Licensed Business Types in Estonia (2026): Which Activities Need a Licence, Fintech Guide

Licensed business types estonia have become a moving target in 2026, as a cluster of EU-level reforms reshapes which activities need authorisation before they can launch. The momentum behind the proposed PSD3 package, the full application of the Markets in Crypto-Assets Regulation (MiCA), and the establishment of the EU Anti-Money Laundering Authority (AMLA) mean that founders can no longer rely on guidance written even eighteen months ago. For fintech teams in particular, payments, e-money and crypto businesses, the line between a regulated and an unregulated activity has shifted, and getting it wrong is expensive.

This guide sets out, in plain terms, which activities require a licence in Estonia, how the fintech picture looks after the 2026 changes, and the practical steps to apply, passport and stay compliant.

Why 2026 is different for Estonian licensing

Three regulatory currents converge in 2026. First, the European Commission’s payment services reform package, the proposed PSD3 and the accompanying Payment Services Regulation, builds on PSD2 and is expected to tighten authorisation, safeguarding and fraud-prevention expectations for payment service providers and e-money institutions once adopted and in force.^[3] Second, MiCA now governs crypto-asset service providers and token issuers across the EU, replacing Estonia’s older national virtual-asset registration regime with a harmonised authorisation standard.^[5] Third, AMLA has been established to help centralise anti-money-laundering supervision across the EU, with FATF’s risk-based expectations feeding into sharper due-diligence and transaction-monitoring obligations for crypto and payment firms alike.^[6][7]

The practical effect is that several activities which once sat in a lighter-touch or registration-only perimeter now require full authorisation, higher capital and more robust governance. In Estonia, the Financial Supervision and Resolution Authority (Finantsinspektsioon) is the gatekeeper for payment, e-money and crypto-asset services, and its application and ongoing-supervision expectations have risen accordingly.^[1] The thesis of this guide is simple: scope your product against the 2026 perimeter early, because licensing decisions drive your corporate structure, capital planning and go-to-market timeline. Where any doubt exists, take Estonian-qualified legal advice before you commit.

Which businesses require a licence in Estonia?, comprehensive checklist

Among the licensed business types estonia recognises, the regulated perimeter spans financial services, digital assets and a range of non-financial sectors. The checklist below groups activities by sector, with a one-line summary and the supervisory or statutory anchor for each. It is a decision-support tool, not a substitute for a formal licensing assessment.

Financial services (Finantsinspektsioon-supervised)

• Payment services. Executing payments, acquiring, money remittance and account information or payment initiation services require authorisation as a payment institution, supervised by Finantsinspektsioon.^[1][3]
• Electronic money (e-money). Issuing electronic money, prepaid balances redeemable for funds, requires an electronic money institution (EMI) licence.^[1][4]
• Credit and lending. Deposit-taking and banking require a credit institution licence; consumer-credit and creditor activity are separately regulated.^[1]
• Investment services. Dealing, brokering, portfolio management and investment advice require authorisation as an investment firm.^[1]
• Insurance and insurance distribution. Underwriting and distribution are both licensable and supervised by Finantsinspektsioon.^[1]

Crypto and digital assets

• Crypto-asset service providers (CASP). Custody, operation of a trading platform, exchange of crypto for fiat or other crypto, placing, transfer and advice are all regulated crypto-asset services under MiCA, requiring authorisation.^[5]
• Token issuance. Issuing asset-referenced tokens or e-money tokens (including many stablecoins) triggers MiCA issuer requirements, with the more onerous rules applying to significant tokens.^[5]
• AML obligations. Crypto businesses are obliged entities under Estonia’s Money Laundering and Terrorist Financing Prevention Act and must meet FATF and AMLA-aligned standards.^[2][6][7]

Regulated non-financial sectors

• Gambling. Organising games of chance, betting and lotteries requires an activity licence and, for individual operations, an operating permit.
• Alcohol, tobacco and food. Wholesale and retail of alcohol and tobacco, and certain food-handling activities, require registration or activity licences.
• Pharmaceuticals and healthcare. Manufacture, wholesale and retail of medicinal products, and the provision of healthcare services, are licensable.
• Transport. Carriage of passengers and goods for hire, including road haulage, requires an operating licence.
• Telecommunications and electronic communications. Network and communication service provision is subject to notification and, in some cases, licensing.
• Energy, waste and the environment. Electricity and gas distribution, and waste handling, require sector-specific permits.
• Real estate and professional brokering. Certain brokerage activities are subject to registration requirements.

