In mid 2021 the FIU counted 641 valid licenses for virtual currency services. At the start of 2026 it counted 36. On 1 July 2026 it canceled their register data, and from that day, as the FIU announced on 30 June 2026, only firms with a MiCA authorization from Finantsinspektsioon or another EEA supervisor may provide crypto asset services in Estonia.
Overview of AML in Estonia: which law applies, and what changed after Danske Bank?
Estonia's main anti money laundering law is the Money Laundering and Terrorist Financing Prevention Act, often called the Estonian AML Act. The Riigikogu adopted it on 26 October 2017, it took effect on 27 November 2017, and the version in force since 21 July 2026 is current. Its Estonian title is Rahapesu ja terrorismi rahastamise tõkestamise seadus (RahaPTS), and Riigi Teataja notes that only the Estonian text has legal force. Footnote 1 names the Fourth EU Money Laundering Directive, (EU) 2015/849, as amended by the Fifth, (EU) 2018/843.
Of the other laws, the International Sanctions Act sets the financial sanctions duties, and Penal Code s. 394 makes laundering a crime. MONEYVAL evaluates the regime against the FATF Recommendations, the standard behind AML rules in other jurisdictions too.
Danske Bank's own report put flows through its Estonian branch at about €200 billion from 2007 to 2015, as the Danske Bank case records. On 19 February 2019 Finantsinspektsioon ordered the branch to cease its activities in Estonia within eight months.
In October 2023 an IMF analysis of eight Nordic and Baltic countries judged Estonia's efforts sufficient and recommended more international collaboration: more cross border data and joint supervisory steps.
The regulatory authorities: who supervises AML in Estonia?
| Body | What it supervises or does | Basis (in force, November 2026) |
|---|---|---|
| Financial Intelligence Unit (FIU, Rahapesu Andmebüroo) | Every obliged entity unless the Act names another supervisor; receives suspicion and cash reports and sanctions notifications; grants and revokes FIU authorizations; decides AML misdemeanor cases out of court | MLTFPA ss. 53(1), 64(1), 70, 75, 97(1); International Sanctions Act s. 21 |
| Finantsinspektsioon (Financial Supervision and Resolution Authority) | Credit and financial institutions under its financial supervision, in every activity listed in ss. 2 and 6, including crypto asset service providers it authorizes under MiCA; decides AML misdemeanor cases out of court | ss. 64(2), 97(1); Estonia's MiCA implementing act |
| Board of the Estonian Bar Association | Advocates | s. 64(3) |
| Ministry of Justice and Digital Affairs | Notaries; may delegate to the Chamber of Notaries | s. 64(4) |
| Ministry of Finance | The FIU works in its area of government; it organizes the AML/CFT Committee and published the 2025 national risk assessment | ss. 12(5), 53(1) |
| AML/CFT Committee | Government committee: national risk assessment, action plan, policy proposals | s. 12(1), (2) |
The FIU acts autonomously within the Ministry of Finance's area of government (s. 53(1)). The Government appoints its head for five years on the Minister of Finance's proposal (s. 53(2)); Matis Mäeker began a second term on 14 June 2026.
The AML/CFT Committee, the government committee the Ministry of Finance runs, brings the responsible minister and secretaries general together with the FIU, Finantsinspektsioon and Eesti Pank, the Central Bank of Estonia (s. 12(2), (5)).
Who falls under the Estonian AML Act, and who needs an FIU authorization?
Section 2 of the MLTFPA names the obliged entities, and s. 70 decides which of them also need an FIU authorization before they start: financial institutions, trust and company service providers, pawnbrokers, and precious metal and stone buyers (s. 70(1)). The duty falls away for a firm that holds or must seek a Finantsinspektsioon authorization, works under another EEA supervisor's authorization notified to Finantsinspektsioon, or serves only its own group (s. 70(2)).
