market Act itself – as well as the Act on Alternative Financing – provides for certain reliefs and exemptions. Whether an offer of coins and tokens (initial coin and initial token offerings) triggers a prospectus requirement depends on the features of the coin or token and requires careful examination of the case at hand.

Other commercial activities are subject to the Trade Act, provided that they are not expressly exempt.

Given that the financial industry is highly regulated, fintech companies should understand that their business model may subject them to substantial regulatory requirements. Depending on the business model, careful structuring may result in eased or no requirements at all.

Under what conditions are fintech businesses subject to licensing requirements? Are there any exemptions?

In determining whether a licence is required, the activity of the fintech companies concerned is decisive, but not the use of a particular product or technique (eg, an app, interface or distributed ledger technology).

Digital currencies, initial coin offerings

Bitcoin – the most prominent blockchain-based cryptocurrency – is not subject to FMA supervision because it is not classified as a payment or financial instrument under Austrian law.

However, for the operation of various business models based on cryptocurrencies, a licence from the FMA (eg, according to the Banking Act, the Act on Alternative Investment Fund Managers or the Payment Services Act 2018) or a prospectus according to the Capital Market Act may be required.

Due to differences in the technical, functional and economic design of initial coin offerings, each offering must be assessed on a case-by-case basis. The regulatory assessment must always be based on the specific form of the initial coin offering in each individual case and may result (for example) in the applicability of the Banking Act, the Act on Alternative Investment Fund Managers, the Act on Securities Supervision 2018 or in a prospectus requirement according to the Capital Market Act.

Alternative lending platforms

Alternative lending platforms are difficult to implement without triggering a licence requirement. Connecting potential lenders with potential borrowers requires either a licence according to the Banking Act (the brokerage of loans constitutes banking business) or a respective trade licence according to the Trade Act.

Digital payments

A licence according to the Payment Services Act 2018 may be required if the fintech company is involved executing payment services – for example, initiating or executing payment transactions, enabling cash placements or withdrawals on a payment account, or money remittance.

The provision of mere technical services (to be construed on a narrow basis) is generally exempt from the Payment Services Act 2018. The Electronic Money Act or the Banking Act may apply to commercial issuances of payment instruments.

Alternative financing platforms

A licence from the FMA pursuant to the Banking Act, the Act on Alternative Investment Fund Managers or the Payment Services Act 2018 may be required. A prospectus according to the Capital Market Act may be required, although the Capital Market Act itself as well as the Act on Alternative Financing provide for certain relief and exemptions.

Investment, asset and wealth management/robo-advice

Fintech companies that offer investment, asset and wealth management services or robo-advice may require a licence under the Securities Supervision Act 2018, implementing the EU Markets in Financial Instruments Directive II (MiFID II) into Austrian law.

Are any fintech products or services prohibited in your jurisdiction?

No, but some activities are subject to licensing requirements. Conducting such activities without the required authorisation may result in (among other things) substantial administrative fines.

Data protection and cybersecurity

What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?

The processing and transfer (domestic and cross-border) of data relating to fintech products and services is subject to the EU General Data Protection Regulation (GDPR), which in Austria is supplemented by national data protection law.

The GDPR applied as of 25 May 2018 and provides for substantial fines (up to €20 million or 4% of the company’s annual turnover) in case of material violations (eg, illegal transfers of data to countries outside the European Union).

What cybersecurity regulations or standards apply to fintech businesses?

Regulators have become focused on cybersecurity and its associated risks. Accordingly, both European and national regulators have issued guidelines on IT security with which credit institutions must comply.

These guidelines are also relevant for fintech companies because such businesses are either licensed themselves or cooperate with licenced institutions that will hold them to the same level of accountability.

Financial crime

What anti-fraud, anti-money laundering or other financial crime regulations govern the provision of fintech products and services?

Due diligence obligations to combat money laundering and terrorist financing are regulated in the Act on Anti-money Laundering in the Financial Market. They are based on the Fourth EU Money Laundering Directive. Fintech companies must observe these due diligence requirements if they perform activities which require a licence and are therefore subject to the supervision of the FMA.

The obligation to exercise such anti-money laundering due diligence may also arise on the basis of the Trade Act.

The Fifth EU Money Laundering Directive will apply anti-money laundering obligations to cryptocurrency exchanges and custodian wallet providers for digital currencies.

What precautions should fintech businesses take to ensure compliance with these provisions?

The provisions are based on the ‘know your customer’ principle, which aims to deprive money launderers of their anonymity.

Accordingly, customers must be identified by means of an official photo ID (eg, upon entering into a business relationship).

If money laundering or terrorist financing is suspected, a report must be submitted to the Money Laundering Reporting Office.

Consumer protection

What consumer protection laws and regulations apply to the provision of fintech products and services?

Under Austrian law, the level of protection afforded to consumers generally does not depend on the type of product or service. Contracts between entrepreneurs and consumers must meet the requirements of the Consumer Protection Act. Contracts concluded at a distance (eg, via telephone, e-mail or the Internet) or outside business premises are subject to the Distance Selling Act.

Those provisions – to a large extent based on EU law – aim to ensure that consumers are informed in a transparent way and are not subject to unusual or unfair provisions. The Austrian legislature provides for special information obligations and rights of withdrawal for the benefit of consumers. These are largely based on EU law.

Competition

Does the provision of fintech products or services in your jurisdiction raise any particular competition regulatory concerns?

The provision of fintech products or services raises no particular competition regulatory concerns per se.

