Crypto License in Estonia

Business Fit and Local Presence

An ordinary Estonian CASP needs a private limited (OÜ) or public limited (AS) company, an Estonian registered office and actual services in Estonia. Its management board must include at least two people.

An OÜ offering custody or operating a trading platform also needs a supervisory board of at least three people. Other CASP OÜs are exempt, with Article 68 management-body requirements applying to shareholders instead. Article 60 institutions follow separate rules.

Effective management must be in the EU, with at least one EU-resident director. This does not require Estonian residence or tax residence. Assess banking feasibility.

Choose the Applicable Regulatory Route

Activity	Legal Route	Authority	Output	Cross-Border Use	Limitation
Selected services	New Article 59 authorization; Article 63 grant	Finantsinspektsioon	Scoped authorization	Article 65 notification	Excludes issuance and payments
Eligible financial institution	Article 60 notification of existing permissions	Supervisor	Notified services	MiCA notification	Equivalent permissions only; complete notice 40 working days before starting; legacy VASP insufficient
Asset-referenced tokens (ARTs) tracking assets or currency combinations	Issuer authorization or bank Article 17	Finantsinspektsioon	Offer or admission compliance	Issuer rules	Separate regime; exceptions apply
Issuing e-money tokens (EMTs), linked to one official currency	Bank or electronic money institution (EMI); white paper	Prudential supervisor	Status and notification	Issuer rules	CASP permission insufficient

Services the Authorization Can Cover

Select applicable CASP services:

• Holding and Moving Assets: custody and administration; transferring assets for clients
• Trading and Exchange: operating a platform; exchanging crypto-assets for funds or other crypto-assets
• Orders and Placement: executing orders, receiving and forwarding orders, or placing crypto-assets
• Advice and Portfolios: giving recommendations or managing client portfolios

Documents Gofaizen & Sherle Helps Prepare

Gofaizen & Sherle prepares agreed documents from client facts and provider information. Clients implement operations.

• Business plan and program of operations
• Governance, controls, complaints and conflicts policies
• AML/CFT procedures and safeguarding arrangements
• Information and communication technology (ICT), DORA and outsourcing documentation
• Responses to regulator questions

Scope and Cost Components

Scope	Deliverables	Exclusions	Professional Fee	Official Fees	Third-Party Costs
Application support	Filing and responses	Approval; implementation	Quote after assessment	EUR 3,000 processing	Translation, providers, audit
Prudential safeguards	Funds or qualifying cover	Service fees	Separate funding	Not an official fee	Insurance assessed separately
Ongoing compliance	Agreed support	Operating expenses	Separately agreed	Annual supervision	Staff, ICT, banking, audit

Service-class minimums are EUR 50,000, rising to EUR 125,000 for custody or exchange and EUR 150,000 for platforms. Financial safeguards must cover the higher of that minimum or one-quarter of the previous year’s fixed overheads. First-year calculations use forecast expenses for 12 months.

Qualifying own funds, compliant insurance, comparable guarantees or combinations can meet this requirement. Check availability and coverage. Annual supervision fees have capital and service-based components.

Information the Applicant Provides

Provide ownership, beneficial owners, funds and management experience; products, clients, markets and forecasts; existing governance, AML, ICT and outsourcing; client-asset protection and complaints arrangements.

Regulatory Review and Project Timing

Receipt acknowledgment takes up to five working days. Completeness review takes up to 25 working days from receipt; incomplete files require supplementation.

Assessment and decision take up to 40 working days from completeness. Requests in the first 20 working days of assessment can pause it for up to 20 working days; later requests create no further pause. Decision notification follows within five working days.

Preparation, supplementation and provider reviews follow separate schedules.

The Legal Framework in Estonia

A crypto-asset service provider carries out regulated crypto services professionally. MiCA Regulation (EU) 2023/1114 provides the EU framework; Estonia’s Market in Crypto-Assets Act adds national governance, reporting and supervision rules. Finantsinspektsioon handles CASP authorization and supervision. The Financial Intelligence Unit retains its anti-money-laundering role, including receiving suspicious-transaction reports.

AML/CFT rules address money laundering and terrorist financing. The Transfer of Funds Regulation and its Travel Rule require information about transfer senders and recipients. DORA governs digital operational resilience, including ICT risk and incident handling. These requirements affect daily operations as well as application documents.

Current Position

Position	Status	Applicant Consequence
Transition ended July 1, 2026	Confirmed	Use Estonian authorization, eligible Article 60 notification or properly notified EEA services; no automatic VASP conversion; pending applicants cannot onboard clients, open accounts or actively market in the EEA
Activity and existing permissions	Requires project-specific verification	Establish route and scope
Bank and provider acceptance	External dependency	Independent decisions and implementation

Controls and Reporting After Authorization

• Management continuously maintains safeguards and governance. Keep service and transaction records for five years, or up to seven on timely supervisory request.
• Compliance monitors customers and transactions, records transfer information and reports suspicions to the FIU when triggered; management remains accountable.
• Management and ICT teams maintain DORA controls and report major incidents to Finantsinspektsioon and the Information System Authority.
• Management keeps complaints records, reviews conflicts policies annually and maintains outsourcing agreements, oversight and exit arrangements. The CASP remains responsible.
• Management and auditors provide audited annual accounts, an own-funds check where used, and quarterly or annual supervisory reports under applicable deadlines.

Regulatory Risks

Supervisors can demand information, suspend or prohibit services and marketing, and stop unauthorized activity.

Banking and Client Money Arrangements

Authorization does not guarantee a bank account.

• Operating account for expenses
• Where Article 70 applies, segregated client funds other than EMT at a credit institution or central bank; banks, payment institutions and EMIs are exempt from these fund-placement rules
• Acquiring or payments require your own or your provider’s permission under the EU Payment Services Directive (PSD2)
• Provider review of owners, funding sources and expected flows

Crypto-assets are not held on an IBAN. Banking support concerns separate onboarding.

Tax Considerations for the Business

Distributed profits generally attract 22/78 on the net distribution. Retention or reinvestment generally does not trigger this tax; benefits and nonbusiness payments can be taxable.

Standard VAT is 24%, subject to place, timing and exemptions. The fiat–virtual-currency exchange exemption does not cover every crypto service.

Assess payroll, withholding and permanent establishments from actual operations. Transfer-pricing rules also affect a nonresident’s Estonian permanent establishment.

Other EU Locations to Consider

All five use MiCA’s service perimeter. Match operations and management to services; check national requirements and costs.

Jurisdiction	Authority	Substance	Key Limitation
Lithuania	Bank of Lithuania	Lithuanian operations	National details vary
Spain	CNMV	Spanish operations	Banco de España oversees issuers separately
Cyprus	CySEC	Cypriot operations	EMT oversight elsewhere
Czech Republic	Czech National Bank	Czech operations	Old trade permission insufficient
Malta	MFSA	Maltese operations	Old VFA status insufficient

Under Article 65, the home authority forwards cross-border information within ten working days. Permitted services may start on receipt of its communication or, at latest, 15 calendar days after submission of required information.