iGaming & Gambling Compliance in Estonia

Estonia is open to licensed online gambling. Games of chance, totalisator and fixed-odds betting (toto) and games of skill can all be offered remotely by a private company that holds an Estonian activity licence and a remote operating permit; lotteries above small thresholds are reserved for a state-owned company. Unlicensed sites are blocked by domain and by payment account.

The Estonian Tax and Customs Board licenses and supervises the sector; the Financial Intelligence Unit supervises compliance with the money laundering law and must approve every new activity licence. The biggest obstacle for a new entrant is the licensing package itself: 1,000,000 euros of share capital for games of chance, gambling as the company's only business, fit-and-proper vetting of owners and managers, a live connection to the Board's reporting system and a tested connection to the restricted players register before launch.

1. Who regulates this sector

Estonia is a unitary state, so licensing is national. Municipalities play a role only for land-based venues, whose opening needs the written consent of the local government (Gambling Act § 27).

2. Licensing and authorisation

The Gambling Act (hasartmänguseadus) allows only gambling that complies with it (§ 2(7)). Remote gambling covers games played and decided by electronic device outside a gaming location, including online, and games where stakes and prizes move electronically (§ 5(1), as amended from 1 January 2026). Since 21 November 2025, transactions in derivatives under the Securities Market Act are expressly not gambling (§ 2(6¹)).

Two authorisations

Activity licence (tegevusluba)

Indefinite and non-transferable, issued separately for games of chance, toto and games of skill (§ 16). The Board decides within four months of a complete file and no later than six months after the application (§ 18(4)), after the Financial Intelligence Unit has approved the application within 60 days (§ 18(3¹)). State fee: 47,940 euros for games of chance, 31,960 euros for toto, 3,200 euros for games of skill (Tax and Customs Board, page updated 26 February 2026).

Operating permit (korraldusluba)

Issued per land-based location or ship, or per type or sub-type of gambling offered remotely (§ 22(1)). A remote permit runs for up to five years, names the server location and the internet addresses used, and needs an independent expert assessment of the software (§§ 26, 28(3¹)). Decision within two months of a complete file, no later than four months (§ 22(4)); state fee 3,200 euros.

Who can hold them

Only a reliable public or private limited company, for which gambling is the sole line of business apart from catering, leisure events and intra-group support services (§ 9(1)–(2)). Minimum share capital is 1,000,000 euros for games of chance, 130,000 euros for toto and 25,000 euros for games of skill (§ 9(4), (6), (7)). Lotteries are reserved for a company wholly owned by the Estonian state (§ 9(5)). Shareholders with a qualifying holding (10 per cent or more), beneficial owners and board members must have no criminal record and no link to unlicensed gambling (§§ 9(3), 11). The Board states that a licence from another European Economic Area country gives no right to offer gambling in Estonia.

Remote games of chance and toto permits are granted only to operators whose electronic recordkeeping and control system is connected to the Board's information system (§ 22(2¹)); the Board also requires a tested connection to the restricted players register before a permit for remote games of chance, toto or classical lottery is issued.

3. AML, KYC and customer due diligence

Gambling operators, except organisers of commercial lotteries, are obliged entities under the Money Laundering and Terrorist Financing Prevention Act (rahapesu ja terrorismi rahastamise tõkestamise seadus) § 2(1)(3). The Tax and Customs Board supervises the sector; the Financial Intelligence Unit supervises compliance with the money laundering law.

When due diligence applies

Every obliged entity applies due diligence on establishing a business relationship, on doubts about earlier data and on suspicion, regardless of thresholds (§ 19(1)). A business relationship includes a contact where repeated transactions can reasonably be expected (§ 3(4)), which describes a registered player account. On top of that, a gambling operator must apply due diligence at least when paying winnings, accepting a bet, or both, where the amount given or received by the customer is 2,000 euros or more, whether paid at once or in linked payments over up to one month (§ 19(3)).

What due diligence involves

The measures are identification and verification from a reliable and independent source, including electronic identification and trust services; identification of representatives and beneficial owners; understanding the relationship; checking for politically exposed persons; and ongoing monitoring (§ 20(1)). Enhanced measures are mandatory for politically exposed persons, high-risk third countries and doubts about data or documents (§ 36(2)). Additional measures may include source-of-funds evidence and a first payment from an account in the customer's name at a European Economic Area credit institution (§ 38(2)).

