--- title: "Estonia Payments Regulation Monitor | World Payments Monitor" canonical: https://payments.gi/jurisdictions/estonia/ source_html: /jurisdictions/estonia/index.html description: "Estonia payments and e-money regulation: 14 modules, 71 sourced findings, updated 2026-10-26. Licensing, safeguarding, stablecoins, AML/CFT." generated_at: 2026-10-26T19:20:26Z content_sha256: 25142582d106d81998097e1f45512775f97af78721509e5f4337f4140bade4b5 generator: "fe-fleet/md-twin@1.0" --- # Estonia EE schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-26 · 14 modules · 71 sourced findings · 133 sources in the cumulative register Download report (PDF) Expand all 14 Modules 0 Moved this cycle 1 Key judgments 2 Open gaps 71 Findings 9 Tier-1 sources Confidence mix 4 confirmed 10 unpopulated (sums to 14 rendered modules; click to filter) No modules moved this cycle. Law made at European Economic Area level that applies in Estonia is covered once, on the [European Economic Area](/jurisdictions/european-economic-area/) page. This page covers Estonia’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,643 Full executive summary 290 Jurisdiction sub-brief 2 443 ###### Latest update · 25 October 2026 #### Lead Signal Estonia's parliament passed a payment-fraud-prevention law, 936 SE, on or about 21 October 2026, giving banks and payment and e-money institutions a statutory basis they have not previously had: the right to detect fraud ahead of a payment's execution and to delay or refuse that payment where fraud is suspected. The same instrument opens a formal channel for those institutions to exchange fraud-suspicion data with each other, with the police, and with CERT-EE, Estonia's computer emergency response team. For payment service providers operating in Estonia, this is a genuine widening of operational authority: until this law takes effect, a provider that suspected an authorised-push-payment scam in progress had no clear legal footing to simply stop the transaction. The law has passed the legislature but awaits publication in the Riigi Teataja before it takes effect, so the precise commencement date remains open, expected toward the end of 2026. The measure sits in the consumer-protection and anti-fraud space, but its mechanics, a payment hold plus inter-institutional data sharing, are the kind of infrastructure that reshapes how providers operationally respond to suspected fraud in real time, not merely how they report it after the fact. #### Other Developments A supervisory precept against a licensed bank. Coop Pank AS disclosed that Finantsinspektsioon, Estonia's financial supervisor, issued a precept following an on-site inspection, requiring remediation of governance, internal control, risk management, regulatory reporting and lending procedures, with deadlines running into 2027. This is a company disclosure; the regulator's own notice was not independently located. The precept does not itself identify a single root cause, and it covers a broad set of operational and governance areas rather than a narrow conduct failing. A conduct and consumer-protection bill in the pipeline. A second bill, 796 SE, is moving through the Riigikogu to transpose the EU's distance-marketing-of-financial-services directive into Estonian law. As described, it would place limits on manipulative interface design, sometimes called dark patterns, in distance contracts for financial services, and would give consumers a right to request contact with a human representative rather than being confined to an automated channel such as a chatbot. The exact reading stage of the bill and its expected adoption or commencement date have not been confirmed from a primary dated source. #### Cross-Monitor Connections The new payment-hold and data-sharing power under 936 SE has an evident financial-crime dimension: a mechanism built to intercept suspected fraud before a payment completes, and to share suspicion data across institutions and with law enforcement, functions as infrastructure that typically also strengthens detection of layering and mule-account activity, a reading that financial-crime monitoring of Estonia would want to track in parallel. The data-sharing gateway the law creates also touches data-protection questions, since fraud-suspicion information shared between banks, payment firms, police and CERT-EE will often constitute personal data, and the precise legal basis for that sharing under data-protection law has not yet been confirmed from the Act's own text. #### Outlook The operative date of 936 SE depends on its publication in the Riigi Teataja, expected by the end of 2026 as at the close of this cycle; once that happens, the practical test will be how actively Estonian banks and payment firms use the new hold-and-share power and whether any implementing guidance follows from the supervisor or law enforcement. For 796 SE, the item to watch is progress through the Riigikogu toward a confirmed reading stage and adoption date, which would fix when the dark-pattern prohibitions and human-contact right become binding on firms marketing financial services at a distance. Coop Pank's remediation against its precept, with deadlines into 2027, remains a standing item for firms and counterparties tracking the Estonian banking sector's supervisory posture. 4 earlier updates not shown here. ###### Standing brief · as of 4 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Estonia enters World Payments Monitor coverage as a mature, fully-integrated EEA payments jurisdiction whose settled architecture increasingly sits in tension with an AML legacy that refuses to close out. Finantsinspektsioon operates the standard PSD2/EMD2 licensing model, authorising and supervising both banks and non-bank payment institutions and e-money institutions under the Payment Institutions and E-money Institutions Act, with EEA-wide passporting rights attached to any Estonian licence. That baseline sits alongside the country's post-Danske Bank inheritance: the Estonian branch processed approximately EUR200 billion in suspicious non-resident transactions between 2007 and 2015, a scandal that produced the branch's 2019 market exit and more than $2 billion in global US and Danish settlements in 2022. Nearly a decade on, that legacy is still generating fresh legal friction rather than fading into history. In September 2024 the Harju County Court annulled a EUR300,000 Financial Intelligence Unit sanctions-enforcement fine against AS LHV Pank, ruling that the FIU had not adequately demonstrated individual board-member breach of due-diligence duties over roughly EUR2.2 million in Russia-sanctions-linked payments — a judicial pushback on enforcement evidentiary standards that sits awkwardly against LHV's own reputation as the most conservative of Estonia's four largest banks on Russia-linked wind-down. Layered on top is a second cliff-edge: Estonia's Crypto Asset Market Act rebased domestic virtual-asset regulation onto MiCA and DORA from 1 July 2024, shifting CASP supervision from the FIU to Finantsinspektsioon and setting a 1 July 2026 expiry for legacy FIU-issued VASP licences. The most recent available snapshot, from August 2025, showed zero domestic CASP authorisations granted against 25 providers registered to operate cross-border into Estonia — a figure that has not been re-verified past the transition deadline, which fell just three days before this cycle's baseline date. #### Other Developments Card-scheme access in Estonia runs on two distinct tracks. Wallester holds a Visa Principal Membership with direct network access to issue cards, is PCI DSS Level 1 certified and is licensed by Finantsinspektsioon — a direct-principal-membership route that is comparatively rare for a non-bank EMI and is used competitively as a trust signal. LHV, by contrast, provides indirect card-scheme access and collection services to roughly 200 fintech partners as a member of major UK and EU payment schemes. The bank's banking-as-a-service model has made it, by one estimate, a facilitator of roughly 7% of all instant transfers across Europe for clients including Coinbase, TrueLayer, Currency Cloud and Wise, though a more recent source cites a higher ~8% figure and reconciliation is recommended next cycle. Estonia's corridor infrastructure is fully harmonised with euro-area rails — TARGET2-Eesti/T2 for large-value settlement, STEP2 for batch SEPA credit transfers, and RT1/TIPS for instant payments — reflecting full euro-area membership since 2011 and SEPA membership since 2014. Swedbank, SEB and LHV together cover roughly 95% of interbank and intrabank credit transfers within the country. The banking sector itself remains foreign-capital-dominated, led by Swedbank (26.66% market share by total assets, EUR15.76 billion, in 2025), SEB and Luminor, alongside the domestically-owned challenger LHV. LHV's acquiring infrastructure — 3-D Secure, bank-link/QR redirect, Nets Estonia-certified POS — underpins non-bank orchestration platforms such as Montonio via virtual-IBAN-based safeguarded settlement. High-risk-sector merchants — crypto-adjacent, forex, gaming, payment processing — continue to be steered toward international EMI acquiring rather than conservative domestic bank acquiring. On the product side, Estonia's e-Residency programme now underpins nearly half of newly founded startups involving an e-resident, up from 38% in 2023. Wallester's 2025 roadmap added 24/7 instant currency exchange across ten currencies and direct Xero/QuickBooks integrations. Commercially, Wallester was ranked the #1 fastest-growing fintech in Europe on the FT1000 2026 list — 38th overall, up from 48th, on 178.9% three-year revenue CAGR, with disclosed revenue rising from EUR9.14 million in 2023 to EUR17.2 million in 2024. Montonio processed over EUR1.5 billion in 2025 payment volume, grew monthly recurring revenue by more than 60%, launched on Shopify and completed a full-product rollout across the Baltics and Poland; and Creem, an AI-focused financial-infrastructure startup, raised a EUR1.8 million pre-seed round led by Practica Capital in August 2025. On consumer