Services · Licences & special services

Estonia crypto license in 2026: getting a MiCA CASP license

Updated 7 October 2026

Of 641 licenses, not one is left. Since 1 July 2026 an Estonian crypto firm needs a CASP license from the Financial Supervision Authority: capital from $57,000, a board of at least two and a team on the ground, in exchange for access to the whole EU market.

In mid-2021 Estonia had 641 valid crypto licenses. On 1 July 2026 it had none. Rahapesu Andmebüroo (the FIU, Estonia's Financial Intelligence Unit) cancelled the last of them that day; only 36 were still standing at the start of the year. The country that founders once picked for the quickest crypto status in the EU has shut that door completely.

There were so many licenses because the bar was set almost at the floor: until March 2020 a share capital of $2,900 was enough. When the FIU re-checked licence holders after the 2022 reform, it found falsified CVs, nominee directors who did not know they held the job, and copy-paste business plans with no link to Estonia at all.

Today a crypto business in Estonia needs a CASP (crypto-asset service provider) authorisation under MiCA, the EU-wide crypto-assets regulation, issued by Finantsinspektsioon (the Estonian Financial Supervision Authority, which also oversees banks, insurers and investment firms). In roughly eighteen months of taking applications, it granted one standalone license: Lightspark Payments Europe AS received it in June 2026. Two more Estonian firms offer crypto services as already regulated financial institutions: LHV Pank, a bank, and the investment firm Lightyear Europe AS.

What this means for you. The Estonian license is now harder and more expensive to get, but it carries far more weight: one authorisation opens the market of all 27 EU states plus Norway, Iceland and Liechtenstein. The entry ticket is capital from $57,000 to $170,000, a management board of at least two people, a supervisory board for exchanges and custodians, and a real team on the ground. Below is what the law requires, what it costs on top of our fees, and when another country makes more sense. For the full story of the reform, see our article crypto licence in Estonia in 2026.

What is an Estonian crypto license after MiCA

Since 30 December 2024, crypto services across the EU have been governed by MiCA (the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114). It replaced a patchwork of national regimes with a single rulebook. A company that provides crypto services to clients is called a CASP (crypto-asset service provider).

Estonia added its own details in KrÜTS (Krüptovaraturu seadus, the Crypto-Asset Market Act), passed by the Riigikogu, the Estonian parliament, on 5 June 2024. In Estonian the permit is called tegevusluba (operating licence); EU documents call it an authorisation. People search for it as an Estonia crypto license, a MiCA license or a CASP license. It is the same document.

You need it if you do at least one of the ten things listed in Article 3 of MiCA for clients:

• hold and administer clients' crypto-assets (a custodial wallet);
• operate a trading platform, in other words an exchange;
• exchange crypto for money or for other crypto;
• execute client orders, or receive them and pass them on;
• place crypto-assets, meaning you help an issuer sell tokens;
• advise on crypto-assets or manage portfolios;
• transfer crypto-assets on behalf of clients.

The core features of the Estonian license sit in § 5 and § 7 of KrÜTS. It has no expiry date and cannot be transferred to another company. The holder's registered address must be in Estonia. The company itself can only be an OÜ (osaühing, a private limited company) or an AS (aktsiaselts, a public limited company).

Not everyone needs this license. MiCA largely leaves NFTs (non-fungible tokens, unique digital items) out of scope. Issuing your own token, unless it is a stablecoin, calls for a white paper (an information document about the token notified to Finantsinspektsioon) rather than a license. Banks and investment firms that already hold a license can add crypto services by notification, as LHV Pank and Lightyear did.

How does the CASP license differ from the old FIU license

The big shift is who checks what. The FIU looked mainly at AML (anti-money laundering). Finantsinspektsioon examines the whole business, using the same yardstick it applies to banks and payment institutions.

On capital the gap is small: after 2022 the FIU demanded $120,000 to $290,000, MiCA asks for $57,000 to $170,000. What has become expensive is people, IT and compliance. Estonian law gave former FIU licence holders no simplified route, unlike Germany for example: everyone applies on the same terms.

