Our Expert in Estonia
Add crypto to EMI licence Estonia is one of the most pressing licensing questions facing fintech boards in 2026, as MiCA rules bed in, the EU debates reform of the payments framework, and the Estonian supervisor tightens its expectations on crypto-exposed operators. Licensed electronic money institutions (EMIs) and payment institutions (PIs) increasingly want to offer fiat-crypto rails, custody and exchange features to retain customers and open new revenue lines. The core decision is deceptively simple to state and genuinely difficult to answer: can you extend your current authorisation, or must you apply for a separate crypto-asset service provider authorisation?
This guide takes a clear position on when each route is correct, walks through the Estonian supervisory process step by step, and gives legal and compliance teams a decision framework they can act on.
Who this is for: CEOs, general counsel, CFOs and compliance leads at licensed EMIs and payment institutions, plus fintech founders weighing product expansion into crypto.
What it answers: whether you can add crypto services under your existing EMI/PI licence in Estonia, the application requirements, how capital and AML obligations change, realistic timelines, and a decision framework for choosing between amendment and a new authorisation.
The short answer: sometimes you can amend, often you cannot. Where your crypto offering is narrowly payment-related, fiat-to-crypto on and off ramps tied to payment flows, with no safekeeping of crypto-assets, an amendment to your EMI or payment institution licence may be sufficient. Where you intend to custody crypto-assets, run an exchange, match orders, or issue tokens, Estonian and EU law treats those as distinct regulated activities that generally require a separate authorisation. The decision to add crypto to EMI licence Estonia therefore turns on precise activity classification, not marketing labels. Get the classification wrong and you risk enforcement, bank de-risking, and a forced wind-down of a live product.
A central feature of the current landscape is that MiCA has replaced Estonia’s former national virtual asset service provider (VASP) registration regime. Under MiCA, crypto-asset service providers (CASPs) are authorised and supervised in Estonia by Finantsinspektsioon rather than registered with the Financial Intelligence Unit. Firms that held the older VASP registrations have had to transition to MiCA authorisation within the applicable transitional arrangements. Industry observers expect Finantsinspektsioon to scrutinise crypto-adjacent amendments closely through 2026 as MiCA authorisation becomes the expected home for genuine crypto-asset services. The likely practical effect is a narrowing of what can be achieved by amendment alone. That makes early, honest scope mapping the single most valuable task your team can undertake before filing anything.
Estonian licensing law authorises an EMI or payment institution to carry out specified payment and e-money activities listed in its authorisation. Finantsinspektsioon (the Estonian Financial Supervision and Resolution Authority) grants, varies and supervises these authorisations, and any change to permitted activities requires its approval. The central legal question when you add crypto to EMI licence Estonia is whether the proposed service falls inside your existing activity descriptors or constitutes a new, separately regulated activity, most commonly a crypto-asset service under MiCA.
An amendment is the realistic route where the crypto element is incidental to a payment service you are already authorised to provide. Typical examples include:
In these models the crypto risk is contained, your prudential profile changes modestly, and the supervisor may be able to approve a scope variation without requiring a full new authorisation.
A separate authorisation is required, these are the hard red lines, where you intend to:
These activities map to crypto-asset services under Regulation (EU) 2023/1114 (MiCA). They trigger MiCA authorisation by Finantsinspektsioon, MiCA-level custody and governance obligations, and prudential requirements calibrated to crypto risk. Attempting to shoehorn them into an EMI amendment is a common reason projects stall or are refused.
Classification also governs how you can offer services across the EU. Payment and e-money passporting rights attach to your EMI/PI authorisation, but they do not automatically carry crypto-asset services with them. MiCA introduces EU-level harmonisation and its own notification mechanism for providing crypto-asset services across member states, which means a genuine crypto offering intended for multiple member states is usually better housed under a MiCA authorisation than bolted onto a payment licence. If cross-border scale is part of your thesis, this interplay should shape the decision before you file.
Mapping your intended product to the correct regulatory category is the practical heart of the exercise. Each model carries a different compliance load, and the same marketing feature can sit on either side of the amendment-versus-new-authorisation line depending on how it is built.
If you hold crypto-assets or the keys that control them for clients, you are providing custody. Under MiCA, custodians face specific obligations: segregation of client crypto-assets, liability for loss of assets held in custody, a custody policy, and robust operational and cyber controls. The Estonian position aligns with this: custody is treated as a core crypto-asset service that an EMI cannot simply absorb into its payment authorisation. If custody is on your roadmap, plan for a separate authorisation.
Order matching, operating a platform, acting as a counterparty, or providing execution of orders all constitute exchange or trading services. These attract the fullest set of conduct, prudential and AML obligations and sit firmly outside the EMI amendment route. They also carry the highest supervisory scrutiny because of market-integrity and conflict-of-interest concerns.
