Banking & Digital Banking Compliance in Estonia

Estonia is open to digital banking, and its national electronic identity infrastructure makes remote onboarding routine. Market access is controlled, though: a credit institution licence is granted by the European Central Bank on a proposal from Finantsinspektsioon, and EEA banks can enter by passport or branch.

Finantsinspektsioon (the Financial Supervision and Resolution Authority) supervises banks for prudential, conduct and AML purposes. The Financial Intelligence Unit receives reports and coordinates financial sanctions, and Eesti Pank is the central bank.

The biggest obstacle for a new entrant is building a remote identification and monitoring setup that meets section 31 of the AML Act and the supervisor's guidelines. This matters most for non-resident customers, whom the national risk assessment treats as a key exposure for Estonian banks.

1. Who regulates this sector

The European Banking Authority issues guidelines that Finantsinspektsioon adopts as advisory guidelines, and the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) will begin direct supervision of 40 entities across the EU from 1 January 2028.

2. Licensing and authorisation

Under the Credit Institutions Act (krediidiasutuste seadus), § 4, credit institutions have the exclusive right to receive deposits or other repayable funds from the public, and § 13 requires a licence for that activity. The licence also covers investment services to the extent stated in it. Only credit institutions may use "pank" or "ühistupank" (association bank) in their business name (§ 12).

Capital

A new bank must have paid-in share capital of at least 5 million euros; an operating company must hold initial capital of the same amount (§ 35).

Application

The management board files the application with a three-year business plan, IT and security systems, internal rules, manager and qualifying-holder information, and a commitment to Guarantee Fund contributions (§§ 13¹–13²). The processing fee is 1,500 euros.

Decision

The decision is due within six months of a complete file and no later than 12 months after the application (§ 14). The European Central Bank decides on a proposal from Finantsinspektsioon.

Seat

An Estonian-licensed bank must have its registered office and head office in Estonia (§ 13(2)).

Banks authorised in another EEA state may operate through a branch or cross-border services under the passport. A bank from outside the EEA must obtain Finantsinspektsioon authorisation for an Estonian branch. That procedure was rewritten on 21 July 2026 to transpose Directive (EU) 2024/1619 (the sixth Capital Requirements Directive), including a description of the branch's activities and governance arrangements.

Deposits are protected by the Guarantee Fund up to 100,000 euros per depositor per bank. Taking deposits from the public without a licence breaches the statutory monopoly in § 4. Non-bank payment, e-money and consumer credit licences are separate regimes and do not permit deposit-taking.

3. AML, KYC and customer due diligence

Credit institutions, and branches of foreign credit institutions registered in Estonia, are obliged entities under § 2 and § 6 of the Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus, "MLTFPA"). Finantsinspektsioon enforces the Act against the banks it supervises (§ 64(2)).

When due diligence applies

Due diligence applies at the start of every business relationship, for occasional transactions of 15,000 euros or more, and whenever there is suspicion or doubt about earlier data (§ 19). Measures in § 20(1), clauses 1 to 5, must be completed before the account is opened or the transaction made (§ 19(5)). Banks must apply due diligence to occasional money transfers above 1,000 euros (§ 25(1¹)). Anonymous accounts, passbooks, crypto-asset accounts and safe-deposit boxes are prohibited (§ 25(2)).

What must be done

A bank identifies and verifies the customer and any representative, identifies the beneficial owner and understands the ownership and control structure, and establishes the purpose and nature of the relationship. It also checks for politically exposed person (PEP) status and monitors the relationship (§ 20). The beneficial owner of a company is the natural person with ultimate control, with a fallback test of more than 25% ownership and then the senior managing official (§ 9). Where an EU register holds beneficial owner data, the bank must obtain the register extract and report discrepancies to the Estonian registrar (§ 20(2¹), (2⁴)). A bank may not deal with a company whose capital is more than 10% bearer shares (§ 42(2)).

Enhanced due diligence

Enhanced measures are mandatory for PEPs, high-risk third countries, doubts about data authenticity, and countries with weak AML systems or significant corruption where the section 31 remote safeguards are not used (§ 36). PEP relationships need senior management approval, source of wealth and funds checks and enhanced monitoring (§ 41). After enhanced due diligence, the customer's risk profile must be reassessed within six months (§ 38(3)).

Reporting and retention

Suspicions go to the Financial Intelligence Unit without delay and no later than two working days after detection, including for refused or abandoned relationships (§ 49(1)–(2)). For banks, the 32,000-euro cash report applies only to cash foreign exchange with persons who are not customers; other obliged entities report all cash transactions above that amount (§ 49(3)). Identification documents, transaction records and correspondence are kept for at least five years after the relationship ends (§ 47).