How much capital do you need for a CASP license in Estonia

The minimum is set by Annex IV of MiCA and depends on the services you offer. Estonian law adds no amounts of its own.

The second rule, in Article 67 of MiCA: prudential safeguards must equal at least a quarter of the previous year's fixed overheads whenever that figure exceeds the minimum. Fixed overheads means total expenses minus profit-linked bonuses, profit shares and one-off costs.

Worked example. An exchange service that also holds client assets (class 2) spent $900,000 in a year on salaries, rent, IT and audit. A quarter of that is $230,000. That beats the $150,000 minimum, so the company must hold $230,000 and recalculate every year.

You can meet the requirement in three ways: top-quality own funds (CET1, Common Equity Tier 1, meaning paid-up share capital and retained earnings), an insurance policy covering the EU countries where you operate, or a mix of both. If you use own funds, an audit firm checks compliance at the balance sheet date (§ 17 KrÜTS). An annual audit is mandatory for every licence holder, and the regulator must be told about the chosen auditor at least 10 days in advance.

Client money does not count towards capital. Article 70 of MiCA requires it to be kept apart from your own funds and placed with a bank or a central bank by the end of the next business day.

What are the requirements for directors, office and staff

The most expensive part of an Estonian license is not the capital but the people. KrÜTS requires a management board (juhatus, the executive body that runs the company) of at least two members. If an OÜ holds client crypto-assets or runs a trading platform, it also needs a supervisory board (nõukogu, the body that oversees management) of at least three. In that case you need five senior people, and Finantsinspektsioon assesses each of them for reputation, knowledge and experience (the fit and proper test).

MiCA (Article 59) requires the place of effective management to be in the EU and at least one director to live in the EU. ESMA (the European Securities and Markets Authority) went further in its supervisory briefing to national regulators of 31 January 2025: at least one executive board member should live in the country granting the license. A board member based in a neighbouring country is tolerated only for states with fewer than 1 million inhabitants. Estonia has more, so the working rule is simple: one board member lives in Estonia.

According to the same ESMA briefing, the chief executive should as a rule work for the company full time, other board members at least half their time, and key staff should sit in the country of registration. Letter-box companies (a firm with an address but no management in the country) do not get authorised. Supporting functions such as IT support or HR can stay outside the EU.

The law sets no minimum office size. But without an office it is hard to prove what the regulator checks: where decisions are made and where the team works. That is why a registered address, an office, a dedicated phone line and a local director are part of our service. Any change to the management or supervisory board must be notified at least 30 days before the new person starts (§ 7 KrÜTS).

What AML, IT and tax reporting rules apply to a CASP

AML has not gone anywhere; it has become part of a much bigger review. A CASP still verifies clients (KYC, know your customer), monitors transactions and reports suspicious ones to Rahapesu Andmebüroo. A dedicated AML compliance officer is responsible for this. ESMA accepts one person combining risk management and compliance only in smaller or lower-risk firms.

Three European layers now sit on top:

• The travel rule (Regulation (EU) 2023/1113 on information accompanying transfers): every crypto transfer must carry data on the sender and the recipient. KrÜTS expressly obliges CASPs to comply.
• DORA (the Digital Operational Resilience Act, Regulation (EU) 2022/2554): since 17 January 2025 you need an ICT (information and communication technology) risk policy, testing and reports on major ICT incidents to Finantsinspektsioon, which forwards them to other authorities, including RIA (Riigi Infosüsteemi Amet, the Estonian Information System Authority, the country's cyber regulator).
• DAC8 (Directive (EU) 2023/2226 on the exchange of tax information on crypto-assets): since 1 January 2026 CASPs collect data on clients and their transactions, and the first annual report for 2026 goes to EMTA (Maksu- ja Tolliamet, the Estonian Tax and Customs Board) in 2027. The data then flows to the tax authority of each client's country of residence.