protection, Estonia recorded 18,300 card-fraud incidents (EUR2.6 million lost, a rate below the EU average) against 5,800 fraudulent payment-order transactions (EUR10.6 million) in 2023, with payment-order fraud comparatively worse than card fraud relative to EU peers; the EU's PSR/PSD3 reform reached provisional political agreement in late 2025 mandating PSP reimbursement for impersonation-fraud victims and platform liability for fraud originating on online platforms, though Estonian domestic transposition has not yet been published. #### Cross-Monitor Connections Two threads in this baseline cycle are flagged for the Financial Integrity Monitor rather than developed further here. First, the Sentinel-fed AML/CFT record — the Danske Bank scandal's causal role in Estonia's post-2018 AML/CFT reform, and Estonia's 2022 FATF/MONEYVAL Mutual Evaluation finding of compliance or largely-compliance on 25 of the 40 FATF Recommendations — warrants original illicit-finance analysis beyond this monitor's payments-market-structure scope. Related correspondent-banking de-risking findings compound the picture: Deutsche Bank and Bank of America discontinued correspondent agreements with Danske Bank in 2015, years before the scandal became public, and Sweden's Finansinspektionen separately fined SEB over $107 million and Swedbank nearly $400 million for AML failures tied to non-resident account monitoring across the Baltics. Second, the MiCA/CMA CASP-authorisation transition — zero domestic authorisations against 25 cross-border registrants at last snapshot — raises a potential supervisory-gap window around the 1 July 2026 cliff-edge that may itself warrant AML/CFT licensing-gap monitoring. #### Outlook Two dates anchor the forward calendar. The 1 July 2026 expiry of legacy FIU-issued VASP licences has now passed, and next cycle should prioritise re-verifying the current domestic CASP-authorisation count rather than carrying forward the stale August 2025 snapshot. Separately, Estonia's domestic transposition timeline for the EU's PSR/PSD3 APP-fraud-reimbursement reform remains unpublished and is a gap to track. Underlying both is a structural theme worth watching across the jurisdiction: LHV's expanding role as BaaS provider, indirect scheme-access point and acquiring-infrastructure backbone concentrates commercial significance and operational-resilience exposure in a single institution, a dependency pattern that this monitor will continue to track alongside the slower-burning Danske Bank AML legacy. Read full brief · 1643 words Standing brief, as of 4 July 2026. #### Regulatory Status Estonia operates a mature, fully-integrated EEA payments regime: Finantsinspektsioon authorises and supervises payment institutions and e-money institutions under PIEIA/MERAS with EEA-wide passporting, DORA has applied since 17 January 2025 with Finantsinspektsioon as the single national competent authority across banks, PIs, EMIs and CASPs, and the Crypto Asset Market Act rebased virtual-asset regulation onto MiCA from 1 July 2024 with a transition deadline of 1 July 2026 for legacy VASP licences. Settlement infrastructure runs fully through TARGET2-Eesti/T2, STEP2 and RT1/TIPS, with Swedbank, SEB and LHV covering roughly 95% of domestic interbank transfers. Card-scheme access operates on dual direct (Wallester/Visa Principal Membership) and indirect (LHV banking-as-a-service) tracks. Consumer conduct supervision splits between Finantsinspektsioon (prudential) and the Consumer Protection and Technical Regulatory Authority (general consumer-facing conduct), while EMI safeguarding follows the standard EMD2/PSD2 segregation-plus-own-funds-backstop model. The jurisdiction's most persistent overhang is its AML/CFT legacy: the Danske Bank Estonia branch's processing of approximately EUR200 billion in suspicious non-resident transactions (2007-2015) drove Estonia's post-2018 AML/CFT reform and continues to generate active litigation, including a 2024 Harju County Court annulment of a EUR300,000 FIU sanctions-enforcement fine against LHV and a 2020 Finantsinspektsioon fine against SEB Pank, while correspondent-banking relationships remain shaped by post-Danske de-risking and continued non-resident enhanced-due-diligence friction. #### Outlook Two forward markers dominate the outlook for Estonia: re-verification of the domestic CASP-authorisation count now that the 1 July 2026 MiCA/CMA transition deadline has passed, and publication of Estonia's domestic transposition timeline for the EU's PSR/PSD3 APP-fraud-reimbursement reform. Underlying both is the structural dependency the monitor will continue to track — LHV's expanding role as BaaS provider, indirect scheme-access point and acquiring-infrastructure backbone — alongside the slower-burning judicial and supervisory consequences of the Danske Bank AML legacy. Read full brief · 290 words ###### Latest update · 25 October 2026 #### Regulatory Status Estonia's payments regulatory environment tightened on the consumer-protection and fraud-prevention front. The Riigikogu passed 936 SE on or about 21 October 2026, giving credit institutions and payment and e-money institutions a statutory basis to detect fraud before a payment executes and to delay or refuse that payment on suspicion, together with a formal gateway to exchange fraud-suspicion data with each other, the Police and Border Guard Board, and CERT-EE. The law has been adopted but awaits publication in the Riigi Teataja before taking effect. Separately, a bill transposing the EU's distance-marketing-of-financial-services directive, 796 SE, is progressing through the Riigikogu; it would limit manipulative interface design in distance financial-services contracts and introduce a right for consumers to reach a human representative rather than only an automated channel, though its exact reading stage and commencement date are unconfirmed. On the supervisory side, Finantsinspektsioon issued a precept to Coop Pank AS requiring governance, internal control, risk management, regulatory reporting and lending-procedure remediation, with deadlines into 2027. #### Outlook Publication of 936 SE in the Riigi Teataja, expected toward the end of 2026, will fix the operative date of the new payment-hold and data-sharing powers. Progress of 796 SE through the Riigikogu is a parallel item to track for firms with distance-sales or chatbot-based consumer channels. Coop Pank's remediation against its supervisory precept runs into 2027 and remains a standing item for the Estonian banking sector. 1 earlier update not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Regulatory Status Estonia's payments-adjacent regulatory perimeter moved on two fronts this cycle. The legacy VASP licensing regime became fully invalid from 1 July 2026, with Finantsinspektsioon's MiCA CASP authorisation now the sole valid pathway for crypto-asset service provision and no automatic grandfathering of legacy FIU licences; the FIU underscored this by revoking BB Trade Estonia OU's VASP licence, FVT000209, on 29 June 2026 for non-compliance with a corrective precept. Separately, the e-Business Register's beneficial-ownership data moved from free public lookup to a purpose-based access model from 10 July 2026, restricting unauthenticated public access and requiring obliged entities or legitimate-interest claimants to establish documented access. Both changes point in the same direction: Estonia is moving from a historically maximally open fintech, crypto, and corporate-transparency posture toward EU-harmonised, access-controlled market infrastructure. #### Outlook The practical questions for the coming cycle are how much of Estonia's legacy VASP population completes MiCA CASP authorisation versus exits the market, and how quickly payment and e-money institutions can establish legitimate-interest or obliged-entity access workflows for Estonian beneficial-ownership data without disrupting onboarding timelines. Read full brief · 443 words × 14 of 14 modules Signal Moved Judgment Gap Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### W1aLicensing, Authorisation & Market Accesslimited signalConfirmedconfirmed 2026-07-04▾# Estonia operates the standard EEA PSD2/EMD2 licensing model: Finantsinspektsioon authorises and supervises payment institutions and e-money institutions under PIEIA/MERAS, with dual bank/non-bank routes and EEA passporting. Horizon · 2026-07-01 (± a quarter) Estonia VASP-to-CASP legacy transition hard backstop Adopted, not yet in force · Tier 4 source Standing sub-brief · as of 4 July 2026 145 words · last cycle 2026-10-25 #### Licensing, Authorisation & Market Access Finantsinspektsioon authorises and supervises payment institutions and e-money institutions under the Payment Institutions and E-money Institutions Act (PIEIA/MERAS), with EEA-wide passporting rights extended to licensed EMIs and PIs — the standard EEA PSD2/EMD2 model, applied without a distinct bank-only carve-out. The licence itself carries a EUR350,000 minimum own-funds requirement for authorised e-money institutions, and Finantsinspektsioon must decide within three months of a complete application, though in practice decisions tend to land closer to four months. Both bank-PSPs and non-bank PI/EMI applicants use the same statutory route, though the capital and process burden falls specifically on the non-bank EMI licence track. #### Outlook No licensing-regime changes were identified this cycle; the framework is treated as an established baseline. Future cycles should watch for any divergence introduced by the MiCA/CMA transition's spillover into licensing capacity at Finantsinspektsioon, given the regulator's expanded CASP-supervision remit. Read full sub-brief · 145 words Periodic update · new data 2026-10-25 #### Licensing, Authorisation & Market Access Coop Pank AS, a licensed Estonian credit institution, disclosed that Finantsinspektsioon issued a precept following an on-site inspection, requiring it to remediate governance, internal control, risk management, regulatory reporting and lending procedures, with deadlines extending into 2027. The disclosure comes from the bank itself rather than from a located public notice by the supervisor, and the precept does not identify a single narrow failing; it spans governance and operational risk management together, which is a broader remediation scope than a routine conduct finding. For a licensed credit institution, a precept of this breadth sits closer to a supervisory intervention on the institution's overall control environment than a point enforcement action, and the multi-year remediation horizon into 2027 signals that Finantsinspektsioon expects structural rather than immediate fixes. This is the only licensing or authorisation-relevant development identified for Estonia. It does not, on the evidence available, indicate a change to Estonia's licensing regime itself, the authorisation criteria for banks or payment and e-money institutions, or market-access conditions; rather, it is a supervisory action against one named institution operating under its existing licence. #### Outlook The deadlines attached to the Coop Pank precept run into 2027, making the bank's remediation trajectory a standing item to track across coming cycles. Firms and counterparties with exposure to Coop Pank, or to the Estonian banking market more broadly, should expect further disclosure as remediation milestones are reached, though whether Finantsinspektsioon itself will issue a public notice beyond the bank's own disclosure is not yet known. 