Obtain MiCA-compliant CASP authorization in Estonia with RUE. Legal support for exchanges, custodians, brokers, and trading platforms seeking structured EU market entry.
Prepared by RUE editorial team Ā· Reviewed by Milana Ā· Updated 23 October 2026
Book Free ConsultationEstonia remains one of the most credible EU jurisdictions for crypto businesses, but in 2026 the legal reality is no longer the old VASP permit. The relevant route is CASP authorization under MiCA, supervised by Finantsinspektsioon, with national AML, corporate, tax, and operational rules still fully relevant.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
RUE structures Estonian CASP projects end-to-end: company formation, licensing strategy, governance design, AML/CFT framework, MiCA documentation, DORA-readiness mapping, and regulator-facing support.
We also coordinate related workstreams that usually delay crypto launches in practice: banking and EMI introductions, accounting setup, annual reporting, tax structuring, Travel Rule tooling, and local substance planning in Estonia.
The Estonian crypto license in 2026 means CASP authorization aligned with EU law, not the legacy FIU-era VASP model.
An Estonian CASP can use MiCA passporting mechanisms to scale across the EU, subject to notification and host-state operational rules.
Estonia offers efficient company administration, strong e-governance infrastructure, and a mature ecosystem for fintech and compliance operations.
Estonia is not a light-touch shortcut. That is precisely why licensed structures here are taken seriously by banks, counterparties, and institutional clients.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
An Estonia crypto license in 2026 means a CASP authorization under MiCA. The competent authority for CASPs is Finantsinspektsioon, while the Financial Intelligence Unit (FIU) remains relevant for AML reporting and enforcement in its statutory role. This is a materially different regime from the old VASP framework, both in document depth and in operational expectations.
The regulator reviews substance, not just paperwork. A compliant file must show that the applicant can actually operate the requested services: governance, internal controls, safeguarding, ICT resilience, AML/CFT, complaints handling, outsourcing oversight, and financial sustainability. For higher-risk models such as custody, exchange, transfer, or trading platform operation, the scrutiny is correspondingly deeper.
Exact requirements depend on service scope. A custody-focused applicant, a broker, and a trading platform do not carry the same prudential or operational burden. That is why a regulator-grade application must map each requested MiCA service to its capital bucket, control environment, outsourcing model, and client asset flow.
You need an Estonian company with genuine operational presence. In practice, applicants typically use an OĆ registered in the Estonian Commercial Register, with a real office, accessible records, and decision-making that can be evidenced in Estonia. A mailing address alone is not enough.
For many applicants, local substance is also critical for banking, tax residency analysis, and regulator comfort on effective management.
Management quality is a licensing issue, not an HR issue. Finantsinspektsioon assesses the reputation, competence, time commitment, and role clarity of directors and key function holders. As a practical baseline, applicants should plan for at least two board members and clearly allocated control functions.
A common failure point is appointing impressive names with no real availability. Regulators test substance through interviews, role descriptions, and internal reporting logic.
Capital depends on the MiCA service class requested. In broad market practice under MiCA, the relevant entry buckets are ā¬50,000, ā¬100,000, and ā¬150,000, depending on the services. However, applicants must distinguish initial capital from ongoing own funds.
After authorization, own funds must be maintained on an ongoing basis under MiCA prudential logic. For scaling businesses, the fixed-overheads test often becomes more relevant than the entry capital number shown in marketing materials.
A generic AML manual is not enough. Your framework must be built around the actual risk profile of your services, clients, geographies, channels, and token flows. Estonian CASPs are expected to align with the Money Laundering and Terrorist Financing Prevention Act, MiCA governance expectations, and the recast Transfer of Funds Regulation for Travel Rule compliance.
One practical nuance many articles miss: self-hosted wallet interactions are not prohibited per se, but they require a documented risk-based control model, including ownership verification or alternative mitigating controls where appropriate.
CASP licensing now requires a credible ICT control environment. Under DORA, crypto firms must demonstrate operational resilience, incident handling, vendor oversight, and continuity planning. For custody or exchange models, the regulator will expect architecture-level explanations, not slogans.
ISO 27001 is not a statutory substitute for DORA, but it is often a useful evidence layer when documenting the security management system.
The application must prove viability, not just legality. Finantsinspektsioon expects a business plan tied to the requested services, governance model, target markets, outsourcing structure, and realistic financial assumptions. A standard practical baseline is a 2-year business plan with opening balance sheet, P&L, cash flow, and capital planning.
A recurring red flag is a business plan that ignores the cost of Travel Rule vendors, KYT tools, audit, DORA controls, and payment infrastructure. Regulators notice immediately when the numbers are not operationally credible.
Client protection is a core MiCA theme. If you hold client crypto-assets or client funds, you must show how they are segregated, reconciled, protected from misuse, and recoverable in distress scenarios. Even non-custodial service providers need clear customer documentation and complaints procedures.