| Group | Who is covered | Basis (in force, November 2026) |
|---|---|---|
| Money movers | Banks; currency exchanges; payment and electronic money institutions, except payment initiation and account information providers; crypto asset service providers, except those giving advice only; life insurers and brokers; fund managers; investment firms; creditors and credit intermediaries; crowdfunding providers; savings and loan associations | ss. 2(1)(1), (2), 6 |
| Gambling | Gambling operators, except organizers of commercial lotteries | s. 2(1)(3) |
| Property and valuables | Real estate intermediaries; rental intermediaries at €10,000 a month or more; traders paid or paying €10,000 or more in cash; art dealers at €10,000 or more; pawnbrokers; precious metal and stone buyers | s. 2(1)(4) to (6), (14), (15) |
| Gatekeepers | Auditors; accounting and tax advisers; trust and company service providers; notaries, attorneys, enforcement agents, bankruptcy and interim trustees and other legal service providers acting for a client in a financial or real estate deal or helping plan one, such as a company formation | s. 2(1)(7) to (9); s. 2(2) |
| Non profits | Non profit associations and foundations paid or paying over €5,000 in cash, or dealing with a party connected to a country under sanctions or embargoes | s. 2(3) |
| Others | The central securities depository when it opens accounts without an account operator; cross border cash and securities carriers | s. 2(1)(12), (13) |
Which authorization must an Estonian crypto firm hold since 1 July 2026?
An FIU license no longer covers crypto services. Virtual currency providers left the list of obliged entities on 1 July 2026 (s. 2(1)(10) repealed), and a crypto asset service provider under MiCA is now a financial institution under the Act (s. 6(2)(3¹)). Before onboarding an Estonian crypto counterparty, check four things:
- Authorization. A MiCA authorization from Finantsinspektsioon or another EEA supervisor; an old FIU license number (FVT) proves nothing.
- Pending files. A former FIU licensee that applied to Finantsinspektsioon before 1 July 2026 and still awaits a decision is not treated as operating without authorization under Penal Code s. 372 while it waits, yet it may sign no new client contracts (MiCA implementing act s. 48(5)).
- Transfer data. Travel rule information on every crypto asset transfer (Regulation (EU) 2023/1113).
- Wallet risk. Its assessed risk of transfers with wallets no provider hosts (MLTFPA s. 13(1¹)), which always call for enhanced due diligence (s. 36(2)(6)).
What are the AML compliance obligations in Estonia?
Fourteen duties form the core of an Estonian AML program, each set by its own subsection of the MLTFPA. Most scale with risk. The entity sets the scope of customer due diligence (CDD) from its own risk assessment (s. 20(6)) and adds enhanced due diligence (EDD) where risk is higher (s. 36(1)). The last column names the matching control in complead, formerly Sanction Scanner, or marks the duty as the entity's own.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| Risk assessment and risk appetite | ss. 10, 13(1) to (5) | Document customer, country, product and channel risk in proportion to the entity's size and complexity; set lower and higher risk fields, the risk appetite (in writing, by senior management) and the risk model; update where necessary and based on the published national risk assessment. A supervisor may waive the written assessment for some entities outside Finantsinspektsioon's supervision. | Each rule can be limited to a product, segment or jurisdiction; every change gets a version that logs who made it, when and why, with a one click rollback. |
| Rules of procedure, internal control, training | s. 14(1), (2), (6), (7) | Written rules that mitigate the assessed risks, controls that check them, and training for staff who open relationships or make transactions. Entities other than credit and financial institutions may ask for a partial or full release. | Outside the platform: the entity's own policy and training. |
| Board member in charge and compliance officer | s. 17(1), (2), (4), (5) | Where the board has more than one member, one answers for the Act; credit, financial and s. 70 entities appoint a compliance officer who reports to the board and works permanently in Estonia; the FIU and the supervisor are told, and the FIU coordinates the appointment. | Every alert decision records who made it. |
| When CDD applies | s. 19(1), (5), (6) | At onboarding; for occasional transactions of €15,000 or more, single or related within a year; on doubts about earlier data; on any suspicion, whatever the exemptions; before the relationship or transaction starts. | Customer risk assessment and KYC keeps one risk score per customer. |
| CDD measures | s. 20(1) | Identify and verify the customer and any representative; identify the beneficial owner and understand the ownership and control structure; understand the relationship; learn whether the person is a PEP, a family member or a close associate; monitor. | In a KYB check, every party is screened against sanctions, PEP, watchlists and adverse media. |
