Fintech & Digital Payments Compliance in Estonia

Estonia is open to digital payment, e-money and lending businesses, and its national electronic identity (ID card, Mobile-ID and Smart-ID) makes remote onboarding of residents straightforward. The market is not lightly supervised: after the large bank money laundering cases of the last decade, licences are granted slowly, the head office and a compliance officer must be physically in Estonia, and authorisations have been withdrawn for weak anti-money laundering controls.

The principal regulators are Finantsinspektsioon, which licenses and supervises payment, e-money and credit firms including their anti-money laundering compliance, and the Financial Intelligence Unit (Rahapesu Andmebüroo), which receives suspicious transaction reports.

The biggest obstacle for a new entrant is substance: a credible local management board, a compliance officer approved by the Financial Intelligence Unit, safeguarding of client funds and a remote onboarding process that meets the statutory safeguards for non-resident and high-volume customers.

1. Who regulates this sector

The Consumer Protection and Technical Regulatory Authority also has a consumer protection remit that can touch financial advertising; it is not covered in detail here.

2. Licensing and authorisation

The Payment Institutions and E-money Institutions Act (makseasutuste ja e-raha asutuste seadus, MERAS) requires a company to hold an authorisation from Finantsinspektsioon to operate as a payment institution or e-money institution (§ 14). The eight regulated payment services are listed in § 3, from account services and money remittance to payment initiation and account information.

Capital figures are from MERAS § 64; legal form rules from §§ 5 and 7 (version in force from 1 March 2026). Finantsinspektsioon decides within three months of receiving a complete application and in any case within six months of filing (§ 18). It may refuse an applicant that appears to have chosen Estonia to avoid stricter rules in the country where it mainly operates (§ 19). The registered office and head office must be in Estonia (§ 46) and the management board must have at least two members meeting fitness and propriety requirements (§ 47).

Small-scale exemptions

Finantsinspektsioon can exempt from most prudential chapters a money remitter whose payment transactions average no more than one million euros a month, a limited provider of the clause 1 to 5 services averaging no more than three million euros a month and earning less than half its income from payments, and an e-money issuer whose average outstanding e-money does not exceed 500,000 euros (§§ 11 and 12). Exempt firms cannot open branches or provide services in other EEA states.

Passporting, agents and lending

An Estonian institution notifies Finantsinspektsioon before opening a branch or providing services in another EEA state (§ 29). Paying agents must be notified with a description of their anti-money laundering controls (§ 59) and their managers must meet reputation requirements (§ 61). Consumer lending and credit intermediation require a separate Finantsinspektsioon licence under the Creditors and Credit Intermediaries Act; Finantsinspektsioon regularly withdraws these licences and fines lenders for breaches of responsible lending rules.

3. AML, KYC and customer due diligence

Under the Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus, RahaPTS), payment service providers (except pure payment initiation and account information providers), e-money institutions, creditors and credit intermediaries, and crowdfunding service providers are financial institutions and therefore obliged entities (§ 6(2)). Finantsinspektsioon enforces the Act for the firms it supervises (§ 64).

When CDD applies

On establishing a business relationship; for occasional transactions of 15,000 euros or more; for occasional money transfers above 1,000 euros; and always on suspicion (§§ 19 and 25). Verification must be completed before the relationship or transaction (§ 19(5)).

What CDD covers

Identity and verification from a reliable independent source, representatives, beneficial owners, purpose of the relationship, politically exposed person (PEP) status and ongoing monitoring (§ 20).

No anonymity

Financial institutions may not offer services usable without identification, except limited-use accounts on which nothing can be done until due diligence is complete (§§ 25 and 27). Payment service providers may not execute a customer's instructions if they cannot meet these duties (§ 42(3)).

Enhanced due diligence

Mandatory for PEPs, high-risk third countries, doubts about documents and certain sanctioned or high-corruption connections (§ 36), with senior management approval and source of funds and wealth checks (§§ 39 and 41).

Beneficial ownership

A beneficial owner is the natural person with ultimate control, with a fallback test of more than 25 per cent shareholding (§ 9). For customers whose beneficial owners must be registered in an EU state, the firm must obtain the registry extract (§ 20(2¹)) and report discrepancies with the Estonian e-Business Register (§ 20(2⁴)). Business relationships with companies whose capital is more than 10 per cent bearer shares are prohibited (§ 42(2)).

