CASP Licence in Estonia: Planning to apply for a CASP licence in Estonia?

The Markets in Crypto-Assets Regulation (MiCA) has replaced the national virtual asset service provider regime in Estonia. Crypto-asset service providers (CASPs) now need authorisation from Finantsinspektsioon, and the requirements are considerably stricter than under the previous FIU registration model.

Many applicants underestimate this shift. Structures that were accepted in the past — a nominee director, a virtual office, policies copied from a template — are, in our assessment, unlikely to pass under MiCA.

Below are the 10 most common reasons a CASP application may be refused or withdrawn. For each, we set out what the law requires, our view based on practice, and how to prepare.

A note on terminology: “The law” sections describe legal requirements with references to MiCA and related acts. “Our view” sections reflect our professional assessment and are not statements of law.

1. No real presence in the EU

The law. A CASP must have a registered office in a Estonia (where it carries out at least part of its crypto-asset services), its place of effective management in the EU, and at least one director is local resident.

Our view. A nominee director and a virtual office were often accepted under the former FIU regime. In our assessment, they do not meet MiCA’s requirements: the regulator expects the company to be genuinely managed from the EU.

How to prepare:

• Appoint a director who is resident in the EU and actually takes part in management decisions.
• Make sure board meetings, key decisions and records demonstrably take place in the EU.
• Use a real office where at least part of the services is provided.

2. Management fails the fit and proper test

The law. Members of the management body must be of sufficiently good repute and possess appropriate knowledge, skills and experience, both individually and collectively, to perform their duties.

Our view. A common reason for a negative assessment is a lack of experience specifically in crypto-assets or financial regulation. General business experience alone is often not enough.

How to prepare:

• Map each board member’s experience against the services you plan to provide.
• Fill gaps before filing, for example by appointing a member with regulatory or crypto-asset experience.
• Prepare complete CVs, references and criminal record certificates in advance.

3. Opaque ownership structure

The law. The application must identify all direct and indirect shareholders with qualifying holdings, and their good repute must be demonstrated. Authorisation may be refused where close links or the law of a third country prevent effective supervision.

Our view. Multi-layered structures through jurisdictions with limited transparency attract close scrutiny and often lead to repeated information requests.

How to prepare:

• Draw a complete ownership chart up to the ultimate beneficial owners.
• Collect documents confirming the repute and source of wealth of each qualifying shareholder.
• Consider simplifying the structure before filing if any layer cannot be clearly explained.

4. Capital does not meet the requirements

The law. A CASP must hold prudential safeguards equal to the higher of the permanent minimum capital for its class of services — EUR 50,000, 125,000 or 150,000 — and one quarter of its fixed overheads for the preceding year.

Our view. The origin of the capital is also examined from an AML perspective. Funds whose source cannot be clearly documented can delay or jeopardise the application.

How to prepare:

• Confirm which class your services fall into and calculate the required amount.
• Document the source of the capital with contracts, bank statements and tax records.
• Budget for ongoing compliance, since the requirement applies continuously, not just at filing.

5. A box-ticking programme of operations

The law. The application must include a programme of operations describing the crypto-asset services to be provided, including where and how they will be marketed.

Our view. A template business plan that does not match the company’s actual model is one of the main reasons for regulator queries and withdrawn applications. The regulator compares the plan with the rest of the file and notices inconsistencies.

How to prepare:

• Describe the services, target markets, client types and marketing channels you will actually use.
• Make sure the financial projections, staffing and policies are consistent with the plan.
• Avoid generic wording copied from other applications.

6. AML/CFT exists only on paper

The law. A CASP must have effective anti-money laundering and counter-terrorist financing arrangements, including a risk assessment, customer due diligence (KYC), transaction monitoring, sanctions screening and compliance with the travel rule.

Our view. Policies copied from a template, without the tools and staff to apply them, significantly increase the risk of refusal.

How to prepare:

• Tailor the business-wide risk assessment to your actual products, clients and jurisdictions.
• Select and contract KYC, transaction monitoring and travel rule tools before filing.
• Appoint a qualified compliance officer and money laundering reporting officer.

7. Weak protection of client assets

The law. A CASP must segregate clients’ crypto-assets and funds from its own. A CASP providing custody must also have a custody and administration policy.

Our view. Segregation must work in practice — in your wallets and your records — not just in the policy.

How to prepare:

• Define the wallet structure and how client holdings are recorded and reconciled.
• Choose the credit institution or custodian for client funds.
• Align the custody policy with the technical setup actually in use.

8. ICT and security are not documented

The law. The application must include technical documentation of the ICT systems and security arrangements, together with a description in non-technical language .

