Over the past few years, the requirements for corporate service providers in Estonia have changed significantly. AML/KYC, sanctions compliance, UBO identification, source of funds, business geography, group structure and understanding a company’s actual activities have long ceased to be mere formalities of client onboarding.
In 2026–2027, this trend is becoming even more pronounced.
As a corporate service provider and the contact person responsible for communication with the Estonian Financial Intelligence Unit (FIU/RAB), I see these developments as more than simply stricter regulation. The market is gradually moving away from formal compliance towards meaningful risk management. And for legitimate businesses, this is actually good news.
A complex client is not necessarily a bad client
An international corporate structure is not, in itself, a red flag. Neither is a foreign UBO. Multiple jurisdictions, remote management, international payments or an unconventional business model do not automatically mean that a client should be rejected.
A risk-based approach follows a fundamentally different logic: understand the risk, verify it, assess it and determine whether it can be effectively managed.
The Estonian FIU views AML/CFT risk management as an interconnected system — from understanding the company’s own business model and conducting a risk assessment to defining its risk appetite, implementing internal procedures, applying CDD measures and carrying out ongoing monitoring. Internal procedures should reflect how the company actually operates, rather than simply reproduce the wording of legislation.
This is why I do not believe compliance should become a competition over who rejects the most clients.
Risk-based AML approach: understand, verify, assess and manage client risk
A risk-based approach is not a zero-risk approach
The purpose of AML/KYC is not to make international business impossible, nor to exclude every client whose structure falls outside a standard template.
The purpose is to understand who we are working with, what the company actually does, who owns and controls it, where the funds come from, and whether the declared business activity corresponds to reality.
Sometimes this assessment should indeed result in a decision not to establish or continue a business relationship. In other cases, elevated risks can be managed through additional documentation, enhanced due diligence, deeper analysis or ongoing monitoring.
For me, the quality of compliance is measured not by the number of rejected clients, but by the quality and defensibility of the decisions being made.
What does this mean for clients in practice?
If a corporate service provider asks additional questions about your business model, counterparties, countries of operation, source of funds or ownership structure, it does not automatically mean you are considered suspicious. Most often, the objective is much simpler: to develop a complete understanding of the business and to be able to support that understanding with appropriate documentation.
For clients, this means it is becoming increasingly important for their corporate structure to be clear, coherent and explainable.
For example, a company may be incorporated in Estonia, sell to customers in Germany, work with developers in Poland, have a UBO residing in the UAE and maintain relationships with counterparties in several other jurisdictions. None of this is necessarily a problem.
However, there should be a clear economic rationale:
- why the company is incorporated in Estonia;
- where it is managed from;
- where its customers are located;
- how its revenue is generated and reflected in the accounts;
- what function each element of the structure serves.
The more clearly a business can answer these questions, the easier it becomes to deal not only with its corporate service provider, but also with banks, payment institutions and other participants in the financial system.
Example of an international company structure with an Estonian OÜ, clients in the EU and a UBO abroad
Sanctions screening is not the same as sanctions compliance
Another important trend: simply checking the name of a client or UBO against sanctions lists is no longer sufficient. Modern sanctions compliance goes much further.
Depending on the circumstances, it may be necessary to analyse ownership and control, the ultimate beneficiary of a service, the geography of a transaction, the purpose of the goods or services, the role of intermediaries and the actual economic substance of the relationship.
Sanctions risk does not always require a direct payment or a direct contract with a sanctioned person. It may also arise through the provision of certain services or other economic benefits.
The practical conclusion for businesses is straightforward: today, it is important to understand not only who receives the invoice, but also what is actually happening behind the transaction. This is particularly relevant for international businesses, where a single transaction may involve several jurisdictions, intermediaries, banks and regulatory regimes.
Compliance is no longer just a folder of documents
A few years ago, an AML file was often seen primarily as a collection of mandatory documents: passport, proof of address, UBO declaration, questionnaire and sanctions screening results. Today, expectations go considerably further.
Risk assessment, risk appetite, internal procedures, customer risk profiles, CDD/EDD, ongoing monitoring, sanctions screening, reporting, training and internal controls are increasingly expected to work as parts of one functioning compliance system — especially for licensed financial companies.
Even using external KYC or identity verification providers does not transfer the obliged entity’s responsibility to that provider. The corporate service provider remains responsible for determining the customer’s risk profile and risk level.
In my view, this is one of the most important changes taking place. The question is no longer simply:
“Do we have this document?”
Increasingly, the real question is:
“Why did we make this decision, and can we justify it?”
AML/CFT compliance system: risk assessment, CDD/EDD, monitoring, sanctions screening and internal controls
Good KYC protects not only the provider, but also the client
There is another side to compliance that is discussed far less often. A properly developed KYC profile is useful not only for the corporate service provider or the regulator. It is useful for the business itself.
Banks, payment institutions and other obliged entities often ask very similar questions:
- Who is the UBO?
- Where do the funds come from? (Clear financial statements help answer this.)
- Where does the company operate?
- Why was this particular corporate structure chosen?
- Who are the main counterparties?What does the transaction flow look like?
If these issues have already been properly addressed at the corporate servicing stage, it becomes significantly easier for the client to explain its structure consistently to other participants in the financial system.
For this reason, I do not view good compliance solely as a regulatory burden. When implemented properly, it becomes part of a company’s corporate infrastructure.
What changes in 2027?
From 10 July 2027, a significant part of the core AML/CFT requirements will be governed directly by the EU Anti-Money Laundering Regulation (AMLR).
At EU level, the AMLR will directly regulate, among other areas:
- risk assessment and internal controls;
- CDD, SDD and EDD;
- PEP requirements;
- customer and beneficial owner identification;
- ongoing monitoring, reporting and record keeping.
At the same time, national regulation will not disappear. The work of national FIUs, supervision, national registers, administrative measures and liability will still be governed, in part, at national level.
For compliance professionals, this means the framework is becoming both more harmonised across the EU, much like the MiCA regime for crypto-asset service providers, and more substantive in practice.
Where are we heading?
I see the direction quite clearly:
- less formal KYC — more understanding of the actual business;
- fewer universal checklists — more risk-based analysis;
- fewer documents created “for the file” — more ability to explain and defend the decisions being made.
I believe this is the right direction. At the same time, compliance must not turn into automatic de-risking, where the easiest way to reduce one’s own exposure is simply to reject every non-standard client.
Good compliance should not prevent legitimate businesses from operating. It should help distinguish between a complex but transparent and lawful structure and a genuinely unacceptable risk.
The role of a corporate service provider today is no longer simply to collect a passport, proof of address and a completed KYC questionnaire. Our role is to understand our clients’ businesses well enough to explain, with confidence and evidence, why we are prepared to work with them — and to recognise when a particular risk can no longer be reasonably managed.
The ability to draw that line will increasingly distinguish meaningful compliance from compliance that exists only on paper.
Need a compliant setup for your Estonian company?
eBusiness Solutions OÜ is a licensed corporate service provider (FIU licence FIU000421). We provide a legal address, contact person service and company formation in Estonia with a clear, risk-based onboarding process. You can read our AML/CFT Policy or contact us for a free consultation.
