Austria - Ministry of Finance and Licensing

(Section: "Markets and Jurisdictions")

1) Market picture and organ roles

BMF (Bundesministerium für Finanzen) is the central gambling authority of the federation level: it issues federal concessions, oversees online casinos/lotteries, controls the payment of special fees, initiates inspections and sanctions.
Lands (Länder) - regulate bookmaking/betting offline (Betting) at the level of land laws and permits.
Control bodies - financial police/anti-fraud units, consumer protection, advertising media supervision; cooperation with banks and communication providers for the execution of instructions.
Market model - federal monopolies/concessions for lotteries and casinos; land licenses for offline rates.

2) Licensing structure

2. 1 Federal circuit (BMF)

Lotteries/Instant Lotteries - state concession model (single/limited number of concessions).
Casinos (land) - a limited number of federal concessions at addresses/halls.
Online casino/online lottery - the right is granted to holders of the corresponding federal concession when fulfilling IT/AML/RG requirements (separate admission to a remote channel).
Poker outside the casino - outside the federal perimeter is considered a prohibited offer.

2. 2 Land outline (Länder)

Bookmaking/offline betting - land permits, PPP requirements (zone, operating mode, cash discipline, CCTV), personnel training; advertising and RG - subject to federal restrictions.

2. 3 Key principles

Fit & Proper for beneficiaries/directors, transparency of ownership structure and source of funds.
Local presence: Austrian legal entity, bank accounts, responsible persons (including AML/RG).
Certification: RNG/platforms/calculation modules, reporting interfaces and logs.

3) Online: who and how can work

Online lotteries/online casinos are within the perimeter of the federal concession: the remote channel is available only to BMF licensees.
Online rates - depending on land regulations; in most cases, remote activities are linked to offline/local presence and compliance with advertising, RG and AML land requirements.
Unlicensed domains - subject to law enforcement measures (including instructions for payment and media channels).

4) Taxation and fees (high level)

• Casino (on-prem/online) - progressive bets on GGR (bets − wins) with upper thresholds by law; separate jackpot/bonus rules.
• Lotteries - deductions from the bet (handle) according to the established scale; allocation to socially significant goals.
• Rates - land fees/taxes: most often with rates or GGR (for land and product).
• CIT/VAT - corporate tax at the national rate; betting/winning operations are usually out of VAT, related services (IT, marketing, hosting) - according to general rules.
• Frequency - monthly/quarterly declarations + annual reports (audit).
• Accounting - separate offline/online, for each product and land; correct reflection of bonuses, void/cashout, cancellations.

5) Reporting and supervisory access

Electronic forms: e-filing of declarations and reports, confirmation of payments.
Regulator access: test accounts, regular uploads, API/portals, secure channels.
Control: office reconciliation of otchetnost↔platezhi, requests for explanations; on-site audits and IT audits.

6) AML/CFT and identification

KYC/KYB: verification of identity/age (18 +), beneficiaries, sanctions/POP; source of funds by triggers.
Transactional monitoring: limits, atypical patterns, connections of accounts/means of payment; STR/SAR to competent authorities.
Storage: retention of KYC dossiers/journals by dates; GDPR compatibility, data protection.
Training: regular training of AML personnel, documented escalation scenarios.

7) Responsible Gaming (RG)

Self-exclusion/prohibition of admission: centralized mechanisms of prohibitions to participate, mandatory status check at registration/login/payment.

Self-limiting: deposit/loss/time limits, timeouts, "cooling."

Early diagnosis: pursuit of losses, sharp deposits, night activity - reasons for the intervention of the RG team.
Communications: visible RG warnings, fair chances and bonus conditions, help channel.

8) Advertising, promo and affiliates

Bans: targeting minors/vulnerable, misleading offers, "guaranteed winnings."

Bonuses: transparent T&C (wagers/deadlines/mouthguards); correct accounting in GGR/NGR.
Affiliates: contracts and a white list of creatives; it is forbidden to promote unlicensed brands for Austria.
Media control: compliance with frequencies, RG markings, removal of violating creatives on demand.

