Estonia has changed its model for supervising the entire sector. The licensing of crypto services has been transferred from the Financial Intelligence Unit (Rahapesu Andmebüroo, FIU) to the Financial Supervision Authority, and on 1 July 2026, the previous licences held by virtual currency service providers ceased to be valid. This is not merely a change of name: the standard itself has changed. Previously, a licence was an anti-money laundering tool and was valid only in Estonia. Now it is a financial authorisation involving capital requirements, an assessment of management suitability, prudential requirements and a licence valid throughout the European Union.
The scale of the changes is telling: between 2017 and 2021, the Bureau issued more than two thousand licences; by December 2024, only 43 remained valid; and by the end of the transition period, only a handful of companies were operating under the new regime.
That said, the Bureau has not disappeared. It continues to receive and analyse reports of suspicious transactions, supervise other obliged entities and enforce the Anti-Money Laundering Act. What has changed is the distribution of roles – and this is precisely where companies most often get confused when trying to understand who they are now accountable to and what to do about their previous status
| Topic | Practical explanation |
|---|---|
| Who previously issued them | The Financial Intelligence Unit (FIU) — licences for virtual currency service providers under the Anti-Money Laundering Act |
| Who issues them now | Finantsinspektsioon — CASP authorisations under the Crypto-Asset Market Act and the MiCA Regulation |
| When did the regime change? | The Crypto-Assets Market Act came into force on 1 July 2024 |
| Acceptance of applications by the Bureau | Ceased at the end of 2024; pending applications were returned to applicants |
| End of the transition period | 1 July 2026 — previous licences ceased to be valid |
| Automatic conversion | Did not take place: a new application had to be submitted to the Financial Inspectorate |
| Market trends | Over 2,000 licences in 2017–2021 → 43 valid as at December 2024 |
| What remains for the Bureau | Receipt and analysis of reports on suspicious transactions, supervision of other obliged entities, enforcement of the law |
| AML responsibilities | Remain in full force regardless of which authority is responsible for licensing |
| Operating without authorisation | Prohibited: it is not permitted to accept new clients, open accounts or actively market to EEA clients |
| What’s next at EU level | The EU-wide AMLR Regulation and the new supervisory authority, the AMLA, are reshaping the landscape as the decade draws to a close |
If you have any questions, our managers are always on hand and ready to help! If you’re not sure what your company’s current status is, please send us your registration code and we’ll check the registers for you free of charge.
The difference between the previous and current regimes lies not in the strictness of the documentation requirements, but in the nature of the supervision.
The previous regime. Licences were issued by the Money Laundering Data Bureau under the Anti-Money Laundering Act. Compliance procedures, the reputation of senior management and links to Estonia were scrutinised. There were no capital requirements as we understand them today; the licence was valid only within Estonia, and supervision focused on AML.
Current regime. Authorisation is granted by the Financial Supervision Authority under the Crypto-Asset Market Act and the MiCA Regulation. New requirements have been introduced regarding own funds, prudential ratios, a substantive assessment of the suitability of the board and qualified shareholders, as well as requirements for operational resilience and the protection of client assets. In return, the authorisation is valid across all EU countries.
What has remained the same. Anti-money laundering obligations have not gone away: the company remains an obliged entity, required to verify customers, assess risks, report suspicious transactions and comply with international sanctions. The Bureau continues to receive and analyse these reports and to enforce the law. In other words, the company now has two authorities to report to instead of one, rather than one replacing the other.
The most dangerous misconception amongst companies that have not transitioned to the new regime is: ‘If we no longer have a licence, then there are no requirements either’.
Practical conclusion: abandoning a company is the worst of all available options. You must also formalise your withdrawal.
The issue of the transfer of supervisory powers is part of a broader trend, and it is worth keeping this in mind when planning.
The European Union has adopted a package of anti-money laundering legislation: a single, directly applicable regulation to replace disparate national rules, and a new supranational supervisory authority, the AMLA, headquartered in Frankfurt. For companies, this means the harmonisation of requirements for customer and beneficial owner due diligence, whilst for some large financial institutions, it means direct supervision by a supranational authority rather than a national one.
What practical implications does this have right now:
A change of supervisory authority almost always brings to light accumulated problems: board meetings that have not been held, overdue reports, and out-of-date information in the register. These issues must be dealt with alongside regulatory matters — and it is more convenient when both aspects are handled by a single provider.
| Stage | What happened |
|---|---|
| 2017–2021 | The Money Laundering Data Bureau issued more than 2,000 licences to virtual currency service providers. |
| 2022–2023 | Regulatory requirements were tightened, and a mass revocation of licences began due to a lack of genuine business activity. |
| 1 July 2024 | The Law on the Crypto-Asset Market came into force; the Financial Inspectorate became the competent authority. |
| End of 2024 | The Bureau ceased accepting applications; pending applications were returned. 43 licences remained valid. |
| Until 1 July 2026 | A transitional period was in force: operations under the old licence were permitted until a new licence was obtained. |
| 1 July 2026 | The previous licences ceased to be valid, and entries in the register were cancelled. |
There are exactly three scenarios, and it is best to make an informed choice between them.
The first is to transition to the new regime. Submit an application for a CASP authorisation to the Financial Inspectorate. This is a realistic option if you have the required capital for the relevant class, a team undergoing suitability assessment, and a physical presence in the EU. Details of the procedure can be found on the CASP authorisation page.
The second option is to remove the model from the scope. Sometimes it is sufficient to redesign the product so that the company no longer provides services listed in the regulation: for example, replacing the built-in exchange with a redirect to a licensed provider, or transitioning to the status of a technology provider for a licensed company. This is a viable option, but it requires genuine reclassification, not simply renaming the services.
The third option is to wind up the business. Properly wind up relationships with clients, refund funds, finalise accounts and wind up the company, or prepare it for sale. It’s a slower process than simply stopping replying to emails, but it’s the only option that won’t cause problems in the future.
Continue to serve EEA clients without authorisation. Accept new clients and open accounts for them. Carry out active marketing aimed at a European audience. Pretend to be a licensed provider by referring to a previous licence number — a company’s status can be checked in the register of supervisory authorities within a minute, and such checks have now become a standard part of counterparties’ compliance procedures.
A useful procedure that is worth incorporating into your own compliance framework. The status of licensed financial market entities can be checked in the Financial Inspection’s register; details of the company and its board of directors can be found in the Commercial Register; and the status of corporate service providers can be verified in the Business Activities Register. A reference to a ‘licence’ in a counterparty’s presentation without confirmation in the register is sufficient grounds for not entering into a relationship.
Regardless of licensing status, an obliged entity must: apply customer due diligence measures in accordance with a risk assessment; identify beneficial owners; carry out sanctions screening; monitor business relationships; report suspicious transactions; appoint a responsible person; retain documents for the prescribed periods; and carry out internal controls and staff training. This is precisely what constitutes the scope of work under the second package.
Let’s outline the company’s current status, which obligations remain in place, and what options are available: transitioning to a new operating model, restructuring the business model, or an orderly exit. We’ll provide an assessment of the budget and timelines for each option within one working day.
Order