Bitpanda Faces Regulatory Scrutiny Over Risk Management Deficiencies
Bitpanda, a prominent European cryptocurrency platform founded in Vienna, has recently encountered significant regulatory challenges in Germany. The German Federal Financial Supervisory Authority (BaFin) conducted a special audit of Bitpanda’s German subsidiary, Bitpanda Asset Management GmbH (BAM), revealing serious shortcomings particularly in risk management, IT infrastructure, and outsourced activities.
The BAM entity, which began offering financial services in late 2022, was subject to this intensive review less than a year after commencing operations. BaFin had signaled early on that all licensed crypto dealers and custodians would undergo such examinations within their first year of business. According to BAM’s 2023 financial statements, the audit focused primarily on the company’s business organization, including its risk assessment processes and reliance on related Bitpanda group companies for crucial functions like customer identification and crypto asset custody.
Bitpanda’s corporate structure shows a complex interconnection with its Austrian parent company, Bitpanda GmbH, which handles key operational activities and asset custody. Leadership links reflect this entwined relationship, with Lukas Enzersdorfer-Konrad, a long-time executive in Vienna, acting as CEO of the German subsidiary as well as the overall group’s operational head.
Findings of the BaFin-Led Special Audit
Documents accessed by investigative journalists reveal that the audit uncovered a total of 16 significant findings, classified by severity as five “serious,” four “weighty,” and six “moderate.” These issues centered on deficiencies in the company’s risk management framework, a core area for financial services providers, especially those dealing with cryptocurrencies. It reportedly took nearly a year—from March 2024 through the first quarter of 2025—for the identified problems to be fully resolved.
The audit was technically executed by the Deutsche Bundesbank on behalf of BaFin. It highlighted that BAM’s infrastructure and daily processes were heavily reliant on the parent firm in Vienna. The intertwined operational dependence raised regulatory concerns, particularly given the intricate relationship between risk management, IT, and outsourcing handled among various group entities.
Internal Audit Department Raises Alarm
Further complications surfaced in the summer of 2025 during an internal meeting involving CEO Enzersdorfer-Konrad and Bitpanda leadership. The company’s internal audit function reportedly expressed stark concerns in a presentation criticizing the risk management “second line of defense” as lacking in necessary expertise and unwilling to cooperate with the internal audit team. The auditors warned of ongoing regulatory non-compliance risks and the potential appointment of a regulatory special representative.
The presentation also controversially mentioned that some internal documentation appeared to have been generated using AI tools like ChatGPT without appropriate quality control or relevance to actual Bitpanda processes. This pointed to gaps in internal governance and control mechanisms essential for a fintech operator whose business depends heavily on trust and compliance.
Expert Commentary on the Regulatory Issues
Nikolai Badenhoop, a legal scholar specializing in sustainable finance law, described the findings as “grave,” emphasizing that such weaknesses strike at the heart of a financial institution’s regulatory obligations. He noted that if the internal audit’s critiques are accurate, the professional competence and reliability of Bitpanda’s management could be seriously questioned.
Despite these regulatory challenges, Bitpanda maintains that it operates as one of the most heavily supervised crypto platforms in Europe. The company states it collaborates closely with supervisory authorities and implements continuous improvements in governance and compliance processes. According to Bitpanda, findings from BaFin audits are normal occurrences that are addressed through action plans and ongoing internal and external reviews, including annual audits by KPMG.
Bitpanda’s Rapid Growth and Corporate Culture
Bitpanda has expanded swiftly since its founding in 2014, growing to over seven million users and securing a “unicorn” valuation exceeding one billion U.S. dollars. The company enjoys high-profile sponsorships with major sports clubs and athletes, underscoring its ambition and public profile. Its founders retain substantial ownership stakes, with plans for an initial public offering reportedly underway.
The corporate culture, shaped partly by Silicon Valley’s “move fast and break things” ethos, may contribute to the tensions between rapid innovation and regulatory compliance. Founders such as Eric Demuth have publicly critiqued European regulatory bureaucracy, highlighting a cultural clash that might explain some governance gaps uncovered by BaFin and internal audit teams.
Regulatory Developments and Political Donations
Bitpanda was the first Austrian company to obtain a license as a provider of crypto asset services from the Austrian Financial Market Authority (FMA), reflecting its intention to be at the forefront of regulation in the space. However, the tightening regulatory landscape since early 2025 presents ongoing challenges.
Notably, Bitpanda donated 1.75 million euros to major German political parties during 2025, with founder Demuth stressing the importance of democracy and economic stability. This political engagement signals the company’s interest in shaping the regulatory environment that will govern crypto services in Europe.
Bitpanda’s recent regulatory scrutiny highlights the difficulties that fintech and crypto companies face in balancing fast growth with robust governance. Continuous monitoring and adaptation to evolving compliance demands appear essential for sustaining trust among regulators, investors, and customers in this highly dynamic industry.
Read more at: www.profil.at
