Checking a MiCAR White Paper: What the First Published MiCA Penalty Against Bitpanda Means for Investors

Austria's Financial Market Authority, the FMA, has fined Bitpanda GmbH 70,000 euros. The trigger sounds technical: a crypto-asset white paper reached the regulator too late, and marketing went out before the document had been published. For you as an investor, it raises the most practical question in the EU's new crypto rulebook. Every token offered to the public in the EU must come with a mandatory document that you can read before you buy. We checked whether that document can actually be retrieved, and called up all 972 white papers held in the European register to find out.

FMA Fines Bitpanda 70,000 Euros: What the MiCA Notice of August 14, 2026 Says

The FMA published the sanction on August 14, 2026. It concerns Bitpanda GmbH, based in Vienna, and rests on several breaches of Regulation (EU) 2023/1114 on markets in crypto-assets, known as MiCAR. The fine amounts to 70,000 euros and the penalty decision is final. The FMA notice sits on the regulator's website; automated requests are turned away, while the page loads normally in a browser.

What stands out is less the amount than the fact that the authority published the case at all. By its own account, this is the first final MiCAR penalty decision the FMA has made public. The regulator attaches a message to it about the phase the regulation has reached: MiCAR has moved beyond licensing and supervision and now extends to enforcement. The FMA states explicitly that being the first published case gives neither the company concerned nor the breaches identified any special standing.

Bitpanda has commented publicly. According to the company, the objections related solely to timing and to formal requirements around the publication of the white paper and an accompanying information document. Customer funds, platform security and the financial interests of clients were not affected, and the points were remedied once the regulator raised them.

Three MiCAR Charges Under Articles 7 and 8: Late Filing, Marketing Ahead of the White Paper, Missing Disclosures

The notice lists three points, and all three concern the same mechanism: the white paper and how it was advertised.

1. Late filing. A crypto-asset white paper was not submitted to the FMA at least 20 working days before its publication, contrary to Article 8(1) and (5) MiCAR.
2. Marketing before publication. Contrary to Article 7(2) MiCAR, a marketing communication was distributed before the required white paper had been published.
3. Missing mandatory disclosures in the marketing. One marketing communication lacked the statement that no authority has reviewed the white paper and that the offeror alone is responsible for it (Article 7(1)(e)), together with a telephone number and an email address (Article 7(1)(d)).

The FMA does not name the token or the specific white paper the sanction relates to. That reticence is standard practice and it holds here too: the published material supports no inference about any particular offering, and the regulator has confirmed nothing on the point.

Final Through a Waiver of Appeal: What Section 22(2b) FMABG Means for the MiCA Proceedings

According to the FMA, the proceedings were concluded on an accelerated basis under Section 22(2b) of the Financial Market Authority Act. That provision allows a company to waive its right of appeal with binding effect before the decision is issued, provided it knows the operative wording at that point. The reasoning behind the decision may then be omitted, and the penalty becomes final immediately.

This matters for how the case should be read, and it cuts both ways. On one side, the sanction will no longer be contested and the matter is closed. On the other, administrative practice does not treat a waiver of appeal as an admission of guilt on the substance. It shortens the procedure, and nothing further follows from it. Anyone reading the fine as evidence of broader misconduct is going beyond what the notice actually says.

Measured against the size of the company, the amount barely registers, and the penalty range MiCAR sets for breaches of the white paper and marketing rules by legal persons runs well above it. The value of this case for you lies elsewhere. It shows which obligations the supervisor genuinely enforces, and those obligations exist for your benefit.

The Crypto-Asset White Paper Under MiCAR Title II: Which Document the Regulation Requires

MiCAR distinguishes three groups of crypto-assets. Asset-referenced tokens and e-money tokens fall under separate, stricter regimes; if you want to know which stablecoin issuers are authorised in the EU, you will find them in the MiCA register of stablecoin issuers. All other crypto-assets, meaning the overwhelming majority of the market from bitcoin down to a small project token, fall under Title II of the regulation. For those, the rule is straightforward: anyone offering them to the public in the EU, or seeking their admission to trading on a trading platform, must draw up a white paper, submit it to the competent supervisor and publish it.

The white paper is neither a sales brochure nor a project paper the offeror writes for itself. Its content is prescribed by the regulation: details of the offeror and the issuer, a description of the project and of the crypto-asset, the terms of the offering, the rights and obligations attached to the asset, the underlying technology, the risks, and information on adverse climate and environmental impacts. That structure is the real advance on the years before MiCAR, when every project decided for itself what it disclosed.

Nor are these obligations new. MiCAR entered into force on June 29, 2023 and became applicable in stages: Titles III and IV on asset-referenced tokens and e-money tokens from June 30, 2024, and Title II with Articles 4 to 15, which governs here, from December 30, 2024. Article 143(1) MiCAR contains a grandfathering rule for offerings that had already closed before that date. For everything offered to the public afterwards, the white paper obligation applies with no transition period.

