Austria AML: FM-GwG Obligations Explained from the FMA

Austria's Financial Markets Anti-Money Laundering Act, known as the FM-GwG, is the main rulebook for banks, financial institutions and virtual currency providers there. The Austrian Financial Market Authority (FMA) publishes an unofficial English translation, which we used for this guide. It covers who is caught, the risk assessment and customer due diligence duties, enhanced due diligence cases, reporting and record keeping. For the international background, see our guide to the FATF and its 40 Recommendations.

The legal basis

According to the FMA, the FM-GwG has applied to Austria's entire financial market since 1 January 2017 and transposes international and EU rules. The FMA's page names Directive (EU) 2015/849 as amended by Directive (EU) 2018/843, and Regulation (EU) 2015/847 on information accompanying transfers of funds, as the EU basis. Beneficial ownership provisions sit in a separate act, the Beneficial Owners Register Act. The FMA says Austria transposed the fifth directive through amendments published in Federal Law Gazette I No. 62/2019 and refers to a later amendment in Federal Law Gazette I No. 151/2024. The translation we read is a consolidated version current as of 1 January 2025. The translation is for information only, and the German text is authoritative.

Who the Act covers

Article 1 paragraph 1 of the translation covers credit institutions, financial institutions and virtual currency providers, and excludes branches in other Member States of Austrian-incorporated institutions. Article 2 defines these groups, including crypto-asset service providers. The FMA also publishes regulations for specific sectors, including savings associations, life insurance and online identification, and four guidance circulars covering risk assessment, due diligence, internal organisation and reporting.

Risk assessment

Article 3 sets up a coordinating committee at the Federal Ministry of Finance to maintain a national risk assessment, meeting at least twice a year and publishing its findings. Under Article 4, obliged entities must assess their own money laundering and terrorist financing risks, considering customers, geographies, products, services, transactions and delivery channels, and must do so before rolling out new products. They must document the assessments and give them to the FMA on request.

Customer due diligence

Article 5 says due diligence applies when establishing a business relationship, for occasional transactions of at least 15,000 euro or transfers of funds over 1,000 euro, on suspicion, or when previously obtained identity data is doubtful. Article 6 covers identifying and verifying the customer and beneficial owner, understanding the purpose of the relationship and the source of funds, ongoing monitoring and keeping information up to date. Identity verification methods include in-person, remote and electronic options. Entities may scale their measures to risk and must assign each customer a risk class.

Article 7 says verification generally has to happen before the relationship starts, with limited exceptions, and that if due diligence cannot be completed the entity must refrain from transacting and consider terminating the relationship. Article 7a permits AI-based transaction monitoring if certain conditions are met, including documentation and access for the FMA.

Simplified due diligence

Article 8 allows simplified due diligence only where the risk assessment identifies lower risk using the factors in Annex II, and requires the entity to confirm the low risk, keep monitoring transactions and retain sufficient records.

Enhanced due diligence

• General (Article 9): applies in the cases in Articles 9a to 12 or where risk is assessed as higher using the factors in Annex III. Complex, unusually large or unusual transactions must be examined with heightened monitoring.
• High-risk third countries (Article 9a): specific measures such as senior management approval.
• Correspondent relationships (Article 10): requirements for cross-border correspondent relationships.
• Politically exposed persons (Article 11): senior management approval and source of wealth checks for politically exposed persons, their family members and close associates.
• Self-hosted crypto addresses (Article 11a): risk assessment and mitigation for transfers to or from them.
• Prohibitions (Article 12): bans correspondent relationships with shell banks and anonymous accounts or safe-deposit boxes, and sets extra rules for non-cooperative countries, including reporting transactions over 100,000 euro involving them.

Our guide to high-risk third countries and enhanced due diligence explains how the EU and FATF lists feed into measures like these.

Reporting and confidentiality

Under Article 16, entities must file a suspicious activity report with the Money Laundering Reporting Office without delay when they know, suspect or have reasonable grounds to suspect money laundering, predicate offences or terrorist financing, and must cooperate fully with requests for information. Article 17 says that after filing, entities must stop related transactions unless doing so is impossible, and that the reporting office can order transactions to be delayed or omitted. Article 20 requires entities to keep reporting procedures confidential from customers and third parties.

Record keeping and data protection

Article 21 requires due diligence documents and transaction records to be kept for ten years after the relationship ends or the occasional transaction occurs. Personal data must then be deleted unless other laws require longer retention or related criminal proceedings are pending. Data collected solely for AML purposes cannot be used for other purposes such as commercial ones, and new customers must receive data protection information before the relationship begins.

Our suggestions for firms with Austrian exposure

These are Learnsignal's suggestions, not FMA requirements. Check whether the Austrian counterparty is an obliged entity under Article 1. Compare its risk classification approach against your own. If you use automated monitoring, note that Article 7a sets conditions for AI-based tools. Keep Austrian customer records in line with the ten-year rule and the deletion requirement. Training on EU and national AML frameworks is available through Learnsignal CPD.

What we could not confirm

The translation text we read stopped after Article 22, so we cannot describe the internal organisation and AML officer duties in Article 23 or the penalty provisions in Articles 34 to 41, including fine amounts. The translation is unofficial and the German text is authoritative, so check the original before relying on any detail. We did not read the FMA circulars or the Beneficial Owners Register Act. The FMA page we read was last modified in August 2020, and we have not checked whether newer FMA guidance exists.

Frequently asked questions

Who does the FM-GwG apply to?

According to Article 1 of the FMA's translation, credit institutions, financial institutions and virtual currency providers.

How long must records be kept in Austria?

Article 21 requires ten years after the business relationship ends or the occasional transaction occurs.

Does the Act allow AI in transaction monitoring?

Article 7a permits AI-based transaction monitoring if certain conditions are met, including documentation and FMA access.