Our view. The documentation should describe the systems you actually run, not a vendor’s generic template.

How to prepare:

• Document your architecture, access controls, key management and incident response.
• Prepare the non-technical summary for readers without an IT background.
• Map your setup against DORA requirements, including third-party ICT risk.

9. Key functions outsourced without oversight

The law. Outsourcing does not relieve a CASP of its responsibility and must not impair the quality of internal control or the competent authority’s ability to supervise.

Our view. A model in which the Estonian company is merely a shell for an external operator is unlikely to be approved.

How to prepare:

• List all outsourced functions and justify why each can be outsourced.
• Put written agreements in place that give the CASP and the regulator access and audit rights.
• Keep enough in-house expertise to supervise each provider.

10. Incomplete or inconsistent application

The law. Finantsinspektsioon may request additional information where the materials submitted do not satisfy it that the applicant meets the requirements.

Our view. In practice, prolonged rounds of queries often end with the application being withdrawn.

How to prepare:

• Cross-check the business plan, policies, financial projections and organisational chart for consistency.
• Answer each regulator query fully and with supporting documents.
• Consider an independent review of the file before submission.

Pre-filing checklist

Before submitting a CASP application to Finantsinspektsioon, check that you can answer “yes” to each point:

• The company is genuinely managed from the EU and has at least one EU-resident director.
• Each board member’s experience matches the planned services.
• The ownership chart is complete up to the ultimate beneficial owners.
• Capital meets the requirement and its source is documented.
• The programme of operations reflects the real business model.
• AML/CFT policies are supported by working tools and qualified staff.
• Client assets are segregated in practice, not only on paper.
• ICT documentation describes the systems actually in use and addresses DORA.
• Outsourced functions are justified and supervised.
• All documents in the file are consistent with each other.

Planning to apply for a CASP licence?

We can assess your company’s readiness, identify the key risks in your application and help you prepare a complete and consistent file. Contact us to discuss your project.

Legal sources:

1. Regulation (EU) 2023/1114 (MiCA): Arts. 59(2), 62(2), 63, 67, 68, 70, 73, 75 and Annex IV (https://eur-lex.europa.eu/eli/reg/2023/1114/oj)
2. Regulation (EU) 2023/1113 (Transfer of Funds Regulation): the travel rule (https://eur-lex.europa.eu/eli/reg/2023/1113/oj)
3. Regulation (EU) 2022/2554 (DORA): ICT and operational resilience (https://eur-lex.europa.eu/eli/reg/2022/2554/oj)
4. Estonian Money Laundering and Terrorist Financing Prevention Act (RahaPTS) (https://www.riigiteataja.ee/en/akt/520072026005)

This article is for general information only and does not constitute legal advice. Requirements and regulatory practice may change; the outcome of any application depends on its specific circumstances.

Read more at

The simplest structure: an OÜ

For most entrepreneurs, the appropriate legal form is an osaühing (OÜ), roughly equivalent to a private limited company.

An OÜ can be established by a natural person or a legal entity, and the current minimum share capital is only €0.01. The state fee is €265 (service fee will be added). An OÜ must have a management board and must submit an annual report.

The €0.01 minimum should not necessarily be interpreted as the recommended amount of capital for every business. The appropriate capital depends on the company’s activities and financing needs.

The most convenient route for a foreign founder

If you are not an Estonian resident, the practical route is:

e-Residency → Estonian OÜ → registered address/contact person → business account → accounting and tax compliance.

Estonia’s e-Residency programme provides a government-issued digital identity that allows eligible foreigners to access Estonian digital business services. It does not, however, give you Estonian citizenship, tax residency or an automatic right to live in Estonia.

Step 1: Apply for e-Residency

If you do not already have an Estonian digital identity, apply for e-Residency.

Once approved, you receive an e-Residency digital ID card that can be used for secure digital authentication and signing.

The important point is that e-Residency is primarily a digital business identity, not an immigration programme. It does not automatically change your personal tax residence.

Step 2: Choose your company name

Before registering the company, choose a name and check whether it is available.

The name should be distinguishable from existing Estonian companies and should also be checked against relevant trademarks. Estonia’s Business Register provides tools for checking company names before registration.

It is also sensible to check the corresponding domain name and social-media handles before committing to the company name.

Step 3: Arrange an Estonian legal address or contact person

A foreign founder generally needs an Estonian legal address or, depending on the circumstances, a licensed Estonian contact person.

This is where using an Estonian service provider can make the process considerably easier. Providers commonly offer a package combining a legal address/contact person, company formation and accounting.

