Crypto License in Estonia

Business Fit and Local Presence

An ordinary Estonian CASP needs a private limited (OÜ) or public limited (AS) company, an Estonian registered office and actual services in Estonia. Its management board must include at least two people.

An OÜ offering custody or operating a trading platform also needs a supervisory board of at least three people. Other CASP OÜs are exempt, with Article 68 management-body requirements applying to shareholders instead. Article 60 institutions follow separate rules.

Effective management must be in the EU, with at least one EU-resident director. This does not require Estonian residence or tax residence. Assess banking feasibility.

Choose the Applicable Regulatory Route

Services the Authorization Can Cover

Select applicable CASP services:

• Holding and Moving Assets: custody and administration; transferring assets for clients
• Trading and Exchange: operating a platform; exchanging crypto-assets for funds or other crypto-assets
• Orders and Placement: executing orders, receiving and forwarding orders, or placing crypto-assets
• Advice and Portfolios: giving recommendations or managing client portfolios

Documents Gofaizen & Sherle Helps Prepare

Gofaizen & Sherle prepares agreed documents from client facts and provider information. Clients implement operations.

• Business plan and program of operations
• Governance, controls, complaints and conflicts policies
• AML/CFT procedures and safeguarding arrangements
• Information and communication technology (ICT), DORA and outsourcing documentation
• Responses to regulator questions

Scope and Cost Components

Service-class minimums are EUR 50,000, rising to EUR 125,000 for custody or exchange and EUR 150,000 for platforms. Financial safeguards must cover the higher of that minimum or one-quarter of the previous year’s fixed overheads. First-year calculations use forecast expenses for 12 months.

Qualifying own funds, compliant insurance, comparable guarantees or combinations can meet this requirement. Check availability and coverage. Annual supervision fees have capital and service-based components.

Information the Applicant Provides

Provide ownership, beneficial owners, funds and management experience; products, clients, markets and forecasts; existing governance, AML, ICT and outsourcing; client-asset protection and complaints arrangements.

Regulatory Review and Project Timing

Receipt acknowledgment takes up to five working days. Completeness review takes up to 25 working days from receipt; incomplete files require supplementation.

Assessment and decision take up to 40 working days from completeness. Requests in the first 20 working days of assessment can pause it for up to 20 working days; later requests create no further pause. Decision notification follows within five working days.

Preparation, supplementation and provider reviews follow separate schedules.

The Legal Framework in Estonia

A crypto-asset service provider carries out regulated crypto services professionally. MiCA Regulation (EU) 2023/1114 provides the EU framework; Estonia’s Market in Crypto-Assets Act adds national governance, reporting and supervision rules. Finantsinspektsioon handles CASP authorization and supervision. The Financial Intelligence Unit retains its anti-money-laundering role, including receiving suspicious-transaction reports.

AML/CFT rules address money laundering and terrorist financing. The Transfer of Funds Regulation and its Travel Rule require information about transfer senders and recipients. DORA governs digital operational resilience, including ICT risk and incident handling. These requirements affect daily operations as well as application documents.

Current Position

Controls and Reporting After Authorization

• Management continuously maintains safeguards and governance. Keep service and transaction records for five years, or up to seven on timely supervisory request.
• Compliance monitors customers and transactions, records transfer information and reports suspicions to the FIU when triggered; management remains accountable.
• Management and ICT teams maintain DORA controls and report major incidents to Finantsinspektsioon and the Information System Authority.
• Management keeps complaints records, reviews conflicts policies annually and maintains outsourcing agreements, oversight and exit arrangements. The CASP remains responsible.
• Management and auditors provide audited annual accounts, an own-funds check where used, and quarterly or annual supervisory reports under applicable deadlines.

Regulatory Risks

Supervisors can demand information, suspend or prohibit services and marketing, and stop unauthorized activity.

Banking and Client Money Arrangements

Authorization does not guarantee a bank account.

• Operating account for expenses
• Where Article 70 applies, segregated client funds other than EMT at a credit institution or central bank; banks, payment institutions and EMIs are exempt from these fund-placement rules
• Acquiring or payments require your own or your provider’s permission under the EU Payment Services Directive (PSD2)
• Provider review of owners, funding sources and expected flows

Crypto-assets are not held on an IBAN. Banking support concerns separate onboarding.

Tax Considerations for the Business

Distributed profits generally attract 22/78 on the net distribution. Retention or reinvestment generally does not trigger this tax; benefits and nonbusiness payments can be taxable.

Standard VAT is 24%, subject to place, timing and exemptions. The fiat–virtual-currency exchange exemption does not cover every crypto service.

Assess payroll, withholding and permanent establishments from actual operations. Transfer-pricing rules also affect a nonresident’s Estonian permanent establishment.

Other EU Locations to Consider

All five use MiCA’s service perimeter. Match operations and management to services; check national requirements and costs.

Under Article 65, the home authority forwards cross-border information within ten working days. Permitted services may start on receipt of its communication or, at latest, 15 calendar days after submission of required information.