20 Working Days Before Publication: Why the MiCAR Article 8 Deadline Is Not a Formality

The deadline that set off the Bitpanda case looks at first like administrative routine. It has a function all the same. Those 20 working days give the competent authority time to look at the document before it reaches the market. No substantive review is attached to this, and certainly no approval, as set out below. What the supervisor can establish in that window is whether an offering is coming, who stands behind it and whether the mandatory disclosures are formally present.

Miss the deadline and the supervisor loses that lead time. Add marketing before the white paper is published and the intended sequence inverts: the buying decision then forms on the basis of the advertising, while the document setting out risks and rights is not yet available. That sequence is exactly what Article 7(2) MiCAR protects, and it is exactly what was not observed in the case under review.

Mandatory Disclosures in Crypto Marketing: How to Spot a MiCAR-Compliant Communication

The FMA's third charge concerns the part you meet most often in daily life: the advertising itself. Article 7 MiCAR requires a marketing communication to be clearly identifiable as such, the information in it to be fair, clear and not misleading, and its content to be consistent with the white paper. On top of that come the mandatory disclosures that were missing in the case at hand.

Three of them you can check for yourself in seconds when an advertisement, a newsletter or a social media post pushes a token at you:

• Does it state that no authority has reviewed or approved this white paper and that the offeror alone is responsible for its content?
• Are the offeror's telephone number and email address given, so that there is a way to reach them?
• Does it say where the white paper is published, and does that document already exist?

If all of this is missing, the advertising is not automatically an attempted fraud. But the notice fails the requirements MiCAR sets for a lawful offering in the EU, and that is a usable first warning sign. If you would rather stay with supervised firms in any case, our overview of regulated crypto exchanges lists the providers that can actually show a MiCAR authorisation.

Right of Withdrawal Under MiCAR Article 13: 14 Calendar Days, and When It Does Not Apply

The white paper is the precondition for a right that many investors know nothing about. Article 13 MiCAR gives retail holders who acquire a crypto-asset in a public offering, either directly from the offeror or through a service provider involved in it, a right of withdrawal lasting 14 calendar days. Withdrawal is free of charge, no reason has to be given, and the period starts when you agree to the purchase. All sums paid, including any fees, must be reimbursed. The white paper has to point this right out expressly.

The limitation matters at least as much as the right itself. The withdrawal right does not apply where the crypto-asset was already admitted to trading on a trading platform before you bought it. For the typical purchase of a listed coin through an exchange, then, it does not bite. It applies to initial offerings, to sale phases ahead of a listing, and to tokens an offeror sells to you directly. That is also the area where disputes most often arise later on.

White Paper Liability Under MiCAR Article 15: What Applies When the Information Is Wrong

The second lever lies in liability. Article 15 MiCAR makes the offeror, or the person seeking admission to trading, responsible for the information in the white paper. Where that information is incomplete, unfair, unclear or misleading, a holder who suffers loss as a result can claim damages. The regulation shifts the burden of proof in the investor's favour: the company has to show that it took the steps needed to make the information meet the requirements.

In practice this means the white paper is the document an offeror can later be held to. If you secure it before you buy, you also secure the basis for a possible claim. A screenshot of the advertising will not do the job, because liability attaches to the mandatory document. How you file purchase records so they still hold value later also matters for your tax return down the line.

No Regulatory Review: Why a MiCA White Paper Is Not a Seal of Approval

This is where the biggest misconception sits, and the FMA sanctioned it through a missing mandatory disclosure of all things. Neither the FMA nor BaFin nor any other European supervisor approves a crypto-asset white paper. BaFin states expressly for its own remit that it does not endorse white papers. The document is submitted; it is not reviewed in the sense in which a securities prospectus is approved.

That is why the statement that no authority has reviewed the document and that the offeror bears sole responsibility appears in the regulation as a mandatory disclosure. It is the most honest line in the entire rulebook. When someone sells you a project on the argument that it is «MiCA-compliant» or «checked by the regulator», they are either confusing the licensing of the service provider with an assessment of the token, or doing it deliberately. The authorisation of a trading venue under Article 63 MiCAR says nothing about whether a token listed there is any good.

Our Own Survey of August 18, 2026: 972 White Papers in the ESMA Register, 125 of Them Unreachable

If the white paper is the central investor document, then everything depends on your being able to find it and open it. cryptoticker.io carried out this analysis itself on August 18, 2026.

The method in one sentence: we downloaded the file covering white papers for crypto-assets other than asset-referenced and e-money tokens from the interim register of the European Securities and Markets Authority, ESMA, and called up every white paper address on file over HTTP with a browser identifier, following redirects; every address that did not answer with code 200 was then called again individually, a second and a third time, spaced apart. Objects tested: 972 register entries, with the survey running on August 18, 2026 between 16:20 and 16:40 UTC.