Reporting and retention

Suspicions go to the Financial Intelligence Unit without delay and no later than two working days after they arise, including for refused or abandoned relationships (§ 49(1) and (2)). Obliged entities other than credit institutions must also report every cash transaction above 32,000 euros within two working days (§ 49(3)). Reports are filed through the unit's online form or the X-road service (§ 50). Tipping off is prohibited (§ 51). Identification documents and records are kept for at least five years after the relationship ends, extendable by a supervisory compliance notice for up to five more years (§ 47). A management board member must be responsible for compliance, and the compliance officer must work permanently in Estonia and be approved in coordination with the Financial Intelligence Unit (§ 17).

4. Identity verification and onboarding

A natural person is identified from an Estonian identity document, a valid foreign travel document, a compliant driving licence or, for children under seven, a birth certificate (RahaPTS § 21(3)). The firm records name, personal identification code (or date of birth and residence), any authority to represent and contact details (§ 21(1)). Where the original document is not seen, identity may be verified from a certified copy or from other reliable independent information, including electronic identification and trust services, using at least two different sources (§ 21(4)). Companies are identified from the commercial register, which the firm may consult directly instead of asking for documents (§ 22).

Firms may rely on another obliged entity's due diligence or outsource it under a written contract, but they remain responsible, must notify Finantsinspektsioon of outsourcing in advance and may not rely on or outsource to anyone in a high-risk third country (§ 24).

Finantsinspektsioon's advisory guideline on anti-money laundering (amended 8 April 2024) explains how it expects the two-source method to work: one source is always a colour copy of a photo identity document, the same data from an official database, or, for lower-risk customers, a strong authentication with a digital ID; for medium or higher risk the customer sends a freshly taken photograph that the firm confirms is recent. The guideline also applies, with stated exceptions, the European Banking Authority's guidelines on remote customer onboarding.

5. Digital channels: what's different

Bottom line: remote onboarding is fully permitted, but once a customer lives outside the EEA, comes from a high-risk third country or sends more than 15,000 euros a month (25,000 euros for a legal person), RahaPTS § 31 dictates which remote methods may be used.

Which remote method, when

Section 31(1) requires credit and financial institutions to use a scheme listed in § 31(3) or a compliant alternative whenever due diligence is not done in person and the customer resides outside the EEA or monthly outgoing payments exceed the thresholds. The listed schemes are an electronic identification scheme notified under Article 9 of Regulation (EU) No 910/2014 (eIDAS) at assurance level substantial or high, and a qualified trust service. Where neither can be used, the alternative must keep data accurate and current, store images, video, audio and data securely at a quality that identifies the person unambiguously, and fail if the connection breaks or another technical defect occurs (§ 31(3¹)). For residents of high-risk third countries the alternative is not available (§ 31(1¹)). Institutions may check data against the identity documents database (§ 31(5)).

Below the thresholds

For EEA-resident customers below the monthly limits, § 21(4) applies: verification from at least two reliable independent sources, which in practice can be a document image combined with a national digital ID login, a selfie or a database check.

E-residents

When an e-resident's digital identity card is used for remote identification, another identity document listed in § 21(3) must be used at the same time (§ 31(4)). A firm may terminate the relationship without notice if that card is refused, suspended or invalidated on certain statutory grounds (§ 43(2)).

6. Data protection and biometrics

The General Data Protection Regulation (Regulation (EU) 2016/679) applies directly and is supervised by the Data Protection Inspectorate. RahaPTS § 48 treats processing for anti-money laundering as a matter of public interest, forbids reusing that data for other purposes such as marketing and requires customers to be told how their data is processed before onboarding. Certain data subject rights (restriction, portability, objection) may be limited where honouring them would undermine due diligence.

Face matching against an identity document photo is biometric processing of special category data. The Inspectorate's published explanations state that biometric data cannot be processed on the basis of contract performance and needs an exception under GDPR Article 9(2), such as explicit consent or a legal basis. Firms should document which basis they rely on for liveness and face matching, and run a data protection impact assessment.

Retention is fixed by RahaPTS § 47: five years after the relationship ends for identification data, then deletion, unless a compliance notice extends retention by up to five years.

7. Sector-specific obligations

Safeguarding and internal control

MERAS §§ 78 to 80 require client funds to be safeguarded; breaches carry fines of up to 5,000,000 euros or 10 per cent of consolidated turnover for a legal person (§ 114). Internal rules must cover, among other things, ICT risk under the Digital Operational Resilience Act and the handling of sensitive payment data (§ 50).

Prepaid instruments and e-money

A payment service provider may accept a payment made with an anonymous prepaid card only if the card is not reloadable, holds no more than 150 euros, is used only for goods and services, cannot be funded with anonymous e-money, is monitored by its issuer and the payment does not exceed 50 euros (RahaPTS § 25(2¹)).

