Estonia CASP Licence: The 2026 Guide

Estonia built the reputation of Europe’s most accessible crypto jurisdiction, and for years “get an Estonian crypto licence” meant the fast, light FIU registration everyone talked about. Under MiCA that phrase now means something specific and much more serious: an Estonia CASP licence, issued by a new regulator, with capital, substance and a technology-resilience programme behind it. This guide sets out exactly what the CASP authorisation is, which services fall into which capital class, and how the EU passport works — so you can plan the application around the parts that matter.

In our practice, the operators who get this right treat the CASP as what it now is — a full financial-services licence — not the notice-and-go registration Estonia was known for. The ones who struggle budgeted for the old world and were caught out by the handover from the Financial Intelligence Unit to the Financial Supervision Authority. Below is the version we scope from.

What a CASP authorisation actually is

CASP stands for Crypto-Asset Service Provider. It is the single licence created by MiCA — the EU’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 — for any business that provides crypto-asset services to third parties. Before MiCA, each EU country ran its own national regime, and Estonia’s was a Virtual Asset Service Provider (VASP) registration supervised by the Financial Intelligence Unit that became famous for being quick and cheap to obtain. MiCA swept that away and put one harmonised authorisation in its place.

The crucial Estonian detail is who now holds the pen. Supervision of crypto firms has moved from the FIU to the Estonian Financial Supervision Authority (Finantsinspektsioon) — the same regulator that oversees the country’s banks, insurers and payment institutions. That matters: a CASP is not a company registration or an AML notice, it is a supervised financial-services licence in the same family as an e-money or investment-firm authorisation. You apply to the financial regulator, you are assessed on fit-and-proper management and capital, and you report to that authority for the life of the licence. For the wider picture of how these terms fit together, our explainer on VASP, CASP and MiCA unpacks the vocabulary in full.

The three service classes and their capital

MiCA does not charge one flat capital figure. It bundles the regulated crypto services into three capital classes, and your minimum own-funds requirement is fixed by the highest-class service you provide. Because these thresholds live in the regulation itself, they are the same in Estonia as in every other EU state — you do not shop between EU countries for cheaper capital.

The dividing lines are worth reading carefully. The moment you hold client assets — custody, wallets, safeguarding — or run an exchange desk, you are in Class 2 at €125,000. The moment you operate the matching venue itself — a trading platform with an order book — you are in Class 3 at €150,000. A pure advisory or order-routing model that never touches client crypto can sit in Class 1 at €50,000. Most businesses that people casually call “a crypto exchange” turn out to be Class 2 or Class 3 once you map what they really do; our Estonia crypto exchange licence guide walks through that classification, and our CASP capital requirements piece breaks the tiers down further.

How EU-27 passporting works

This is the reason to license in the EU at all. Under MiCA Article 65, an authorised CASP that wants to provide services in other member states does not re-apply anywhere. It notifies the Financial Supervision Authority of the host states and services it intends to offer; the FSA forwards that notification to the competent authorities in those states; and after a short notice period the firm can operate there. One authorisation, up to 27 markets, on a notification basis.

In practice that turns a single Estonian CASP into a passport for the entire European single market — the largest regulated crypto market in the world. You still respect each host country’s local marketing and consumer rules, and you still geo-block jurisdictions you are not authorised in, but you are not filing 27 licence applications or funding 27 lots of capital. That single-licence economics is the whole case for the EU route, and it is what our Estonia crypto licence pillar covers end to end.

Why Estonia, specifically

If the capital and the passport are identical EU-wide, what keeps Estonia on the shortlist? Three things: efficiency, tax and track record.

Estonia’s e-government is the practical edge. Digital signatures, e-Residency and online administration mean incorporating the applicant company and running it afterwards carries less friction than almost anywhere in the EU — filings, board resolutions and reporting are genuinely digital-first rather than paper dressed up. On tax, Estonia keeps its distinctive distributed-profits corporate model: company profits are taxed only when they are distributed, not as they are earned, which suits crypto teams reinvesting to scale. And on track record, the country has hosted crypto business for the best part of a decade, so crypto-aware banks, EMI/PI partners, auditors and compliance talent who have actually done this before are on the ground.

The trade-off is substance. An Estonian CASP applicant is an Estonian OÜ (osaühing) with a genuine registered office, real local operating presence, fit-and-proper management the FSA can assess, and a resident-anchored AML function. This is not a nameplate with a mailbox; the Financial Supervision Authority tests for real substance under MiCA, and thin structures get sent back. That is a deliberate reset from the FIU era, when Estonia issued thousands of light-touch VASP permits and later revoked a large share of them.

DORA, AML and the compliance backbone

A CASP is a supervised licence, so the obligations run past day one. Two frameworks sit underneath every Estonian CASP.

AML/CFT. You need a dedicated money-laundering reporting officer (MLRO), customer due-diligence, transaction monitoring and suspicious-activity reporting aligned to the EU’s 5th and 6th AML directives, plus the Travel Rule — originator and beneficiary data attached to crypto transfers under the EU Transfer of Funds Regulation. This is the operational heart of the licence and the part regulators scrutinise hardest.

DORA. The Digital Operational Resilience Act — Regulation (EU) 2022/2554 — has applied to CASPs since 17 January 2025. It requires an ICT risk-management framework, incident classification and reporting, resilience testing, and oversight of your third-party technology providers. A CASP file submitted without a credible DORA programme is incomplete, and this is one of the most common reasons applications stall. On top of both sit MiCA’s own conduct rules: client-asset safeguarding and segregation, conflict-of-interest management, disclosures and complaints handling. Banking follows the same logic — crypto-friendly banks and EMI or payment-institution partners, arranged around a licensed, substance-backed entity rather than a shell.

From the old FIU VASP registration to CASP

For years, Estonia’s draw was a fast FIU VASP registration with light requirements. MiCA ended that model, and the Estonian handover is unusually sharp. The FIU regime is being retired, supervision has passed to the Financial Supervision Authority, and legacy FIU VASP authorisations are valid only until 1 July 2026. Critically, there is no automatic conversion — a VASP permit does not roll into a CASP licence. Every firm that wants to keep operating has to reapply to the FSA and be authorised as a CASP in its own right.

For anyone still holding a legacy registration, the sequence is straightforward but time-sensitive: scope your service classes and capital now, stand up the substance and the DORA and AML programmes, and file for CASP well ahead of the cliff rather than at it. An existing Estonian VASP can qualify for a shorter, simplified review — potentially closer to three months rather than the four to six a from-scratch file takes — but “simplified” is not “automatic”, and leaving it late risks a gap in your permission to trade. New entrants skip the legacy stage entirely and apply for CASP directly, which, given the deadline, is usually the cleaner path anyway.

The upside for the extra rigour is real. An FSA-issued CASP carries weight with banks, PSPs, auditors and institutional counterparties in a way an FIU registration never did, and it opens the whole EU by notification. It costs more in substance and capital than the old world, but it buys a durable, passportable EU credential — and for a serious crypto business that is precisely the point.

If you are deciding between service classes, weighing Estonia against another EU home, or timing a VASP migration before the July 2026 deadline, we will map it to where your users and your capital actually sit and quote the real number. Book a free consultation and we will scope your Estonia CASP file end to end.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.