An overview of the regulation of virtual assets in Estonia

1. Virtual asset laws and regulations in Estonia

The regulation of virtual assets in Estonia began to take shape with the amendment of the Money Laundering and Terrorist Financing Prevention Act (MLTFPA) in 2019. The amendments introduced virtual currency service providers as obliged entities and defined virtual currency as a digital representation of value that is not issued or guaranteed by a central bank or public authority and is accepted as a means of exchange.

The MLTFPA requires virtual currency service providers to obtain a license from the Estonian Financial Intelligence Unit (FIU) and implement anti-money laundering and counter-terrorist financing (AML/CTF) measures. These measures include conducting due diligence on customers, monitoring transactions, and reporting suspicious activity to the Estonian FIU. The license process includes registering a headquarters in Estonia, paying a licensing fee, and identifying customers.

In addition to the MLTFPA, Estonia has implemented EU Directive 2015/849, which established a European legal framework for virtual currencies. This directive requires cryptocurrency service providers to have a license and follow AML/CFT rules.

What is considered a virtual asset in Estonia?

MLTFPA: This is the primary law governing virtual assets in Estonia. The MLTFPA defines virtual currency as a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency, and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored or traded electronically. Virtual currency service providers are required to obtain a license from the Estonian FIU and implement AML/CFT measures.
EU Directive 2015/849: Estonia has implemented this directive, which establishes a European legal framework for virtual currencies. Cryptocurrency service providers are required to have a license and follow AML/CFT rules.
International Sanctions Act, 2019: It recognises virtual currency service providers as persons with special obligations to ensure that they are monitoring their transactions for compliance with international sanctions. This can help prevent financial crimes like money laundering and terrorism financing that might be facilitated through the use of virtual assets.

Who do such laws and regulations apply to?

The MLTFPA of Estonia applies to virtual currency service providers based on their actual intention and the nature and purpose of their activity. Virtual currency service providers who “provide services of exchanging a virtual currency against a fiat currency and vice versa or of exchanging one virtual currency against another virtual currency” are obliged to register themselves with the Estonian FSA and comply with the AML/CTF measures. The law also includes other entities, such as custodian wallet providers, who provide services for the safeguarding of private cryptographic keys on behalf of their customers or provide private storage media for the storage of cryptographic keys. Such providers must also comply with AML/CTF measures laid down in the MLTFPA, regardless of their place of residence or registration.

Who are the relevant regulatory authorities in relation to virtual assets in Estonia?

In Estonia, the primary regulatory authority responsible for overseeing and supervising virtual currency service providers is the Estonian FIU, which operates under the Police and Border Guard Board. The Estonian FIU is responsible for issuing licenses to virtual currency service providers, monitoring their compliance with AML/CFT regulations, and ensuring that they follow strict know-your-customer (KYC) and due diligence procedures.

In addition to the FIU, the Estonian Financial Supervision and Resolution Authority (FSA) may also have some indirect involvement in the regulation of virtual assets, particularly when it comes to the licensing and supervision of financial institutions that engage in activities related to virtual assets.

What are the penalties for breaches of virtual asset laws and regulations in Estonia?

In Estonia, penalties for breaches of virtual asset laws and regulations, primarily the MLTFPA, can be both administrative and criminal. The specific penalties imposed depend on the nature and severity of the violation.

Administrative penalties can include:

Fines: The Estonian FIU can impose fines on virtual currency service providers for non-compliance with AML/CFT regulations, ranging from 320 EUR up to 32,000 EUR for individuals and up to €400,000 for legal entities. In some cases, the Estonian FIU may impose a penalty of up to twice the amount of the benefit derived from the violation.
License suspension or revocation: The Estonian FIU can suspend or revoke the license of a virtual currency service provider if they fail to comply with the regulatory requirements or pose a threat to public order or national security.

Criminal penalties can include:

Fines: In case of more severe violations, individuals can face criminal fines of up to 400 fine units (1 fine unit is equal to 4 EUR), and legal entities can face fines of up to 32,000 fine units (128,000 EUR).
Imprisonment: In the most serious cases, individuals can face imprisonment for up to 5 years for violations related to money laundering, terrorist financing, or other criminal activities involving virtual assets.

2. Regulation of virtual assets and offerings of virtual assets in Estonia

Are virtual assets classified as ‘securities’ or other regulated financial instruments in Estonia?

In Estonia, virtual assets are not automatically classified as ‘securities’ or other regulated financial instruments. However, depending on their specific characteristics and use cases, some virtual assets may fall under the definition of a security or another regulated financial instrument as per the Estonian Securities Market Act (SMA).