2 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access Estonia's payment-institution and e-money-institution licensing process changed procedurally from 18 March 2026, when Finantsinspektsioon began requiring all applications for a PI/EMI operating licence to be submitted through its online application portal, rather than through whatever prior submission channel applicants had previously used. This is a T1, regulator-sourced procedural change, distinct from a change to the substantive licensing statute itself, which remains unaltered. Alongside this procedural shift, market-practice commentary indicates Finantsinspektsioon has intensified its substance-of-operations expectations for EMI, PI, and CASP applicants and existing licence-holders, now expecting demonstrable local presence, genuine management, and operational readiness, ahead of or alongside the 2026 MiCA cutover affecting adjacent crypto-asset licensees. This finding carries lower confidence than the portal-mandate change: it rests on a single T3 commentary source and has not been independently corroborated by a T1 regulatory statement this cycle. If borne out in practice, it would represent a meaningful tightening of the practical bar for non-bank payment institutions and e-money institutions seeking Estonian authorisation, distinguishing more clearly between applicants with genuine Estonian operational substance and those seeking a purely nominal EEA licensing base. Carrying the bank-PSP versus non-bank-PI/EMI distinction forward: both changes described here bear specifically on the non-bank PI/EMI/CASP licensing track overseen by Finantsinspektsioon, rather than on bank-PSP prudential licensing, which operates under a separate supervisory track not addressed by either development this cycle. #### Outlook The substance-of-operations tightening is the item to watch most closely: confirmation via an actual licensing refusal, renewal condition, or T1 regulatory statement would upgrade this from an uncertain, single-source finding to a confirmed supervisory-practice shift. The portal-mandate change is already settled and requires no further monitoring beyond ensuring applicant awareness. Periodic update · new data 2026-09-11 #### Licensing, Authorisation & Market Access Finantsinspektsioon (the FSA) is Estonia's sole licensing authority for Payment Institutions and Electronic Money Institutions under the Payment Institutions and E-money Institutions Act, and has also served as the sole MiCA CASP authorisation authority since 1 July 2024. This cycle produced the first instance of a single entity holding both authorisation types simultaneously: on 19 June 2026, the FSA granted Lightspark Payments Europe AS a dual MiCA CASP and EMI licence, the first such combined authorisation issued in Estonia. This is a market-access precedent worth tracking, since it demonstrates that Estonia's licensing architecture, though administered by a single authority, has historically kept crypto-asset and e-money authorisation tracks operationally separate; a single entity clearing both bars concurrently signals both regulatory capacity to process combined applications and commercial appetite for combined authorisation among applicants. Estonian Payment Institutions remain authorised to provide all eight PSD2 payment-service categories with full EU/EEA passporting rights, a standing scope-of-authorisation fact that continues to underpin Estonia's position as an EU payments-licensing hub. Separately, and distinctly from the PI/EMI licensing track, Estonia's VASP-to-CASP legacy transition for crypto-adjacent payment and custody activity reaches its hard backstop on 1 July 2026. Legacy licences issued under the prior FIU-administered regime will cease to be valid at that point, with no automatic conversion into MiCA CASP status; affected firms must independently secure new authorisation from the FSA to continue operating. The combination of these three facts, an active dual-authorisation precedent, standing PSD2 passporting breadth, and an approaching legacy-licence cliff-edge, frames Estonia's market-access environment this cycle as one of active reconfiguration rather than settled stability. #### Outlook The 1 July 2026 backstop is the immediate date to track: the volume of firms securing new CASP authorisation ahead of that date, relative to the size of the legacy licensee base, will determine whether Estonia's crypto-adjacent payments market experiences an orderly transition or a supply-side contraction. The Lightspark dual-licence precedent may also indicate a template other applicants pursue ahead of the backstop. Evidence 6 Sources and findings (6) - T1[https://www.fi.ee/en/payment-and-e-money-services/applying-operating-licence-payment-services/operating-licences-payment-institutions-and-e-money-institutions](https://www.fi.ee/en/payment-and-e-money-services/applying-operating-licence-payment-services/operating-licences-payment-institutions-and-e-money-institutions)retrieved 2026-07-04 - T3[https://www.buckinghamcapitalconsulting.com/post/2019/08/09/how-to-apply-for-payment-institution-or-electronic-money-institution-emi-license-in-eston](https://www.buckinghamcapitalconsulting.com/post/2019/08/09/how-to-apply-for-payment-institution-or-electronic-money-institution-emi-license-in-eston)retrieved 2026-07-04 - T3[https://www.complywise.ee/fintech-law-and-compliance/financial-licenses/e-money-license-in-estonia/](https://www.complywise.ee/fintech-law-and-compliance/financial-licenses/e-money-license-in-estonia/)retrieved 2026-07-04 - T1[https://www.fi.ee/en/payment-and-e-money-services](https://www.fi.ee/en/payment-and-e-money-services)retrieved 2026-07-04 - T1[https://www.riigiteataja.ee/en/eli/514052014002/consolide](https://www.riigiteataja.ee/en/eli/514052014002/consolide)retrieved 2026-07-04 - T3[https://hacken.io/discover/estonia-crypto-license/](https://hacken.io/discover/estonia-crypto-license/)retrieved 2026-07-04 ### W1bConduct, Safeguarding & Promotions1 gaplimited signalProbableconfirmed 2026-07-04▾# Safeguarding follows the standard EMD2/PSD2 approach overseen by Finantsinspektsioon with EBA outsourcing guidance adopted; consumer conduct splits between Finantsinspektsioon and the Consumer Protection and Technical Regulatory Authority. Open gap — wpm-int-1 796 SE exact Riigikogu reading stage and expected adoption/commencement date not confirmed from a primary dated source. Merchant-acquiring/scheme-dispute vector under-indexed per bias-correction guidance; recommend a targeted search next cycle. Horizon · 2026-Q4 (± six months) 796 SE distance-marketing/dark-pattern transposition pending Proposed · Tier 1 source Standing sub-brief · as of 4 July 2026 189 words · last cycle 2026-10-25 #### Conduct, Safeguarding & Financial Promotions Finantsinspektsioon confirms that the EBA Guidelines on outsourcing arrangements (25 February 2019) — covering audit rights, data security and location, sub-outsourcing and exit strategies — apply to Estonian credit institutions, EMIs and PIs alike; this outsourcing baseline now sits underneath, and is being extended by, DORA. Consumer-facing conduct supervision itself is split: Finantsinspektsioon retains prudential oversight while the Consumer Protection and Technical Regulatory Authority handles general consumer-facing conduct issues under the Consumer Protection Act, a bifurcated model distinct from the single-regulator approach used elsewhere in this monitor's coverage. On safeguarding, Estonian EMIs apply the standard EMD2/PSD2 mechanism — segregation of customer e-money funds plus an own-funds backstop — overseen by Finantsinspektsioon alongside the EUR350,000 capital floor; the specific account-structure detail beneath that segregation requirement was not itemised in sourced findings this cycle and is logged as a gap for future refinement. #### Outlook The live item to watch in this module is less a new rule than an implementation one: safeguarding-account structural specifics remain under-documented, and next cycle should look for FSA guidance or enforcement action that clarifies the mechanism beyond the generic EMD2/PSD2 description. Read full sub-brief · 189 words Periodic update · new data 2026-10-25 #### Conduct, Safeguarding & Financial Promotions A bill, 796 SE, is progressing through the Riigikogu to transpose the EU's distance-marketing-of-financial-services directive into Estonian law. As currently described, the bill would place limits on manipulative interface design, commonly termed dark patterns, within distance contracts for financial services, and would give consumers a right to request contact with a human representative rather than being restricted to an