The Estonian e-Residency programme currently indicates typical pricing of approximately €200–€400 per year for a contact-person/legal-address service, although prices vary by package.

This is often the most convenient option for a founder who has no physical office in Estonia.

Step 4: Register the OÜ online

Once you have the required digital identity, you can register the company through Estonia’s official e-Business Register.

The registration process consists essentially of preparing the application, digitally signing it, paying the state fee and submitting it. The official e-Residency guidance estimates approximately 15 minutes to one hour for the online registration process itself.

The state registration fee is currently €265.

In straightforward cases, this means you can create the company without travelling to Estonia.

Step 5: Open a business account

After incorporation, you need an account through which the company can receive and make payments.

For internationally operated businesses, an EEA-based fintech or business-payment provider can sometimes be more convenient than a traditional bank. Estonia’s e-Residency programme specifically notes that e-residents can consider EU-licensed fintech providers as well as banks in Estonia or elsewhere in the EEA.

However, opening a financial account is not guaranteed simply because you have an Estonian company or e-Residency. Financial institutions conduct their own compliance and know-your-customer checks.

Your country of residence, nationality, business model, customers, expected transactions and source of funds can all affect the result.

Step 6: Set up accounting

This is the part that should not be overlooked.

An Estonian company is still a real company with accounting and reporting obligations. All Estonian companies, including dormant companies, must submit an annual report.

For a small online business, the most convenient solution is often to use an accounting service that integrates with your company’s banking and accounting systems.

A typical outsourced setup might include:

• bookkeeping;
• annual report preparation;
• VAT returns, if applicable;
• payroll reporting, if you have employees;
• tax calculations;
• assistance with the Estonian Tax and Customs Board.

This is generally easier than trying to manage Estonian accounting yourself unless you already understand the local requirements.

Please see our accounting prices here: https://parenzolaw.com/en/services08/

What about VAT?

VAT registration is not automatic when you establish an Estonian company.

As of 2026, the mandatory VAT-registration threshold is generally €40,000 of relevant annual turnover, although the precise application of the rules depends on the nature and location of your transactions. Voluntary registration can also be possible.

Please notice: e-Residency does not eliminate your home-country taxes

Creating an Estonian OÜ does not automatically make you an Estonian tax resident.

If you live and work in another country, that country may still consider you personally tax resident there. It may also impose taxes on your salary, dividends or other income.

There can also be corporate tax issues if the company is effectively managed from another country or creates a permanent establishment there.

Alternative: Open an Estonian Company by Power of Attorney

If you do not want to apply for e-Residency or prefer to delegate the incorporation process to a lawyer, there is another convenient option: opening an Estonian company by power of attorney.

In this case, you do not need to travel to Estonia personally. The incorporation procedure can be handled by a lawyer acting on your behalf under a notarised power of attorney.

The practical process is:

Power of Attorney → documents sent to Tallinn → preparation of company details → notarial appointment → registration of the OÜ.

Step 1: Receive the Power of Attorney template

Our lawyer will prepare and send you a template of the power of attorney.

The document will authorise our lawyer to represent you before the Estonian authorities and a notary and to complete the necessary steps for establishing your company.

You will need to sign the power of attorney in accordance with the applicable local requirements.

Step 2: Notarise and apostille the Power of Attorney

In most cases, the power of attorney must be notarised and apostilled. The apostille applies where the country in which the power of attorney is signed is a party to the Hague Apostille Convention. If the signing country is not a party to that Convention, the document will instead need to be legalised through the applicable consular procedure.

The exact document requirements may depend on the country where you are signing the power of attorney and the applicable international rules.

Once the document has been properly notarised and, where required, apostilled, it should be sent to our office in Tallinn.

Step 3: Send the original document to our Tallinn office

The original power of attorney is sent to our office in Tallinn.

Once we receive the document, our lawyer can proceed with the next steps and arrange an appointment with an Estonian notary.

This means that you can complete the necessary formalities in your country of residence while our team handles the Estonian part of the procedure.

Step 4: Provide the company details

Before the notarial appointment, you provide us with all the necessary information about the company.

This normally includes:

• proposed company name;
• business activities;
• shareholder information;
• management board information;
• share capital;
• registered address;
• other information required for preparing the incorporation documents.

Our lawyer will use this information to prepare the documents required for the incorporation procedure.

Step 5: Notarial incorporation in Estonia

After receiving the power of attorney and the necessary company information, we book a time with an Estonian notary.

Our lawyer represents you at the notarial appointment and completes the incorporation formalities on your behalf.

You therefore do not need to travel to Estonia to attend the appointment personally.

How much does it cost?