The Estonian FSA is responsible for the supervision of securities and other financial instruments. If a virtual asset meets the criteria of a security or another regulated financial instrument under the SMA, it will be subject to the relevant regulatory requirements, such as prospectus approval, licensing, and disclosure obligations.

Are stablecoins and NFTs regulated in Estonia?

In Estonia, stablecoins and non-fungible tokens (NFTs) are not explicitly mentioned in the existing regulations. However, they may fall under the scope of the MLTFPA if they are used as a means of exchange, payment, or investment.

The Estonian FIU is responsible for regulating virtual currency service providers, and the MLTFPA sets out the regulatory requirements for these providers, including anti-money laundering AML/CFT measures.

Whether a stablecoin or an NFT is subject to regulation in Estonia depends on its specific characteristics and use cases. If a stablecoin or an NFT is considered a virtual currency or a digital representation of value under the MLTFPA, it may be subject to the regulatory requirements for virtual currency service providers.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in Estonia?

DeFi activities are not specifically regulated under Estonian law. However, if DeFi activities involve the provision of virtual asset services or are carried out by virtual asset service providers, they are subject to the requirements of the MLTFPA.

In practice, this means that DeFi lending service providers, for example, are required to conduct customer due diligence, adopt risk management principles, establish internal policies, and report suspicious transactions. Additionally, depending on the level of their activities, DeFi service providers may also need to seek authorisation from the Estonian Financial Intelligence Unit.

It is worth noting that the Financial Supervision Authority has indicated that it is keeping a close eye on DeFi activities and has emphasised the need for service providers to adhere to the same standards of customer protection and market integrity as traditional financial services providers.

Are there any restrictions on issuing or publicly offering virtual assets in Estonia?

Yes, there are restrictions and requirements for issuing or publicly offering virtual assets in Estonia. Here are some key points to consider:

Licensing: Any company that wishes to offer virtual assets or provide services related to virtual assets must obtain a license from the Estonian FIU. There are two types of licenses: a Virtual Currency Exchange Service License and a Virtual Currency Wallet Service License.
KYC and AML Compliance: Licensed entities are required to implement KYC and AML measures. This includes customer identification, due diligence, and transaction monitoring.
Registration of the ICO: If a company is planning to launch an Initial Coin Offering (ICO), it must register the ICO with the Estonian FIU. The Estonian FIU will then provide a review of the ICO, but this does not constitute an endorsement.
White Paper Requirements: The company launching the ICO must prepare a white paper that includes detailed information about the project, the virtual token, the issuer, and the rights and obligations attached to the token.
Legal Entity: The issuer must be a legal entity registered in Estonia.
Capital Requirements: The issuer must maintain a minimum share capital of 12,000 EUR for a Virtual Currency Exchange Service License and 125,000 EUR for a Virtual Currency Wallet Service License.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in Estonia?

While the Estonian FIU has a comprehensive regulatory framework for virtual assets, there are some scenarios where certain activities may be exempt from the requirements. Here are a few examples:

Non-economic activity: If the virtual asset is issued for a non-economic purpose, such as a reward for participating in a volunteer project or for charitable purposes, it may be exempt from some requirements. However, the Estonian FIU must still be notified about the activity.
In-group transactions: Transactions conducted within a group of companies, where the parent company holds at least 50% of the shares or voting rights in the subsidiary, may be exempt from some requirements.
Occasional transactions: If a person carries out occasional transactions with virtual assets that do not exceed a certain threshold (1,000 EUR per month), they may be exempt from licensing requirements. However, they must still comply with AML/CFT obligations if their activities trigger those requirements.
Technical maintenance: Service providers that only offer technical maintenance or support for virtual currency wallets may be exempt from licensing requirements, provided they do not have control over the virtual assets.

3. Regulation of VASPs in Estonia

Are VASPs operating in Estonia subject to regulation?

VASPs are subject to regulation in Estonia, and the Estonian FIU is the primary authority responsible for overseeing and regulating VASPs. To operate legally in Estonia, VASPs must obtain a license from the Estonian FIU and adhere to various regulatory requirements. Here are some elaborations on the regulation of VASPs in Estonia:

Licensing: VASPs must obtain a Virtual Currency Exchange Service License or a Virtual Currency Wallet Service License, depending on the services they intend to provide.
KYC and AML Compliance: To prevent money laundering and terrorist financing, licensed VASPs must implement KYC and AML measures, such as customer identification, due diligence, and transaction monitoring. These requirements are set out in MLTFPA.
Regulatory Compliance: VASPs must comply with various regulatory requirements related to maintaining a local presence, appointing a compliance officer, implementing internal controls, and ensuring the security of customers’ virtual assets.
Capital Requirements: VASPs must maintain a minimum share capital, which varies between Virtual Currency Exchange Service License and Virtual Currency Wallet Service License.
IT Systems: VASPs must maintain IT systems to ensure the security and integrity of virtual assets and related data. They must also have a business continuity plan to address potential disruptions.
Audit and Reporting: VASPs are subject to annual audits performed by certified auditors or audit firms, and must submit annual reports on their activities to the Estonian FIU. VASPs must also report any suspicious activities to the Estonian FIU.