Governance and reporting

Operators need a documented risk assessment (§ 13), rules of procedure covering due diligence, politically exposed persons and sanctions (§ 14(1)) and staff training (§ 14(6)). The compliance officer collects and analyses unusual transactions and reports suspicion of money laundering or terrorist financing to the Financial Intelligence Unit (§ 17(7)). The Gambling Act adds its own retention rule: remote player identification and transaction records are kept for at least five years (§ 53(3)).

4. Identity verification and onboarding

For remote gambling, the Gambling Act requires the operator to identify every player and register the player's first and last name, personal identification code (or date of birth if there is none) and the time and date of each entry to and exit from the gaming environment (§ 53(1)(2)–(3)). The server must hold registration, verification, age-check, restricted-list and session data (§ 52(1)).

Accepted documents and remote methods

The money laundering law lists the documents for identifying a natural person: an Estonian identity document, a valid foreign travel document or a qualifying driving licence (§ 21(3)). Where the original is not available, identity may be verified from a certified copy or from other reliable and independent information, including electronic identification and trust services, using at least two different sources (§ 21(4)). The Gambling Act itself does not list approved remote methods. The detailed rules on remote identification in § 31 of the money laundering law (notified eIDAS schemes at substantial or high assurance, qualified trust services, or video and image capture of sufficient quality) bind credit and financial institutions, not gambling operators; but onboarding without physical presence and without those safeguards is a listed higher-risk factor for every obliged entity (§ 37(3)(4)).

Age, exclusion and reliance

Players under 21 may not play games of chance or skill games offered remotely; toto and lotteries are closed to under-18s (§ 34(2)–(3)), and remote operators must take measures to exclude underage players in Estonia (§ 53(1)(1)). Operators may rely on another obliged entity's due diligence, or outsource it under a written contract, but stay responsible for compliance and may not rely on anyone established in a high-risk third country (money laundering law § 24(1)–(7)).

5. Digital channels: what's different

Bottom line: online play needs its own operating permit and identification of every player before play, with deposits and payouts locked to the player's own regulated account; the anti-money laundering threshold and the restricted players check are the same in both channels.

Identification moves from the door to the account

A land-based casino identifies everyone entering and copies their identity document (Gambling Act § 37(8)–(10)). Online, the obligation attaches to the player account and every session (§ 53(1)(2)–(3)). Remote onboarding without the safeguards of § 31 of the money laundering law is a higher-risk factor (§ 37(3)(4)), so the choice of method feeds directly into the player's risk profile.

Payments are closed-loop

Remote stakes must arrive through a credit institution, payment institution, e-money institution or crypto-asset service provider licensed in the European Economic Area (§ 5(3)). Deposits are accepted only from an account in the same player's name at a credit, payment or e-money institution (or from the player at the operator's own venue), and payouts go only to the account the player paid in from (§ 53(1)(5)–(6)).

Player protection is built into the product

Before first play, the operator must prominently offer a weekly or monthly loss limit, refuse bets that would breach it, lower it immediately on request and raise it only after the player confirms after 48 hours (§ 55(1)–(2)). The remote-gambling chapter of the Act (§§ 52 to 56¹) contains no geolocation requirement; enforcement against offshore sites relies instead on domain and payment blocking (§§ 56, 56¹).

6. Data protection and biometrics

The EU General Data Protection Regulation applies directly in Estonia and is supervised by the Data Protection Inspectorate; operators that use face matching should treat the resulting templates as biometric data. The sector-specific rules sit in the Gambling Act. An operating permit application must explain how players' data will be protected under the Personal Data Protection Act (§ 23(2)(5)). Data from the restricted players register may be seen only by employees who need it and may not be used for consumer research or direct marketing, or passed on (§ 39(6)). Remote identity evidence, session logs and transaction records must remain retrievable for at least five years for the Board, the police and the Financial Intelligence Unit (§ 53(3)).

7. Sector-specific obligations

Register of restricted players

The register is a sub-register of the register of taxable persons kept by the Tax and Customs Board (§ 39(1)). A person joins it by written application, choosing a period of six months to three years before which removal cannot be requested, and may restrict games of chance, toto and classical lottery separately (§ 39(3), (5)). Operators of games of chance, toto and classical lottery must ensure listed people cannot play the restricted products (§ 39(8)).

Software, reporting and outsourcing

Remote gaming equipment must ensure that outcomes cannot be influenced, data survive interruptions and changes are logged (§ 54(1)); the Board can demand an independent expert assessment at any time (§ 54(2)), and it recognises experts holding ISO/IEC 17025 accreditation. Servers outside Estonia need evidence of cooperation between the host country's gambling and money laundering authorities and Estonian authorities, unless the host state is party to the Convention on Cybercrime or has a cooperation agreement (§ 52(3)–(4)).