For custody models, the insolvency treatment of client assets and the legal structure of wallet control should be documented with unusual care. This is one of the most scrutinized areas in serious CASP files.
Licensing and banking are separate workstreams. An Estonian crypto license improves credibility, but it does not automatically create bankability. Applicants should prepare a parallel banking strategy covering operational accounts, safeguarding logic, fiat settlement, and payment counterparties.
RUE typically treats banking readiness as part of the license project, not as an afterthought, because weak fiat rails can delay launch even after authorization is granted.
Compare Estonia with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
5 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
ā¬0
Estimated Timeframe
Country-specific
Capital Requirement
ā¬0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Estonia remains attractive from a corporate tax timing perspective. The core feature is that resident companies generally pay 0% corporate income tax on retained and reinvested profits, while profit distributions are taxed when made. For many founder-led crypto businesses, this is commercially significant because licensing, technology, and compliance costs are front-loaded.
Tax is triggered on distribution, not on accrual. If the company earns profit and keeps it inside the business, no corporate income tax is generally due at that stage. When profits are distributed, the standard corporate tax burden is typically expressed as 22/78 of the net distributed amount, which corresponds to 22% of the grossed-up taxable base under the 2026 regime.
This timing advantage does not eliminate the need for tax planning. Founders still need to assess management remuneration, cross-border dividend treatment, permanent establishment risk in other countries, transfer pricing, and VAT characterization of services.
Not all crypto services are VAT-exempt. Following the logic of ECJ Hedqvist, certain exchange services may fall within VAT exemption treatment similar to currency exchange. But custody, software access, white-label infrastructure, SaaS, API services, token listing support, or advisory work may be taxable depending on the exact legal and factual structure.
For a licensed CASP, the real annual burden is usually operational rather than tax-driven: audit, accounting, local substance, compliance staff, KYT, Travel Rule tooling, external legal support, and DORA controls. That is why RUE usually plans tax and licensing together, not as separate projects.
Authorization is the starting line. An Estonian CASP must maintain prudential, AML, governance, reporting, and ICT controls on a continuous basis.
Yes, but legally it is no longer the old VASP-style Estonian crypto license. In 2026, when founders search for crypto license in Estonia, the legally correct concept is CASP authorization under Regulation (EU) 2023/1114 (MiCA). Estonia implemented the national supervisory architecture through its domestic legal framework, while the competent authority for CASPs is Finantsinspektsioon.
The transition matters because the old FIU-supervised VASP model was AML-centered, while the CASP regime is full financial supervision. Under the legacy system, businesses could operate with a national authorization focused primarily on AML/CFT. Under MiCA, the regulator assesses governance, safeguarding, prudential capital, complaints handling, outsourcing, ICT resilience, and conduct obligations in a far more integrated way.
The key dates are:
For new entrants, the practical answer is simple: there is no strategic reason to build around the old VASP vocabulary. The application, internal controls, and launch model should be designed as a MiCA-ready CASP project from day one. RUE supports this through CASP licensing, MiCA license in Estonia, and MiCA application document preparation.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
ā¬24,000 ā ā¬35,000
Estimated Timeframe
4ā6 months
EU Passporting
Available
We map your business model to MiCA service classes, identify whether CASP authorization is required, define capital bucket, and assess Estonia fit. Duration: 1-2 weeks.
Register the Estonian entity, structure ownership, arrange legal address and office, appoint board members, and plan local substance. Duration: 1-4 weeks.
Build the regulator-facing file: 2-year business plan, governance framework, AML/CFT package, DORA and ICT controls, financial model, source-of-funds evidence, and service descriptions. Duration: 3-8 weeks.
Submit the CASP application to Finantsinspektsioon with the required annexes and official fee payment. The file must be complete enough to pass the initial admissibility and completeness stage. Duration: 1 week.
The regulator checks whether the application package is complete. A practical benchmark is around 25 working days, but the clock may pause if information is missing or clarification is requested.
Finantsinspektsioon reviews governance, capital, AML, safeguarding, outsourcing, and ICT resilience in substance. A practical benchmark is around 40 working days, with possible extension and multiple rounds of questions.
Board members and key persons may be interviewed. We coordinate responses, remediate gaps, and align documents with regulator comments. This stage often determines whether the timeline stays realistic.
After approval, the company finalizes banking, vendor onboarding, internal reporting, staff training, and, where relevant, MiCA passporting notifications. Realistic total project timeline: 3-8 months.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
No, the relevant route in 2026 is CASP authorization under MiCA, not a new legacy VASP license. The old Estonian VASP framework was transitional and AML-centered. For new applicants, the legally relevant concept behind the search term crypto license in Estonia is a MiCA-compliant CASP authorization supervised by Finantsinspektsioon.