automated channel such as a chatbot. This is a conduct-of-business and consumer-facing measure rather than a prudential one: it would reach into how financial-services firms design their digital sales journeys and how they route customer contact, which has direct relevance for payment and e-money institutions selling or servicing products at a distance in Estonia. The precise legislative stage the bill has reached, and its expected date of adoption or commencement, have not been confirmed from a primary dated source as at the close of this cycle. The transposition obligation itself derives from an EU directive, so firms operating across the EU single market under passporting arrangements should expect broadly comparable conduct requirements to emerge in other member states on their own transposition timetables, even where Estonia's own bill has not yet reached a confirmed stage. #### Outlook The item to track is 796 SE's progress through the Riigikogu to a confirmed reading stage and adoption date, which will fix when the dark-pattern prohibitions and the human-contact right become binding obligations on firms marketing financial services at a distance in Estonia. Firms with distance-sales or chatbot-based customer service channels serving Estonian consumers should treat this as a near-term conduct requirement in development, pending confirmation of its commencement date. Evidence 5 Sources and findings (5) - T3[https://www.buckinghamcapitalconsulting.com/post/2019/08/09/how-to-apply-for-payment-institution-or-electronic-money-institution-emi-license-in-eston](https://www.buckinghamcapitalconsulting.com/post/2019/08/09/how-to-apply-for-payment-institution-or-electronic-money-institution-emi-license-in-eston)retrieved 2026-07-04 - T2[https://d1.awsstatic.com/fs-compliance-center/pdf-summaries/estonia.pdf](https://d1.awsstatic.com/fs-compliance-center/pdf-summaries/estonia.pdf)retrieved 2026-07-04 - T1[https://www.fi.ee/en/estonian-financial-supervision-and-resolution-authority](https://www.fi.ee/en/estonian-financial-supervision-and-resolution-authority)retrieved 2026-07-04 - T1[https://mkm.ee/en/consumer-protection](https://mkm.ee/en/consumer-protection)retrieved 2026-07-04 - T1[https://www.riigiteataja.ee/en/eli/514052014002/consolide](https://www.riigiteataja.ee/en/eli/514052014002/consolide)retrieved 2026-07-04 ### W2Stablecoins & Digital MoneyProbableconfirmed 2026-07-04▾# Estonia rebased its virtual-asset regime onto MiCA via the CMA (in force 1 July 2024); FIU-to-Finantsinspektsioon supervisory shift; transition window to 1 July 2026; zero domestic CASP authorisations as of the last available (August 2025) snapshot. Horizon · 2026-03-18 (± a quarter) Estonian FSA CASP-application online-portal filing becomes mandatory In force · Tier 1 source Horizon · 2026-07-01 (± a quarter) MiCA/CMA transition deadline: legacy FIU-issued VASP licences expire In force · Tier 3 source Horizon · 2026-03-18 (± a quarter) Estonian FSA CASP-application online-portal filing becomes mandatory In force · Tier 1 source Standing sub-brief · as of 4 July 2026 177 words · last cycle 2026-07-04 #### Stablecoins & Digital Money Estonia's Crypto Asset Market Act entered into force on 1 July 2024, rebasing domestic virtual-asset regulation onto MiCA and DORA and shifting CASP supervision from the Financial Intelligence Unit to Finantsinspektsioon; legacy FIU-issued VASP licences remain valid only until 1 July 2026. As of August 2025, the most recent available snapshot, zero domestic CASP authorisations had been granted, while 25 providers were registered to operate cross-border into Estonia — a gap between cross-border reach and domestic authorisation capacity that has not been re-verified since, despite the transition deadline having since passed. This cliff-edge structure creates a near-term authorisation risk: firms relying on legacy VASP status must complete CASP authorisation or exit the market, and the absence of a refreshed post-deadline count leaves open whether the domestic pipeline has cleared. #### Outlook The immediate priority for next cycle is re-verification of the current domestic CASP-authorisation count now that the 1 July 2026 transition deadline has passed, alongside monitoring of Finantsinspektsioon's mandatory online CASP-application portal (live since 18 March 2026) for filing volumes and processing times. Read full sub-brief · 177 words no periodic updates on record for this sub-brief Evidence 6 Sources and findings (6) - T3[https://charltonsquantum.com/estonia-virtual-assets-regulation/](https://charltonsquantum.com/estonia-virtual-assets-regulation/)retrieved 2026-07-04 - T1[https://www.fi.ee/en/investeerimine/investeerimisvaldkonna-tegevuslubade-taotlemine/kruptovaraturu-tegevusluba](https://www.fi.ee/en/investeerimine/investeerimisvaldkonna-tegevuslubade-taotlemine/kruptovaraturu-tegevusluba)retrieved 2026-07-04 - T3[https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/estonia](https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/estonia)retrieved 2026-07-04 - T3[https://manimama.eu/mica-implementation-in-estonia/](https://manimama.eu/mica-implementation-in-estonia/)retrieved 2026-07-04 - T3[https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/estonia](https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/estonia)retrieved 2026-07-04 - T3[https://hacken.io/discover/estonia-crypto-license/](https://hacken.io/discover/estonia-crypto-license/)retrieved 2026-07-04 ### W3Operational Resilience & Critical InfrastructureProbableconfirmed 2026-07-04▾# DORA applies directly in Estonia since 17 January 2025 with Finantsinspektsioon as NCA across banks, PIs, EMIs and CASPs. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/estonia/) Standing sub-brief · as of 4 July 2026 129 words · last cycle 2026-07-04 #### Operational Resilience & Critical Infrastructure Finantsinspektsioon acts as the national competent authority for DORA (Regulation (EU) 2022/2554), applicable in Estonia since 17 January 2025 and covering ICT risk management, incident reporting, resilience testing and third-party oversight across banks, payment institutions, e-money institutions and crypto-asset service providers alike. Incident-classification and reporting timelines run on a four-to-24-hour initial notification, a 72-hour intermediate report and a one-month final report, per Finantsinspektsioon's published guidance. DORA now functions as the operational baseline that supersedes and extends the EBA's 2019 outsourcing guidelines carried forward from the pre-DORA conduct regime (see W1b). #### Outlook No material DORA-implementation disputes or enforcement actions were identified for Estonia this cycle; the module is treated as an established, stable baseline pending any incident-reporting enforcement action that would surface DORA's practical bite. Read full sub-brief · 129 words no periodic updates on record for this sub-brief Evidence 5 Sources and findings (5) - T3[https://www.cyadviso.com/dora-estonia-finantsinspektsioon](https://www.cyadviso.com/dora-estonia-finantsinspektsioon)retrieved 2026-07-04 - T1[https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora) Applies beyond this jurisdiction (EU)retrieved 2026-07-04 - T3[https://copla.com/blog/compliance-regulations/dora-regulations-in-estonia-and-impact-for-all-industries/](https://copla.com/blog/compliance-regulations/dora-regulations-in-estonia-and-impact-for-all-industries/)retrieved 2026-07-04 - T2[https://d1.awsstatic.com/fs-compliance-center/pdf-summaries/estonia.pdf](https://d1.awsstatic.com/fs-compliance-center/pdf-summaries/estonia.pdf)retrieved 2026-07-04 - T3[https://manimama.eu/mica-implementation-in-estonia/](https://manimama.eu/mica-implementation-in-estonia/)retrieved 2026-07-04 ### W4Scheme & Network ComplianceProbableconfirmed 2026-07-04▾# Card-scheme participation runs through direct principal membership (Wallester/Visa) and indirect BaaS scheme access (LHV); PCI DSS Level 1 used as a trust signal. Standing sub-brief · as of 4 July 2026 149 words · last cycle 2026-07-04 #### Scheme & Network Compliance Wallester holds a Visa Principal Membership carrying direct network access to issue cards, is PCI DSS Level 1 certified, and is licensed by Finantsinspektsioon — a direct-principal-membership route that is comparatively rare for a non-bank EMI and is used competitively as a trust signal in a market where most e-money institutions rely on sponsor-bank access. LHV, by contrast, provides indirect card-scheme access and collection services to roughly 200 fintech partners as a member of major UK and EU payment schemes, illustrating the bank-PSP route to scheme participation that non-banks typically cannot access directly. Both models coexist without apparent friction, giving Estonian PSPs a genuine choice between direct-membership cost/complexity and indirect-access speed/simplicity. #### Outlook No Estonia-specific interchange-fee enforcement action or domestic card-scheme rule dispute was identified this cycle — a coverage gap flagged for a targeted search next cycle rather than a substantive absence of scheme tension. Read full sub-brief · 149 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T2[https://wallester.com/](https://wallester.com/)retrieved 2026-07-04 - T3[https://thepaypers.com/fintech/interviews/transforming-digital-banking-and-instant-payments-the-lhv-story](https://thepaypers.com/fintech/interviews/transforming-digital-banking-and-instant-payments-the-lhv-story)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/payments/payment-and-settlement-systems](https://www.eestipank.ee/en/payments/payment-and-settlement-systems)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/payment-systems/oversight-payment-and-settlement-systems](https://www.eestipank.ee/en/payment-systems/oversight-payment-and-settlement-systems)retrieved 2026-07-04 ### W5Payment Corridor DynamicsConfirmedconfirmed 2026-07-04▾# Estonia's corridor infrastructure is fully integrated into pan-European rails: TARGET2-Eesti/T2, STEP2, RT1/TIPS; top-3 banks cover ~95% of domestic transfers. Horizon · 2026-11 (± a quarter) SEPA