Mica CASP Authorisation in Estonia: Requirements, Process, Costs and Faqs

Securing MiCA CASP authorisation in Estonia is now the central compliance task for any crypto-asset business that wants to operate lawfully in or from Estonia within the European Union’s harmonised framework. Since the Markets in Crypto-Assets Regulation (MiCA) transition closed and national enforcement crystallised around mid-2026, the Finantsinspektsioon (the Estonian Financial Supervision Authority) has become the sole authorising body for crypto-asset service providers (CASPs) seeking to operate from an Estonian base. This page explains who needs authorisation, what the regulator requires, how much it costs, how long it takes, and how Estonia compares with other EU jurisdictions.

The legacy Estonian virtual asset service provider (VASP) registration regime that defined the market from 2017 onward has been superseded. Firms that once relied on a VASP registration must now obtain a full CASP licence under MiCA, following the harmonised standards set out in Regulation (EU) 2023/1114. This guide is written for founders, general counsel, compliance leads and investors planning a filing, and it is grounded throughout in primary regulator and legislative sources.

Regulator snapshot: MiCA CASP authorisation in Estonia is granted by the Finantsinspektsioon, which assesses eligibility, prudential strength, governance and AML controls. Authorisation grants EU-wide passporting rights once completed.

MiCA & Estonia, regulatory context (what changed in 2026)

MiCA created the first pan-European regime for crypto-assets and the firms that service them. It replaced a patchwork of national registration systems, including Estonia’s influential but much-criticised VASP regime, with a single, licence-based framework intended to apply consistently across all 27 Member States. The practical effect for Estonia is dramatic: a jurisdiction that historically hosted thousands of lightly supervised VASPs now operates a demanding, principles-plus-rules authorisation process overseen by a specialist financial regulator.

What MiCA requires of CASPs

Under MiCA, any entity providing one or more crypto-asset services on a professional basis within the EU must be authorised as a CASP. The regulated services are defined in the Regulation and include custody and administration of crypto-assets, operation of a trading platform, exchange of crypto-assets for funds or for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services.

The MiCA text prescribes minimum capital requirements, governance standards, conduct-of-business obligations, safeguarding rules for client assets and funds, outsourcing controls, complaint handling and conflict-of-interest management. These provisions are applied uniformly, which is precisely what enables EU passporting once a CASP is authorised in one Member State such as Estonia.

Estonia’s approach and the Finantsinspektsioon’s role

The Finantsinspektsioon is the competent authority for MiCA in Estonia. Its approach reflects both EU-level harmonisation and the national ambition to rebuild reputational credibility after the VASP era. In practice this means that applicants for mica casp authorisation estonia should expect rigorous scrutiny of business models, source of funds, management competence and the substance of their Estonian operations. The regulator publishes application guidance and filing procedures through its official portal, and it engages supervised entities through structured information requests during review. Firms should treat older VASP-era guidance as obsolete and work exclusively from current Finantsinspektsioon material and the MiCA text itself.

Why choose Estonia for your CASP

Estonia remains a credible EU launch jurisdiction for crypto-asset businesses, provided founders approach the process with realistic expectations. The country combines a digital-first administrative culture with established fintech infrastructure, and English-language engagement is common across professional and regulatory interactions.

• Digital incorporation and e-residency: Company formation is fast and largely online, reducing the time needed to establish the legal entity that will hold the licence.
• English-language processes: Much of the professional ecosystem operates in English, easing documentation and advisory workflows for international founders.
• Clear corporate tax model: Estonia’s distributed-profits tax approach is attractive for reinvestment-focused businesses, though tax structuring should always be confirmed with specialist advisers.
• EU passporting from day one: A completed Estonian CASP licence unlocks the entire single market without separate national licences.
• Mature professional base: Experienced compliance, legal and audit providers understand the transition from the VASP regime to MiCA.

The principal risks are equally concrete. The Finantsinspektsioon is applying heightened scrutiny following the VASP wind-down, capital and substance thresholds are enforced strictly, and a wave of re-applications from former VASPs can lengthen queues. Founders weighing a crypto licence estonia against alternatives should review our Crypto Licensing services hub and the jurisdiction comparison set out later on this page.

Process, How to apply for MiCA CASP authorisation in Estonia (step-by-step)

The route to mica casp authorisation estonia is a structured, document-intensive process. Before beginning, assemble a core team, legal counsel, a prospective compliance officer, a technology lead and, where custody is involved, a safeguarding specialist. Expect a realistic end-to-end horizon of several months from first draft to licence, assuming prompt responses to the regulator and fully translated, consistent documentation. The steps below describe a typical casp application estonia pathway and the documents the Finantsinspektsioon will expect.

Step 1, Pre-application planning and corporate set-up

Define precisely which MiCA crypto-asset services you intend to provide, because the scope drives capital tier, governance and policy requirements. Then establish the Estonian legal entity that will hold the licence.