Non-compliance with these regulatory requirements can lead to penalties, such as revocation of the license.

Are VASPs providing virtual asset services from offshore to persons in Estonia subject to regulation in Estonia?

Offshore VASPs offering virtual asset services to individuals in Estonia are subject to regulation under the MLTFPA. It applies when services are provided remotely to persons located in Estonia. Consequently, VASPs serving Estonian residents must comply with the requirements, including registration, licensing, customer due diligence, internal controls, record-keeping, ongoing monitoring, and reporting suspicious transactions to the Estonian FIU.

The Estonian FIU has jurisdiction over VASPs targeting Estonian residents or conducting activities within Estonia. A VASP is considered to provide services in Estonia if it has a permanent establishment, offers services through a local agent or representative, or actively markets its services to Estonian residents. If a VASP falls under any of these categories, it may need to obtain a license from the Estonian FIU.

What are the main requirements for obtaining licensing / registration as a VASP in Estonia?

To obtain a license or registration as a VASP in Estonia, the following main requirements must be met:

Legal Entity: Establish a legal entity registered in Estonia, either as a private limited company or a public limited company.
Share Capital: Hold a minimum share capital of 12,000 EUR for a Virtual Currency Exchange Service License and 125,000 EUR for a Virtual Currency Wallet Service License.
AML/CFT Compliance: Implement effective AML/CFT procedures, including KYC, due diligence, and transaction monitoring processes.
Internal Controls: Appoint a compliance officer, establish risk management procedures, and implement internal audit mechanisms to ensure compliance with regulatory requirements.
IT Systems: Ensure IT systems are in place to secure virtual assets, customer data, and transaction records, including appropriate cybersecurity measures and a business continuity plan.
Registered Contact Person: Appoint a registered contact person responsible for communicating with the Estonian FIU and ensuring compliance with regulatory requirements. The contact person must be a resident of Estonia or have a right of residence in Estonia.
Physical Presence: Have a physical presence in Estonia, such as a registered office or a place of business.

State Fees: Pay the required state fees for license application and supervision. As of March 2023, the state fees for license application and supervision in Estonia are as follows:

Virtual Currency Exchange Service License:
State fee for reviewing the application	3,300 EUR
State fee for supervision (paid annually)	4,800 EUR
Virtual Currency Wallet Service License:
State fee for reviewing the application	1,300 EUR
State fee for supervision (paid annually)	2,400 EUR

Fit and Proper Test: Pass the Estonian FIU’s assessment of the suitability of the VASP’s management board members, shareholders, and beneficial owners.

After meeting all the requirements and submitting a complete application, the FIU will review the application and make a decision within 60 days. If approved, the VASP will receive a license to operate in Estonia. If denied, the VASP can appeal the decision according to Estonian law.

What are the main ongoing requirements for VASPs regulated in Estonia?

VASPs regulated in Estonia must comply with several ongoing requirements to ensure they are following applicable regulations. These requirements include:

Risk-based approach: Estonian VASPs must adopt a risk-based approach to their AML/CFT compliance efforts. This means that VASPs must have policies and procedures in place that are appropriate to the level of risk that they pose in terms of money laundering and terrorist financing.
Compliance officer: Appointing a qualified compliance officer to oversee AML and terrorist financing compliance efforts and other responsibilities.
Know-your-customer and customer due diligence: Identifying and verifying customers, conducting ongoing monitoring of their activities, and ensuring they are not engaging in money laundering or terrorist financing.
Record-keeping: Maintaining records of transactions and customer information, including identification and verification data, for at least five years.
Reporting: Promptly reporting any suspicious transactions or information suggesting money laundering or terrorist financing to the Estonian FIU.
Capital requirements: Complying with prescribed capital requirements to ensure the VASP is sufficiently capitalised to meet its obligations and responsibilities to customers.
Cybersecurity controls: Implementing cybersecurity measures to protect against cyber threats and safeguard virtual assets, customer data, and transaction records.
Regular audits: Undergoing regular audits by independent auditors to ensure compliance with applicable regulations and the effectiveness of AML and terrorist financing controls.

