Crypto License in Estonia 2026

You need an Estonian company with genuine operational presence. In practice, applicants typically use an OÜ registered in the Estonian Commercial Register, with a real office, accessible records, and decision-making that can be evidenced in Estonia. A mailing address alone is not enough.

• Operational office in Estonia, not a virtual-only setup;
• Corporate records, contracts, and compliance files available for inspection;
• Board governance that reflects real management, not nominee-only optics;
• Substance proportionate to the business model, volumes, and risk profile.

For many applicants, local substance is also critical for banking, tax residency analysis, and regulator comfort on effective management.

Management quality is a licensing issue, not an HR issue. Finantsinspektsioon assesses the reputation, competence, time commitment, and role clarity of directors and key function holders. As a practical baseline, applicants should plan for at least two board members and clearly allocated control functions.

• Board members with relevant financial services, crypto, payments, risk, or compliance experience;
• AML/CFT responsible person and reporting lines;
• Compliance and risk ownership documented in policies and governance charts;
• Clean criminal background, no unresolved regulatory integrity concerns, and transparent UBO structure;
• Evidence that key persons have enough time to perform their duties.

A common failure point is appointing impressive names with no real availability. Regulators test substance through interviews, role descriptions, and internal reporting logic.

Capital depends on the MiCA service class requested. In broad market practice under MiCA, the relevant entry buckets are €50,000, €100,000, and €150,000, depending on the services. However, applicants must distinguish initial capital from ongoing own funds.

• €50,000 typically applies to lower-risk service combinations such as reception/transmission of orders, advice, portfolio management, and transfer of crypto-assets;
• €100,000 typically applies to execution of orders, placing of crypto-assets, and exchange of crypto-assets for funds or other crypto-assets;
• €150,000 typically applies to custody/administration and operation of a trading platform.

After authorization, own funds must be maintained on an ongoing basis under MiCA prudential logic. For scaling businesses, the fixed-overheads test often becomes more relevant than the entry capital number shown in marketing materials.

A generic AML manual is not enough. Your framework must be built around the actual risk profile of your services, clients, geographies, channels, and token flows. Estonian CASPs are expected to align with the Money Laundering and Terrorist Financing Prevention Act, MiCA governance expectations, and the recast Transfer of Funds Regulation for Travel Rule compliance.

• Business-wide ML/TF risk assessment;
• CDD/EDD procedures, including PEP and sanctions screening;
• UBO identification and verification;
• Source of funds and, where risk requires, source of wealth analysis;
• Transaction monitoring and blockchain analytics (KYT);
• Travel Rule data collection and transmission workflows for crypto transfers;
• Suspicious transaction/activity reporting to the FIU;
• Record retention for at least 5 years where required by AML law.

One practical nuance many articles miss: self-hosted wallet interactions are not prohibited per se, but they require a documented risk-based control model, including ownership verification or alternative mitigating controls where appropriate.

CASP licensing now requires a credible ICT control environment. Under DORA, crypto firms must demonstrate operational resilience, incident handling, vendor oversight, and continuity planning. For custody or exchange models, the regulator will expect architecture-level explanations, not slogans.

• ICT risk management framework and asset inventory;
• Access control, MFA, privileged access governance, and logging;
• Wallet architecture using combinations of MPC, HSM, multisig, and hot/cold segregation;
• Client asset segregation and reconciliation controls;
• Business continuity and disaster recovery planning;
• Major ICT incident classification and reporting workflows;
• Third-party ICT provider governance and outsourcing register;
• Vulnerability management, patching, and penetration testing.

ISO 27001 is not a statutory substitute for DORA, but it is often a useful evidence layer when documenting the security management system.

The application must prove viability, not just legality. Finantsinspektsioon expects a business plan tied to the requested services, governance model, target markets, outsourcing structure, and realistic financial assumptions. A standard practical baseline is a 2-year business plan with opening balance sheet, P&L, cash flow, and capital planning.

• Service-by-service revenue model;
• Client acquisition assumptions and concentration risk;
• Cost of compliance, staff, technology, and external vendors;
• Liquidity runway and stress assumptions;
• Documented source of funds for shareholders and capitalization;
• Explanation of how prudential own funds will be maintained post-launch.

A recurring red flag is a business plan that ignores the cost of Travel Rule vendors, KYT tools, audit, DORA controls, and payment infrastructure. Regulators notice immediately when the numbers are not operationally credible.

Client protection is a core MiCA theme. If you hold client crypto-assets or client funds, you must show how they are segregated, reconciled, protected from misuse, and recoverable in distress scenarios. Even non-custodial service providers need clear customer documentation and complaints procedures.

• Terms of business and risk disclosures aligned with actual services;
• Clear fee schedule and execution logic;
• Complaints handling policy with escalation path and response timelines;
• Segregation of client assets and internal ledger controls where applicable;
• Conflict-of-interest policy and disclosure framework;
• Outsourcing controls where customer-facing functions are delegated.

For custody models, the insolvency treatment of client assets and the legal structure of wallet control should be documented with unusual care. This is one of the most scrutinized areas in serious CASP files.

Licensing and banking are separate workstreams. An Estonian crypto license improves credibility, but it does not automatically create bankability. Applicants should prepare a parallel banking strategy covering operational accounts, safeguarding logic, fiat settlement, and payment counterparties.

• Corporate account strategy in Estonia or another EU jurisdiction;
• EMI/PSP relationships for SEPA flows and client payments;
• Transaction flow mapping between wallets, treasury, and fiat accounts;
• Bank-facing AML pack and business model summary;
• Contingency planning if the first banking route is delayed.

RUE typically treats banking readiness as part of the license project, not as an afterthought, because weak fiat rails can delay launch even after authorization is granted.