9) Technical requirements

Certification: RNG/platform/coefficient calculators - certified by recognized laboratories; periodic recertification.

Logging: immutable logs (WORM), time synchronization, end-to-end tracing "rate → calculation → payment → adjustment."

Reliability/Information Security: DR/BCP with target RPO/RTO, encryption at rest/in transit, RBAC/SoD, pentests/scans on schedule.

10) Checks and sanctions

Office: reconciliation of reporting and payments, GGR/NGR anomalies, compliance with bonus policy.
Field/IT audit: sampling sessions/tickets, staff interviews, checking cash discipline and hosting/logs.
Measures: fines, additional charges, UX/RG/AML prescriptions, domain/payment blocking; in case of gross violations - suspension/revocation of admission.
Mitigation: voluntary disclosure of errors, corrective plans, strengthening of internal controls.

11) Entry roadmap

A. Federal Circuit (Lottery/Casino/Online Casino)

1. Strategy: product matrix, fiscal burden assessment (special collections + CIT).
2. Legal structure: Austrian legal entity, beneficiaries, bank accounts.
3. Application: package for concession/admission to the online channel, fit & proper, financial stability, IT and reporting architecture.
4. Technical circuit: RNG/module certification, WORM logs, reporting showcases, API.
5. AML/RG: data providers, SoF triggers, limits/timeouts/self-exclusion.
6. UAT: test cases of GGR/NGR calculations, bonuses, reporting integrations.
7. Go-Live: freeze configurations, runbook incidents, SLA with PSP/hosting.
8. First 90 days: rhythm of declarations, otchetnost↔billing reconciliations (<0.5%), internal audit.

B. Land outline (offline/online land rates)

1. Land map: where to open, quotas/zoning, operating hours.
2. PPP/online: address permits, cash discipline, CCTV, local support.
3. RG/advertising: markings, frequency caps, prohibition of aggressive inductions.
4. Accounting and reporting: separate reporting by land/channel, deadlines and payment codes.

12) Compliance checklists

Licensing and Finance

• Path defined: federal concession or land permits
• fit & proper package, financial stability, IT/reporting architecture ready
• Calendar of declarations and payments; otchetnost↔billing reconciliation <0.5%

AML/KYC & RG

• KYC/KYB Policies, Sanctions/PEP, SoF Procedures
• Self-exclusion, deposit/loss/time limits, cooling
• STR/SAR Logs, CCR/Log Retention, Staff Training

Engineering and safety

• RNG Certificates/Platforms, Version Control
• WORM logs, time synchronization, DR/BCP tests
• Encryption, RBAC/SoD, scheduled penetration tests/scans

Marketing & Affiliates

• Creative whitelist, RG markings, frequency limits
• Banning promos for the self-excluded; compliance log (screenshots/URLs/dates)
• Quick Recall Procedure

13) Operational Control KPI

Fiscal: timely filing ≥99%; discrepancy otchetnost↔billing <0.5%.
AML/KYC: average verification time; share of false positives; SLA STR/SAR.
RG: proportion of players with active limits; Self-exclusion lock TTR <1 min.
Information security: MTTR incidents; completion of DR tests; closing critical vulnerabilities.
Marketing: 100% self-excluded filtering; 0 violations of advertising restrictions.

14) FAQ

Can an online casino be launched without a federal concession?
No, it isn't. Online casinos are the prerogative of federal concession holders with a separate admission to the remote channel.

Who regulates offline rates?
Lands. Land permits, compliance with local PPP rules and advertising are required.

How are bonuses taken into account in the tax base?
According to local instructions: bonuses/void/cashout are reflected in GGR/NGR according to the established methods; incorrect accounting leads to additional charges.

Are there block measures against unlicensed sites?
Yes I did. Instructions for payment routes/media, law enforcement practice against illegal domains and advertising.

Note

Numerical rates, progression thresholds and e-form format are regularly updated at the federation and state level. Before submitting applications and the first reporting period, check the current texts and technical specifications to avoid additional charges and pauses in operations.