Instant Payments Regulation — ISO 20022 structured-address enforcement milestone Adopted · Tier 3 source Horizon · 2027-04 (± six months) SEPA Instant Payments Regulation — EMI/PI compliance deadline Adopted · Tier 3 source Standing sub-brief · as of 4 July 2026 145 words · last cycle 2026-09-28 #### Payment Corridor Dynamics Estonia's corridor infrastructure is fully integrated into pan-European settlement rails: TARGET2-Eesti/T2 for large-value settlement, STEP2 for batch SEPA credit transfers, and RT1/TIPS for instant payments, reflecting full euro-area membership since 2011 and SEPA membership since 2014. Swedbank, SEB and LHV together cover roughly 95% of interbank and intrabank credit transfers within Estonia, a concentration that matters as much for resilience analysis as for market-structure analysis given how much of the country's payment flow runs through three institutions. The corridor structure itself has not changed this cycle; Estonia's position as a fully harmonised euro-area participant leaves little room for jurisdiction-specific corridor differentiation. #### Outlook No corridor-access changes were identified for Estonia this cycle. The module is treated as a stable, low-differentiation baseline — commercial competition in Estonian payments concentrates instead in the BaaS and embedded-finance layers built atop these shared rails (see W6, W9). Read full sub-brief · 145 words Periodic update · new data 2026-09-28 #### Payment Corridor Dynamics Estonian banks apply materially different SEPA Instant transaction limits, ranging from EUR 15,000 at the more conservative end up to the EUR 100,000 SCT Inst scheme ceiling adopted by more permissive institutions, across major participants including Swedbank, SEB, LHV, and Coop Pank. This variation exists within a single supranational instant-payments scheme and reflects differing institutional risk appetites rather than a regulatory floor or ceiling difference, since the SCT Inst scheme itself sets EUR 100,000 as the maximum permissible limit, not a mandatory one. This corridor-level variation sits against the backdrop of the EU Instant Payments Regulation, Regulation (EU) 2024/886, which obliged all EU payment service providers, including Estonian PSPs, to be able to receive SEPA instant credit transfers from January 2025 and to send them from October 2025. Both deadlines fall within this baseline window and have already passed, meaning the underlying capability mandate is now a settled, in-force feature of the Estonian payments landscape; what remains variable is the transaction-limit ceiling each institution chooses to apply within that mandate rather than whether instant-payment capability exists at all. The practical consequence for payment flows through Estonia is that a transaction routed through a lower-limit institution may need to be split or routed differently than an equivalent transaction through a higher-limit institution, a friction point for high-value SEPA Instant use cases that does not exist to the same degree in corridors where all major PSPs have converged on the scheme ceiling. #### Outlook Watch whether competitive or supervisory pressure narrows the spread between the EUR 15,000 and EUR 100,000 limits currently observed across major Estonian PSPs, which would indicate convergence toward the SCT Inst ceiling as a market norm rather than an institution-specific risk decision. Evidence 5 Sources and findings (5) - T1[https://www.eestipank.ee/en/estonian-payment-market](https://www.eestipank.ee/en/estonian-payment-market)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/payments/target-services](https://www.eestipank.ee/en/payments/target-services)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/payments/tips](https://www.eestipank.ee/en/payments/tips)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/payments/rt1-instant-payment-system](https://www.eestipank.ee/en/payments/rt1-instant-payment-system)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/press/new-tips-system-will-make-instant-payments-more-affordable-smaller-banks-30112018](https://www.eestipank.ee/en/press/new-tips-system-will-make-instant-payments-more-affordable-smaller-banks-30112018)retrieved 2026-07-04 ### W6Industry Structure & CommercialProbableconfirmed 2026-07-04▾# Foreign-capital-dominated banking sector (Swedbank, SEB, Luminor, LHV) alongside a disproportionately significant fintech ecosystem (Wise, Veriff, Salv, Montonio, Wallester, Inbank, Lightyear). Standing sub-brief · as of 4 July 2026 186 words · last cycle 2026-10-18 #### Industry Structure & Commercial Dynamics Estonia's banking sector remains foreign-capital-dominated, led by Swedbank, SEB, Luminor — the largest, via the DNB/Nordea Baltic merger — and LHV; Swedbank alone held 26.66% market share by total assets (EUR15.76 billion) in 2025. LHV has emerged as the domestically-owned challenger within that structure, and by one estimate facilitates roughly 7% of all instant transfers across Europe through its banking-as-a-service model serving 200-plus fintech clients including Coinbase, TrueLayer, Currency Cloud and Wise — though a more recent source cites a higher ~8% figure, and reconciliation of the two figures is recommended next cycle. That BaaS scale makes LHV a systemically significant single point of commercial and operational dependency for the Baltic and wider European fintech ecosystem, concentrating both competitive advantage and single-point-of-failure risk in one institution. #### Outlook The LHV concentration is the structural theme to track across this module: any operational disruption at LHV would propagate commercial impact well beyond Estonia's borders given its 200-plus-client BaaS book. Watch also for continued Baltic fintech-acquisition activity amid scarce new licences, though no completed Estonia-specific PI/EMI transaction was identified within the trailing 12 months. Read full sub-brief · 186 words Periodic update · new data 2026-10-18 #### Industry Structure & Commercial Dynamics The European Commission's clearance of OTP Bank Nyrt.'s acquisition of sole control of Luminor Holding AS (Case M.12586) is a consolidation event for Estonia's banking and payments industry structure. Luminor, registered in Tallinn and the third-largest pan-Baltic bank, moves from ownership by a Blackstone-managed private-equity consortium and DNB Bank into the ownership of OTP, a Central European banking group. OTP's own materials describe the transaction as its entry into the Baltic markets, expanding its footprint to fourteen countries, increasing total group assets by more than ten percent, and raising the share of group operations conducted within the euro zone to fifty percent. The transaction was signed 20 July 2026 and cleared 13 October 2026; the purchase price has not been publicly disclosed. The industry-structure significance of this transaction lies in the ownership-model shift it represents: Luminor's prior owners were a private-equity consortium together with a Nordic banking group, a structure associated with eventual divestment horizons; its new owner is a strategic, geographically-diversifying Central European banking group for whom the Baltic region now forms a core part of a fourteen-country footprint. This is a different commercial logic from the prior ownership and is likely to shape how Luminor's payment-services and banking operations are integrated, resourced, and prioritised going forward, though no integration plan or operational detail was identified in sources reviewed this cycle. No bank-versus-non-bank distinction is material to this development, since both the acquirer and the target are licensed banking groups rather than non-bank payment institutions. No competition-specific condition was identified as attached to the clearance, which the Commission processed under its simplified procedure, a route reserved for transactions the Commission does not consider likely to raise serious doubts as to compatibility with the internal market. That procedural choice indicates the Commission's own assessment of limited competitive overlap or concern, independent of any other regulatory consideration. #### Outlook The next visible milestone for Estonia's industry structure will be how OTP folds Luminor's existing payment-services and banking operations into its wider group architecture across its now fourteen-country footprint, and whether that integration produces any visible change in Luminor's product offering, branding, or operational model in the Estonian market. No specific integration timeline has been disclosed in sources reviewed. 