The company's own taxes are a separate question: Estonia taxes corporate profit when it is distributed, not when it is earned. Rates and details are on our page taxes in Estonia.

How long does it take to get a crypto license in Estonia

On paper, about four months. Article 63 of MiCA gives the regulator 25 working days to check completeness and 40 working days to decide. The clock can be stopped for up to 20 more working days while you answer questions. That adds up to at most 85 working days after a complete file is filed.

In practice the clock often restarts: incomplete files come back, and questions arrive in several rounds. In a letter to market participants dated 23 March 2026, Finantsinspektsioon itself warned that anyone who had not yet applied was unlikely to get a decision before 1 July 2026. Even the regulator did not expect to finish within three-odd months.

Preparing the file is a project of its own. Article 62 of MiCA lists 18 groups of documents, from the programme of operations and custody policy to technical documentation of IT systems and the procedure for segregating client assets. Since 18 March 2026 applications go only through the Finantsinspektsioon application portal, in Estonian. Supporting documents in English are accepted if the application says so explicitly.

The usual path looks like this:

1. Project review: which services, which class, how much capital, who sits on the management and supervisory boards.
2. Incorporating an OÜ or AS, with a registered address and office in Estonia and a company account.
3. Building the team: board members, AML officer, risk management, IT.
4. The application file under Article 62 of MiCA and ESMA forms, plus fit and proper questionnaires for managers.
5. Filing through the portal and paying the menetlustasu (processing fee) of $3,400.
6. Answering the regulator's questions, sometimes over several rounds.
7. Once licensed, notifying the countries of the EU where you plan to operate.

The regulator publishes each grant on its website no later than the next working day after the decision takes effect, and ESMA adds the firm to its CASP register. The same register lets you check any company that claims to be licensed.

What does an Estonian crypto license really cost

The regulator's fee is the smallest line in the budget: the menetlustasu is $3,400. For comparison, under the FIU after 2022 the state took $12,000. Notifying other EU countries is free.

The real money goes elsewhere:

• capital of $57,000 to $170,000, or more under the quarter-of-overheads rule;
• salaries for at least two board members, one of them living in Estonia, and an AML officer;
• fees for three supervisory board members if you hold client assets or run an exchange;
• IT systems and processes that meet DORA;
• the mandatory annual audit, bookkeeping and regulatory reporting;
• the annual järelevalvetasu (supervision fee charged by Finantsinspektsioon).

The supervision fee has two parts: one based on capital and one based on business volume. Volume is measured differently by service: total transactions for exchangers and brokers, average client assets for custodians and portfolio managers, and annual revenue from the service for exchanges, advisers and transfer providers.

Our fees for company formation, address, office, compliance checks and application support are in the table below. Capital and team salaries are the company's own money: work out your capital from the MiCA classes in the table above. You can also order company formation on its own on our page company registration in Estonia.

What happens if you operate without a license after 1 July 2026

From 1 July 2026 it is a crime. Unlicensed activity in the financial sector is punishable under § 372 of the Karistusseadustik (the Estonian Penal Code), and Finantsinspektsioon has reminded the market of exactly that. Breaches of MiCA by a licensed firm carry separate liability: under § 37 of KrÜTS a company can be fined up to $5.7 million, up to twice the gain made, or up to 5% of group turnover.

The law left former FIU licence holders one concession (§ 48 KrÜTS). If they applied to Finantsinspektsioon before 1 July 2026 and no decision has been made, their activity is not treated as unlicensed. But they may not sign new client contracts until the decision. Those who never applied must tell clients the service is ending and, within a reasonable time, return their assets to a wallet or account the client names.

The pitfalls that sellers of ready-made licenses leave out

You cannot buy a ready-made license. The license is not transferable, and acquiring a qualifying holding (10% or more) in a licensed firm requires notifying Finantsinspektsioon, which can block the deal (Articles 83 and 84 of MiCA). An ad for an Estonian OÜ with a crypto license in 2026 almost certainly means a cancelled FIU licence.

