Internal audit for crypto-asset service providers (CASPs) in Austria
We are OptiRisk Consulting in Vienna. We provide internal audit for crypto-asset service providers (CASPs) in Austria: as the whole function under an annual engagement with a risk-based audit plan, in co-sourcing alongside your own team, or as ad hoc audits. Applicants in the preparation phase get the internal audit documents for the authorisation file. As of October 2026, the ESMA register lists 12 CASPs with Austria as home member state. A specialised compliance partner delivers compliance and AML/CFT and contracts directly with you.
Author: Thomas Michalik, internal auditor · 10+ years in internal audit at bank and insurance groups · currently head of internal audit at a bank subsidiary · fit-and-proper trained · updated
Does MiCAR require an internal audit function?
- MiCAR (Regulation (EU) 2023/1114) contains no explicit internal audit requirement.
- Art. 62(2)(i) MiCAR requires internal control mechanisms to be described in the authorisation application. Art. 68(6) obliges the management body to assess regularly the effectiveness of the policies and procedures adopted to comply with Chapters 2 and 3 of Title V.
- In our reading, a CASP that has to demonstrate that effectiveness needs an independent review. That is the role of internal audit.
- In our reading, small and mid-sized CASPs can provide this review through an outsourced internal audit function.
Can a CASP outsource it (Art. 73 MiCAR)?
- In our reading, yes, on the conditions of Art. 73 MiCAR: the CASP takes all reasonable steps to avoid additional operational risk, remains fully responsible for its obligations, and the FMA must be able to exercise its supervision, including on-site access, vis-à-vis the service provider.
- The CASP also needs an outsourcing policy and a written contract with a termination right, and it must provide information to the FMA on request.
- In our reading, small CASPs can outsource the function completely. The firm names one person who commissions and oversees the internal audit.
What does an internal audit review at a CASP?
The audit plan sets number and rhythm of audits, spread over a multi-year cycle.
- Safeguarding of clients' crypto-assets and funds under Art. 70 MiCAR
- Outsourcing arrangements under Art. 73 MiCAR
- Governance and own funds
- Conflicts of interest
- ICT risk management under DORA
- AML/CFT controls including the travel rule (Regulation (EU) 2023/1113)
How does DORA affect the audit plan?
- Art. 6(6) DORA: the ICT risk management framework is subject to internal audit by auditors with sufficient ICT knowledge and appropriate independence. Microenterprises are exempt.
- Art. 6(10) DORA: the verification of compliance with the ICT risk management requirements may be outsourced, but the firm remains fully responsible.
- In our reading, this means the audit plan of a CASP carries ICT as a standing audit area, and the audit team needs the ICT knowledge to cover it.
How does an engagement with OptiRisk work?
- Annual contract with a risk-based audit plan agreed with the management board. Number and rhythm of audits follow the risk analysis, as set in the audit plan.
- You get reports that the management board, the supervisory board and the FMA can use directly, with findings, risk rating, actions, owners and deadlines, and follow-up of open points.
- Independence: for one firm, OptiRisk Consulting provides either internal audit or risk management, never both, and we do not audit what we built.
- A specialised compliance partner delivers compliance and AML/CFT and contracts directly with the firm.
For the general model, see outsourced internal audit for regulated financial firms in Austria.
Frequently asked questions
01Does a CASP need an internal audit function?
MiCAR contains no explicit requirement. In our reading, the need for an independent review follows from Art. 62(2)(i) MiCAR, which requires internal control mechanisms in the authorisation application, and from Art. 68(6), which obliges the management body to assess regularly the effectiveness of the policies and procedures adopted under Chapters 2 and 3 of Title V. In our reading, that assessment is evidenced by an independent review, which is the role of internal audit.
02Can OptiRisk Consulting provide both internal audit and risk management for the same CASP?
No. For the same firm, we provide either the internal audit function or the risk management function, never both. We do not audit a function we built ourselves. This separation follows the principle of independence of the control functions.
03What does internal audit review at a CASP?
Core audit areas are safeguarding of client crypto-assets and funds under Art. 70 MiCAR, outsourcing under Art. 73, governance and own funds, conflicts of interest, ICT risk management under DORA and AML/CFT controls including the travel rule. The audit plan sets number and rhythm of audits. We spread them over a multi-year cycle across the whole audit universe, meaning all auditable areas of the firm.
04Does OptiRisk Consulting also support the authorisation application?
Yes. Support covers a gap analysis against the requirements of Art. 62 MiCAR, preparation of application documents on governance, internal controls and own funds, coordination of the parties involved and answers to FMA queries during the assessment. The specialised compliance partner prepares compliance and AML-specific documents.
Sources
Consolidated texts on RIS and EUR-Lex, and information from the FMA and ESMA.
Contact
The first call takes 30 minutes and is confidential and without obligation. We clarify your regulatory position, the scope and the contract model. We hold consultations in English or German. The contact page is in German.