Gambling tax and reporting

Operators file a gambling tax return and pay by the 15th day of the following month. For 2026 the Board lists 5.5 per cent of bets less prizes for toto and remote games of skill, down from 6 per cent in 2025.

8. Risk indicators and red flags

Gambling typologies identified in Estonia's national risk assessment

• Match-fixing and deliberate losing: bets against an accomplice, especially in peer-to-peer games such as poker.
• Structuring below 2,000 euros: deposits or bets split to stay under the due diligence threshold.
• Stolen or third-party cards: attempts to stake with stolen cards or cards belonging to companies.
• Forged identity documents: often used by people on the restricted register trying to regain access.
• Buying winnings or chips: purchase of winning tickets or chips from legitimate players.
• Low-risk even bets: parallel 1:1 bets, for example on roulette, to wash funds with little loss.
• Crypto funding: wallets that cannot be tied to the player, a weakness flagged before crypto stakes were legalised.

Source: Ministry of Finance, National Risk Assessment, chapter 10, Gambling (published February 2022).

9. Enforcement and penalties

Enforcement works through the authorisation itself as much as through fines. The Board may revoke an activity licence for false information, unremedied non-compliance, serious economic offences by managers or owners, or repeated or material breaches (Gambling Act § 20(1)). Revocation is mandatory where the operator, a board member, procurator, beneficial owner or owner has been punished for money laundering or terrorist financing, or has breached international sanctions (§ 20(2)). A revoked licence voids all permits for that type of gambling, and play must stop within three days (§§ 20(3), 21(3)). Operating permits can be revoked for breaches of the Act, ignored compliance notices, repeated advertising breaches or misdemeanours under §§ 74, 75 and 82 to 86 (§ 30(1)).

Against unlicensed operators, the Board orders hosting providers to remove content, internet access providers to block domain names, number holders to stop numbers and media services to stop programmes (§ 56), and orders payment service providers to freeze the operator's accounts (§ 56¹). The Board publishes the blocked domain names; its blocked gambling websites page was last updated on 2 October 2026. Breaches of the money laundering law are also subject to misdemeanour liability, and both the company and the responsible individuals can be held liable.

10. Recent changes and what to watch

• 2 September 2026 [Bill, not enacted] A bill tabled in the Riigikogu by the Isamaa faction would restore a 7 per cent gambling tax rate for the categories cut by the 2025 reform. Operators should model both rates for 2027.
• 21 July 2026 [In force] The latest amendments to the money laundering law took effect; the consolidated text in force runs until 30 March 2029, when further amendments are scheduled.
• 1 January 2026 [In force] The Gambling Act amending act (RT I, 30.12.2025, 2) allowed crypto-assets as stakes, required remote stakes to pass through European Economic Area licensed banks, payment, e-money or crypto-asset providers, made Financial Intelligence Unit approval a condition of new activity licences and added sanctions breaches as a mandatory revocation ground. Onboarding and payment flows built before 2026 need review.
• 1 January 2026 [In force] Gambling tax for toto and remote games of skill fell to 5.5 per cent of bets less prizes, from 6 per cent.
• 21 November 2025 [In force] Transactions in derivatives under the Securities Market Act were excluded from the definition of gambling, so products structured as derivatives fall under securities law rather than the Gambling Act.
• 10 July 2027 [Adopted, applies 10 Jul 2027] Regulation (EU) 2024/1624 on anti-money laundering becomes directly applicable and will replace much of the national due diligence regime for gambling operators.

11. What this means for identity verification

Identity capture must produce the data points the Gambling Act requires: legal name, personal identification code or date of birth for foreign players, and a timestamped log of every session, all retained for at least five years. Estonian players can be onboarded with national electronic identity; foreign players are usually onboarded with a travel document, and where the original is not presented the money laundering law expects verification against at least two independent sources, so document checks are typically paired with a face match, a database check or a payment from an account in the player's name. Retaining images, liveness results and audit trails supports the risk rating. Age must be confirmed against the 21-year threshold for casino and skill games, not 18. The restricted players register check belongs in the onboarding flow and before access to each restricted product. Re-verification is triggered when cumulative stakes or winnings reach 2,000 euros within a month, when data is in doubt, and when the player's risk profile changes.