1 earlier distinct update(s) Periodic update · new data 2026-09-11 #### Industry Structure & Commercial Dynamics Estonia's payments and fintech industry structure is undergoing substance-driven consolidation this cycle. Finantsinspektsioon now expects demonstrable local presence, genuine management, and operational readiness as preconditions for granting or maintaining Payment Institution, Electronic Money Institution, or MiCA CASP authorisation. This represents a shift in supervisory emphasis toward the operational substance of licensed entities rather than nominal compliance with registration requirements alone. The practical commercial effect of this tightened expectation is consolidation pressure: entities without genuine local operational substance face a materially higher bar to obtain or retain authorisation, which favours better-capitalised or more operationally embedded firms over thinly-resourced registration-only entrants. This dynamic is directly evidenced by the market's first dual MiCA CASP plus EMI authorisation, granted to Lightspark Payments Europe AS on 19 June 2026, which required the firm to clear both the FSA's payment-institution substance bar and its crypto-asset authorisation bar concurrently. This structural shift should be read alongside the approaching 1 July 2026 legacy-licence backstop for crypto-adjacent payment and custody activity: firms facing both the substance-expectation tightening and the legacy-licence cliff-edge simultaneously are under compounding pressure to demonstrate genuine operational readiness within a compressed timeframe. #### Outlook Expect continued consolidation pressure through the remainder of this cycle as the FSA's substance expectations interact with the 1 July 2026 legacy-licence backstop. The rate at which additional dual- or single-authorisation grants follow the Lightspark precedent will be a useful indicator of how quickly the market is adapting to the FSA's tightened posture. Evidence 5 Sources and findings (5) - T3[https://thebanks.eu/banks/12997](https://thebanks.eu/banks/12997)retrieved 2026-07-04 - T3[https://wise.com/gb/blog/banks-in-estonia](https://wise.com/gb/blog/banks-in-estonia)retrieved 2026-07-04 - T3[https://surefintech.eu/fintech-in-the-baltic-states-2026-key-trends-and-players/](https://surefintech.eu/fintech-in-the-baltic-states-2026-key-trends-and-players/)retrieved 2026-07-04 - T3[https://bankingfrontiers.com/estonias-lhv-bank-prioritizes-fintechs-smes/](https://bankingfrontiers.com/estonias-lhv-bank-prioritizes-fintechs-smes/)retrieved 2026-07-04 - T3[https://surefintech.eu/fintech-in-the-baltic-states-2026-key-trends-and-players/](https://surefintech.eu/fintech-in-the-baltic-states-2026-key-trends-and-players/)retrieved 2026-07-04 ### W7Legal & LitigationConfirmedconfirmed 2026-07-04▾# Estonia's e-Business Register BO data moves to purpose-based access from 10 July 2026 under TEKSA/6AMLD transposition, ending the historic free-public-lookup model. Horizon · 2026-07-10 (± a quarter) Estonia e-Business Register BO purpose-based access takes effect Adopted · Tier 4 source Standing sub-brief · as of 4 July 2026 210 words · last cycle 2026-08-05 #### Legal & Litigation The Danske Bank Estonia branch processed approximately EUR200 billion in suspicious non-resident transactions between 2007 and 2015, prompting an Estonian FSA precept and the branch's 2019 market exit, and generating more than $2 billion in global US and Danish settlements in 2022. That legacy continues to generate fresh litigation: in September 2024 the Harju County Court annulled a EUR300,000 FIU sanctions-enforcement fine against AS LHV Pank, in force from 1 October 2024, ruling that the FIU had not adequately demonstrated individual board-member breach of due-diligence duties over roughly EUR2.2 million in Russia-sanctions-linked payments. That annulment is notable given LHV's own reputation as the most conservative of Estonia's four largest banks on Russia-linked wind-down, signalling judicial pushback on FIU evidentiary standards even where the underlying institution is not considered a lax actor. Separately, Finantsinspektsioon fined AS SEB Pank in 2020 for AML-rule breaches identified during a 2019 on-site inspection, an action coordinated with Swedish and Lithuanian supervisors and carrying escalating penalties of up to EUR100,000 for repeat breaches. #### Outlook The Harju County Court's evidentiary-standard ruling is the item to watch: it may embolden further challenges to FIU sanctions-enforcement actions, creating friction between aggressive AML/sanctions enforcement and due-process requirements that could shape how Estonian courts handle future enforcement appeals. Read full sub-brief · 210 words Periodic update · new data 2026-09-08 #### Legal & Litigation Estonia's e-Business Register moved from free public lookup of beneficial-ownership data to a purpose-based access model effective 10 July 2026. Access is now limited to competent authorities, obliged entities conducting due diligence, contractual partners, and parties able to demonstrate a legitimate interest; unauthenticated public users can no longer freely view beneficial-owner details. This is an Assessed-confidence finding sourced from a single Tier-4 legal-advisory account, with no Ministry of Finance primary publication or underlying legislative text yet retrieved to confirm the precise access criteria or transition mechanics. For payment institutions and e-money institutions, the legal consequence is direct: onboarding and counterparty due-diligence processes that have relied on frictionless public UBO lookup for Estonian corporate entities now require a documented legitimate-interest basis or obliged-entity status to retain equivalent access from 10 July 2026 onward. This is a change to underlying legal-access plumbing rather than a change to the substantive beneficial-ownership disclosure obligations themselves. #### Outlook The item to watch is how quickly institutions relying on Estonian counterparty data can establish documented access workflows without disrupting onboarding timelines, and whether the underlying TEKSA legislative text, once retrieved, changes the assessment of who qualifies as a legitimate-interest claimant in practice. Evidence 5 Sources and findings (5) - T1[https://www.fi.ee/en/news/seb-pank-fined-breaches-anti-money-laundering-rules](https://www.fi.ee/en/news/seb-pank-fined-breaches-anti-money-laundering-rules)retrieved 2026-07-04 - T1[https://fiu.ee/en/news/fine-eu300000-against-lhv-has-been-annulled](https://fiu.ee/en/news/fine-eu300000-against-lhv-has-been-annulled)retrieved 2026-07-04 - T2[https://danskebank.com/investigations](https://danskebank.com/investigations)retrieved 2026-07-04 - T3[https://charltonsquantum.com/wp-content/uploads/docs/estonia-crypto-guide.pdf](https://charltonsquantum.com/wp-content/uploads/docs/estonia-crypto-guide.pdf)retrieved 2026-07-04 - T3[https://en.wikipedia.org/wiki/Danske_Bank_money_laundering_scandal](https://en.wikipedia.org/wiki/Danske_Bank_money_laundering_scandal)retrieved 2026-07-04 ### W8Merchant Acquiring & RiskProbableconfirmed 2026-07-04▾# Merchant acquiring delivered by domestic banks (LHV) and EMI/card-issuing platforms (Wallester); safeguarding-account/virtual-IBAN structures support orchestration players like Montonio. Standing sub-brief · as of 4 July 2026 144 words · last cycle 2026-07-04 #### Merchant Acquiring & Risk LHV operates the merchant-acquiring infrastructure — 3-D Secure, bank-link/QR redirect, Nets Estonia-certified POS — that underpins Montonio's merchant settlement via virtual IBANs and safeguarded client-fund segregation, illustrating how bank-provided settlement rails support non-bank orchestration platforms operating on top of them. High-risk-sector merchants in Estonia — crypto-adjacent, forex, gaming and payment-processing businesses — are directed toward international EMI acquiring solutions rather than conservative domestic bank acquiring, reflecting the continued de-risking posture of traditional Estonian banks toward higher-risk merchant category codes. The result is a two-tier acquiring market: bank-anchored acquiring for conventional retail merchants, and EMI-anchored acquiring for higher-risk or internationally-oriented ones. #### Outlook No Estonia-specific interchange-fee dispute or acquiring-rule enforcement action was identified this cycle; the module's structure — bank infrastructure underneath non-bank orchestration, EMI acquiring for de-risked merchant categories — is treated as stable pending any shift in bank risk appetite. Read full sub-brief · 144 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T2[https://www.lhv.ee/en/payment-acquiring](https://www.lhv.ee/en/payment-acquiring)retrieved 2026-07-04 - T3[https://bankingfrontiers.com/estonias-lhv-bank-prioritizes-fintechs-smes/](https://bankingfrontiers.com/estonias-lhv-bank-prioritizes-fintechs-smes/)retrieved 2026-07-04 - T2[https://wallester.com/](https://wallester.com/)retrieved 2026-07-04 - T3[https://binderr.com/marketplace/ee/open-a-business-bank-account-in-estonia](https://binderr.com/marketplace/ee/open-a-business-bank-account-in-estonia)retrieved 2026-07-04 ### W9Product Innovation & Market DevelopmentProbableconfirmed 2026-07-04▾# Estonia's crypto-asset regime has fully transitioned to MiCA: legacy FIU VASP licences invalid from 1 July 2026; Finantsinspektsioon is sole CASP authority; FIU continued interim enforcement (BB Trade Estonia OÜ revocation, 29 June 2026). Horizon · 2026-07-01 (± a quarter) Estonia MiCA CASP mandatory transition completes, legacy VASP licences invalid Adopted, not yet in force · Tier 1 source Standing sub-brief · as of 4 July 2026 158 words · last cycle 2026-09-11 #### Product Innovation & Market Development Estonia's e-Residency programme continues to drive fintech formation: nearly half of newly founded Estonian startups now involve an e-resident, up from 38% in 2023, sustaining a persistent company-formation pipeline distinctive to the country's digital-government infrastructure. On the product side, Wallester's 2025 roadmap extended its white-label card-issuing and embedded-finance suite with 24/7 instant currency exchange across ten currencies and direct Xero/QuickBooks accounting integrations, broadening the product surface available to its EMI and card-issuing clients. Together these threads describe a product-innovation environment where digital-identity infrastructure feeds a steady company pipeline and embedded-finance providers compete on feature breadth atop the shared regulatory and settlement baseline. #### Outlook Expect continued incremental product expansion from Wallester and peers rather than a single step-change; the more consequential product-access story for Estonia over the medium term sits in the MiCA-aligned crypto space (W2) and in LHV's BaaS product surface (W6), both of which structurally shape what non-bank product innovation is possible. Read full sub-brief · 158 words Periodic update · new data 2026-09-11 #### Product Innovation & Market Development Estonia's fintech and PSP sector continues to see product and market development converge around dual EMI/PI plus MiCA CASP authorisation as a combined operating model, rather than firms pursuing crypto-asset and payment-institution licensing as separate, sequential tracks. This convergence is a direct product of Finantsinspektsioon's raised expectations for genuine local operational substance over nominal registration, which appears to be pushing market entrants toward combined-authorisation structures capable of demonstrating operational readiness across both regulatory perimeters simultaneously. The Lightspark Payments Europe AS dual-licence grant on 19 June 2026 stands as the first concrete instance of this combined-model approach succeeding at the FSA, and represents a structural development in how payment and crypto-asset products may be architected and licensed together in Estonia going forward, distinct from any single product launch. #### Outlook The key development to track is whether the dual-authorisation model becomes a standard market-entry template in Estonia or remains an isolated precedent; this will depend substantially on how quickly other applicants can meet the FSA's substance-readiness bar across both the payments and crypto-asset authorisation tracks simultaneously. 