| Beneficial owner | ss. 9(1), (2), (4); 20(2⁴), (2⁵); 77(5) | Control first; else over 25 percent held directly or indirectly; else the senior managing official. Report differences from the register to the Registrar within a reasonable time (an auditor is exempt when the client fixes the difference before the opinion is signed). Companies, non profit associations and foundations file changes within 30 days of learning of them. | KYB and UBO verification climbs the ownership chain until it reaches natural persons; a layer it cannot resolve stays on the record as unresolved. |
| Politically exposed persons (PEPs) | s. 41(1), (3) | Senior management approval, the origin of wealth and the source of funds, enhanced monitoring; family members and close associates included; risk based measures for at least 12 months after the function ends, longer while the risk remains. | A PEP hit feeds the customer's one risk score; a person reviews it, and the record names that person. |
| EDD and high risk third countries | ss. 3(18), 36(1), (2), 37, 39 | Enhanced measures wherever risk is higher than usual, and always in the cases s. 36(2) lists, among them doubtful data or documents, PEPs, links to a high risk third country on the EU Commission's delegated act list, and crypto transfers with wallets no provider hosts. | The connections graph follows links out from the customer, six hops deep by default, to any sanctioned, PEP or adverse media entity and stores each sourced hop as case evidence. |
| Ongoing monitoring | s. 23(2), (3) | Check transactions against the customer's profile; update data; identify the source of funds; look closer at complex, high value and unusual transactions and at high risk country links. | API triggers start or stop ongoing monitoring name by name, so names no longer relevant leave the rescreening run. |
| Refuse or end the relationship | ss. 42(1), (4), (6), (7); 43 | No relationship or transaction when due diligence cannot be applied or laundering or terrorist financing is suspected. In an existing relationship, a customer's refusal to provide data is a fundamental breach: the entity ends the contract and reports to the FIU. The bans lift on a specific FIU instruction to continue (s. 42(6)) and do not bind an auditor that has reported the circumstances to the FIU (s. 42(7)). | Outside the platform: the decision is the entity's. |
| Suspicious transaction report | ss. 49(1), (2), (5), (6); 50; 51 | Report to the FIU without delay and within two working days, also for refused customers; postpone the transaction until the report unless that causes considerable harm, the transaction cannot be omitted or a delay would hinder catching the offender; do not tell the customer (exceptions for supervisors and law enforcement, group members, professionals in the same structure and parties to the same transaction, s. 51(2), (3)). No report is owed by notaries, enforcement agents, bankruptcy trustees, auditors, attorneys, other legal service providers, accounting service providers or accounting and tax advisers while they assess the client's legal situation or defend or represent it in court or other proceedings, advice on starting or avoiding proceedings included. | Reporting support within case management; the alert itself shows the firing rule and the matched signals. |
| Cash report | s. 49(3) | Obliged entities other than credit institutions report cash over €32,000, single or related within a year, within two working days; credit institutions report cash foreign exchange over €32,000 with persons they have no business relationship with. | A €32,000 threshold rule is written without code and tested first against 30, 60 or 90 days of real history. |
| Financial sanctions | International Sanctions Act ss. 19(1) to (3), 21(1) to (4) | Persons with special obligations check customers whenever a sanction takes effect, changes or ends, update their lists at once, apply the sanction and notify the FIU immediately; on doubt they apply the sanction, gather more information and report when the doubt cannot be resolved; a risk or suspicion of a breach also calls for those checks and a report. | Screening includes the EU and UN lists, both binding in Estonia, and payment screening checks the sender and the receiver of each transfer; fuzzy matching thresholds are set per list type and per list. |
| Records | s. 47(1), (3), (7) | Identity and relationship records at least five years after the relationship ends; transaction and report records at least five years after the transaction or report; up to five more years on a supervisor's compliance notice; then delete, unless another law sets a different procedure. | The search audit trail keeps each check on file with the searcher, the search terms, the time and the result, empty results included. |
What due diligence applies to Estonian companies and their owners (KYC in Estonia)?
Picture an Estonian private limited company (illustrative) whose register entry names one foreign shareholder while its own papers show a holding company in between. The beneficial owner test runs in order: control (s. 9(1)), then over 25 percent held directly or indirectly (s. 9(2)), then, once every other means is exhausted, the senior managing official (s. 9(4)). The register difference goes to the Registrar within a reasonable time, unless it is a suspicion for the FIU (s. 20(2⁴)).
