Economic Substance for Licensed VASPs in Estonia

Estonia's virtual asset service provider (VASP) licensing regime has attracted digital-asset operators from across Europe and beyond – but the Financial Intelligence Unit's post-2022 overhaul means that a licence number alone no longer protects a business. Operators running a letterbox entity while directing commercial activity from another country now face a direct enforcement risk. The substance requirement is not a formality; it is the condition on which the licence survives. This page maps what genuine economic substance means under the current Estonian regime, how it interacts with tax residency and banking access, and where cross-border operators most commonly misjudge the analysis.

The Estonian VASP Regime Today

Estonia licenses and supervises VASPs through the Financial Intelligence Unit (Rahapesu Andmebüroo, RAB) – the dedicated AML and financial-intelligence authority that assumed full supervision of crypto businesses under the amended Money Laundering and Terrorist Financing Prevention Act. The RAB does not just review applications; it actively monitors ongoing compliance, and it has revoked licences at scale when substance standards were not met.

The regime covers exchange services (crypto-to-fiat, crypto-to-crypto) and custodian wallet services as the two primary regulated activities. Both categories require authorisation before commencement. Operating without authorisation exposes the business to enforcement action, public designation and the practical consequence that most European payment rails become inaccessible.

Since the legislative tightening, the RAB has applied a materially higher bar. It evaluates whether management is genuinely present in Estonia, whether operational decisions are made there, and whether the compliance infrastructure – the AML officer, the internal controls, the customer due-diligence records – is maintained on the ground. A registered address and a nominee director no longer satisfy the test. We have seen this repeatedly: operators who licensed under the pre-reform rules and did not update their operating model have had licences suspended or revoked during routine supervisory review.

What Economic Substance Actually Requires in Practice

Genuine economic substance in Estonia means that the business has a real operational footprint in the jurisdiction – not merely a legal address or a filing agent. The RAB's supervisory guidance identifies several concrete indicators that inspectors examine.

First, the responsible person (the AML compliance officer mandated under Estonian law) must be physically based in Estonia, accessible to the RAB and actively discharging their obligations. This is not a delegable role that can be parked with an agent. The responsible person must have the authority – and the actual day-to-day capacity – to implement controls, file suspicious transaction reports and respond to RAB inquiries on short notice.

Second, the management board must reflect real decision-making authority. Where the VASP is owned by a foreign parent or a group holding company, the Estonian board must not be a rubber stamp. The RAB will assess whether material commercial decisions – onboarding policy, risk appetite, product changes – are made in Estonia or directed from abroad. A board that simply ratifies decisions taken elsewhere fails the test.

Third, the operational records must be held in Estonia and accessible to supervisors. This includes customer identification files, transaction monitoring records, risk assessments and correspondence with the RAB. Cloud hosting is acceptable, but the data must be retrievable in Estonia within the timeframes the RAB specifies.

Fourth, the business must have an Estonian bank or payment account for operational purposes. This is both a practical necessity and a substance indicator. In our practice, we find that banking access is often the longest pole in the tent – the application process with Estonian credit institutions and e-money providers can run for several months, and banks apply their own VASP-specific due-diligence requirements independently of the RAB.

How Does the Substance Test Interact With Cross-Border Group Structures?

Cross-border group structures raise the most acute substance questions, because the commercial logic of a group – centralised management, shared IT and compliance, cost allocation across entities – directly conflicts with what Estonian supervision requires from the licensed entity.

A VASP that is part of a group headquartered in, say, the British Virgin Islands or a UAE free zone must be able to demonstrate that the Estonian entity is not merely a conduit. The RAB will look at the intercompany agreements, the staffing model and the management reporting lines. If the Estonian entity has no staff of its own, if the AML function is outsourced entirely to a group compliance centre in another country, and if the board consists of directors who are also on seven other group boards, the substance case is very difficult to make.

This does not mean a group structure is unworkable. It means the structure must be designed deliberately. The Estonian entity needs its own budget, its own staff (at minimum the responsible person and someone with genuine operational authority), and governance documentation that evidences local decision-making. Intercompany service agreements must be arm's-length and must not subordinate the Estonian board to group direction on compliance matters.

For businesses that are simultaneously licensed or registered in other EU member states as they prepare for MiCA (the Markets in Crypto-Assets Regulation supervised by ESMA and national competent authorities), the substance question becomes more complicated. MiCA's passporting model rewards genuine authorisation in a single member state. But "genuine" is the operative word – a shell authorisation designed only to passport into other markets is exactly what both the RAB and MiCA NCAs are looking for when they conduct supervisory cooperation reviews.

To map the substance requirements against your group structure before you commit to Estonia, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analysis. Your entity structure, management model and cross-border user base change the picture significantly.

The Application Process and Timeline

A VASP authorisation application to the RAB requires the business to assemble a comprehensive package before submission – and the quality of that package directly affects how long the review takes.