The cost of opening an Estonian company by power of attorney through our office is approximately €750–€950.

The exact price depends on the circumstances and the required procedure.

The price includes the state fee and notarial expenses related to the incorporation.

Please note that the costs of preparing, notarising and apostilling the power of attorney in your country of residence may be additional, depending on the local requirements.

Who should consider this option?

Opening a company by power of attorney can be particularly convenient if:

• you do not have an Estonian e-Residency card;
• you do not want to travel to Estonia;
• you prefer to have a lawyer handle the incorporation procedure;
• you want professional assistance with the notarial process;
• you need to establish the company while remaining in your country of residence.

This option allows you to delegate the Estonian incorporation procedure to a local lawyer while you complete the document formalities in your own country.

e-Residency or Power of Attorney?

There are therefore two practical ways for a foreign entrepreneur to establish an Estonian OÜ remotely.

With e-Residency, you obtain an Estonian digital identity and can manage many company-related procedures yourself online. This can be particularly convenient if you expect to manage the company yourself over the long term.

With a power of attorney, you delegate the incorporation procedure to a lawyer. This can be more convenient if your immediate objective is simply to establish the company and you prefer not to deal with the Estonian digital registration and notarial process yourself.

The appropriate option depends on how you intend to manage the company after incorporation and whether you already have an Estonian digital identity.

This article is provided for general informational purposes only and does not constitute legal advice. It does not create an attorney-client relationship, and it should not be relied upon as a substitute for advice tailored to your specific circumstances. Procedures, requirements, and costs described above may vary depending on the applicable jurisdiction and the specifics of each case, and may change over time. For advice on your particular situation, please contact our office directly.

Read more at

A request from your bank does not mean that you are suspected of breaking the law. In many cases, it is simply part of the bank’s anti-money laundering (AML) compliance procedures.

However, a bank’s request should never be ignored.

What should you do:

✓ Respond within the deadline specified by the bank.
✓ Keep your response clear, factual, and focused on the questions asked. Emotional arguments or disputes are unlikely to help.
✓ Provide only the documents that directly address the bank’s request.
✓ Avoid sending unnecessary documents or information, as this may raise additional questions.

Your primary objective is to clearly demonstrate the source of funds, the purpose of the transaction, and its underlying economic rationale.

The clearer and more consistent your explanations and supporting documents are, the sooner the bank is likely to complete its review.

Keep in mind:

A well-prepared response can often help avoid follow-up requests, account restrictions, and unnecessary delays in the review process.

One More Important Point

Many people seek legal advice only after they have already responded to the bank several times on their own.

If the initial responses contained incomplete information, inconsistent documentation, or changing explanations, correcting the situation later can become significantly more difficult. In some cases, those earlier responses may even work against your position.

If the bank’s request is complex or you are unsure which documents or explanations should be provided, it is usually advisable to seek legal advice before submitting your first response rather than after several unsuccessful attempts.

Read more at

Regularly reviewing corporate documentation helps ensure that it accurately reflects the company’s current operations and remains aligned with its business processes. This becomes particularly important when there are changes in shareholders or management, the business expands into new markets, new business activities are introduced, or the company works with financial institutions and commercial partners.

In practice, the need to update corporate documentation often becomes apparent at the least convenient moment — during an inspection, in response to a bank request, in the course of a transaction, or while preparing for licensing. If the documentation contains outdated information or no longer reflects the way the company actually operates, this may lead to additional questions and unnecessary delays.

Conducting periodic reviews of corporate documentation is considered good corporate practice. It allows potential inconsistencies to be identified in advance and ensures that documentation remains up to date, without waiting until an urgent situation arises.

Read more at

From a box-ticking exercise to a business necessity

Just a few years ago, many companies viewed internal policies and procedures as little more than a mandatory set of documents required only in certain situations. Today, that approach has changed significantly.

What banks, partners and regulators now expect

The modern business environment places increasing emphasis on transparent corporate governance, effective internal controls, and proper documentation of key business processes. Financial institutions, business partners, and regulatory authorities are paying closer attention not only to whether internal policies exist, but also to whether they accurately reflect the company’s day-to-day operations.

Compliance as part of risk management

For businesses, this means that compliance has become an integral part of risk management rather than a mere regulatory formality. Regularly reviewing internal policies, clearly allocating responsibilities, and keeping corporate documentation up to date help companies navigate inspections with greater confidence, build stronger relationships with business partners, and respond more effectively to evolving regulatory expectations.

Why a proactive approach pays off

Companies that address these issues proactively typically spend far less time and fewer resources resolving compliance-related challenges in the future.

Read more at