4. Identity verification and onboarding

A natural person is identified from an identity document under the Identity Documents Act, a valid foreign travel document, a qualifying driving licence or, for children under seven, a birth certificate (MLTFPA § 21(3)). The bank records the name, personal identification code (or date of birth and residence), and contact details, and verifies name and identity code from a credible and independent source. If the original is not available, the bank may verify identity from notarised copies or from at least two other reliable sources, including electronic identification and trust services (§ 21(4)). Legal persons are verified against the commercial register, which can replace document requests where the bank has access (§ 22).

Finantsinspektsioon's advisory guidelines (amended 8 April 2024) set out the methods. Face-to-face identification compares the person's face with the document photo. IT-based identification compares a facial image captured in the session with the document photo. Where the guidelines allow a "two sources" method, the bank combines an identity document image or strong electronic authentication with a second source such as a population register check, another document or a payment from an account in the customer's name. If the customer's risk is average or higher, the customer must also send a recently taken facial photo.

A bank may rely on another obliged entity's due diligence, or outsource verification to an identity provider under a written contract that preserves supervisory access and is notified to the supervisor in advance. Nothing may be outsourced to a person in a high-risk third country, and the bank remains fully responsible (§ 24).

5. Digital channels: what's different

Bottom line: remote account opening is fully permitted, but it carries method rules: for non-EEA customers and higher-volume accounts the AML Act fixes which remote tools are acceptable, and remote onboarding without those safeguards is treated as higher risk.

The section 31 thresholds

Section 31 of the MLTFPA (as rewritten from 1 July 2024) applies when due diligence is not done in the same location. It requires a notified eIDAS scheme at "substantial" or "high" assurance, a qualified trust service, or a means meeting § 31(3¹). This applies where the customer lives outside the EEA, or where monthly outgoing payments exceed 15,000 euros for a natural person or 25,000 euros for a legal person. A § 31(3¹) tool, used only where an eIDAS scheme or trust service is not possible, must keep data correct and current and capture images, video and audio securely and in unambiguous quality. It must also treat a dropped connection or technical fault as a failed identification. Banks may query the state identity documents database.

Below the thresholds

For EEA residents below those payment levels, Finantsinspektsioon's guidelines allow the two-source method instead of face-to-face or IT-based identification. Banks must also follow the European Banking Authority's guidelines on remote customer onboarding, which Finantsinspektsioon adopted in part from 2 October 2023. Under that adoption, use of an eIDAS-notified "substantial" scheme together with § 31 satisfies several of the European Banking Authority's evidence and liveness criteria.

What is changing

Regulation (EU) 2024/1624 [Adopted, applies 10 Jul 2027] will set EU-wide customer due diligence rules, so the Estonian section 31 regime is expected to be revised. A government fraud bill [Bill, not enacted] would let banks refuse payments where the customer appears to have been manipulated, even if strongly authenticated.

6. Data protection and biometrics

The General Data Protection Regulation applies directly, supervised by the Data Protection Inspectorate. For AML, MLTFPA § 48(2) declares that processing personal data to prevent money laundering and terrorist financing is in the public interest. Data collected for AML may not be reused for other purposes such as marketing. Customers must be informed about AML processing before the relationship begins (§ 48(3)).

Facial images captured for remote identification are biometric data and a special category of personal data under the General Data Protection Regulation, so the bank needs a lawful basis for that processing in addition to the AML purpose. Retention is set by the MLTFPA rather than chosen freely. Remote identification records are kept for five years after the relationship ends (§ 47(6)) and then deleted, unless the supervisor orders retention for up to five more years (§ 47(7)). Where the customer was identified with electronic identification or the document is in a state database, the bank need not retain document copies (§ 47(1¹)).

7. Sector-specific obligations

Correspondent banking

For cross-border correspondent relationships with third-country or higher-risk respondents, a bank must assess the respondent's reputation, supervision and AML controls, obtain senior management approval, and document both institutions' responsibilities. For payable-through accounts, it must be satisfied about the respondent's due diligence on customers with direct access (§ 40). Relationships with shell banks, and with institutions that knowingly let shell banks use their accounts, are prohibited and void (§ 18).

Basic payment services

Since 15 July 2025, credit institutions and Estonian branches of foreign credit institutions must provide basic payment services under the Law of Obligations Act (Credit Institutions Act § 88¹). Finantsinspektsioon may grant an exemption, and the decision must be made within four months. Banks that did not provide these services before 15 July 2025 are covered only if Finantsinspektsioon so orders (§ 141¹⁸). Breaches are punishable by fines of up to 400,000 euros for a legal person (§ 134²⁷).