The core components are: a detailed business description, the beneficial ownership chain with KYC documentation to the ultimate beneficial owners, the AML/CFT risk assessment for the business model, the internal AML programme (policies, procedures, controls), evidence of the responsible person's qualifications and experience, proof of the management board's fitness and propriety, and the legal basis for Estonian substance (office lease, employment contracts or service agreements, bank account confirmation or application evidence).

The RAB can request additional information at any stage. Each request restarts the effective clock on that part of the review. Incomplete or under-documented submissions are the single most common cause of delay in our experience. The RAB has also become considerably more demanding on the substance of the AML programme – a generic policy template is unlikely to pass; the programme must be calibrated to the specific risks of the applicant's product and customer base.

Timelines vary depending on the completeness of the file and the current review queue. Writing qualitatively: applicants with well-prepared files who respond promptly to RAB queries tend to receive decisions significantly faster than those who submit incomplete packages and engage in extended back-and-forth. Operators should budget several months from submission to decision, and should not commence regulated activity until authorisation is confirmed in writing.

One micro-matter from our cross-border practice is instructive. In a recent matter, a payments-adjacent business that had been operating under a pre-reform Estonian registration engaged us after the RAB issued a supervisory notice citing inadequate substance. The entity had a registered address and a nominal compliance officer who was not resident in Estonia. We restructured the operational model – relocating genuine decision-making authority to the Estonian board, appointing a resident responsible person and aligning the intercompany agreements with RAB expectations. The business retained its authorisation and completed the reform cycle without interruption to its banking arrangements. The key variable was acting before the RAB moved to revocation.

Tax Residency and the Substance Interaction

Economic substance in Estonia for VASP-licensing purposes and tax residency are related but legally distinct analyses – and conflating them is a common and costly mistake.

A company incorporated in Estonia is, as a general matter of Estonian corporate law, a resident entity for tax purposes. Estonia's distinctive territorial corporate income tax system – which taxes distributed profits rather than retained earnings – makes it an attractive holding and operating location for digital-asset businesses with a reinvestment model. But tax residence can be challenged by a higher-tax jurisdiction if that jurisdiction's controlled-foreign-company rules or place-of-effective-management tests apply. If the operational substance that satisfies the RAB is actually concentrated in, say, Germany or the United Kingdom, the German or UK tax authorities may take the view that the company's effective management is in their jurisdiction, with corresponding tax consequences.

This is not a theoretical risk. The FCA-supervised environment in the UK and the BaFin-regulated environment in Germany have both shown an appetite for challenging structures where the licensed entity and the actual commercial operation are in different countries. In our practice, we address this from the outset by mapping the regulatory substance requirements alongside the tax residency analysis – treating them as a single integrated question rather than two separate workstreams.

For groups with a VARA (Virtual Assets Regulatory Authority) entity in Dubai, an ADGM/FSRA entity in Abu Dhabi or a Singapore MAS-licensed entity alongside an Estonian VASP, the interaction is more complex still. Each regime has its own management-and-control expectations. The group structure must be mapped so that each entity has the footprint its regulator requires, without creating conflicting claims of tax residence. Allied counsel in the relevant jurisdictions are typically engaged alongside our team on these structures.

Banking Access for Estonian VASPs

Holding a valid VASP authorisation from the RAB does not guarantee banking access. Estonian banks and the EU-based e-money institutions that serve the market apply their own VASP risk-assessment frameworks, and many have materially tightened their criteria following the RAB's large-scale licence revocations and the broader EU AML reform agenda.

From an operational perspective, a VASP applying to an Estonian bank or payment institution should expect to present its RAB authorisation, its AML programme, its transaction monitoring controls, a clear description of its customer base (including the jurisdictions it onboards from), and evidence of substance. Some institutions additionally require an independent AML audit or a compliance certification from a recognised firm.

Businesses that serve customers in high-risk jurisdictions, that process large volumes of peer-to-peer or privacy-preserving transactions, or that have a high proportion of institutional or counterparty business involving non-EEA entities will face the most scrutiny. The banking relationship is not a formality that follows from licensing – it is a parallel process that requires its own preparation and its own commercial strategy.

The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer, derived from FATF Recommendation 15 and implemented across EU member states including Estonia) is an increasingly significant criterion for banking relationships. Banks want to see that a VASP has a credible Travel Rule compliance solution in place before they will open accounts for settlement activity. Operators who have not addressed Travel Rule compliance before approaching banks lose time and sometimes lose the relationship entirely.

If your banking application has stalled or a prior account was closed, a fresh structural review can identify the cause and map a route to compliant access. Write to OBOLUS at info@oboluslaw.com. A second read often surfaces the specific gap that the bank's compliance team flagged internally but did not fully articulate in the account-closure notice.

Common Mistakes Operators Make With Estonian Substance

The mistakes we see most frequently in incoming mandates share a common origin: the business treated the initial licensing application as a compliance event rather than an ongoing operational commitment.

The first pattern is the nominated but non-resident responsible person. The applicant identified a local contact, listed them as the AML officer, and then continued to run compliance from an offshore operations centre. The RAB will detect this through supervisory inquiries, and the gap between the filing and the reality is treated as a material compliance failure – not a paperwork issue.