Estonia’s regulated activities are set out across sectoral statutes published in the official gazette, Riigi Teataja; the exact scope of any licence should be confirmed against the relevant Act before you apply.^[2] For the remainder of this guide, the focus narrows to the licensed business types estonia most relevant to fintech founders, payments, e-money and crypto, where the 2026 changes bite hardest.

Fintech and crypto: the licensed business types estonia founders need in 2026

For most fintech products, the licensing question resolves into one of three categories: a payment institution, an electronic money institution, or a crypto-asset service provider. Each has a distinct regulated activity, capital floor and governance expectation, and the right choice depends on precisely what your product does with customer funds.

Payment institution (PI)

A payment institution authorisation covers services such as executing credit transfers and direct debits, acquiring payment transactions, money remittance, and, critically for many modern products, payment initiation services (PIS) and account information services (AIS).^[3] Under the PSD2 framework, and as expected to continue under the proposed PSD3 reforms, a firm that initiates payments from a user’s bank account, or aggregates account data, is providing a regulated service and must be authorised or act as an agent of an authorised firm.^[3] Payment institutions do not hold customer funds as e-money; they move funds, and they must safeguard those funds in line with applicable requirements and EBA guidance.^[4]

Electronic money institution (EMI)

An EMI licence is required where a firm issues electronic money, stored monetary value that customers can hold in a wallet or on a card and later spend or redeem.^[1][4] The practical distinction from a payment institution is that an EMI stores value on behalf of customers, whereas a payment institution typically only transmits it. Many neobank-style products, prepaid card programmes and multi-currency wallets fall squarely within the EMI perimeter. EMIs may also provide payment services, which is why the EMI licence is often the more flexible choice for ambitious consumer fintechs.

Payment institution thresholds and reduced-scope regimes

The EU payment services framework provides for a lighter regime for certain small payment institutions, subject to activity thresholds, and member states may make use of exemptions and simplified requirements in specific cases. Founders should confirm with Finantsinspektsioon whether a reduced-scope authorisation or exemption is available and what volume ceilings apply before assuming it will suit a scaling business, firms operating under such reduced-scope arrangements generally cannot passport across the EU, which limits their usefulness for products targeting multiple markets.^[1][4]

Crypto-asset service providers under MiCA

The crypto authorisation Estonia once issued under its national virtual-asset register has been overtaken by MiCA’s harmonised CASP authorisation. Crypto businesses providing custody, operating an exchange or trading platform, or executing orders on behalf of clients must obtain authorisation as a crypto-asset service provider.^[5] The transition has been significant: the bar for governance, capital, custody segregation and complaint-handling is considerably higher than under the former registration regime, and firms that held only a legacy registration have generally had to apply for MiCA authorisation within the applicable transitional period or wind down. Custody and exchange are treated as distinct regulated services, and custody-wallet providers face specific safeguarding duties over client assets.

Stablecoin issuance deserves particular attention. Issuing e-money tokens or asset-referenced tokens is regulated under MiCA’s issuer regime, and significant tokens attract enhanced requirements and, in practice, closer prudential scrutiny.^[5] A practical point for fintechs navigating the transition: start the MiCA application conversation with the regulator and your bank in parallel, because banking relationships for crypto firms remain the slowest-moving dependency, and an authorisation is of limited value without an account that can hold and settle client funds.