Information sharing and banking secrecy

Banks may exchange information needed for due diligence regardless of banking secrecy (MLTFPA § 16(2)), and may share information on high-risk customers and suspected criminal transactions with each other (§ 51(5)). Records of these exchanges are kept for five years. Tipping off a customer about a report is prohibited (§ 51(1)).

Investment services and ICT resilience

A bank licence covers investment services to the extent authorised, and the same due diligence rules apply to securities accounts. Breaches of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554), including its third-party ICT risk rules, carry fines of up to 5 million euros or 10% of consolidated turnover (Credit Institutions Act § 134²⁶).

8. Risk indicators and red flags

Estonia's national risk assessment for 2020 to 2024 (approved 30 September 2025) rates the threat level for credit institutions as above average and their vulnerability as medium.

Banking typologies from the national risk assessment

• Correspondent services to foreign fintechs: nested payment flows from respondents layering cross-border proceeds.
• Virtual IBANs: fraud proceeds routed through virtual account numbers that are not stand-alone accounts.
• Account and credential handover: nominees register companies, open accounts and pass ID cards and passwords to third parties.
• Sanctions evasion: evasion cases concentrated in credit institutions.
• Companies with no Estonian link: entities used for foreign predicate crime, sometimes via e-resident structures.
• Identity fraud in remote onboarding: deepfakes and processes that do not fully follow the guidelines.
• Cash through payment services: rising cash reports linked to cross-border transfer and currency exchange.

MLTFPA § 37 adds statutory higher-risk factors, including private banking, nominee shareholders and unusually complex ownership.

9. Enforcement and penalties

Finantsinspektsioon and the Financial Intelligence Unit are the out-of-court authorities for AML misdemeanours, with a three-year limitation period (MLTFPA § 97). Fines are set per offence, and the tier depends on whether the obliged entity is subject to Finantsinspektsioon supervision.

Separately, non-compliance levies enforcing an administrative order against a credit institution run up to 32,000 euros on the first occasion and 100,000 euros thereafter, capped at the higher of 5 million euros or 10% of annual turnover (§ 65(2)). On 19 October 2023 Finantsinspektsioon fined AS LHV Pank 900,000 euros and issued a precept over AML failings in correspondent banking, business relationship monitoring and data retention. In 2025 the Finantsinspektsioon board issued four precepts and fines totalling 416,800 euros across all supervised sectors.

10. Recent changes and what to watch

• 1 January 2028 [Adopted, from 1 Jan 2028] AMLA begins direct supervision of 40 entities; large cross-border banking groups should expect EU-level AML oversight.
• 10 July 2027 [Adopted, applies 10 Jul 2027] The EU Anti-Money Laundering Regulation (2024/1624) applies, together with a 10,000-euro EU cap on cash payments; onboarding procedures will need re-mapping to the new rulebook.
• October 2026 [Bill, not enacted] A Law of Obligations Act amendment on financial fraud is before the Riigikogu; it would let banks refuse manipulated payments and share fraud data, including information covered by banking secrecy.
• 21 July 2026 [In force] Credit Institutions Act amendments transposing Directive (EU) 2024/1619 change third-country branch authorisation and management appointment notifications.
• 1 July 2026 [In force] The ban on anonymous accounts expressly covers crypto-asset accounts (MLTFPA § 25(2)).
• 1 March 2026 [In force] Savings and loan associations can no longer apply for Financial Intelligence Unit authorisation; existing authorisations lapse by 31 December 2028 at the latest.
• 15 July 2025 [In force] Credit institutions must provide basic payment services unless exempted by Finantsinspektsioon.

11. What this means for identity verification

Route each applicant at the start of onboarding by residence and expected monthly outgoing payments, because those two facts decide which remote method is lawful. EEA residents below 15,000 euros (individuals) or 25,000 euros (companies) can be verified with two independent sources. Non-EEA residents and higher-volume customers need a notified eIDAS scheme, a qualified trust service or a compliant video session. Residents of high-risk third countries need an eIDAS scheme or trust service only.

Treat expected volume as a re-verification trigger. A customer onboarded under the lower-tier method who later exceeds the monthly payment limits falls within § 31(1) and must be identified again with an approved method.

Design video and biometric tools around § 31(3¹). That means:

• capture images, video and audio in unambiguous quality;
• fail the session on any interruption;
• compare the live face with the document or database photo;
• store timestamped session data and the identity database query for five years after account closure.

Pair e-resident digital IDs with a second identity document, and expect the 2027 EU rulebook to change data fields and remote-identification evidence.