FMA Ordinance Update Regarding Audit Report Appendices for Payment Institutions

Key Takeaways

• The Austrian Financial Market Authority (FMA) has updated its ordinance concerning the appendix to audit reports for payment institutions.
• This update clarifies reporting requirements and the application of specific regulatory versions for financial years ending after certain dates.

Deep Dive

This regulatory update pertains to the Ordinance of the Financial Market Authority (FMA) on the appendix to the audit report for payment institutions (ZAPV). The regulation outlines the mandatory structure and submission process for auditors when presenting findings related to the Payment Services Act (ZaDiG). Compliance teams must ensure that all audit results are presented in the prescribed appendix format and that accuracy is formally confirmed via the auditor's signature.

A critical component of this update involves the reporting mechanism through the FMA Incoming Platform Ordinance (FMA-IPV). The regulation mandates that the Annex to the audit report must be submitted within six months of the end of the financial year using a standardized electronic data transfer to the Austrian National Bank. This requires strict adherence to technical and temporal reporting standards to avoid regulatory friction.

The document provides a detailed timeline for the application of various regulatory versions, specifically noting that the Annex version associated with BGBl. II No. 143/2026 is applicable to financial years beginning after December 30, 2026. Compliance professionals must carefully track these effective dates to ensure that audit templates and reporting workflows are updated in alignment with the most recent legal provisions.

For compliance professionals, the primary recommendation is to conduct a gap analysis of current audit reporting procedures and electronic submission protocols. It is essential to verify that any "not applicable" or "no business cases" labels used within test modules are clearly explained as required by Section 2. If an institution's business model changes, the risk of inaccurate reporting increases; therefore, robust internal controls over the audit preparation process are necessary to mitigate operational and regulatory risks.

Source: Austrian Financial Market Authority