• Legal form: Typically a private limited company (osaühing) with a clear ownership chain.
• Local substance: A genuine registered office, real decision-making in Estonia, and appropriately resourced management.
• Governance map: Board composition, reporting lines and the identity of responsible managers.
• Beneficial ownership: Transparent ownership documentation and source-of-funds evidence.

Step 2, Capital planning and prudential framework

MiCA sets minimum own-funds requirements that vary by the class of services provided. Determine your applicable tier and document how initial capital will be raised, held and maintained. Prepare a prudential narrative showing that own funds meet the higher of the fixed minimum or an expenditure-based requirement, and demonstrate ongoing capital adequacy through financial projections. Link your budgeting to the detailed crypto licence cost Estonia, capital thresholds & budgets resource for scenario modelling.

Step 3, Drafting policies and operational controls

This is the heart of the file. The regulator expects coherent, implementable policies rather than templates.

• AML/KYC programme: Customer due diligence, ongoing monitoring, sanctions screening and suspicious transaction reporting aligned with Estonian AML law.
• Custody and safeguarding: Segregation of client crypto-assets and funds, key management, and reconciliation procedures.
• IT and information security: Resilience, incident response, business continuity and ICT risk management.
• Outsourcing and conflicts: Controls over third-party providers and documented conflict-of-interest management.
• Complaints and conduct: Fair-dealing procedures and client disclosures.

Step 4, Management and fit-and-proper checks

The Finantsinspektsioon assesses the competence, experience and integrity of board members, responsible managers and key function holders. Prepare detailed CVs, professional references, criminal-record declarations and evidence of relevant experience. Each responsible person must demonstrate suitability for their specific role, and the management team as a whole must show collective competence across the regulated activities.

Step 5, Submission to the Finantsinspektsioon

Compile the application pack and file it through the regulator’s official channel. Submissions typically require Estonian-language or certified translations of key documents, payment of applicable processing fees, and a complete, internally consistent dossier.

• Application form and business plan: Describing services, target markets and financial projections.
• Policy suite: AML, safeguarding, IT security, outsourcing, conflicts and complaints.
• Corporate and ownership documents: Articles, ownership chart and beneficial ownership evidence.
• Prudential evidence: Capital confirmation and financial forecasts.
• Management file: CVs, declarations and fit-and-proper documentation.

Step 6, Regulator review and questions

Once filed, expect one or more rounds of questions. The Finantsinspektsioon mica review commonly probes business-model viability, source of funds, safeguarding architecture and AML controls. Treat each request as substantive: timely, precise and well-evidenced responses materially shorten the overall timeline, while incomplete answers extend it. A dedicated internal owner for regulator correspondence is strongly advisable.

Step 7, Approval, licence wording and EU passporting

On approval, the licence specifies the authorised crypto-asset services. To passport into other Member States, the CASP notifies the Finantsinspektsioon of its intention to provide cross-border services, and the regulator transmits the notification to the relevant host authorities under MiCA’s passporting mechanism. Confirm that the licence wording covers every service you intend to offer, as expansion later may require a variation.

Step 8, If refused or asked to re-apply

If the regulator raises fundamental concerns, it may request remediation or, in serious cases, refuse the application. Applicants can address deficiencies and re-file, and administrative-law routes exist to challenge decisions. The practical priority is a structured remediation plan that resolves the regulator’s stated concerns before resubmission. Former VASPs navigating re-application should expect their prior supervisory history to form part of the assessment.

For a line-by-line document map and sample forms, use our step-by-step CASP application checklist and the downloadable CASP application templates.

Comparison, Estonia vs Malta / Lithuania / Portugal for mica casp authorisation estonia

The following table compares Estonia with three commonly considered EU alternatives. All figures are indicative; capital requirements under MiCA are harmonised across Member States, so the practical differentiators are review speed, regulator posture, cost and local ecosystem rather than the statutory capital floor itself.

Estonia is often preferable where founders value a fully digital incorporation path, English-language workflows and a mature advisory base, and where their ownership and source-of-funds position is clean and well-documented. Lithuania may suit firms prioritising the fastest possible review, while Malta appeals where a deep, experienced fintech regulatory environment is paramount and longer timelines are acceptable. For a detailed scoring of speed, cost and AML risk, see our dedicated Estonia vs Malta/Lithuania/Portugal jurisdiction comparison.

Key requirements & eligibility for an estonia casp licence

The Finantsinspektsioon applies a connected set of tests when assessing an estonia casp licence application. Each reflects a MiCA obligation, interpreted through the regulator’s post-transition supervisory lens. Understanding these tests early allows applicants to design a compliant operation rather than retrofitting one.