In Estonia, the licensing fees for VASPs are structured as follows: For a Virtual Currency Exchange Service License, there is a state fee of 3,300 EUR for reviewing the application, and an annual supervision fee of 4,800 EUR. Meanwhile, for a Virtual Currency Wallet Service License, the state fee for reviewing the application amounts to 1,300 EUR, with an annual supervision fee of 2,400 EUR.

What are the main restrictions on VASPs in Estonia?

The Estonian government imposes various restrictions on VASPs to ensure they operate within the law and do not engage in money laundering, terrorist financing, or other financial crimes. One of the primary restrictions is the requirement to obtain a license from the Estonian FIU, which ensures only legitimate VASPs operate in the country. Licensed VASPs must comply with strict AML/CFT regulations, including strong internal controls and processes to identify, monitor, and report suspicious activities.

Client identification and verification is another aspect of these regulations, ensuring VASPs can verify their clients’ identities for AML and CFT purposes. Data management is also essential, with VASPs required to maintain proper records and secure customer data, including identity verification and transaction details. Reporting suspicious transactions and activities to the Estonian FIU is mandatory, as is adherence to capital requirements that ensure VASPs have sufficient financial resources to operate.

Compliance with cybersecurity regulations is another key restriction, protecting customers’ personal and financial information from unauthorised access or disclosure. Regular audits, both internal and external, are conducted to ensure VASPs operate in a compliant manner and maintain effective anti-money laundering and counter-terrorist financing controls.

What are the main information that VASPs have to make available to its customers?

In Estonia, VASPs are required to make certain essential information available to their customers to ensure transparency. Some of the main information that VASPs must provide to their customers include:

Company details: VASPs must provide customers with their full legal name, registration number, and registered address to ensure customers are aware of the entity they are dealing with.
License information: VASPs must inform customers that they hold a valid license from the Estonian FIU and provide the license number. This helps customers verify the legitimacy of the VASP.
Terms and conditions: VASPs must provide customers with clear and comprehensive terms and conditions that outline the rights and obligations of both parties, including fees, transaction limits, and dispute resolution procedures.
Privacy policy: VASPs must provide customers with a privacy policy that explains how their personal data will be collected, stored, processed, and protected in accordance with Estonian data protection laws.
AML/CFT policies: VASPs must inform customers about their AML/CFT policies, including customer due diligence and verification procedures.
Risk disclosure: VASPs must provide customers with a clear explanation of the risks associated with virtual assets, including price volatility, cybersecurity threats, and the potential for financial loss.
Customer support: VASPs must provide customers with contact information for customer support, including email addresses, phone numbers, and support hours, to ensure customers can access assistance when needed.
Complaint resolution: VASPs must provide customers with information about their complaint resolution process, including how to file a complaint and the timeframe for resolving complaints.

What market misconduct legislation/regulations apply to virtual assets?

In Estonia, the market misconduct legislation and regulations applicable to virtual assets primarily fall under the SMA and the Credit Institutions and Financial Services Act (CIFSA). Although virtual assets are not explicitly mentioned in these acts, the Estonian FSA has clarified that certain provisions may apply to virtual assets, depending on their nature and characteristics.

SMA: If a virtual asset is classified as a security token or another type of financial instrument, it will be subject to the SMA. This includes regulations related to insider trading, market manipulation, and disclosure requirements. The SMA also covers the prospectus requirement for public offerings, which may apply to ICOs or security token offerings (STOs).

CIFSA: VASPs operating in Estonia must comply with the CIFSA, which regulates financial services and imposes requirements on financial institutions. VASPs must obtain a license from the Estonian Financial FIU to operate legally, and they are subject to AML/CFT regulations.

Criminal Code: Market misconduct, such as insider trading and market manipulation, may also constitute criminal offenses under the Estonian Criminal Code. This applies to virtual assets if they are considered securities or other financial instruments.

Consumer Protection Act: The Consumer Protection Act may apply to virtual assets if they are offered to retail investors. This act requires providers to disclose relevant information to consumers and protects consumers from misleading or deceptive practices.

4. Regulation of other crypto-related activities in Estonia

Are managers of crypto funds regulated in Estonia?

Yes, crypto fund managers are regulated in Estonia. The MLTFPA in Estonia, regulates providers of virtual currency services, which includes crypto fund managers.

According to section 70(1) of the MLTFPA, the activity of managing virtual currencies or tokens, including crypto funds, is considered a provider of virtual currency services. Therefore, entities providing these services, including crypto fund managers, must comply with the requirements of the MLTFPA.