The result:

• 847 of the 972 addresses (87.1 percent) served the page. For 125 entries (12.9 percent) the document did not arrive.
• 53 addresses answered with 404, meaning the page no longer exists at that location. For 30 addresses no connection was established at all. Those 83 cases are the hard core of the finding: for roughly one register entry in twelve, the mandatory document cannot be reached through the address on file.
• 22 addresses answered with 403 and 18 with 429, one with 401. These are defences against automated requests and say nothing about whether a person can see the page in a browser. We therefore count them separately and do not treat them as a shortcoming on the provider's part.
• One entry gives the string «N/A» as its white paper address.
• 146 of the addresses point straight at a PDF file rather than at a page that can be read in a browser.

What these numbers do not yield belongs here too. We tested only whether something is served at the registered address. Whether the document served is in fact the white paper, whether it is complete and whether its content is accurate is not measured by this. A single call is also a snapshot; a page that fails to answer today may be reachable again tomorrow.

151 White Papers Through BaFin: What the German Part of the MiCA Register Shows and Leaves Open

For German investors, the breakdown by competent authority is instructive. Of the 972 entries, 151 were notified through BaFin. That puts Germany in third place, behind Ireland with 365 and Malta with 161 entries, and ahead of the Netherlands with 77 and Liechtenstein with 72. Ten entries run through the Austrian FMA, the authority that decided the case discussed here.

On retrievability the German section performs best: 145 of the 151 white papers notified through BaFin could be called up, which is 96 percent. By comparison, the figures for the three other large sections of the register came in lower, at 312 of 365 for Ireland and 139 of 161 for Malta. The six German outliers break down into three 404 responses, two addresses with no connection, one of them the «N/A» entry, and one address with bot defences.

The gap no statistic fills

One field in the register is meant to be particularly useful to you and is barely filled in practice: the list of countries in which the offering applies. For 760 of the 972 entries this field is empty. Only 24 entries name Germany expressly. What follows from that is not that the remaining offerings exclude Germany, but that the register simply does not answer the question. If you want to know whether an offering applies to you, you have to look in the document itself.

Where to Find the MiCA White Paper for Your Token: ESMA Register, Provider Site, Trading Platform

Three routes lead to the document, and they differ in how reliable they are.

First, the ESMA register. The European Securities and Markets Authority maintains an interim register on its MiCA page, filled by the national supervisors and updated weekly. Alongside authorised service providers it holds the white papers for crypto-assets other than asset-referenced and e-money tokens, each with the offeror, the competent authority and the address of the document. This is the most complete source. It is provided as a file, which makes access harder for a lay reader.

Second, the provider's own site. Article 9 MiCAR requires the white paper to be published on the offeror's website and to stay accessible there for the duration of the offering. In practice it usually sits in the legal section of the site. As an example, the register lists for Bitpanda GmbH the white paper for the token Vision, retrievable in the company's legal section, dated August 11, 2026. Whether the penalty decision relates to that document or to another one, the FMA has not disclosed, and no connection can be drawn from the register entry.

Third, the trading platform. Where a token is admitted to trading, the platform regularly holds the white paper itself or links to it. That is the most convenient route and at the same time the one where you have least control over which version you are seeing. On larger trading venues you will usually find the documents gathered in the legal or help section.

What the MiCA Penalty Does Not Mean: Licensing, Customer Funds and the Regulator's Own Framing

Three distinctions, so the proportions stay right. First, the penalty decision does not touch the company's authorisation. In April 2025 Bitpanda became the first company to receive an authorisation from the FMA as a crypto-asset service provider under Article 63 MiCAR; the group also holds licences from Germany's BaFin and Malta's MFSA. The notice makes no mention of any withdrawal or restriction.

Second, none of the three points concerned customer funds or the security of the platform. The company said so expressly, and the published charges support nothing else: the three points go to the sequence and the completeness of documents.

Third, the case marks a beginning rather than a one-off. The FMA itself stresses that being the first published decision confers no special status. The real news is that supervisors are now enforcing white paper and marketing obligations by formal decision, and that applies to every provider in the single market alike. How the rulebook develops from here is covered in our piece on the planned MiCA review.

Checking a MiCAR White Paper: What to Take Away

1. Before every purchase, check whether a white paper exists, and save it. In an initial offering it is the basis of your rights under Articles 13 and 15 MiCAR. Stick to platforms that are supervised themselves: which ones those are is set out in our overview of crypto exchanges.
2. Read the mandatory disclosures in the advertising as a checklist. If the statement about the absence of regulatory review, the contact details or the reference to a published white paper is missing, then something the regulation requires is missing. File your purchase records straight away so that you can find them again later, for instance with one of the tools from our comparison of tax and portfolio tools.
3. Do not confuse the licensing of the provider with a review of the token. No authority endorses a white paper. If regulation is being sold to you as a quality guarantee for a coin, that is wrong. What you can control yourself is custody: our hardware wallet comparison shows how to manage it without a third-party platform.

(As of August 18, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)