1 earlier distinct update(s) Periodic update · new data 2026-09-08 #### Product Innovation & Market Development Estonia's legacy VASP licensing regime became fully invalid from 1 July 2026. Finantsinspektsioon's MiCA CASP authorisation is now the sole valid pathway for crypto-asset service provision in Estonia, and there is no automatic grandfathering for firms that held a licence under the prior FIU-administered regime. This is a High-confidence, Tier-1-sourced finding corroborated by the Estonian Ministry of Finance and the FATF/MONEYVAL follow-up report. For product and market-development teams, the practical effect is that any Estonia-linked crypto-asset offering must now be built on, or migrating toward, FSA MiCA CASP authorisation rather than the legacy registration-style FIU licence that historically made Estonia an accessible entry point for crypto-asset service providers. The FIU's supervisory posture through the transition itself is a relevant product-risk signal. On 29 June 2026, the FIU revoked the VASP licence of BB Trade Estonia OU, licence FVT000209, for non-compliance with a corrective precept, days ahead of the regime's full sunset. This is a directly sourced primary enforcement action and indicates that the FIU used its remaining legacy authority to close out non-compliant licensees rather than allowing the cutover date to resolve outstanding compliance issues by default. Any partner or product-integration due diligence on an Estonian-licensed crypto counterparty should treat legacy FIU VASP status as fully superseded and verify current standing against the Finantsinspektsioon MiCA CASP register. #### Outlook The open question for market development is how much of Estonia's legacy VASP population completes MiCA CASP authorisation, exits the Estonian market, or seeks authorisation via passporting from another member state; no aggregate transition statistics have been retrieved this cycle. The BB Trade Estonia revocation is one data point suggesting continued FIU enforcement through the transition's final weeks, and further such actions in the immediate aftermath of the 1 July cutover would be the clearest forward indicator of how strictly the no-grandfathering position is being applied. Evidence 5 Sources and findings (5) - T3[https://investinestonia.com/business-opportunities/fintech/](https://investinestonia.com/business-opportunities/fintech/)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/estonian-payment-market](https://www.eestipank.ee/en/estonian-payment-market)retrieved 2026-07-04 - T3[https://tech.eu/2026/03/11/estonia-leads-europe-in-fintech-growth-as-wallester-becomes-the-sector-s-fastest-growing-company/](https://tech.eu/2026/03/11/estonia-leads-europe-in-fintech-growth-as-wallester-becomes-the-sector-s-fastest-growing-company/)retrieved 2026-07-04 - T3[https://charltonsquantum.com/estonia-virtual-assets-regulation/](https://charltonsquantum.com/estonia-virtual-assets-regulation/)retrieved 2026-07-04 - T2[https://lhv.co.uk/acquiring/](https://lhv.co.uk/acquiring/)retrieved 2026-07-04 ### W10Consumer Protection & APP Fraud1 judgmentProbableconfirmed 2026-07-04▾# Consumer protection runs through the Consumer Protection Act/Consumer Disputes Committee plus Eesti Pank fraud-prevention coordination; PSR/PSD3 APP-fraud reform pending domestic transposition. Key judgment — Probable · impact ELEVATED Estonia's new payment-fraud-prevention law represents a material widening of PSP powers: for the first time, banks and payment/e-money institutions have a statutory basis to delay or refuse a suspect payment, and a formal gateway to share fraud-suspicion data with each other, police and CERT-EE. claims: wpm-2026-W43-001 Horizon · 2026-Q4 (± a quarter) 936 SE awaiting Riigi Teataja promulgation Adopted · Tier 1 source Standing sub-brief · as of 4 July 2026 141 words · last cycle 2026-10-25 #### Consumer Protection & APP Fraud Estonia recorded 18,300 card-fraud incidents in 2023, with EUR2.6 million lost and a fraud rate of 4 per 100,000 transactions — below the EU average of 15 — alongside 5,800 fraudulent payment-order transactions totalling EUR10.6 million, a figure comparatively worse than card fraud relative to EU peers. The EU's PSR/PSD3 reform reached provisional political agreement in late 2025, mandating PSP reimbursement for impersonation-fraud victims and platform liability for fraud originating on online platforms, but Estonian domestic transposition has not yet been published, leaving the practical consumer-facing effect of the reform undetermined for now. #### Outlook Watch for Estonia's domestic PSR/PSD3 transposition timeline once published — it will determine when Estonian consumers gain the new reimbursement and platform-liability protections — and for any follow-up Eesti Pank fraud-prevention initiatives building on the payment-order-fraud gap identified in the 2023 data. Read full sub-brief · 141 words Periodic update · new data 2026-10-25 #### Consumer Protection & APP Fraud Estonia's Riigikogu passed 936 SE, a payment-fraud-prevention law, on or about 21 October 2026. The law gives credit institutions and payment and e-money institutions a statutory basis, for the first time, to detect fraud before a payment transaction is executed and to delay or refuse that payment where fraud is suspected. It also establishes a formal gateway for those institutions to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with CERT-EE, Estonia's national computer emergency response team. Credit providers and credit intermediaries gain a parallel right to exchange data specifically in relation to loan fraud. Until this law takes effect, Estonian payment service providers have had no clear legal basis to halt a payment on suspicion of authorised-push-payment fraud; the new power directly addresses that gap and brings Estonia into closer alignment with jurisdictions that already grant providers a hold-and-investigate window. This is a material widening of consumer-facing fraud-prevention capability: it shifts providers from a reactive, post-loss posture, in which a victim's only recourse is after funds have left their account, toward a preventive posture in which a provider can interrupt a suspicious transaction before completion. The data-sharing dimension compounds this, because a provider acting on a fraud suspicion can now draw on, and contribute to, a cross-institutional and law-enforcement-linked pool of fraud intelligence rather than acting on its own transaction data alone. The law has passed the legislature but has not yet been published in the Riigi Teataja, so it is not yet in force; its practical effect for consumers and providers alike depends on that publication, expected toward the end of 2026 as at the close of this cycle. #### Outlook The near-term marker is formal publication of 936 SE, which will fix its entry-into-force date and convert the current prospective power into an operative one. Once operative, the material question for consumer-protection purposes is how quickly and how visibly providers begin using the hold power in practice, and whether complaint or dispute volumes around authorised-push-payment fraud in Estonia begin to shift as a result. Providers should also expect that the new data-sharing gateway will generate operational questions about retention, access and onward use of fraud-suspicion data shared with police and CERT-EE, which sit alongside, rather than replace, existing fraud-reporting duties. Evidence 5 Sources and findings (5) - T1[https://www.eestipank.ee/en/press/estonian-payment-forum-searched-ways-preventing-payment-fraud-16012025](https://www.eestipank.ee/en/press/estonian-payment-forum-searched-ways-preventing-payment-fraud-16012025)retrieved 2026-07-04 - T1[https://mkm.ee/en/consumer-protection](https://mkm.ee/en/consumer-protection)retrieved 2026-07-04 - T1[https://www.eesti.ee/eraisik/en/artikkel/consumer-protection/settlement-of-disputes/settlement-of-disputes-at-the-consumer-disputes-committee](https://www.eesti.ee/eraisik/en/artikkel/consumer-protection/settlement-of-disputes/settlement-of-disputes-at-the-consumer-disputes-committee)retrieved 2026-07-04 - T1[https://www.europarl.europa.eu/news/en/press-room/20251121IPR31540/payment-services-deal-more-protection-from-online-fraud-and-hidden-fees](https://www.europarl.europa.eu/news/en/press-room/20251121IPR31540/payment-services-deal-more-protection-from-online-fraud-and-hidden-fees) Applies beyond this jurisdiction (EU)retrieved 2026-07-04 - T1[https://www.eestipank.ee/en/press/estonian-payment-forum-searched-ways-preventing-payment-fraud-16012025](https://www.eestipank.ee/en/press/estonian-payment-forum-searched-ways-preventing-payment-fraud-16012025)retrieved 2026-07-04 ### W11AML/CFT & Financial Crime1 gapSourced from Sentinel.gi ↗Confirmedconfirmed 2026-07-04▾# Defined by the Danske Bank Estonia scandal and its post-2018 AML/CFT reform legacy, with continuing enforcement follow-on (SEB 2020, LHV 2024); FATF/MONEYVAL 2022 broadly compliant. Open gap — wpm-int-2 Sentinel-fed W11 AML/CFT content for Estonia was not available this cycle; awaiting primary source. no under-indexing note recorded Standing sub-brief · as of 4 July 2026 152 words · last cycle 2026-07-04 #### AML/CFT & Financial Crime This module is sourced from Sentinel.gi and is carried here for attribution rather than original analysis. The Danske