Stablecoins may require a second license. Under MiCA, EMTs (e-money tokens, stablecoins pegged to a single currency such as the euro) count as electronic money. On 10 June 2025 the EBA (European Banking Authority) said that some CASP services involving such tokens also qualify as payment services under PSD2 (Directive (EU) 2015/2366 on payment services). In a letter dated 18 August 2025 Finantsinspektsioon confirmed that these services also require a payment institution or e-money institution license, or a partner that holds one. See our pages on the Malta PSP (payment service provider) license and payment system (EMI, electronic money institution) accounts.

Clients from Russia and Belarus are off limits. Since the EU's 19th sanctions package, adopted on 23 October 2025, EU CASPs may not provide any MiCA crypto-asset services to Russian nationals and residents or to companies established in Russia. The exception covers Russian nationals with the right to reside in the EEA or Switzerland. A parallel ban applies to Belarus. If your audience is mostly there, an Estonian license will not save the business.

E-Residency is closed to Russian and Belarusian citizens. E-Residency (a digital ID card for running an Estonian company remotely, which gives no right to live in the country) has not been issued to first-time applicants from these countries since 2022. In any case, remote management is not enough for a CASP license.

Line up an account for client money early. Client funds must sit in a segregated bank account, and banks are cautious with crypto firms. Start looking while you prepare the application: business accounts in Estonia.

An offshore license does not open the EU. A firm outside the EU may serve Europeans only at their own exclusive initiative (reverse solicitation, Article 61 of MiCA). Any marketing aimed at the EU, social media included, kills that exemption. For clients outside the EU such a structure can work, for example a British Virgin Islands (BVI) company with a VASP (virtual asset service provider) license.

Who the Estonian crypto license is not for

A CASP license is a working financial company, not a certificate on the wall. So the honest list of people who should look elsewhere is longer than license sellers would like.

Not a fit for:

• anyone looking for a signboard for an offshore business with no people or decisions in the EU;
• projects without a spare $57,000 to $170,000 for capital and a budget for a team in Estonia throughout the review;
• services whose clients are mainly Russian or Belarusian nationals and residents;
• anyone who needs to launch in the EU within weeks: such projects are better off partnering with an already licensed firm;
• issuers of their own token, who need a white paper rather than a license.

A good fit for:

• teams that already live in Estonia or are ready to hire there;
• fintech companies that want one regulator for the whole EU market;
• former FIU licence holders that already have processes, AML and a track record in the country.

If you are relocating together with the business, sort out your personal tax on crypto income in advance: see our country overview crypto and relocation.

Estonia or another EU country: where to get a MiCA license

MiCA requirements are identical across the EU and EEA: the same capital, the same 25 plus 40 working days of review, the same passport to the whole market. What differs is the regulator, the language, local add-ons such as Estonia's three-person supervisory board, and how many authorisations the regulator actually grants. The last point is visible in ESMA's interim CASP register.

The register also includes banks and investment firms that provide crypto services by notification. So the count shows not how strict the law is but the regulator's throughput: how many projects it has already taken through the process. With three entries, Estonia currently ranks last among the Baltic states.

The choice of country usually comes down to three questions. Where do the people you will put on the board live? In which language are you comfortable dealing with the supervisor? And are you ready for Estonia's five-person governance add-on if you plan to hold client assets or open an exchange?

How we help you get a CASP license in Estonia

We start with a review: which services you want to provide, which class and capital follow from that, whether you have people for the management and supervisory boards, and whether owners or clients carry any sanctions risk. If the project is not ready for a license, we say so before the company is formed, not after a refusal.

Then we handle forming the OÜ with a full set of documents, the registered address, arranging an office and a dedicated phone line, a local director, paying in the capital, bookkeeping and reporting, compliance checks on participants, and support with the Finantsinspektsioon application through to a decision. Other licenses and corporate services are collected in our section licences and special services.

Fees

FAQ