Crypto-asset regulation and tokenization in Estonia

In Estonia, the move from former virtual currency service permissions to MiCA changes project preparation. Finantsinspektsioon supervises financial authorization, while the Financial Intelligence Unit retains anti-money laundering functions. A business must distinguish those responsibilities.

Alongside selecting services, the project needs to explain its organization, asset protection and client-facing staff competence. This guide connects those requirements to Estonian procedures, restrictions on pending applicants and the separate treatment of tokenized securities.

What changes from former permissions to MiCA

Estonia applies MiCA alongside the Market in Crypto-Assets Act, a national act governing the activities, liability, supervision and termination of market participants. Its entry into force in July 2024 must be distinguished from application of the different European titles. Classification separates crypto-asset services, ART or EMT issuance and transactions in financial instruments excluded from MiCA. Estonia used the full eighteen-month maximum transitional period allowed by the European regulation, unlike other Member States that shortened it.

The joint June 2026 communication by Finantsinspektsioon and the FIU confirms the end of the transitional period for the former regime. Since July 1, a historical virtual currency service license is insufficient to continue business and, as announced by Finantsinspektsioon, the Financial Intelligence Unit canceled the register data for those licenses on that date. Citing a former license number no longer evidences authorization. A provider's MiCA authorization and its scope must be checked, including cross-border services by entities from other European Economic Area states.

What Finantsinspektsioon and the intelligence unit do

Finantsinspektsioon is the national authority for authorization and supervision under the MiCA framework. The FIU retains financial intelligence functions and receives suspicious transaction reports. Their involvement must not be confused with a requirement for two equivalent CASP licenses or with the former FIU permission remaining available as a commercial alternative.

The market access documentation distinguishes CASP authorization from issuer procedures. EMT issuance requires credit institution or electronic money institution status and compliance with the corresponding MiCA obligations. ART projects must assess issuer authorization or the applicable route and the white paper. Service permission does not replace issuance entitlement.

How to apply and handle a pending application

Finantsinspektsioon states that CASP and ART applications must use its portal from March 18, 2026. Applications are submitted in Estonian; accompanying English documents must be expressly identified. Preparation includes the program of operations, governance, shareholders and management, controls, asset protection and procedures appropriate to each requested service.

Statutory periods distinguish completeness checks from subsequent assessment. Information requests and permitted suspensions mean they cannot be treated as guaranteed commercial timeframes. Financial entities meeting Article 60 MiCA conditions have a specific notification route, limited to the services and equivalences provided by the regulation.

Section 48(5) of the national act addresses applications submitted before July 1, 2026, that remain undecided. Those activities are not considered unauthorized for Section 372 of the Penal Code, but new client contracts are prohibited. This is not a granted MiCA authorization. The June supervisory communication requires activity restrictions, asset protection and client information while the application is assessed.

Which rules apply to tokenized securities

The Securities Market Act and European investment services framework are relevant where a token is a financial instrument. Issuance, offering, trading and custody must be analyzed according to their function. Commercial labels such as NFT, utility token or property token do not independently determine classification or exclude securities rules. Since December 10, 2022, the Securities Market Act has expressly allowed securities to be issued by means of distributed ledger technology. No additional civil-law advantage should be inferred from this: the registration and transfer rules applicable to the tokenized security must be checked for each structure.

The DLT Pilot Regime provides permissions for infrastructures trading or settling certain financial instruments. It is not a general tokenization authorization and does not automatically change ownership of underlying assets. Documentation must identify holders' rights, their debtor or issuer, transfer mechanisms and enforcement conditions, including insolvency of participating entities.

Which skills and controls operations require

The knowledge and competence guidelines, applicable from July 28, 2026, according to Finantsinspektsioon, distinguish staff providing information from staff giving advice. The authority identifies at least annual assessment and continuing training. These expectations complement governance, conduct and client protection duties; a simple digital interface does not reduce the service provider's responsibilities.

The Finantsinspektsioon test environment supports trials with agreed objectives and conditions. Where a solution involves a financial service requiring a license, the published conditions limit testing to technical aspects and exclude providing that service to clients during the trial. Completion does not guarantee authorization or certify compliance. Operational resilience, anti-money laundering and transfer controls require their own assessment, as does the tax obligation to identify clients’ residence and report their transactions under the EU administrative cooperation directive for crypto-assets (DAC8). Estonia implemented it through an act of March 25, 2026, in force since April 25, 2026: information for 2026 is reported for the first time by June 30, 2027.

How to prepare the Estonian application

Prepare the program of operations, ownership information, responsible personnel and service-specific policies. Finantsinspektsioon’s portal and language instructions govern submission. Check the supervisor’s register first: according to Finantsinspektsioon, by June 30, 2026, it had granted a single CASP authorization, compared with 641 valid virtual currency licenses in mid-2021, and the ESMA register of October 2026 lists three Estonian entities, two of them financial entities already authorized. Where an English statutory translation is used, check the provisions supporting the application against the Estonian text.

Launch preparation must show how assets are protected and returned, staff are trained and functions are outsourced. Former-regime operators need to check current restrictions without treating a pending application as authorization. Technical testing can resolve system questions but does not replace permission to serve clients. The ongoing European review should also be monitored: on December 4, 2025, the Commission put forward a proposal for a regulation, COM(2025) 943, that would transfer to ESMA the authorization and supervision of crypto-asset service providers, except credit institutions and Article 60 entities. It remains a proposal under negotiation and is not law in force.

To understand how this framework applies to your project, discuss your case with our team.