Consumer credit and buy-now-pay-later

Creditors must assess creditworthiness and keep compliant internal rules under the Creditors and Credit Intermediaries Act. Finantsinspektsioon fined Svea Finance AS a total of 200,000 euros in June 2025 and Bondora AS 200,000 euros in April 2025 for responsible lending failures.

EEA providers operating through agents

An e-money institution or payment service provider headquartered in another EU state that operates in Estonia other than through a branch can be ordered to appoint a central contact point in Estonia to ensure compliance with RahaPTS (§ 15(6)).

8. Risk indicators and red flags

Payment and e-money red flags (Financial Intelligence Unit and Finantsinspektsioon)

• Remote control: the applicant appears to act for someone else or is directed or watched by a third party during onboarding.
• Document tampering: formats inconsistent with the issuing country, identical or pasted signatures.
• Name mismatch: an incoming payment above 1,000 euros where the payee name clearly differs from the account holder.
• Transit account: large inflows from abroad passed straight on to foreign accounts with implausible payment descriptions.
• Account farming: an unreasonable number of accounts or virtual card accounts, or sudden unexplained limit increases.
• Funnel pattern: many unrelated payers into one account followed by rapid withdrawal or onward transfer.
• Card misuse: a card used by someone unrelated to its holder.
• Virtual IBANs and cross-border services: named by Finantsinspektsioon as the main sector risks alongside sanctions evasion.

9. Enforcement and penalties

RahaPTS sets misdemeanour fines per breach. For an obliged entity supervised by Finantsinspektsioon, failing to identify and verify a customer, or breaching risk assessment and internal control rules, carries a fine of up to 5,000,000 euros or twice the benefit gained or harm prevented, rising for a legal person to 10 per cent of consolidated turnover (§§ 82 and 84). Breaches of the EU transfer of funds rules carry the same maximum (§ 96). Non-compliance levies to enforce an order can reach 32,000 euros for a first and 100,000 euros for each subsequent occasion for a legal person, capped at the higher of 5,000,000 euros or 10 per cent of annual turnover (§ 65(2)). MERAS has parallel fines and levies (§§ 106, 109 and 114).

Finantsinspektsioon withdrew the payment institution authorisation of Ühisarveldused AS on 18 August 2025 for material breaches of MERAS and anti-money laundering requirements; the Tallinn Administrative Court lifted interim relief in May 2026, so the withdrawal is effective while the main appeal continues. In September 2026 it ordered Wallester AS to remedy weaknesses in governance, client asset safeguarding and anti-money laundering controls by 31 December 2026.

10. Recent changes and what to watch

• 16 September 2026 [In force]: Finantsinspektsioon order against Wallester AS signals continued on-site scrutiny of payment institutions' AML staffing and safeguarding.
• 1 July 2026 [In force]: RahaPTS amendments took effect bringing crowdfunding service providers into the financial institution definition and barring payment providers from executing instructions where § 25 duties cannot be met.
• June 2026 [Bill, not enacted]: Bill 947 SE, transposing the new EU Consumer Credit Directive, would bring buy-now-pay-later and interest-free credit under creditworthiness and pre-contract information rules.
• June 2026 [Draft act in preparation]: the Ministry of Finance is preparing a new anti-money laundering act to transpose the Sixth Anti-Money Laundering Directive.
• 9 March 2026 [In force]: Finantsinspektsioon updated its advisory guideline on applying international financial sanctions.
• 18 July 2025 [In force]: MERAS amendments allow payment and e-money institutions to participate in settlement systems for instant payments.
• 10 July 2027 [Adopted, applies 10 Jul 2027]: the EU Anti-Money Laundering Regulation (EU) 2024/1624 becomes directly applicable and will replace much of RahaPTS.

11. What this means for identity verification

Build two onboarding paths. Estonian and other EEA residents with modest volumes can be verified with two independent sources, typically a national digital ID authentication plus a document or database check, with a fresh selfie for anyone not rated lower risk. Non-EEA residents and customers expected to exceed 15,000 euros a month (25,000 euros for companies) need a notified eID at substantial or high assurance, a qualified trust service, or a document, face and liveness flow that records images and video at identifying quality and aborts on any interruption. Residents of high-risk third countries can only be onboarded remotely through a notified eID or qualified trust service.

Treat e-resident cards as a second factor, not a standalone document. Monitor outgoing payment volumes after onboarding, because crossing the monthly threshold triggers the stronger method. Store digital identification evidence, database query logs and timestamps for five years after the relationship ends, then delete them. Collect business customers' beneficial owner register extracts and report discrepancies. Plan now for the EU Anti-Money Laundering Regulation from July 2027.