Capital and prudential tests

Applicants must hold own funds at least equal to the higher of the MiCA minimum capital for their service class or an amount derived from fixed overheads. Capital must be genuinely available, maintained on an ongoing basis, and supported by credible financial projections. The regulator examines not only the opening position but the plausibility of continued compliance under realistic revenue scenarios. Treat the headline casp capital requirements as a floor, not a target, and budget for a comfortable buffer.

Governance and IT/security requirements

The firm must demonstrate sound governance: a competent, suitably sized management body, clear reporting lines, and effective internal control functions covering risk and compliance. On technology, the regulator expects robust ICT risk management, operational resilience, incident response and, where custody is provided, demonstrably secure key-management and safeguarding arrangements.

AML/CFT expectations and local AML overlap

CASPs are obliged entities under anti-money-laundering rules. The application must present a full AML/CFT framework, risk assessment, customer due diligence, ongoing monitoring, sanctions screening and reporting, that satisfies both MiCA conduct standards and Estonian anti-money-laundering legislation enacted through national law (see Riigi Teataja). A credible AML programme, backed by an appointed compliance officer, is frequently decisive.

Fit and proper standards and local presence

Managers and key function holders must meet fit-and-proper standards for competence, experience and integrity. Beyond individuals, the firm must show real Estonian substance, a registered office, genuine local decision-making and resourcing proportionate to the business. Shell structures with no operational footprint will not satisfy the Finantsinspektsioon.

Costs, capital requirements and realistic timelines

Budgeting accurately is essential to a smooth casp application estonia. The table below sets out indicative cost categories. Fee and capital figures are illustrative and subject to Finantsinspektsioon review and the specifics of your service scope; confirm current amounts against the official regulator pages and the MiCA text before finalising forecasts.

A realistic timeline runs as follows. Preparation and drafting of the full policy suite and business plan typically takes several weeks to a few months, depending on team readiness. Filing is a defined event once the pack is complete. Regulator review, including question rounds, commonly spans a few months, with standard timelines falling in the three-to-nine-month band noted in the comparison table. Complex applications, custody-heavy models, or former-VASP re-applications sit at the longer end.

Three assumptions underpin the shorter timelines: documents are fully translated and internally consistent, management responds to information requests promptly, and the applicant has no adverse supervisory history. Where any of these fail, build additional contingency into the plan. For scenario-based cashflow modelling tied to each capital tier, consult the detailed crypto licence cost Estonia resource.

Post-authorisation obligations & ongoing MiCA compliance in Estonia

Authorisation is the beginning of a continuing supervisory relationship. Sustained mica compliance estonia is a condition of retaining the licence, and the Finantsinspektsioon monitors adherence through reporting and periodic engagement.

• Capital maintenance: Own funds must remain at or above the required level at all times, with prompt notification of any shortfall.
• Client asset safeguarding: Continuous segregation and reconciliation of client crypto-assets and funds.
• Regulatory reporting: Periodic financial, prudential and conduct reporting as required under MiCA and national rules.
• AML reporting: Ongoing suspicious-transaction reporting and compliance-officer oversight.
• Significant-change notifications: Prior or prompt notification of changes to ownership, management, business model or material outsourcing.

Enforcement risk is real. The regulator can impose remediation requirements, restrictions or, in serious cases, revoke authorisation. Firms should maintain an internal audit cadence and a living compliance manual; our post-authorisation MiCA compliance playbook sets out a practical operating model.

Practical next steps & what to prepare before you instruct counsel

Preparation is the single biggest determinant of a smooth path to mica casp authorisation estonia. Before engaging advisers, organise the following so that drafting can begin immediately and the Finantsinspektsioon review proceeds without avoidable delay.

• Service scope: A clear list of the MiCA crypto-asset services you intend to provide.
• Capital plan: Confirmation of available own funds and the applicable minimum tier.
• Ownership and funds: Transparent ownership chart and source-of-funds documentation.
• Team: A prospective compliance officer, a technology lead and board members who meet fit-and-proper standards.
• Operating model: Draft custody, AML and IT security approaches ready for formalisation.

Assemble a core team spanning compliance, technology and legal functions, and work from a single, living document index so that the application pack remains internally consistent. For a document-by-document map aligned to each Finantsinspektsioon request, use our step-by-step CASP application checklist, and anchor your budgeting in the crypto licence cost Estonia resource. With disciplined preparation, Estonia remains a credible and efficient home for a MiCA-authorised CASP.

Sources

• Finantsinspektsioon (Estonian Financial Supervision Authority), official site and MiCA/CASP guidance
• EUR-Lex, Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA)
• Riigi Teataja, Estonian State Gazette (national legislation, including AML provisions)
• European Commission (DG FISMA), MiCA implementation and delegated acts
• ESMA, Markets in Crypto-Assets Regulation (MiCA) implementation and technical standards