Finantsinspektsioon is the key authority for CASP authorization and supervision. The FIU still matters in the AML/CFT ecosystem, especially for suspicious activity reporting and enforcement within its competence, but the licensing authority for MiCA CASPs is no longer the old FIU-led VASP model.
The typical MiCA entry buckets are ā¬50,000, ā¬100,000, and ā¬150,000 depending on the services requested. Lower-risk services such as advice or reception/transmission of orders usually sit in the lower bucket, while custody and trading platform operation usually sit in the highest bucket. Always confirm the exact capital category against your final service scope before filing.
Initial capital is the entry threshold for authorization; own funds are the ongoing prudential requirement after licensing. Many founders budget only for the entry number and miss the fact that a growing CASP may need to maintain a higher amount over time due to fixed overheads and other prudential metrics. This becomes especially important for exchanges and custody businesses.
A realistic project timeline is usually 3-8 months. Company setup may take 1-4 weeks, documentation 3-8 weeks, completeness review around 25 working days, and substantive review around 40 working days, often with extensions or clock-stops if the regulator requests more information. Complex custody or platform models can take longer.
Yes, you should plan for real operational presence in Estonia, not just a correspondence address. The regulator expects substance proportionate to the business model. A real office, accessible records, local management presence, and evidence of actual decision-making materially strengthen both the licensing file and later banking discussions.
You need real governance and effective management, and in practice local substance is strongly advisable. Estonia does not operate on a pure mailbox logic for CASPs. Applicants generally plan for at least two board members, clear control functions, and enough local presence to demonstrate operational reality. The exact residency mix should be assessed case by case.
Yes, non-residents can own the company. Estonia does not prohibit foreign ownership of an OĆ used for CASP licensing. However, shareholders and UBOs must be fully transparent, pass integrity checks where relevant, and document the lawful source of funds used for capitalization and operations.
An Estonian CASP can cover custody, exchange, execution, reception and transmission of orders, placing, transfer services, portfolio management, advice, and operation of a trading platform. The authorization is scope-specific. You only receive approval for the services actually requested and supported by your governance, capital, and control environment.
Yes, both can be covered if they are included in the CASP application scope. Exchange of crypto-assets for funds and exchange of crypto-assets for other crypto-assets are recognized MiCA service categories. These models usually require stronger AML, transaction monitoring, and banking/payment infrastructure than advisory-only businesses.
Custody is a separate regulated service and must be expressly requested. It is one of the most demanding service lines because it triggers deeper scrutiny of safeguarding, wallet architecture, key management, reconciliation, incident response, and insolvency treatment of client assets. In typical MiCA structuring, custody sits in the ā¬150,000 capital bucket.
Yes, a clearly assigned AML/CFT responsible function is essential. The exact title and structure may depend on your model, but the regulator expects a competent person responsible for AML controls, suspicious activity escalation, staff training, and interaction with the FIU for AML reporting where required. A nominal appointment without real authority is a common red flag.
The baseline includes KYC, EDD, sanctions and PEP screening, KYT, suspicious activity reporting, and Travel Rule compliance. You also need a business-wide risk assessment, source-of-funds procedures, ongoing monitoring, and recordkeeping for at least 5 years where required by AML rules. For self-hosted wallet exposure, a documented risk-based framework is expected.
Yes, DORA is part of the operating reality for CASPs in the EU. In practice this means ICT risk management, incident classification and reporting, business continuity, disaster recovery, third-party ICT oversight, and documented resilience controls. For custody and exchange models, DORA readiness is not an optional extra; it is part of regulator credibility.
It gives access to the MiCA passporting framework, not automatic same-day launch everywhere. After authorization, cross-border activity into other EU states normally requires the relevant notification process and operational readiness for those markets. Local consumer, tax, language, and marketing rules may still matter in each target country.
The main corporate feature is 0% tax on retained profits and taxation on distribution. In 2026, distributed profits are generally taxed using the 22/78 formula on the net amount distributed. VAT treatment depends on the exact service line: some exchange services may be exempt, while custody, software, advisory, and ancillary services may be taxable.
Audit obligations depend on the company’s legal and regulatory profile, but licensed CASPs should assume a high standard of financial reporting and audit-readiness. Even where a statutory audit threshold analysis is needed, counterparties, banks, investors, and regulators usually expect audited or audit-ready financials for a serious crypto business operating under MiCA.
The most common problems are unclear service scope, weak source-of-funds evidence, generic AML manuals, lack of real substance, and poor governance. Other frequent issues include unrealistic financial projections, no credible banking strategy, and technology descriptions that never explain custody, wallet control, or incident management in operational terms.
Yes. RUE supports not only the licensing file but also the adjacent workstreams that usually determine whether the business can actually launch: crypto business banking, bank account opening in Estonia, Estonian accounting, annual reporting, MiCA documentation, and ongoing compliance structuring.