On and off ramps are the grey zone where an amendment is most plausible. The determinative question is whether your institution ever controls crypto-assets or merely facilitates a payment that converts via a licensed counterparty. A pass-through ramp, with conversion handled by an external CASP, can often proceed by amendment. A ramp where you hold crypto balances cannot. Document the flow of funds and keys precisely, the supervisor will.
Hosted (custodial) wallets re-introduce custody and therefore the separate-authorisation analysis above. Non-custodial wallet software, where the user alone controls keys, has a lighter regulatory profile, but AML obligations and consumer-facing conduct expectations still apply depending on the surrounding services. Do not assume “non-custodial” removes you from scope entirely; both EU AML rules and FATF guidance look at the substance of the service, not the label.
Where an amendment is the right route, the path runs through Finantsinspektsioon. The authority publishes its licensing and supervisory expectations and processes applications through its official channels. Treat the amendment as a mini-authorisation: the supervisor will re-examine the areas affected by your new activity, not rubber-stamp a one-line change.
Expect to prepare and submit a dossier covering, at minimum:
Finantsinspektsioon assesses the suitability of management and key function holders. When you add crypto to EMI licence Estonia, demonstrate that someone credible owns crypto risk: relevant experience, clear accountability, and board-level oversight. Weak or generic governance evidence is a frequent cause of queries and delay.
The supervisor expects demonstrable operational readiness before approval, not promises to build later. For any activity touching crypto, that means documented segregation and reconciliation between fiat and crypto positions, key management controls, cyber-resilience testing, and clear vendor oversight. Firms in scope should also account for the EU Digital Operational Resilience Act (DORA) requirements on ICT risk management. Evidence of a real control environment, logs, test results, reconciliation reports, carries far more weight than policy documents alone.
A disciplined amendment typically moves through four stages:
A narrow, well-evidenced amendment can complete more quickly; anything approaching full crypto-asset services should be re-scoped as a separate MiCA authorisation, which generally takes longer.
Adding crypto activity changes both your prudential calculations and your AML regime. Underestimating either is a classic failure point when firms add crypto to EMI licence Estonia.
Your initial and ongoing capital requirements are tied to your permitted activities and risk profile. Introducing crypto-related services generally increases operational risk, and where you hold or transact crypto, market and liquidity risk as well. In practice this means:
Under MiCA, CASPs are subadject to minimum capital requirements that vary by the class of services provided, as set out in the Regulation. Full custody and exchange activities under a separate authorisation typically carry materially higher initial and ongoing capital than a contained payment-rail amendment, a key input to the cost side of your decision. Confirm the current applicable thresholds with the supervisor or counsel before relying on any figure.
Crypto-asset services are obliged entities under EU and Estonian anti-money-laundering law. Even where your change is payment-only, you will still need to update your AML program and may need to notify the supervisor. Enhancements commonly required include:
Note that AML supervision of crypto-asset service providers in Estonia is exercised by Finantsinspektsioon as part of MiCA authorisation and ongoing supervision, while reporting of suspicious activity continues to flow to the Financial Intelligence Unit.
Crypto activity raises the sanctions and tracing bar. The EU Transfer of Funds Regulation extends the “travel rule” to transfers of crypto-assets, requiring originator and beneficiary information to accompany qualifying transfers, and FATF guidance sets the global baseline for comparable obligations. Your program should integrate:
Supervisors increasingly expect these as table stakes, not optional extras, for any firm that adds crypto to EMI licence Estonia.
The amend-versus-new-authorisation decision no longer sits in a static legal frame. Two EU developments are actively shifting the calculus in 2026, and both point toward housing genuine crypto activity in a purpose-built authorisation rather than stretching a payment licence.
MiCA (Regulation (EU) 2023/1114) establishes an EU-wide regime for crypto-asset services and issuers, with its crypto-asset services provisions applying from 30 December 2024. For EMIs the most directly relevant obligations concern custody, segregation of client assets, liability for loss, and a formal custody policy, along with governance, prudential and marketing requirements. MiCA also contains specific provisions on e-money tokens, which are of direct interest to EMIs considering token issuance. The European Banking Authority and ESMA continue to publish technical standards and guidelines that flesh out supervisory expectations. The net effect is that custody and exchange belong under MiCA, which strengthens the case for a separate authorisation whenever those services are in scope.
The European Commission’s proposed payments package, comprising a new Payment Services Regulation and a third Payment Services Directive (PSD3), is progressing through the EU legislative process and will reshape the payments perimeter, with implications for payment initiation, account information services and liability allocation. The exact final text and timing remain subject to the legislative process. For EMIs integrating crypto rails into payment journeys, the likely direction is tighter expectations on interoperability, fraud liability and operational resilience. The Estonian Ministry of Finance tracks these EU legislative developments at national level. Firms designing crypto-enabled payment products should future-proof their design now, so that a payment-rail amendment today does not become a compliance gap tomorrow.