Bank Estonia branch generated approximately EUR200 billion in suspicious flows between 2007 and 2015, a scandal that drove Estonia's post-2018 AML/CFT reform: strengthened Financial Intelligence Unit powers and tightened virtual-asset-service-provider regulation from 2020. Estonia was assessed compliant on 7 and largely compliant on 18 of the FATF's 40 Recommendations in its 2022 FATF/MONEYVAL Mutual Evaluation. Original illicit-finance and sanctions-evasion analysis of these findings is routed to the Financial Integrity Monitor rather than developed further in this brief; readers seeking deeper AML/CFT analysis should consult the Sentinel.gi feed directly. #### Outlook No original outlook is offered here beyond noting that this module's content will continue to track the Sentinel.gi feed; see W7 and W12 for this monitor's own analysis of the payments-market-structure consequences of Estonia's AML/CFT history (enforcement actions and correspondent de-risking). Read full sub-brief · 152 words no periodic updates on record for this sub-brief Evidence 8 Sources and findings (8) - T1sentinel.fiu.ee/en/news/fine-eu300000-against-lhv-has-been-annulled - T?FIM (sentinel.gi) per-JID baseline profile — Estonia — Estonia implements AML/CFT via the MLTFPA, supervised by the EFIU and Finantsinspektsioon (EFSA); a MONEYVAL 5th-round MER (Dec 2022) rated Estonia partially compliant on effectiveness, placing it in enhanced follow-up through at least two FURs (2024, 2025), with persistent gaps in targeted financial sanctions (R.7) and beneficial ownership enforcement. - T1FIM (sentinel.gi) regulatory_horizon_register (issue FIM-BASE-HRZ-001) — VASP-to-CASP MiCA transitional licence hard deadline - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness - T2FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: Estonian Border Guard / Estonian Defense Forces Intelligence Center — Civilian tanker Marshal Vasilevskiy - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: legal-gap - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: capacity-deficit ### W12Correspondent Banking, Settlement & AccessProbableconfirmed 2026-07-04▾# Central-bank settlement access via TARGET-Eesti/T2; correspondent relationships materially reshaped by post-Danske de-risking and continued EDD friction for non-resident clients. Standing sub-brief · as of 4 July 2026 188 words · last cycle 2026-07-04 #### Correspondent Banking, Settlement & Access Eesti Pank provides central-bank settlement access via TARGET-Eesti/T2, including main cash accounts and RTGS dedicated cash accounts, under the Payment and Settlement Systems Act, consolidated onto the single TARGET services platform in March 2023. That settlement-access layer sits above a correspondent-banking relationship structure reshaped by the Danske Bank legacy: Deutsche Bank and Bank of America discontinued correspondent-banking agreements with Danske Bank in 2015, years before the scandal became public, an early market-signal de-risking that predated public regulatory action. Sweden's Finansinspektionen subsequently fined SEB over $107 million and Swedbank nearly $400 million for AML failures tied to non-resident account monitoring across their Estonian, Latvian and Lithuanian operations, reflecting continued cross-border-coordinated Nordic-Baltic supervisory action relevant to Estonian-linked banking groups. Non-resident clients continue to face elevated enhanced-due-diligence friction as a result of this history, even as central-bank settlement access itself remains intact and unaffected. #### Outlook Correspondent-access friction for non-resident and higher-risk clients is likely to persist as a structural feature of the Estonian and wider Baltic banking landscape; watch for any further Nordic supervisory action or correspondent-relationship changes tied to the Danske Bank legacy's continuing aftermath. Read full sub-brief · 188 words no periodic updates on record for this sub-brief Evidence 5 Sources and findings (5) - T1[https://www.eestipank.ee/en/payments/target-services](https://www.eestipank.ee/en/payments/target-services)retrieved 2026-07-04 - T3[https://vinciworks.com/blog/what-is-the-danske-bank-money-laundering-scandal/](https://vinciworks.com/blog/what-is-the-danske-bank-money-laundering-scandal/)retrieved 2026-07-04 - T3[https://nomadgate.com/banking-estonian-e-residents/](https://nomadgate.com/banking-estonian-e-residents/)retrieved 2026-07-04 - T3[https://www.acfcs.org/on-heels-of-record-penalty-against-swedbank-swedish-financial-watchdog-fines-seb-107-million-for-longstanding-aml-gaps-oversight-of-risky-non-resident-customers](https://www.acfcs.org/on-heels-of-record-penalty-against-swedbank-swedish-financial-watchdog-fines-seb-107-million-for-longstanding-aml-gaps-oversight-of-risky-non-resident-customers)retrieved 2026-07-04 - T3[https://www.moneylaunderingnews.com/category/correspondent-bank-accounts/](https://www.moneylaunderingnews.com/category/correspondent-bank-accounts/)retrieved 2026-07-04 ### W13Commercial Intelligence (M&A, Investment & Product)Probableconfirmed 2026-07-04▾# Commercial activity led by scale-stage growth/recognition events (Wallester FT1000, Montonio volume growth) rather than large disclosed M&A; early-stage funding (Creem) continues via the domestic VC ecosystem. Standing sub-brief · as of 4 July 2026 218 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) Wallester was ranked the #1 fastest-growing fintech in Europe on the FT1000 2026 list — 38th overall, up from 48th — on 178.9% three-year revenue CAGR, with disclosed revenue rising from EUR9.14 million in 2023 to EUR17.2 million in 2024, an 87% year-on-year increase. Montonio processed over EUR1.5 billion in 2025 payment volume, grew monthly recurring revenue by more than 60%, launched on Shopify, completed a full-product rollout across the Baltics and Poland, and introduced a Partner Program with more than 100 agency partners — a product-release event spanning Estonia, Latvia, Lithuania and Poland that relies on LHV's underlying acquiring and settlement infrastructure (see W8). Creem, a financial-infrastructure startup serving AI-focused teams, raised a EUR1.8 million pre-seed funding round led by Practica Capital on 26 August 2025 — the amount is disclosed in euros rather than a confirmed US-dollar figure. No completed M&A transaction involving an Estonia-licensed PI/EMI was identified within the trailing 12 months, despite an active Baltic fintech-acquisition trend referenced elsewhere in this monitor's coverage. #### Outlook Commercial activity in Estonia this cycle is led by scale-stage growth and recognition events and early-stage funding rather than large disclosed M&A; watch for whether the broader Baltic fintech-acquisition trend eventually produces an Estonia-specific transaction, and for Montonio's and Wallester's next reported growth milestones. Read full sub-brief · 218 words Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech The dominant commercial event for Estonia this cycle is the European Commission's clearance, under the EU Merger Regulation's simplified procedure, of OTP Bank Nyrt.'s acquisition of sole control of Luminor Holding AS of Estonia, Case M.12586. The deal was signed 20 July 2026 and the Commission's clearance issued 13 October 2026. The parties are OTP Bank Nyrt. (Hungary) as acquirer, with Luminor Holding AS (Estonia) as the target; the sellers were a Blackstone-managed private-equity consortium and DNB Bank. The transaction value has not been publicly disclosed, and the amount is recorded here as not publicly disclosed rather than estimated. OTP's and Luminor's joint materials describe the transaction as OTP's entry into the Baltic markets, with the combined group's footprint expanding to fourteen countries, total assets rising by more than ten percent, and the share of group operations conducted within the euro zone reaching fifty percent following completion. The regulatory review attached to this event was EU-level merger control by the European Commission, which cleared the transaction without conditions identified in the public record. As a discrete, dated commercial event, this transaction is distinct from any broader structural trend analysis of Baltic banking consolidation; it is the specific, named deal between two specific, named parties, cleared on a specific date, with specific (if undisclosed in amount) terms. It sits alongside -- but does not duplicate -- the industry-structure reading of the same underlying fact set, which addresses the ownership-model implications rather than the event particulars. #### Outlook Watch for whether OTP or Luminor disclose transaction value or integration terms in subsequent public filings or announcements, which would convert the currently undisclosed-amount record into a priced transaction for commercial-intelligence tracking purposes. No further corporate-event detail beyond the clearance itself has been identified this cycle. Evidence 3 Sources and findings (3) - T3[https://tech.eu/2026/03/11/estonia-leads-europe-in-fintech-growth-as-wallester-becomes-the-sector-s-fastest-growing-company/](https://tech.eu/2026/03/11/estonia-leads-europe-in-fintech-growth-as-wallester-becomes-the-sector-s-fastest-growing-company/)retrieved 2026-07-04 - T3[https://lift99.co/blog/estonian-startup-awards-2025](https://lift99.co/blog/estonian-startup-awards-2025)retrieved 2026-07-04 - T3[https://www.estvca.ee/news](https://www.estvca.ee/news)retrieved 2026-07-04 No modules match. Filters combine as OR inside a group and AND across groups. Reset all filters ## Provenance and declared absence Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. Suppressed by doctrine: derived risk score; per-module RAG traffic light. Not shown on this page. Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-26. A year-precision row is never promoted into a tighter band. Orphan deltas: 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. Envelope: baseline resolved at jurisdiction_json.baseline ; 14 module(s), 71 finding(s), 133 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](/legal/#contact).