Estonia
Estonia is a unitary state with national supervisors. Finantsinspektsioon licenses and supervises banks, payment, e-money, crypto and insurance firms, including their AML compliance, the Tax and Customs Board licenses gambling, and the Financial Intelligence Unit receives suspicious transaction reports. The national eID makes remote onboarding routine, with stricter methods for non-EEA and high-value customers. Telecom, healthcare, travel and public services follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
Finantsinspektsioon enforces the Money Laundering and Terrorist Financing Prevention Act for the banks, payment and e-money institutions, crypto firms and life insurers it supervises. Gambling operators are supervised by the Tax and Customs Board. The Financial Intelligence Unit receives suspicious and cash transaction reports, approves compliance officers in financial firms and supervises obliged entities that no financial supervisor covers, such as traders accepting large cash payments.
Yes. The ID card, Mobile-ID and Smart-ID make remote onboarding routine for residents. Banks and other financial institutions must use a notified eID at level substantial or high, a qualified trust service or a video method that fails if the connection drops when the customer lives outside the EEA or sends more than 15,000 euros a month (25,000 euros for companies). An e-resident's digital ID needs a second document.
Obliged entities report suspicions of money laundering or terrorist financing to the Financial Intelligence Unit without delay and no later than two working days after they arise, including for refused or abandoned relationships. Firms other than banks also report every cash transaction above 32,000 euros; for banks this applies only to cash foreign exchange with non-customers. Records are kept for at least five years after the relationship ends.
The Data Protection Inspectorate's February 2026 position is that comparing a face image to identify a person is special-category biometric processing under Article 9 of the GDPR. It cannot rest on the performance of a contract and needs explicit consent or a basis in law, plus a data protection impact assessment. Firms should document their basis and, where they rely on consent, offer a non-biometric option such as eID.
Telecom operators, healthcare providers, most online shops and marketplaces, travel and accommodation businesses, government bodies and non-life insurers are not obliged entities. They come within the law only for a listed activity, such as taking a cash payment of 10,000 euros or more or offering currency exchange. Their identity duties come from sector rules instead: the Electronic Communications Act, health law, the Digital Services Act, guest registration and eIDAS.