Two rules concern e-Residency. At a credit or financial institution or a notary, a customer identified remotely with an e-Residency holder's digital identity document needs a second identity document at the same time (s. 31(4)), and if that card is refused, suspended or declared invalid the entity may end the relationship without notice (s. 43(2)(1)). MONEYVAL's 2022 evaluation rated beneficial ownership transparency Moderate (IO.5), naming the large share of companies with e-Residency holders as basic or beneficial owners and poorly designed due diligence at company service providers.
Which euro thresholds trigger due diligence or a report in Estonia?
Most lines count related payments over one year, gambling over one month (s. 19(3)), and the duty starts once the total crosses the line (s. 19(6)). Picture a car dealer (illustrative) paid €6,000 in cash in March and €5,000 in May by the same buyer: due diligence applies at the May payment.
| Line | Amount | Basis (in force, November 2026) |
|---|---|---|
| Occasional transaction CDD | €15,000 or more, single or related within a year | s. 19(1)(2) |
| Traders' cash | €10,000 or more, single or related within a year | ss. 2(1)(5), 19(2) |
| Art dealers | €10,000 or more, single or related within a year | ss. 2(1)(15), 19(2³) |
| Rental intermediaries | Usage fee of €10,000 a month or more | ss. 2(1)(4¹), 19(2²) |
| Non profit associations and foundations | Cash over €5,000, single or related within a year | ss. 2(3), 19(2¹) |
| Gambling | €2,000 or more per bet or win, related payments within one month | s. 19(3) |
| Cash report to the FIU | Over €32,000, single or related within a year | s. 49(3) |
| Beneficial owner | Over 25% direct or indirect shareholding, where control does not identify the owner | s. 9(2) |
| Bearer shares | No relationship where bearer securities exceed 10% of capital | s. 42(2) |
| EU lines from 10 July 2027 | Occasional CDD at €10,000, or a lower value set under art. 19(9); €1,000 for transfers of funds by credit and financial institutions and for crypto asset service providers; identity checks on occasional cash transactions from €3,000; cash payments for goods and services capped at €10,000 unless a lower national limit applies, with payments between private persons and payments or deposits at the premises of banks and payment firms excepted | AMLR arts. 19(1)(b), (2) to (4), 80(1), (3), (4), 90 (football agents and clubs from 10 July 2029) |
When is a suspicious transaction report due in Estonia, and must the payment wait?
Without delay, and no later than two working days after the facts are identified or the suspicion forms, even for a customer turned away (s. 49(1), (2)). Picture a payment institution (illustrative) whose analyst concludes on Thursday 5 November 2026 that a merchant's payouts look like laundering. The report is due at once, and on Monday 9 November at the latest. The payout waits until the report is filed, unless postponing would cause considerable harm, the transaction cannot be omitted or a delay would hamper catching the launderer; then the payout goes ahead and the report follows (s. 49(6)).
The report, Estonia's form of a suspicious activity report (SAR), goes through the FIU's online form or the state data exchange layer (s. 50(2)), and the customer is not told (s. 51(1)). The FIU can then suspend the transaction or restrict the account for up to 30 calendar days, plus 60 more if the owner cannot prove the property's legal origin within 30 days or terrorist financing is suspected (s. 57(1), (3)).
What does an AML compliance officer in Estonia do?
Credit and financial institutions, and entities that need an FIU authorization, must appoint one (s. 17(2)); others may, and without one the board carries the duties (s. 17(3), (9)). The AML compliance officer reports directly to the board, organizes the analysis of unusual and suspicious transactions, files reports to the FIU and gives the board periodic written statements on compliance (s. 17(2), (7)). The officer must work permanently in Estonia and have the education, suitability and impeccable reputation the role needs; the FIU coordinates the appointment (s. 17(5)).
What are the penalties for noncompliance in Estonia?
