Crypto ATM / kiosk operator in Estonia
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Estonia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/EDD required under the Money Laundering and Terrorist Financing Prevention Act (MLTFPA) for all customers, with enhanced KYC for cash-intensive operations (cash-in/cash-out at kiosks).
- Cash transaction reporting thresholds apply under the MLTFPA framework; suspicious transaction reporting to the FIU is mandatory.
- Ongoing transaction monitoring and sanctions screening against UN and EU sanctions lists, tailored to risk profiles.
- Appointment of an AML officer with financial sector experience and at least one management board member who is an Estonian resident.
- Annual financial reports, independent audits, and internal control submissions to the regulator.
- Customer due diligence (CDD) records and data retention obligations under the MLTFPA/MiCA framework.
Key Restrictions
- Must incorporate as an Estonian legal entity with a physical headquarters/office in Estonia.
- At least one management board member must be an Estonian resident.
- Must maintain an Estonian bank account and demonstrate 'genuine local substance' for inspections.
- Authorized capital of €250,000 (required for transfer/custody services, which covers the cash-for-crypto flow in ATM operations, vs. €100,000 for pure exchange).
- Must hold a CASP license from the Financial Supervision Authority (FSA/Finantsinspektsioon) as of January 1, 2025 — legacy FIU licenses valid only until July 1, 2026.
- State fee of €10,000 for application.
- Transition to MiCA-compliant licensing required by July 1, 2026; full compliance with MiCA (Regulation 2023/1114) and the Crypto Asset Market Act.
Key Risks
- High enforcement risk — Estonia withdrew many VASP licenses in 2020 and takes a conservative stance on VASPs, especially cash-heavy models like crypto ATMs.
- Regulatory ambiguity during the transition period (legacy FIU license to FSA MiCA license by July 1, 2026) creates licensing risk.
- Cash-intensive kiosk model attracts elevated AML scrutiny; failure to implement robust cash-transaction monitoring and EDD could lead to license revocation.
- Physical office and local residency requirements increase operational cost and complexity for foreign operators.
- Potential reputational exposure if Estonia tightens cash-crypto restrictions further under MiCA national discretion.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Authorized capital: €250,000 for transfer/custody services (vs. €100,000 for exchange).
Physical headquarters in Estonia, customer identification, annual audits, internal controls, data retention, and good business reputation.
Registration in the Estonian cryptocurrency license register, with ongoing supervision including financial reports and internal control submissions.
Money Laundering and Terrorist Financing Prevention Act (MLTFPA): https://www.riigiteataja.ee/en/eli/ee/Riigikogu/act/520062020002/consolide (via )
Crypto Asset Market Act (CMA): National implementation of MiCA (via )
EU MiCA Regulation (2023/1114): https://eur-lex.europa.eu/eli/reg/2023/1114/oj (via )
EFSRA/FIU licensing: https://www.fi.ee/en (via )
Firms must screen customers and transactions against UN and EU sanctions lists, tailoring controls to risk profiles.
Appoint an AML officer with financial sector experience and ensure at least one management board member is an Estonian resident.
VASPs provide services like virtual currency exchange or wallet services and must maintain internal controls, annual financial reports, and independent audits.
Financial Supervision Authority (FSA, or Finantsinspektsioon): Primary regulator for CASPs and issuers since January 1, 2025 (transferred from FIU); handles licensing, supervision, enforcement, and compliance with MiCA, DORA, financial requirements, consumer protection, and governance.
Financial Intelligence Unit (FIU): Supervised VASPs until end of 2024; prior issuer of licenses (many withdrawn in 2020, ~400 active as of then); legacy licenses valid until July 1, 2026, after which transition to FSA required.
Crypto Asset Market Act (July 1, 2024): Aligns Estonia with EU MiCA (Regulation 2023/1114) and DORA (Regulation (EU) 2022/2554); expands regulation to exchanges, wallets, trading platforms, custodians, and token issuers; mandates FSA licensing, local office, capital adequacy, client protection, and complaint handling.
CASP License: Mandatory for all providers of crypto-asset services, including exchanges, wallets, and transfers; covers virtual currency exchange and transfer services under the single license regime (previously separate).
Registration Regime: Providers must incorporate as an Estonian legal entity with a physical office, local board member/director (Estonian resident), and Estonian bank account; demonstrate "genuine local substance" for inspections. VAT registration with the Estonian Tax and Customs Board is also required post-incorporation.
Incorporate Local Entity: Submit memorandum/articles of association, share capital deposit certificate (€100,000+), and state fee to the Commercial Register.
Submit Application: File electronically via FSA portal (for issuers from March 18, 2026) or by board member; state fee €10,000.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators may operate in Estonia but must obtain a CASP license (FSA-supervised as of 2025, transitioning to full MiCA compliance by July 1, 2026), incorporate locally with a physical office and Estonian-resident board member, hold €250,000 authorized capital (transfer/custody tier), and implement full AML/KYC/EDD programs under the MLTFPA, with elevated scrutiny due to the cash-intensive model.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?