General competition law restrictions may have to be complied with when entering into long-term cooperation agreements.

Cross-border regulation

Are there any particular regulatory issues concerning the cross-border provision of fintech products and services (eg, operating jurisdiction rules and currency controls)?

Foreign companies wishing to access the Austrian market for fintech products and services have the following options:

  • obtain a licence from the Austrian regulator (provided that the fintech engages in a regulated activity);
  • if applicable, passport their existing EEA licence to Austria and either establish a branch or directly provide cross-border services;
  • collaborate with a company that holds the required licences; or
  • adapt the business model for the Austrian market to avoid licence requirements.

Financing, investment and government support

Government support

Does the government provide any incentives or support programmes to promote fintech innovation in your jurisdiction (eg, tax incentives, grants and regulatory sandboxes)?

Although the Austrian government recognises the potential of fintech as a driver of financial innovation, it does not yet offer a regulatory sandbox. Instead, the Financial Market Authority (FMA) has established a designated fintech contact point, with a view to transparency and clarity, that handles questions relating to:

  • licencing requirements;
  • the obligation to publish a prospectus;
  • compliance and anti-money laundering regulations; and
  • how FMA procedures are conducted and the costs involved.

The Ministry of Finance has established an advisory board and proclaimed that it aims to foster growth in the fintech sector.

Has the government concluded any international cooperation agreements to promote and facilitate the cross-border expansion of fintech businesses?

No.

Financing and investment

What private financing and investment schemes are available and commonly used for fintech start-ups in your jurisdiction?

Aside from bank financing and venture capital, fintech companies may raise capital by way of initial coin offerings. During an initial coin offering, capital is usually collected in the form of virtual currencies. In return, the investors receive a coin or token that is linked to the company or project of the initial coin offering organiser. The coin or token can also represent an investment in a company – often a start-up – or promise a claim to a future profit to be earned.

If the coin or token represents a value that is tied to a project or company, the coin or token will typically have an intrinsic value. Thus, there is a significant risk that the FMA could assess such an initial coin offering or initial token offering as an offer subject to prospectus requirements under the Capital Market Act; although, the Capital Market Act and the Act on Alternative Financing provide for certain exemptions.

If the coin or token is classified as a financial investment within the meaning of the Securities Supervision Act 2018, an investment service subject to licensing may be given. In addition, a banking activity (issuing and managing means of payment) may be given if the generated coin can be used as a means of payment.

Ancillary issues

IP rights

What forms of IP protection are available for fintech innovations?

The following categories of intellectual property will typically be relevant for fintech innovations:

  • Computer programs are protected by copyright (as works of literature), provided that they are the result of the unique intellectual creation of their author. In addition to copyright law, protection may also be provided under utility model and patent law. However, software as such is unprotectable either in the form of a patent or a utility model. The legislature allows such protection of software if it is a ‘computer-implemented invention’ (ie, if it relates to a technical context).
  • Databases can also constitute a particular intellectual creation as a result of the compilation of individual contributions into a unified whole. Such compilations are protected by copyright.
  • Individual contents contained on web pages in word, picture or sound are protected by copyright if they are the result of the unique intellectual creation of their author.
  • Websites can also enjoy copyright protection under the same preconditions as described above. If the content of several web pages is independent, but conceptually linked by hyperlinks that together form a systematically arranged internet presence, this may constitute a database provided that it is original; however, this does not affect potential copyrights on the individual web pages.

What rules govern the ownership of IP rights to fintech innovations?

Copyright

Pursuant to the so-called ‘creative principle’ of copyright, the author of a work is always the one who created it. Therefore, the first copyright owner must always be a natural (physical) person – legal persons are unable to develop the intellectual activity required for a work protectable by copyright. Since copyright cannot be transferred among living persons (except in the case of renunciation of a co-author), the author retains its position as author for its entire life (and its legal successors for a period of 70 years from the author’s death). Only after the author dies can the copyright be transferred among legal persons. For the protected period, the author may only dispose of its copyright to the extent that it can (exclusively) grant rights of use of works to third parties or (non-exclusively) grant authorisations to use works.

Patent rights and utility model rights

Software as such is not protectable under the Patent Act or the Utility Model Act. Protection may be afforded if the software applies technical measures to achieve a technical purpose.

Immigration

What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the tech or financial sector?

EU and EEA citizens do not require a visa or a residence or other permit to work or reside in Austria.

An employer may employ a non-EU or EEA citizen (foreigner) if the foreigner has been issued an employment permit or a residence permit valid for this employment.

For skilled staff there are special immigration schemes in place (requiring, among other things, a certain skill level and a salary reaching certain thresholds).

What immigration schemes are available for foreign investors and entrepreneurs wishing to invest in or establish a fintech business in your jurisdiction?

As a national of a third country (ie, a non-EU or non-EEA country), a foreign entrepreneur can apply for a Red-White-Red card for start-up entrepreneurs if the following requirements are met:

  • the development and market introduction of innovative products, services, processes or technologies by a new company to be founded;
  • the submission of a conclusive business plan for the establishment and operation of the company;
  • the personal exercise of significant influence on the management of the planned company;
  • proof of capital for the company to be founded in the amount of at least €50,000, of which at least half is equity; and
  • a certain minimum score pursuant to the legally standardised scoring procedure, which is based on objective criteria such as qualification, work experience, language skills and age.

The card entitles the holder to settle in Austria and operate the start-up business.

Notwithstanding the above, EU and EEA citizens may live in Austria with self-employed status indefinitely and without having to meet further requirements.