CASP Licence in Estonia: Planning to apply for a CASP licence in Estonia?

The Markets in Crypto-Assets Regulation (MiCA) has replaced the national virtual asset service provider regime in Estonia. Crypto-asset service providers (CASPs) now need authorisation from Finantsinspektsioon, and the requirements are considerably stricter than under the previous FIU registration model.

Many applicants underestimate this shift. Structures that were accepted in the past — a nominee director, a virtual office, policies copied from a template — are, in our assessment, unlikely to pass under MiCA.

Below are the 10 most common reasons a CASP application may be refused or withdrawn. For each, we set out what the law requires, our view based on practice, and how to prepare.

A note on terminology: “The law” sections describe legal requirements with references to MiCA and related acts. “Our view” sections reflect our professional assessment and are not statements of law.

1. No real presence in the EU

The law. A CASP must have a registered office in a Estonia (where it carries out at least part of its crypto-asset services), its place of effective management in the EU, and at least one director is local resident.

Our view. A nominee director and a virtual office were often accepted under the former FIU regime. In our assessment, they do not meet MiCA’s requirements: the regulator expects the company to be genuinely managed from the EU.

How to prepare:

• Appoint a director who is resident in the EU and actually takes part in management decisions.
• Make sure board meetings, key decisions and records demonstrably take place in the EU.
• Use a real office where at least part of the services is provided.

2. Management fails the fit and proper test

The law. Members of the management body must be of sufficiently good repute and possess appropriate knowledge, skills and experience, both individually and collectively, to perform their duties.

Our view. A common reason for a negative assessment is a lack of experience specifically in crypto-assets or financial regulation. General business experience alone is often not enough.

How to prepare:

• Map each board member’s experience against the services you plan to provide.
• Fill gaps before filing, for example by appointing a member with regulatory or crypto-asset experience.
• Prepare complete CVs, references and criminal record certificates in advance.

3. Opaque ownership structure

The law. The application must identify all direct and indirect shareholders with qualifying holdings, and their good repute must be demonstrated. Authorisation may be refused where close links or the law of a third country prevent effective supervision.

Our view. Multi-layered structures through jurisdictions with limited transparency attract close scrutiny and often lead to repeated information requests.

How to prepare:

• Draw a complete ownership chart up to the ultimate beneficial owners.
• Collect documents confirming the repute and source of wealth of each qualifying shareholder.
• Consider simplifying the structure before filing if any layer cannot be clearly explained.

4. Capital does not meet the requirements

The law. A CASP must hold prudential safeguards equal to the higher of the permanent minimum capital for its class of services — EUR 50,000, 125,000 or 150,000 — and one quarter of its fixed overheads for the preceding year.

Our view. The origin of the capital is also examined from an AML perspective. Funds whose source cannot be clearly documented can delay or jeopardise the application.

How to prepare:

• Confirm which class your services fall into and calculate the required amount.
• Document the source of the capital with contracts, bank statements and tax records.
• Budget for ongoing compliance, since the requirement applies continuously, not just at filing.

5. A box-ticking programme of operations

The law. The application must include a programme of operations describing the crypto-asset services to be provided, including where and how they will be marketed.

Our view. A template business plan that does not match the company’s actual model is one of the main reasons for regulator queries and withdrawn applications. The regulator compares the plan with the rest of the file and notices inconsistencies.

How to prepare:

• Describe the services, target markets, client types and marketing channels you will actually use.
• Make sure the financial projections, staffing and policies are consistent with the plan.
• Avoid generic wording copied from other applications.

6. AML/CFT exists only on paper

The law. A CASP must have effective anti-money laundering and counter-terrorist financing arrangements, including a risk assessment, customer due diligence (KYC), transaction monitoring, sanctions screening and compliance with the travel rule.

Our view. Policies copied from a template, without the tools and staff to apply them, significantly increase the risk of refusal.

How to prepare:

• Tailor the business-wide risk assessment to your actual products, clients and jurisdictions.
• Select and contract KYC, transaction monitoring and travel rule tools before filing.
• Appoint a qualified compliance officer and money laundering reporting officer.

7. Weak protection of client assets

The law. A CASP must segregate clients’ crypto-assets and funds from its own. A CASP providing custody must also have a custody and administration policy.

Our view. Segregation must work in practice — in your wallets and your records — not just in the policy.

How to prepare:

• Define the wallet structure and how client holdings are recorded and reconciled.
• Choose the credit institution or custodian for client funds.
• Align the custody policy with the technical setup actually in use.

8. ICT and security are not documented

The law. The application must include technical documentation of the ICT systems and security arrangements, together with a description in non-technical language .

Our view. The documentation should describe the systems you actually run, not a vendor’s generic template.

How to prepare:

• Document your architecture, access controls, key management and incident response.
• Prepare the non-technical summary for readers without an IT background.
• Map your setup against DORA requirements, including third-party ICT risk.

9. Key functions outsourced without oversight

The law. Outsourcing does not relieve a CASP of its responsibility and must not impair the quality of internal control or the competent authority’s ability to supervise.

Our view. A model in which the Estonian company is merely a shell for an external operator is unlikely to be approved.

How to prepare:

• List all outsourced functions and justify why each can be outsourced.
• Put written agreements in place that give the CASP and the regulator access and audit rights.
• Keep enough in-house expertise to supervise each provider.

10. Incomplete or inconsistent application

The law. Finantsinspektsioon may request additional information where the materials submitted do not satisfy it that the applicant meets the requirements.

Our view. In practice, prolonged rounds of queries often end with the application being withdrawn.

How to prepare:

• Cross-check the business plan, policies, financial projections and organisational chart for consistency.
• Answer each regulator query fully and with supporting documents.
• Consider an independent review of the file before submission.

Pre-filing checklist

Before submitting a CASP application to Finantsinspektsioon, check that you can answer “yes” to each point:

• The company is genuinely managed from the EU and has at least one EU-resident director.
• Each board member’s experience matches the planned services.
• The ownership chart is complete up to the ultimate beneficial owners.
• Capital meets the requirement and its source is documented.
• The programme of operations reflects the real business model.
• AML/CFT policies are supported by working tools and qualified staff.
• Client assets are segregated in practice, not only on paper.
• ICT documentation describes the systems actually in use and addresses DORA.
• Outsourced functions are justified and supervised.
• All documents in the file are consistent with each other.

Planning to apply for a CASP licence?

We can assess your company’s readiness, identify the key risks in your application and help you prepare a complete and consistent file. Contact us to discuss your project.

Legal sources:

1. Regulation (EU) 2023/1114 (MiCA): Arts. 59(2), 62(2), 63, 67, 68, 70, 73, 75 and Annex IV (https://eur-lex.europa.eu/eli/reg/2023/1114/oj)
2. Regulation (EU) 2023/1113 (Transfer of Funds Regulation): the travel rule (https://eur-lex.europa.eu/eli/reg/2023/1113/oj)
3. Regulation (EU) 2022/2554 (DORA): ICT and operational resilience (https://eur-lex.europa.eu/eli/reg/2022/2554/oj)
4. Estonian Money Laundering and Terrorist Financing Prevention Act (RahaPTS) (https://www.riigiteataja.ee/en/akt/520072026005)

This article is for general information only and does not constitute legal advice. Requirements and regulatory practice may change; the outcome of any application depends on its specific circumstances.

Read more at