Blog · 2026-09-05

Crypto licence in Estonia in 2026: MiCA, requirements, timelines and the real cost

Since 1 July 2026 only a CASP authorisation from Finantsinspektsioon works in Estonia - here is what it takes and what it really costs

In short: the old Estonian crypto licence no longer exists

Until 2022 Estonia handed out virtual currency licences to almost anyone who asked: by mid-2021 the register of the Financial Intelligence Unit (Rahapesu Andmebüroo, FIU) held 641 valid licences. Then the clean-up began. Around 40 were left by February 2025 and 36 by the start of 2026. On 1 July 2026 the FIU cancelled every remaining entry. From that day, crypto services in Estonia may only be provided by companies holding a CASP authorisation under MiCA, issued either by the Estonian Finantsinspektsioon or by the regulator of another EEA state.

If someone offers you a "ready Estonian crypto licence in two weeks" today, they are either uninformed or lying. There are no shelf companies with a licence and no fast track for former FIU licence holders: Estonia's Markets in Crypto-Assets Act (Krüptovaraturu seadus, KrüTS) provided no simplified transition, so everyone applies on the same terms as a newcomer.

Who issues the licence in 2026

Since 1 July 2024 the only body that grants, refuses and revokes crypto-asset service provider (CASP) authorisations in Estonia is Finantsinspektsioon (the Financial Supervision Authority, FSA). It is the same supervisor that licenses banks, payment institutions and investment firms, and it applies the same yardstick to crypto companies. Applications have been accepted since 30 December 2024, the date MiCA started to apply to crypto-asset services across the EU.

The FIU has left the licensing business: it stopped issuing new licences at the end of 2024, and from 1 July 2026 licensed CASPs are fully supervised by Finantsinspektsioon. The FIU still receives suspicious transaction reports, and licensed firms must keep filing them.

One number tells the story. In a year and a half of accepting applications, Finantsinspektsioon has issued exactly one standalone CASP authorisation, to Lightspark Payments Europe AS on 17 June 2026 (together with an e-money institution licence). Two other firms handle crypto-assets under a notification as already-licensed financial institutions: LHV Pank, a bank, and Lightyear Europe AS, an investment firm. As of June 2026 roughly ten more applications were in the pipeline. For comparison, around 280 CASPs had been authorised across the whole EEA by early July 2026.

What changed with the move to MiCA

The biggest change is the philosophy of supervision. The FIU mostly reviewed AML paperwork. Finantsinspektsioon reviews the whole business: governance, capital, ICT resilience, safekeeping of client assets, conflicts of interest, market abuse. The FIU's head, Matis Mäeker, put it bluntly when explaining the switch: you cannot manage risk by supervising anti-money-laundering documents alone.

A separate surprise awaits anyone working with stablecoins. Under MiCA, e-money tokens (EMTs) count as electronic money, so transferring and holding EMTs for clients also falls under the payment services directive PSD2. In a letter of 18 August 2025 Finantsinspektsioon warned that such firms need two licences, MiCA and PSD2, or a partnership with a licensed payment provider. That doubles the size of the application and the budget.

Capital requirements

MiCA sorts crypto services into three classes, and the minimum capital is set by the most demanding service in your set. The requirement is continuous, not a snapshot at filing: own funds must never fall below the higher of the fixed class minimum or one quarter of the previous year's fixed overheads.

The regulation lets you meet the requirement with more than cash: an insurance policy covering every country where you provide services, a comparable guarantee, or a mix of both will do. In practice few insurers sell MiCA cover and none sell it cheaply, so most applicants still put up capital in money. And remember that Finantsinspektsioon can demand more than the minimum if your business plan and volumes justify it.

Director, substance and office: what is actually checked

The MiCA floor (Article 59) is a registered office in an EU state where at least part of the services are actually provided, effective management from within the EU, and at least one EU-resident director. Estonian law adds its own conditions: the entity must be an OÜ or AS with its registered office in Estonia, a management board of at least two people and, as a rule, a supervisory board (nõukogu) of at least three, with exemptions for some OÜs. So instead of the single nominee director of the FIU era you need five suitable people with relevant experience and a clean record. Lawyers at Ellex named this one of the main practical hurdles of the transition.

Substance is tested against reality, not a lease agreement. In its supervisory briefing of 31 January 2025 ESMA explicitly told national regulators to weed out "letterbox" entities: firms whose board lives outside the EU, whose key functions are outsourced to a parent in a third country, and whose Estonian presence amounts to an address and a bookkeeper. Finantsinspektsioon looks at where decisions are taken, where compliance, risk management and IT sit, and who really controls the keys and client assets. Under Estonian AML law the person responsible for AML must work permanently in Estonia.