The second pattern is the absent board. The Estonian director or directors are signatories only. Board resolutions are prepared by group counsel in another country and signed by the Estonian directors without substantive deliberation. When the RAB requests board minutes to assess the quality of internal governance, these minutes expose the structure as a formality.

The third pattern is the mismatch between the licensed scope and the actual product. A business licensed for exchange services that also provides custodian wallet services – even incidentally – is operating beyond its authorisation. The RAB's post-2022 enforcement posture is to treat this as a serious violation, not a technicality.

A common assumption in the market is that an offshore registration – a BVI or Cayman structure with a single regulatory touch-point – is sufficient to serve a global customer base. It is not. Each jurisdiction in which customers are located may require its own regulatory analysis. An Estonian VASP licence is a strong foundation for EU business, but it does not answer questions about the United States (where FinCEN, SEC, CFTC and state money-transmitter licensing apply), Singapore (where the MAS Payment Services Act governs DPT services) or the UAE (where VARA and FSRA have their own VASP regimes). A single licence, however well-structured, does not substitute for a proper geographic analysis of where the business is actually operating.

Decision Point: Is Estonia the Right Base?

Estonia suits a specific operator profile. The business that benefits most from an Estonian VASP authorisation is one that genuinely intends to operate in the EU – that is building toward MiCA CASP authorisation, that has or can build real management presence in Tallinn, and that does not need the offshore confidentiality or the holding-company tax efficiency that a BVI or Cayman structure provides.

Profile A: An early-stage EU-focused exchange with a lean team that can base its compliance function in Estonia, that intends to passport under MiCA, and that is prepared to maintain a resident responsible person and a genuinely active board. Estonia's corporate tax environment and its established digital infrastructure are genuine advantages for this operator. The RAB application process is demanding but well-defined, and the regulatory outcome – a CASP authorisation or its transitional equivalent – provides credible EU market access.

Profile B: A group headquartered outside the EU that wants an EU regulatory touch-point but intends to run all material operations from Dubai or Singapore. This operator faces significant substance risk in Estonia. The cost and complexity of maintaining genuine substance in Tallinn while the commercial operation is elsewhere may outweigh the benefit. For this profile, Malta (via MFSA and the VFA-to-MiCA transition), Lithuania (under the Bank of Lithuania and MiCA) or Ireland (FCA-equivalent supervision) may offer a more workable entry point – though each comes with its own substance expectations.

Profile C: A custodian-only business providing segregated wallet services to institutional clients in the EU. Estonia is workable, but the combination of the RAB's substance requirements and the MiCA custody-specific obligations means the compliance build is non-trivial. The operator should model the full-cost staffing and systems requirement before committing to Estonia as its primary hub.

In all profiles, the decision is driven by the intersection of where the management genuinely is, where the customers are, where the banking is viable and what the tax position looks like across the group. Getting that intersection right before filing is the work – not after.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – the full framework for obtaining and maintaining VASP authorisations across major hubs
• Crypto Regulation and Licensing in the British Virgin Islands – the BVI VASP Act, registration requirements and offshore structuring considerations
• Utility Token Legal Opinion in the United States: Federal and State MTL – navigating SEC, CFTC and state money-transmitter analysis for US-facing token businesses

FAQ

How long does a crypto licence take to obtain?

Timelines vary by jurisdiction and application quality. In Estonia, a well-prepared RAB submission – with complete beneficial-ownership documentation, a credible AML programme and evidence of genuine substance – moves through review considerably faster than an incomplete file. Operators should generally budget several months from submission to decision. Jurisdictions such as Lithuania and Malta operate under comparable EU standards; MAS in Singapore and VARA in Dubai have their own published review processes. We prepare files to minimise back-and-forth and accelerate review wherever the regime permits.

Which jurisdiction is best for licensing my crypto business?

There is no single answer, because the right jurisdiction depends on where your management genuinely sits, where your customers are located, where your banking must operate and what your tax position requires across the group. Estonia suits an EU-focused operator with genuine local presence. The BVI, Cayman and other offshore regimes suit holding and fund structures. VARA in Dubai and MAS in Singapore suit businesses targeting those markets with real operational footprint there. We map the licence, banking and tax stack across all relevant layers before recommending a primary hub.

Do I need a separate custody licence?

In most major regimes, custodian wallet services or the safekeeping of client virtual assets is a discrete regulated activity that either requires its own authorisation or a specific permission within a combined licence. Under the Estonian regime, exchange and custodian wallet services are separate licence categories. Under MiCA, crypto-asset custody is a defined CASP service requiring specific authorisation. In Singapore, under the Payment Services Act, the activity scope determines the applicable licence tier. Operating custody activities under an exchange-only authorisation is a common compliance gap that regulators actively scrutinise. We assess the full activity scope before filing.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we have done so for clients across the full range of VASP business models. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and offshore VASP authorisation strategy, cross-border substance analysis and MiCA readiness for digital-asset operators.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.