Crypto-funded debit card in Estonia
A card program where customer fiat balances are funded from crypto holdings, typically through an off-ramp at point of sale or top-up.
Crypto debit card is conditionally permitted in Estonia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer CDD and ongoing monitoring under MLTFPA (Money Laundering and Terrorist Financing Prevention Act)
- Screen customers and transactions against UN and EU sanctions lists with risk-profiled controls
- Appoint an AML officer with financial sector experience; at least one management board member must be an Estonian resident
- Submit annual financial reports and internal control submissions to FSA
- Firms must maintain AML/KYC/KYT policies, internal controls, and independent audit requirements
- Data retention obligations per MLTFPA and CASP regulatory framework
Key Restrictions
- Must incorporate as an Estonian legal entity with a physical office in Estonia
- Must have at least one management board member who is an Estonian resident
- Must hold both a CASP license (for crypto services) and likely an e-money/payment institution license or partnership (for issuing the card/fiat wallet)
- Crypto-to-fiat conversion at point of sale or top-up likely constitutes a virtual currency exchange service under the CASP license
- Must maintain an Estonian bank account and demonstrate 'genuine local substance' for inspections
- Legacy FIU licenses valid only until July 1, 2026; transition to full FSA CASP license required
- Separate issuer authorization may be required if asset-referenced tokens are involved
Key Risks
- Regulatory transition period (FIU→FSA, legacy→MiCA licenses) creates risk of incomplete compliance during migration
- EFSRA has a historically conservative stance on VASPs, increasing scrutiny risk
- Partner bank / BIN-sponsor arrangements required but no explicit local regulatory framework for crypto-funded debit card programs referenced
- Authorized capital requirements (€250,000 for transfer/custody) and additional e-money capital may create high upfront cost
- Need to coordinate two licensing regimes (CASP + e-money/payment) with potentially overlapping but distinct regulatory obligations
- Foreign key-person documentation must be notarized/apostilled, creating administrative burden
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Authorized capital: €250,000 for transfer/custody services (vs. €100,000 for exchange).
Physical headquarters in Estonia, customer identification, annual audits, internal controls, data retention, and good business reputation.
Registration in the Estonian cryptocurrency license register, with ongoing supervision including financial reports and internal control submissions.
Money Laundering and Terrorist Financing Prevention Act (MLTFPA): https://www.riigiteataja.ee/en/eli/ee/Riigikogu/act/520062020002/consolide (via )
Crypto Asset Market Act (CMA): National implementation of MiCA (via )
EU MiCA Regulation (2023/1114): https://eur-lex.europa.eu/eli/reg/2023/1114/oj (via )
EFSRA/FIU licensing: https://www.fi.ee/en (via )
Firms must screen customers and transactions against UN and EU sanctions lists, tailoring controls to risk profiles.
Appoint an AML officer with financial sector experience and ensure at least one management board member is an Estonian resident.
VASPs provide services like virtual currency exchange or wallet services and must maintain internal controls, annual financial reports, and independent audits.
CASP License: Mandatory for all providers of crypto-asset services, including exchanges, wallets, and transfers; covers virtual currency exchange and transfer services under the single license regime (previously separate).
Issuer Authorization: Separate license required for issuing asset-referenced tokens or other crypto-assets, submitted via the FSA's application portal in Estonian (English documents allowed if specified).
Registration Regime: Providers must incorporate as an Estonian legal entity with a physical office, local board member/director (Estonian resident), and Estonian bank account; demonstrate "genuine local substance" for inspections. VAT registration with the Estonian Tax and Customs Board is also required post-incorporation.
Incorporate Local Entity: Submit memorandum/articles of association, share capital deposit certificate (€100,000+), and state fee to the Commercial Register.
Prepare Documentation: Include AML/KYC/KYT policies, business model description, business plan, governance structure, internal controls, digital resilience plans, biographies/no-criminal-record certificates for key persons (notarized/apostilled for foreigners), and proof of office/local representative. All in Estonian (translations required).
Submit Application: File electronically via FSA portal (for issuers from March 18, 2026) or by board member; state fee €10,000.
Financial Supervision Authority (FSA, or Finantsinspektsioon): Primary regulator for CASPs and issuers since January 1, 2025 (transferred from FIU); handles licensing, supervision, enforcement, and compliance with MiCA, DORA, financial requirements, consumer protection, and governance.
Financial Intelligence Unit (FIU): Supervised VASPs until end of 2024; prior issuer of licenses (many withdrawn in 2020, ~400 active as of then); legacy licenses valid until July 1, 2026, after which transition to FSA required.
Estonian Financial Supervision and Resolution Authority (EFSRA): Oversees broader financial services market, including FinTech innovation, with a conservative stance on VASPs.
Crypto Asset Market Act (July 1, 2024): Aligns Estonia with EU MiCA (Regulation 2023/1114) and DORA (Regulation (EU) 2022/2554); expands regulation to exchanges, wallets, trading platforms, custodians, and token issuers; mandates FSA licensing, local office, capital adequacy, client protection, and complaint handling.
Markets in Crypto-Assets (MiCA) Regulation (effective EU-wide, implemented in Estonia 2025): Unified EU framework; imposes stricter AML, local presence, share capital, and internal controls; all Estonian crypto operations now comply.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a crypto-funded debit card program is feasible in Estonia but requires a CASP license (covering crypto exchange/wallet services) from the FSA under MiCA/CMA, a separate e-money or payment institution license (or a partnership with a licensed e-money institution) for the card/fiat component, local incorporation with physical office and Estonian-resident board member, €250,000 minimum capital for transfer/custody services, and full AML/CFT program under MLTFPA, with all legacy FIU licenses transitioning to full FSA oversight by July 1, 2026.
Questions this verdict aims to answer
- What e-money / payment-institution license is required?
- How is the crypto-to-fiat conversion regulated?
- What KYC and AML obligations apply to cardholders?
- What partner-bank or BIN-sponsor arrangements are required?