The practical conclusion: if you are not prepared to have at least part of the team in Estonia, a managing director, a compliance officer and someone who owns IT and risk, an Estonian authorisation is not for you. Setting up the company itself remains quick and simple, see company registration in Estonia, but a company without people will not get a licence.

AML, DORA and the travel rule

• AML policies, KYC procedures, transaction monitoring and a risk assessment under Estonia's Money Laundering and Terrorist Financing Prevention Act plus MiCA rules. The regulator wants evidence of a working system, not a document: configured rules, testing logs, reports filed with the FIU.
• Travel rule under Regulation (EU) 2023/1113: originator and beneficiary data must travel with every transfer, including transfers involving self-hosted wallets.
• DORA (Regulation (EU) 2022/2554) applies to CASPs from 17 January 2025: an ICT risk management framework, testing, a register of ICT providers, incident reporting to Finantsinspektsioon and to the Information System Authority (RIA).
• Segregation of client assets, a conflicts-of-interest policy, a complaints procedure, a business continuity plan and an orderly wind-down plan.
• Annual audit of the accounts by an external auditor and regular supervisory reporting to the FSA.

Timelines: on paper and in real life

Under Article 63 of MiCA the regulator has 25 working days to check whether the application is complete and 40 working days to decide on a complete application; it may pause the clock for up to 20 more working days to request information. On paper that is three to four months. In real life you add the preparation of the file (usually two to four months for an operating business, longer for a start-up) and rounds of questions, each of which easily eats a month. The application must be filed in Estonian; annexes may be in English if you say so explicitly in the application, but translating the core text is an unavoidable budget line.

Plan for 9 to 12 months from the start of preparation to a decision. Finantsinspektsioon's letter of 23 March 2026 is telling: it warned that applications filed after that date would almost certainly not be decided before 1 July 2026 and required them to include a wind-down plan. Operating without authorisation after the end of the transitional period is a criminal offence under section 372 (4) of the Estonian Penal Code.

What it really costs

Our fees for the Estonian package are fixed. The official Finantsinspektsioon processing fee for a CASP application is 3,000 euros; our budget for payments to the state at the licensing stage is 3,300 euros, allowing for related state fees.

That is the legal part only. An honest first-year budget also includes:

• capital of 50,000 to 150,000 euros (or an insurance policy), which must stay in place at all times;
• salaries for at least two management board members, a compliance officer and the person responsible for risk and IT; supervisory board members usually need to be paid too;
• a real office in Estonia, an auditor, DORA-grade IT infrastructure and its testing;
• translation of the application and policies into Estonian, and the annual supervision fee of Finantsinspektsioon;
• banking: Estonian banks open accounts for crypto firms reluctantly, so opening a business account in Estonia should be planned alongside the licence, not after it.

Taken together, a working business with a small team easily spends several hundred thousand euros in year one. If your budget is smaller, look honestly at other EEA jurisdictions or at operating through a licensed partner; we compare the options on our licences in other jurisdictions page.

Typical reasons for refusal and delay

Finantsinspektsioon publishes requirements rather than refusals, so the list below is drawn from MiCA application practice across the EU and from ESMA's stated expectations. Almost every troubled file hits one of these:

• No real management in Estonia: the board and key functions sit abroad, the local people are nominees.
• A one-person board or a supervisory board with no independent members; the same person runs the business, compliance and risk.
• A business plan that does not match the capital: class 3 services declared on minimal resources, projections without support.
• An opaque ownership structure or sources of capital that cannot be documented.
• An AML system that exists only on paper: no configured scenarios, tests or logs, an MLRO without relevant experience.
• DORA not implemented: no ICT provider register, no testing, no incident response plan.
• Critical functions (key custody, compliance, IT) outsourced without control by the Estonian entity.
• Handling EMTs without a PSD2 licence or a payment institution partner.
• An incomplete file, or one not in Estonian: formally not a refusal, but every document request pushes the timeline back by weeks.

Who Estonia suits, and who it does not

Estonia suits those building a genuinely regulated business with a team in the EU who want a passport to every EEA state through a predictable, strict regulator that communicates in English. The tax system is a bonus: retained corporate profit is not taxed, and the 22% tax is paid only when dividends are distributed (the planned increase to 24% and the 2% "security tax" on corporate profits were both cancelled). We cover taxation for crypto businesses and founders in detail in our article on crypto and taxes when relocating.

Estonia does not suit those looking for a licence as a shop sign, planning to run the business from outside the EU, or hoping to get by on a 2019-sized budget. The FSA will refuse such applicants, and since 1 July 2026 operating without authorisation is no longer an administrative risk but a criminal one.

FAQ