Most refusals and lengthy delays trace back to a short list of avoidable weaknesses. Address them before filing.
Where a firm operates beyond its permitted scope, it exposes itself to supervisory remediation directives, business restrictions, and potential enforcement, alongside the commercial damage of bank de-risking if correspondents judge the crypto exposure uncontrolled. The cheapest remediation is correct classification up front.
Use the following rapid-read sequence to drive the project:
Supporting resources, an EMI licence amendment checklist and a crypto business plan addendum template, can accompany this guide for teams that want a ready-to-use starting point.
The table below sets out the decision dimension by dimension. It is the central deliverable of this guide: use it to pressure-test which route your specific product set demands.
| Dimension | Amend existing EMI/PI licence | Apply for separate MiCA CASP authorisation |
|---|---|---|
| Legal basis | Modify current licence scope under Estonian PI/EMI rules; relies on supervisor assessment. Pro: uses existing authorisation. Con: may not cover core crypto activities. | New authorisation under MiCA. Pro: clearer regulatory fit for crypto activities. Con: distinct application burden. |
| Activities allowed | Payment-related crypto services, fiat on/off ramps, limited pass-through where no durable custody. Full custody/exchange generally excluded. | Broader activities, custody, exchange, execution, issuance support, explicitly covered, with clear obligations. |
| Supervisor approvals | Amendment application to Finantsinspektsioon; detailed documentation. Faster if scope limited. | Full MiCA authorisation application to Finantsinspektsioon; higher scrutiny. |
| Capital & prudential impact | Additional capital may be required for new operational risks; safeguarding rules may apply. | MiCA minimum capital by service class; often higher ongoing prudential requirements. |
| AML supervision | If activities meet crypto-asset service definitions, full AML program and supervision apply. | Full crypto-asset AML controls and supervision apply. |
| Operational requirements | Segregation, reconciliations, custody controls and vendor oversight for limited services. | Comprehensive custody frameworks, audited segregation, stronger IT controls, DORA compliance. |
| Timeline | Typically shorter if limited scope; depends on supervisory workload and completeness. | Usually longer with deeper scrutiny and potential pre-application meetings. |
| Costs | Lower filing costs; moderate advisory and systems-change costs. | Higher authorisation costs, longer advisory spend, larger systems and compliance costs. |
| Enforceability & liability | Ambiguity risk: if activities exceed permitted scope, enforcement risk increases. | Clearer regulatory perimeter reduces ambiguity but increases compliance obligations. |
| Cross-border / passporting | Passport rights depend on activity classification; MiCA may be required for cross-border crypto offers. | Cross-border provision clearer under MiCA’s notification mechanism. |
| Banking relationships | Existing relationships may survive if risks limited; higher crypto exposure risks bank de-risking. | Banks may demand stronger controls; accounts often harder to obtain but expectations clearer. |
| Strategic commercial impact | Faster product roll-out but potential regulatory gaps. | Stronger market credibility but longer time-to-market and higher cost. |
Choose to amend your existing EMI/PI licence when:
Choose to apply for a separate CASP authorisation when:
Our recommendation is unambiguous: if any genuine custody or exchange activity is in your roadmap, do not attempt to force it through an amendment. The regulatory, banking and enforcement risks of an ambiguous perimeter outweigh the time saved. Reserve the amendment route for contained, payment-centric crypto features, and even then, map the flow of funds and keys precisely before you file.
For a tailored assessment of your specific product set, a Licensing Lawyer Estonia, find a specialist can classify your activities against the current regime, and the Estonia practice page, legal experts in Estonia brings together the relevant expertise.
Image alt: Fintech team reviewing EMI licence amendment documents in Estonia when deciding whether to add crypto to EMI licence Estonia.
The decision to add crypto to EMI licence Estonia rewards precision and punishes wishful thinking. Classify each product honestly: contained, payment-related crypto features can often proceed by amendment, but custody, exchange and issuance belong under a separate MiCA authorisation. In 2026, with MiCA’s crypto-asset services regime fully in force and EU payments reform reshaping the perimeter, the balance has shifted toward purpose-built authorisation for any genuine crypto-asset service. Map your flows, strengthen your AML and governance evidence before filing, and choose the route that gives you a defensible regulatory perimeter rather than the fastest paper win.
This article is general guidance and not legal advice; before you add crypto to EMI licence Estonia, obtain tailored counsel on your specific activities, controls and timeline.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Mark Gofaizen at Gofaizen & Sherle Fintech Lawyers, a member of the Global Law Experts network.
posted 13 minutes ago
posted 29 minutes ago
posted 33 minutes ago
posted 46 minutes ago
posted 49 minutes ago
posted 1 hour ago
posted 1 hour ago
posted 2 hours ago
posted 2 hours ago
posted 3 hours ago
posted 3 hours ago
Find the right Legal Expert for your business
Send welcome message