Across all three categories, the AML overlay is now heavier. AMLA’s consolidation of supervisory functions and FATF’s risk-based guidance mean that customer due diligence, beneficial-ownership verification and transaction monitoring must be demonstrably robust from day one, not bolted on later.^[6][7] Estonia’s Money Laundering and Terrorist Financing Prevention Act makes payment, e-money and crypto firms obliged entities with ongoing reporting and record-keeping duties.^[2]

How to apply: application steps, documents, timelines and fees

Knowing which of the licensed business types estonia offers applies to your product is only the start; the application itself is a substantial exercise. Finantsinspektsioon expects a complete, coherent dossier that demonstrates a viable business, sound governance and credible AML controls.^[1] The steps below describe the typical path for a payment, e-money or crypto authorisation.

Required documents

• A fully incorporated Estonian legal entity with a clear ownership and group structure.
• A detailed business plan with multi-year financial projections, product descriptions and target markets.
• Written policies and procedures covering AML/CTF, KYC, sanctions screening, safeguarding of client funds, complaints handling and outsourcing.
• Evidence of initial capital held in a dedicated account, meeting the applicable minimum for the licence type.^[4]
• Fit-and-proper documentation for directors, shareholders and key function holders.
• An IT and information-security description, including business-continuity and incident-management arrangements.
• A description of the governance framework, including the roles of the management board and the money-laundering reporting officer (MLRO).

Governance and AML requirements

Finantsinspektsioon looks for substance, not a letterbox. In practice this means an adequate management presence connected to Estonia, a properly resourced compliance function and a designated MLRO who is demonstrably competent and available to the regulator.^[1] The AML programme must reflect the risk-based approach that FATF and AMLA expect, with documented customer risk assessments, enhanced due diligence for higher-risk relationships and real transaction-monitoring capability rather than policy wording alone.^[6][7] For crypto firms, custody segregation and wallet-security controls will be scrutinised closely under MiCA.^[5]

Typical processing timeline and fees

Processing times depend heavily on the completeness and quality of the submission. EU legislation sets maximum assessment periods for payment, e-money and crypto-asset authorisations, but the effective timeline is typically longer because the assessment period is suspended each time the regulator raises questions and waits for responses. Crypto-asset service provider authorisations under MiCA can be more variable, depending on the complexity of the services and the quality of the custody and governance arrangements presented. Fees vary by licence type and are set out in Estonian legislation; confirm the current figures in Riigi Teataja and on the regulator’s site before budgeting.^[1][2]

Common reasons for refusal and how to remedy them

• Thin substance. A management structure that looks nominal invites rejection; ensure genuine, resourced local functions.
• Weak AML controls. Generic, copy-paste policies without a tailored risk assessment are a frequent stumbling block.
• Unclear fund flows. If the regulator cannot trace how client money is safeguarded, the application stalls.
• Incomplete fit-and-proper evidence. Gaps in background documentation for owners and officers delay decisions.

A practical point for applicants: engage with the regulator early where possible, submit a complete file rather than a partial one, and line up your banking before you file, because an authorisation with no operational account creates a damaging gap between approval and launch.

EU passporting from Estonia, what can be passported and how

One of the strongest commercial reasons to choose Estonia is EU passporting. A payment institution or EMI authorised in Estonia can, in principle, provide its services across the European Economic Area without seeking a fresh licence in each market, relying on the single-market framework established under PSD2 and the Electronic Money Directive, and expected to continue under the PSD3 reforms.^[3]

Steps to passport

Passporting runs through the home regulator. The Estonian firm notifies Finantsinspektsioon of its intention to operate in a host state, specifying whether it will do so on a freedom-of-services basis or by establishing a branch or using agents. Finantsinspektsioon then communicates with the host-state competent authority, and the firm may begin operating once the notification process concludes.^[1][3]

Limitations to watch

• Host-state notifications. Operating via agents or branches triggers additional notification steps and sometimes host-state conditions.
• AML supervision. AML oversight can sit with the host state for branch or agent activity, meaning you may answer to more than one supervisor.^[6][7]
• Crypto is different. MiCA provides its own cross-border notification mechanism for crypto-asset service providers, and the practical reality of national implementation means early-stage firms should verify the current position before assuming seamless EU-wide distribution.^[5]
• Reduced-scope institutions generally cannot passport. If EU-wide reach matters, a full EMI or payment institution is usually the better foundation.^[4]