Most misdemeanor sections of the MLTFPA carry two scales, a higher one for entities under Finantsinspektsioon's financial supervision and a lower one for the rest. Picture an electronic money institution (illustrative) under that supervision, with €40 million of consolidated turnover, that failed to monitor its business relationships. Section 89(4) allows a fine of up to €5,000,000, or up to twice the benefit derived or the harm prevented, or up to 10 percent of its own or its group's consolidated turnover, here €4,000,000. The Act joins the three ceilings with "or" and does not say which prevails. Outside Finantsinspektsioon's supervision, the same breach costs up to €1,000,000 or twice the benefit derived or the harm prevented (s. 89(3)).
| Breach | Ceiling | Basis (in force, November 2026) |
|---|---|---|
| Risk assessment and internal rules; identification; beneficial owner; information on the relationship; PEPs; prohibited relationships; monitoring; outsourcing; suspicion and cash reports; tipping off; records | Up to €1,000,000 or up to twice the benefit derived or the harm prevented. Where the entity was under Finantsinspektsioon's financial supervision: up to €5,000,000 or twice the benefit or harm, or, for a legal person, up to 10% of its own or its group's consolidated turnover | MLTFPA ss. 82, 84 to 90, 92 to 94 (scale in force since 1 November 2023) |
| Correspondent relationship in breach of the Act; anonymous account, passbook, safe deposit box or crypto asset account | Up to €5,000,000 or twice the benefit or harm, or, for a legal person, up to 10% of consolidated turnover | ss. 83, 91 |
| Payer and payee data on fund transfers; originator data on crypto asset transfers (Regulation (EU) 2023/1113) | Up to €5,000,000 or twice the benefit or harm, or, for a legal person, up to 10% of consolidated turnover | ss. 96, 96² |
| Beneficial owner data not filed, not updated or knowingly false, where it blocks due diligence | Shareholder, member or trustee up to 300 fine units; legal person up to €400,000 | s. 95 |
| Limitation period | Three years for ss. 82 to 94 and 96 to 96² | s. 97(2) |
| Sanctions notification to the FIU missed, or false information given | Natural person up to 300 fine units or detention; legal person up to €400,000 | International Sanctions Act s. 35 |
| Money laundering | Pecuniary punishment or up to 5 years; by a group, at least twice, on a large scale or by an obliged person in its economic or professional activities: 2 to 10 years; legal person: pecuniary punishment; a court may order confiscation and extended confiscation | Penal Code s. 394 |
| Money laundering agreement | Pecuniary punishment or up to 2 years; legal person: pecuniary punishment | Penal Code s. 394¹ (since 30 December 2019) |
| Pecuniary punishment of a legal person | €4,000 to €40,000,000, unless the Special Part sets a turnover based fine | Penal Code s. 44(8), (9) (range since 1 November 2023) |
| MiCA breaches (arts. 59, 60, 64 to 83) | Up to €700,000 or twice the profit made or loss avoided; legal person up to €5,000,000, twice that amount, or 5% of its own or its group's turnover | Estonia's MiCA implementing act s. 37 (English translation, version of 1 July 2024) |
What enforcement have the FIU and Finantsinspektsioon taken since 2023?
BB Trade Estonia OÜ, trading as Zondacrypto, shows how the FIU closes a crypto file. On 18 May 2026 it partly suspended the firm's license: no new clients and no new funds, withdrawals allowed, 30 days to meet the license conditions. The firm did not respond, and on 29 June 2026 the FIU revoked license FVT000209 under s. 75(1)(4). Two other files turned on correspondent relationships: LHV Pank's in 2023 and the B2BX exchange's in 2025.
| Date | Body | Entity | Outcome (regulator releases, read 5 November 2026) |
|---|---|---|---|
| 19 October 2023 | Finantsinspektsioon | AS LHV Pank | €900,000 fine and a precept: risk assessment and management of correspondent banking services, monitoring of business relationships, data storage |
| 13 September 2024 (in force 1 October 2024) | Harju County Court | AS LHV Pank | Annulled an FIU fine of €300,000: the FIU had not shown that a specific board member breached the measure in the bank's interest |
| 31 January 2025 | FIU | B2BX Digital Exchange OÜ | Gave up license FVT000176 during supervision that would have led to revocation: correspondent due diligence, source of funds, real time screening and monitoring gaps, late STRs; revenue over €1 billion |
| 18 May and 29 June 2026 | FIU | BB Trade Estonia OÜ (Zondacrypto) | License FVT000209 partly suspended, then revoked under s. 75(1)(4) after the precept went unanswered |
| 16 September 2026 | Finantsinspektsioon | Wallester AS | Precept: governance and control functions, holding client assets, AML/CFT work and its staffing; fix by 31 December 2026 |
What did MONEYVAL and the national risk assessment find on Estonia?
