Estonia Crypto Licence Requirements in 2026

An Estonia crypto (CASP) licence requires an Estonian OÜ with a genuine registered office and real local substance rather than a virtual address, plus the class-based MiCA capital (€50,000–€150,000). Estonia built its name as an easy place to register a crypto business, but the requirements file behind a CASP authorisation is now a full financial-services file, far heavier than the light registration that reputation was built on. The old Financial Intelligence Unit VASP regime asked for little. Under MiCA, the Estonian Financial Supervision Authority (Finantsinspektsioon) asks for a real business: an Estonian OÜ with substance, funded capital, vetted people and a working AML and ICT-resilience programme.

This is the checklist our team works from on live applications. It covers exactly what the 2026 Estonia CASP regime demands (an OÜ with a genuine registered office, initial capital by service class, fit-and-proper management assessed by the FSA, an MLRO and a DORA-compliant ICT framework), along with the transition: the FIU’s VASP registrations expired on 1 July 2026 with no automatic conversion. This is a full EU financial-services regime, and we scope it as one.

The FIU-to-FSA shift and why it matters

Start with the change that reframes everything. Estonia’s crypto businesses used to register with the Financial Intelligence Unit (FIU) under a national VASP regime. Under MiCA that regime has been phased out, and the competent authority is now the Financial Supervision Authority (Finantsinspektsioon) — the same regulator that supervises banks, funds and payment institutions. Crypto is no longer a registration sitting at the edge of the AML system; it is a licensed financial-services activity supervised like any other.

The practical consequence was a hard deadline. Existing FIU VASP authorisations were valid only until 1 July 2026, there was no automatic conversion, and every firm that wanted to keep operating had to reapply to the FSA for a CASP licence. A legacy VASP permit does not roll over; it lapses. For any Estonian crypto business that started under the old regime, mapping where it stands after that transition is the first job, and the Estonia VASP-to-CASP transition guide walks the upgrade path and the deadline mechanics in full. The rest of this article is what the FSA now expects in return.

The company and local substance Estonia requires

Everything starts with an Estonian company. The FSA licenses an Estonian OÜ (a private limited company) with a genuine registered office and real substance behind it. There is no remote-only route: the applicant is incorporated in Estonia, keeps a registered office there, and runs a real operating presence rather than a virtual address. This is the first hard difference from a legacy VASP registration, and it is the requirement operators most often underestimate.

Substance is assessed in the round. The regulator wants to see that the business is directed and administered from Estonia, with the right people performing the core functions locally and a transparent ownership and control structure above them. A company that exists only on paper, with management and operations elsewhere, does not clear the substance test. Estonia’s e-government and e-Residency infrastructure make the mechanics of incorporation and ongoing administration unusually efficient — but efficient setup is not the same as no substance. For the full picture of what a CASP authorisation buys and how it sits within MiCA, our flagship Estonia crypto licence overview maps the regime end to end.

Capital by service class in Estonia

This is the requirement that catches operators pricing Estonia on the state fee alone. MiCA sets a minimum capital floor by the service class you run, and Estonia applies it directly. Your application has to prove the safeguards are there, and MiCA Article 67 then keeps you at the higher of the class minimum or a quarter of the previous year’s fixed overheads. Held as own funds, the money stays in the business, so none of it is written off; an insurance policy is the other permitted form.

These figures are identical in every EU member state because they come from MiCA rather than national law, so the capital tier is not something you optimise by choosing Estonia over another EU jurisdiction. What Estonia offers around the same requirement is digital administration and a distributed-profits corporate-tax model that many reinvesting teams favour. Costs sit outside scope here; for the full year-one build, the state fee and running costs, see the Estonia crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and fit-and-proper vetting in Estonia

Under MiCA, the people behind the company are assessed as rigorously as the business itself, and the FSA runs the vetting. This is not a formality — an unresolved file on any one person holds the whole application.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The FSA expects a board and senior management with genuine financial-services or crypto backgrounds. A founder team with no regulated-industry track record does not meet that expectation. Directors must demonstrate they can actually run a licensed EU financial-services business, because that is now precisely what a CASP is.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting — and must be a real, appointable person who actually does the job.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. Finantsinspektsioon checks where the capital came from and how each beneficial owner built their wealth, and it expects documents rather than explanations. Missing paperwork on wealth is one of the usual reasons an Estonian file stalls.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme Estonia asks for

Alongside people and capital, the FSA reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what turns a four-month approval into a six-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s 5th and 6th anti-money-laundering directives and the Travel Rule (the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers), because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody. For how the authorisation itself is structured, our Estonia CASP licence explainer breaks down each class.

Passporting and assembling the file in the right order

The reward for meeting the full requirements is passporting. Once the FSA grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one Estonian licence, the whole single market, without applying jurisdiction by jurisdiction. That EU-wide reach is precisely what the substance, capital and DORA requirements are the price of. MiCA is a full financial-services regime, not a registration, and the credential it produces carries weight with banks, PSPs and institutional partners that a legacy VASP permit never did.

Work in this order to avoid rework: fix your CASP service classes and the matching capital tier first, then incorporate the Estonian OÜ, arrange the own funds or insurance and stand up the local office and roles. Assemble every UBO and management fit-and-proper file (source of funds, suitability, experience evidence) in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model rather than a template. Only then does the FSA application go in.

The CASP regime is far more demanding than the light registration Estonia offered before 2025. It asks for a real Estonian company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential that passports across 27 markets. Get the file complete and internally consistent the first time and the four-to-six-month window is achievable; file with gaps and it drifts. For firms that held a legacy FIU registration, the simplified transition route could shorten review ahead of the 1 July 2026 deadline.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Estonian substance, fit-and-proper, AML and DORA build end to end and will review any application against the FSA’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.