Custodial wallet / SaaS in Estonia
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Estonia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Must adopt mandatory AML/KYC policies for customer identification/verification, transaction monitoring, source-of-funds checks, and suspicious activity reporting to the FIU (ee.custody.amlkyc-mandatory-policies-for-customer)
- Must appoint a dedicated AML officer employed under contract with financial sector experience (ee.custody.other-appoint-dedicated-aml-officer)
- Must screen customers and transactions against UN and EU sanctions lists, tailoring controls to risk profiles (ee.licensing.firms-must-screen-customers-and)
- Customer due diligence obligations under the Money Laundering and Terrorist Financing Prevention Act (MLTFPA) — VASPs treated as financial institutions since March 2020 (ee.licensing.money-laundering-and-terrorist-financing)
- Ongoing compliance audits, annual financial audits, and MiCA reporting obligations (ee.custody.post-approval-annual-audits-aml-monitoring)
Key Restrictions
- Must incorporate as an Estonian legal entity (OÜ — LLC, or AS — public limited company) with a physical office in Estonia (ee.custody.incorporate-as-estonian-o-llc, ee.licensing.registration-regime-providers-must-incorporate)
- At least one management board member must be an Estonian/EEA resident (ee.custody.local-presence-at-least-one, ee.licensing.appoint-an-aml-officer-with)
- Must maintain an Estonian bank account (ee.custody.local-presence-at-least-one)
- Own funds must cover risks; minimum capital of €250,000 for custody/transfer services (vs. €100,000 for exchange) (ee.custody.capital-varies-by-service100000-minimum, ee.licensing.authorized-capital-250000-for-transfercustody)
- Post-2024: full CASP authorization from EFSA (Finantsinspektsioon) under MiCA required — prior FIU registration is transitional only until July 1, 2026 (ee.custody.post-2024-caspmica-era-full-authorizationlicensing, ee.licensing.financial-intelligence-unit-fiu-supervised)
- State fee of €10,000 for the CASP license application (ee.licensing.submit-application-file-electronically-via)
Key Risks
- Transition risk: legacy FIU registrations are only valid until July 1, 2026 — failure to obtain EFSA/MiCA authorization by then means loss of license (ee.licensing.financial-intelligence-unit-fiu-supervised)
- EFSA review duration post-MiCA is not specified — may be longer than the previous ~30-day FIU process, creating operational uncertainty (ee.custody.efsa-reviews-duration-not-specified)
- The SaaS operator (custodian) — not the white-label client — carries the primary regulatory burden as the licensed CASP; unclear allocation of AML responsibility between SaaS provider and white-label client under MiCA
- AML/KYC obligations for the SaaS provider vs. white-label client are not explicitly delineated in the available facts — potential for regulatory overlap or gaps
- Estonia withdrew many VASP licenses in 2020 — enforcement precedent exists for aggressive regulatory cleanup (ee.licensing.financial-intelligence-unit-fiu-supervised)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Pre-2025 (VASP era): Simple registration with the Financial Intelligence Unit (FIU), not full licensing; quick (30 days), low fees (€345–€3,300), minimal capital (€12,000).
Post-2024 (CASP/MiCA era): Full authorization/licensing by EFSA, with rigorous supervision, audits, and MiCA compliance; prior VASP registrations are transitional until 2026.
Capital: Varies by service—€100,000 minimum for exchange services; €250,000 for transfer/custody services (own funds must cover risks). (Note: Older sources cite €12,000, outdated post-MiCA.)
AML/KYC: Mandatory policies for customer identification/verification, transaction monitoring, source-of-funds checks, suspicious activity reporting to FIU; ongoing compliance audits.
Local Presence: At least one management board member (director) as permanent Estonian/EEA resident; local office/place of business in Estonia; Estonian bank account.
Other: Appoint dedicated AML officer (employed under contract, financial sector experience); good business reputation for owners/directors; auditor agreement; annual financial audits, MiCA reporting.
Incorporate as Estonian OÜ (LLC) or AS (public limited company).
Submit to EFSA (Finantsinspektsioon); prior FIU role ended.
Post-approval: Annual audits, AML monitoring, change notifications.
Primary Estonian Laws: Crypto Asset Market Act (CMA); Money Laundering and Terrorist Financing Prevention Act (MLTFPA).
EU Framework: MiCA Regulation (EU) 2023/1114.
Authorized capital: €250,000 for transfer/custody services (vs. €100,000 for exchange).
Registration Regime: Providers must incorporate as an Estonian legal entity with a physical office, local board member/director (Estonian resident), and Estonian bank account; demonstrate "genuine local substance" for inspections. VAT registration with the Estonian Tax and Customs Board is also required post-incorporation.
Firms must screen customers and transactions against UN and EU sanctions lists, tailoring controls to risk profiles.
Appoint an AML officer with financial sector experience and ensure at least one management board member is an Estonian resident.
Financial Supervision Authority (FSA, or Finantsinspektsioon): Primary regulator for CASPs and issuers since January 1, 2025 (transferred from FIU); handles licensing, supervision, enforcement, and compliance with MiCA, DORA, financial requirements, consumer protection, and governance.
Financial Intelligence Unit (FIU): Supervised VASPs until end of 2024; prior issuer of licenses (many withdrawn in 2020, ~400 active as of then); legacy licenses valid until July 1, 2026, after which transition to FSA required.
Crypto Asset Market Act (July 1, 2024): Aligns Estonia with EU MiCA (Regulation 2023/1114) and DORA (Regulation (EU) 2022/2554); expands regulation to exchanges, wallets, trading platforms, custodians, and token issuers; mandates FSA licensing, local office, capital adequacy, client protection, and complaint handling.
Money Laundering and Terrorist Financing Prevention Act (MLTFPA): https://www.riigiteataja.ee/en/eli/ee/Riigikogu/act/520062020002/consolide (via )
CASP License: Mandatory for all providers of crypto-asset services, including exchanges, wallets, and transfers; covers virtual currency exchange and transfer services under the single license regime (previously separate).
Submit Application: File electronically via FSA portal (for issuers from March 18, 2026) or by board member; state fee €10,000.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS providers must obtain a full CASP license from EFSA under MiCA (€250,000 capital, local Estonian entity with physical office and resident board member, comprehensive AML program), with transitional FIU registrations expiring July 1, 2026.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?