MONEYVAL's latest word on Estonia is its second enhanced follow up, published on 22 January 2026, which raised Recommendations 7 (proliferation sanctions) and 15 (new technologies) to Largely compliant and expects Estonia to report back in one year.
| Report | Adopted (published) | Result (MONEYVAL releases, read 5 November 2026) |
|---|---|---|
| Mutual evaluation report | 64th plenary, December 2022 (25 January 2023) | Effectiveness Substantial on international cooperation, financial intelligence and proliferation sanctions (IO.2, IO.6, IO.11), Moderate on the other eight outcomes; enhanced follow up |
| 1st enhanced follow up | 68th plenary, December 2024 (13 January 2025) | R.6 raised to Largely compliant; 7 Compliant, 19 Largely compliant, 14 Partially compliant |
| 2nd enhanced follow up | 70th plenary, 16 to 18 December 2025 (22 January 2026) | R.7 and R.15 raised to Largely compliant; 7 Compliant, 21 Largely compliant, 12 Partially compliant, none noncompliant; still Partially compliant: R.1, 8, 13, 19, 20, 21, 23, 24, 25, 28, 33 and 35 |
The Ministry of Finance's national risk assessment 2025, built on data from 2020 to 2024, rates laundering risk medium and terrorist financing risk low. Banks, payment and electronic money institutions, virtual asset providers, gambling operators and company service providers rank above average. Most laundering cases it analyzed moved criminal proceeds obtained abroad through the Estonian financial system, a threat from outside. The FIU's Yearbook 2025 counts 14,323 reports in 2025, 10,443 of them suspicious or unusual transaction reports, and 18 supervisory proceedings.
AML solutions for Estonia: how do screening and monitoring apply?
In 2024 Finantsinspektsioon tested 38 sanctions filtering systems at 12 banks, two payment institutions and one investment firm. Results were generally good, but one supplier's system may produce different results in different institutions, and filtering worked better when sanctions experts set it up for the firm's business model.
For an Estonian obliged entity, complead's client screening and ongoing monitoring compares names with all 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, the EU and UN lists among them, with fuzzy matching thresholds set per list type and per list. It also covers Estonia's national sanctions list, the persons listed by Government order under the International Sanctions Act. Sanction Scanner, the screening product, is part of complead.
In transaction monitoring, the s. 23(2) checks run as rules written without code and tested against 30, 60 or 90 days of history before release. Routine alerts go to agents, which close them and leave the evidence, a written narrative and a work log in the case. The compliance officer decides everything else and files with the FIU, and the record names who decided. On complead for crypto, regulatory reporting covers MiCA conduct and FIU filings, both duties of an Estonian crypto asset service provider.
What moved in 2026, and what does the AMLR change in July 2027?
- 22 January 2026. MONEYVAL's second follow up raises Recommendations 7 and 15.
- 1 March 2026. An MLTFPA amendment on savings and loan associations takes effect.
- 1 July 2026. FIU crypto licenses end.
- 21 July 2026. The current MLTFPA version takes effect (amending act of 17 June 2026).
- 14 October 2026. The FIU's financial sanctions guidelines appear in English (Estonian text: 3 June 2025).
From 10 July 2027 the AMLR applies (art. 90), with most of AMLD6: occasional due diligence from €10,000 (€1,000 for fund transfers and crypto asset services), and cash payments for goods and services capped at €10,000 or a lower national limit.
AMLA begins direct supervision of selected obliged entities from 2028.
For each Estonian crypto or payment counterparty already on file, decide which record proves its authorization. An FVT number from the old FIU register no longer does; a MiCA or payment authorization from Finantsinspektsioon or another EEA supervisor does.
What the 2026 PDF adds. Everything a reader needs is on this page. The PDF, sent through the form beside the guide, adds four working templates: an STR clock log (alert, suspicion date, postponement decision, filing date), a cash report tracker for the €32,000 line, a beneficial owner worksheet with the 25 percent test and the note to the Registrar, and a crypto counterparty check.
