Crypto Exchange License in Estonia: MiCA CASP Classes (2026)

If you want to run a crypto exchange in Estonia, the first decision is not the paperwork — it is which service you are actually providing. “Estonia crypto exchange license” is one search term, but MiCA splits the activity into two different CASP service classes with two different capital floors, and picking the wrong one means either overpaying on capital or, worse, operating outside your authorisation. In our practice the exchanges that stall are the ones that treated “exchange” and “trading platform” as the same thing.

They are not. There is also a timing trap unique to Estonia: the old Financial Intelligence Unit VASP registration that made the country famous no longer covers an exchange, and it expires for everyone on 1 July 2026. Below is exactly which class an exchange needs, the difference between an exchange service and a platform under MiCA, and the extra duties a platform operator carries — so you scope the Financial Supervision Authority file correctly the first time.

Which CASP class does an exchange actually need?

MiCA lists ten crypto-asset services, and an exchange touches three of them. The two that decide your capital tier are the exchange service and the trading-platform service; custody is the third, and almost every exchange triggers it too.

If your model is a simple buy/sell desk — the customer converts euros to bitcoin at your quoted price, or swaps one token for another — that is the exchange of crypto-assets service and it sits at Class 2, €125,000. If you run an order book where users post bids and asks and your engine matches them, you are operating a trading platform, and that is Class 3, €150,000. Because a real exchange usually does both — a matching venue plus instant convert and fiat on/off-ramps — most applicants authorise at Class 3 and add the exchange and custody services under the same CASP. That is the standard shape of an Estonian exchange file, and it is the one we scope by default in the Estonia crypto licence engagement.

Exchange service vs trading platform under MiCA

The distinction is not cosmetic — it changes who bears risk and what the Financial Supervision Authority expects to see.

An exchange service makes you the counterparty to the trade. The client transacts with you: you quote a price, you take the other side, and the deal is bilateral. Your obligations centre on a firm, non-discriminatory commercial policy and clear, published pricing.

Operating a trading platform makes you a venue operator. Third parties trade against each other; you provide the order book and the matching engine, but you are not the counterparty to each fill. Because you now set the rules of a market and multiple users interact inside it, MiCA loads the platform with market-integrity duties that an exchange desk simply does not carry. This is why Class 3 exists as a separate, higher tier — you are running market infrastructure, not just a shop.

The extra obligations a platform operator carries

Where an exchange desk mainly proves fair pricing and clean AML, a trading-platform operator has to demonstrate it can run an orderly market. In practice the Financial Supervision Authority will want to see, at minimum:

• Operating rules for the platform — the crypto-assets admitted to trading, the fee structure, and the objective criteria for access, all published and applied without discrimination.
• Orderly-trading systems — resilient matching infrastructure with capacity limits, the ability to reject or cancel orders, and mechanisms to suspend or halt trading in disorderly conditions.
• Market-abuse prevention — arrangements to detect, prevent and report insider dealing and market manipulation, with records kept and suspicious activity escalated.
• Transparency — public quotes and depth on the order book (pre-trade) and prompt publication of executed prices and volumes (post-trade).
• No prohibited self-dealing — MiCA restricts a platform operator from dealing on own account against its own book, so your governance has to keep the venue and any proprietary activity properly separated.

None of this replaces the general MiCA conduct duties every CASP owes — acting honestly and in clients’ best interests, managing conflicts, honest marketing, and complaints handling. A platform operator carries the general conduct rules and the venue-specific ones.

Custody and asset segregation

The moment your exchange holds client crypto — and virtually every exchange does, because users keep balances on the platform — you are also providing the custody and administration service (Class 2). That brings its own hard obligations:

• Client crypto-assets held segregated from the firm’s own assets, so client holdings are never commingled with company funds.
• A position register per client, kept accurate and reconciled, so ownership is provable at any time.
• Liability for loss of client crypto attributable to an incident within your control, which is exactly why key management, wallet architecture and the DORA ICT-resilience programme sit at the centre of the review.

Because custody, exchange and platform operation stack together in a live exchange, the capital floor that governs is the highest class you hold — €150,000 for a Class 3 operator — and the Financial Supervision Authority can require own funds equal to one-quarter of your prior-year fixed overheads if that produces a larger number. We model the real figure against your service mix before you commit; the detail sits in the Estonia crypto licence cost breakdown.

EU-27 passporting, DORA and AML

The reason to license an exchange in Estonia rather than offshore is reach. A CASP authorisation passports across all 27 EU member states by notification under MiCA Article 65 — you file once with the Financial Supervision Authority and notify the host states you intend to serve, instead of applying licence-by-licence. For an exchange that wants the single market, that is the whole game, and it is the core difference explored in what a crypto exchange licence actually is.

Two horizontal regimes apply on top of the class-specific rules. DORA has been in force since 17 January 2025 and requires a full ICT risk-management framework, incident reporting, resilience testing and oversight of third-party technology providers — non-negotiable for a venue running a matching engine. And AML/CFT to the EU’s fifth and sixth directives, with a dedicated MLRO and the Transfer of Funds Regulation (the Travel Rule) on crypto transfers, underpins the whole authorisation. The applicant itself is an Estonian OÜ with genuine substance — a local registered office, qualified and fit-and-proper management, and real operations in Estonia — not an offshore shell. Banking is arranged with crypto-friendly EMI and payment-institution partners that understand a licensed CASP.

Why Estonia for an exchange

Estonia built its reputation as Europe’s most accessible crypto jurisdiction, and under MiCA it has carried that forward — with a catch worth understanding before you file. The legacy FIU VASP registration is being retired: existing authorisations are valid only until 1 July 2026, there is no automatic conversion, and firms must reapply to the Financial Supervision Authority for a CASP licence. For an operating exchange that means treating the upgrade as a fresh, full financial-services application, not a rubber stamp. Our Estonia crypto licence team runs that transition end to end.

What you get in return is a genuinely efficient home for a regulated venue. Estonia’s e-government — e-Residency, digital signatures and online administration — cuts the friction of incorporating and running a licensed OÜ, and the country keeps a distributed-profits corporate-tax model that taxes only when profits are distributed, which suits exchanges reinvesting into growth. On top of that sits a long track record of crypto business, so banks, auditors and service providers already understand the model. An existing Estonian VASP upgrading to CASP can also benefit from a shorter, simplified review — one of the few places where the legacy regime still pays off.

For a trading-platform operator, that ecosystem matters as much as the timeline: the hardest part of launching an exchange is rarely the licence itself but the fiat rails and banking around it. We build the CASP application, the market-integrity and custody controls, the DORA and AML frameworks, and the banking together — because for an exchange they only work as one package.

If you are scoping an Estonian exchange and need to fix the right CASP class before you spend on capital, book a free consultation and we will map the services, the tier and the timeline to your model.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.