Comparison table, EMI vs payment institution vs CASP

The table below summarises the headline differences between the principal fintech licence categories. Treat capital figures as indicative and confirm current thresholds against Finantsinspektsioon guidance and the applicable EU rules.^[1][4]

Practical compliance checklist for fintech founders (pre-application and first 12 months)

Securing one of the licensed business types estonia recognises is a milestone, not the finish line. Supervisory expectations continue throughout the firm’s life, and the first twelve months after authorisation set the tone for your relationship with the regulator. Use the checklist below as a working document.

• Product scoping. Map every money flow and crypto interaction against the regulated perimeter before you build.
• Licensing decision matrix. Document why you chose PI, EMI or CASP, and what would trigger a change of authorisation.
• Core policies. AML/CTF, sanctions, KYC, safeguarding, outsourcing, complaints and conflicts, reviewed and board-approved.
• Contracts and terms. Customer terms and conditions, agent agreements and partner contracts aligned to your licence scope.
• Banking relationships. Secure and stress-test accounts for safeguarding and settlement before launch.
• Staged roll-out. Consider controlled testing before full market launch.
• AML programme in operation. Transaction monitoring, screening and suspicious-activity reporting running and evidenced, not just documented.^[6][7]
• Reporting obligations. Calendar and resource regulatory, prudential and AML reporting deadlines.
• Audit and assurance. Plan internal and external reviews of controls within the first year.
• Change management. Track MiCA and PSD3 developments and feed them into product and compliance governance.^[3][5]

Consult official guidance from Finantsinspektsioon, the EBA and the European Commission as your primary references, and treat commentary from any other source as secondary.^[1][3][4]

When you might avoid licensing, design patterns and workarounds

Not every fintech needs its own authorisation. Thoughtful product design can keep a business outside the regulated perimeter, or at least defer the need for a licence while the model is proven. Common patterns include:

• Agent or distributor models. Operating as an agent of an authorised payment institution or EMI, so the regulated activity sits with the licensed principal.
• Partnering with a licensed PSP. Using a banking-as-a-service or embedded-finance partner that holds the licence while you own the customer experience.
• AIS-only or PIS-only scoping. Limiting the product to information services can reduce the authorisation burden, though these services remain regulated.^[3]
• Non-custodial crypto design. Products that never take custody of client assets may fall outside certain MiCA custody obligations, but the analysis is fact-specific and MiCA’s service definitions are broad.^[5]

These are legitimate strategies, but they carry real risk if applied loosely. The boundary between facilitating and performing a regulated service is narrow, and the regulator looks at economic substance rather than labels. Before relying on any workaround, obtain Estonian-qualified legal advice; professional conduct standards and the value of tailored counsel are recognised by the Estonian Bar Association.^[8]

Conclusion and next steps

The licensed business types estonia now spans a wider and more demanding fintech perimeter than it did just a year ago, driven by the proposed PSD3 package, MiCA’s harmonised crypto regime and AMLA-led AML consolidation. The winning approach is to scope your product against the 2026 rules early, choose the right authorisation, payment institution, EMI or crypto-asset service provider, structure for EU passporting where distribution matters, and build genuine substance and AML capability from the outset. Because the stakes and the cost of error are high, engage experienced Estonian counsel before you file, and use the application process as an opportunity to build a compliance foundation that will survive supervision.

To take the next step, speak to a Licensing specialist via the Global Law Experts directory and pair this guide with the supporting deep-dives on EMI applications, crypto AML obligations and fintech banking.

Sources

1. Estonian Financial Supervision and Resolution Authority (Finantsinspektsioon)
2. Riigi Teataja, Estonian official gazette
3. European Commission, Payment Services (PSD2/PSD3)
4. European Banking Authority (EBA)
5. European Commission, Markets in Crypto-Assets (MiCA)
6. Financial Action Task Force (FATF)
7. Anti-Money Laundering Authority (AMLA)
8. Estonian Bar Association (Eesti Advokatuur)