Digital asset regulation and tokenization in Finland

In Finland, a crypto-asset business needs to coordinate authorisation, custody, marketing and tax information. The Financial Supervisory Authority, FIN-FSA, oversees financial regulation, while Vero administers tax obligations with a separate scope. Compliance in one area does not settle the others.

This guide starts with asset rights and services offered, then connects MiCA with Finnish rules and practical matters such as separating client positions, explaining product risks and collecting tax-reporting data.

How MiCA applies after the virtual currency regime

MiCA distinguishes cryptoasset services, asset-referenced tokens, ARTs, and e-money tokens, EMTs, in Finland. Financial instruments are excluded. Act 402/2024 supplements the European framework and replaces the 2019 virtual currency provider legislation, preserving certain rules during transition. Repeal should not incorrectly be dated to the end of that transition.

Continuity for registered operators required an application by 30 October 2024. The national deadline was 30 June 2025. FIN-FSA expressly reminded firms that continuing afterwards required appropriate MiCA entitlement. Historical registration is no longer an alternative entry route and does not automatically cover additional CASP services.

What FIN-FSA and Vero each do

FIN-FSA, Finanssivalvonta, supervises MiCA and its national implementation. Section 2 of Act 402/2024 provides for cooperation with the Consumer Ombudsman and assigns resolution responsibilities to the Financial Stability Authority. Describing FIN-FSA as the sole authority for every business matter would therefore omit distinct responsibilities affecting the same platform.

The Tax Administration, Vero, applies a different perimeter. Its CARF and DAC8 instructions require in-scope providers to collect user and transaction data from 2026 for the first returns in 2027. Systems need to address tax residence, documentation and records; tax compliance does not establish permission to provide financial services.

What a provider application must demonstrate

A CASP application must reflect the services actually provided. FIN-FSA's anti-money laundering guidance requires an individual risk assessment, related controls, qualified officers and training resources. For Article 60 entities, submissions must reflect the changes that cryptoasset services introduce into existing organisational arrangements.

Section 5 of the national Act permits an appeal to the Helsinki Administrative Court after six months without a decision on a complete application. This is a remedy against delay, not approval by positive administrative silence. Launch planning must distinguish preparation, documentary completeness, decision and cross-border entitlement where relevant.

Why client asset identification and separation matter

In KKO 2020:64, the Supreme Court allowed attachment of bitcoin held in an account controlled by a debtor after assets belonging to the debtor and purchased for another person had been mixed. The judgment addresses those facts and asset identification and separation. It does not establish that every collective custody arrangement necessarily produces the same result.

For tokenized securities, the DLT Pilot Regime provides bounded permissions and exemptions for eligible infrastructures. It does not itself turn a token into ownership of an underlying asset. Structuring requires the right, obligor, relevant register and transfer formalities to be identified, with reconciliation between technical positions and enforceable legal rights.

What compliant marketing requires

The supervisory review published in June 2026 identified unbalanced marketing, information that was difficult to find, and pricing and contractual deficiencies. FIN-FSA expressly challenged associating supervision with investment safety. Communications, including social media, must explain risks and service scope without presenting authorisation as endorsement of returns or assets.

DORA adds resilience obligations for entities within scope, covering technology risk, incidents and external providers. Custody and automated execution architectures require documented responsibilities, continuity and recovery mechanisms. Automating a function does not replace the responsible entity's ability to control and oversee it.

How to prepare services, custody and disclosures

Preparation should bring together the service catalogue, anti-money laundering risk assessment and custody contracts. For each client asset, explain identification, separation and return. The practical relevance of KKO 2020:64 remains confined to its facts and does not replace assessment of the project’s custody arrangements.

Before launching a website or onboarding clients, review pricing, terms, marketing and tax-data collection. CARF and DAC8 duties should follow Vero’s provider-specific scope, separately from FIN-FSA authorisation. Permission, marketing and the interface should describe the same service and risks.

To understand how this framework applies to your project, discuss your case with our team.