Crypto fund managers must have authorisation from the Estonian FIU, which is responsible for supervising and regulating these activities. They are also required to have internal control measures in place to identify and mitigate the risks of money laundering and terrorist financing. In addition, the crypto fund managers must also submit suspicious transaction reports to the Estonian FIU.

Are distributors of virtual asset funds regulated in Estonia?

In Estonia, distributors of virtual asset funds fall under the regulatory framework set by the MLTFPA. These distributors are considered providers of virtual currency services, which encompasses offering virtual asset funds to the public.

According to Section 70(1) of the MLTFPA, a “provider of virtual currency services” includes:

providers offering services for the exchange of virtual currencies against a fiat currency or against other virtual currencies;
providers engaged in the transfer of virtual currencies; and
providers offering virtual asset services, which includes the offering of virtual asset funds to the public.

As a result, distributors of virtual asset funds are subject to the MLTFPA’s requirements. These include:

obtaining authorisation from the Estonian FIU before providing services;
implementing internal control measures to mitigate the risks of money laundering and terrorist financing;
conducting thorough due diligence on customers and monitoring transactions to identify and prevent suspicious activities; and
submitting suspicious transaction reports to the Estonian FIU as required.

Are there requirements for intermediaries seeking to provide trading in virtual assets for clients or advise clients on virtual assets in Estonia?

Intermediaries in Estonia offering services related to virtual currencies, such as exchanging virtual currencies against fiat or other virtual currencies, providing virtual asset services, buying or selling virtual currencies as a service, and trading or advising clients on virtual assets, must adhere to the guidelines set out in the MLTFPA. These intermediaries, classified as providers of virtual currency services, are required to:

obtain authorisation from the Estonian FIU before offering services;
implement strong internal control measures to mitigate money laundering and terrorist financing risks; and
comply with suspicious transaction reporting requirements, submitting reports to the Estonian FIU as necessary.

In addition to the MLTFPA requirements, intermediaries involved in trading virtual assets or providing investment advice may also be subject to other financial regulations, such as those related to securities trading. In this context, intermediaries must follow appropriate AML and KYC regulations to ensure compliance with the MLTFPA.

5. Other relevant regulatory information

Are there any upcoming regulatory developments in respect of crypto-related activity in Estonia?

The Estonian government’s policy on virtual currency regulation will be largely influenced by the implementation of the EU’s Markets in Crypto-Assets (MiCA) regulation. Under MiCA, crypto-asset service providers (CASPs) will be required to obtain authorisation from national competent authorities in order to operate in the EU. This will involve meeting strict regulatory requirements, such as having a sound business plan, implementing effective risk management procedures, and maintaining adequate capital reserves. CASPs will also be subject to ongoing supervision and enforcement actions by national competent authorities to ensure compliance with MiCA’s requirements.

In addition, MiCA will introduce new rules for the issuance and trading of crypto-assets, including requirements for disclosure, transparency, and investor protection. Issuers of crypto-assets will be required to publish a white paper containing all relevant information about the offering, including the project’s purpose, the rights attached to the crypto-assets, and the use of proceeds. Trading platforms will be required to obtain authorisation and comply with organisational and conduct of business rules, such as conflict of interest policies and best execution requirements.

Has there been any notable events in Estonia that has prompted regulatory change recently?

Yes, there have been some notable events in Estonia that have prompted regulatory change recently, particularly in relation to virtual currency regulation.

Danske Bank Money Laundering Scandal: In 2018, it was revealed that Danske Bank’s Estonian branch was involved in one of the largest money laundering scandals in history. The scandal involved the transfer of around 200 billion EUR in suspicious funds through the bank’s Estonian branch between 2007 and 2015.In response to the scandal, the Estonian government introduced a number of changes to its AML/CTF framework. These changes included strengthening the powers of the Estonian FIU, increasing the penalties for non-compliance, and introducing new regulations for virtual currency service providers. The new regulations for virtual currency service providers came into force in 2020 and require service providers to obtain a license from the Estonian FIU and comply with AML/CTF requirements.
Coin Metro Hacking: In 2019, the Estonian cryptocurrency exchange, Coin Metro, was hacked, resulting in the theft of around 1.7 million EUR in cryptocurrency.In response to the hack, the Estonian government introduced new regulations for virtual currency exchanges. The new regulations came into force in 2020 and require virtual currency exchanges to implement stronger security measures, such as two-factor authentication and to comply with AML/CTF requirements.

6. Pending litigation and judgments related to virtual assets in Estonia (if any)

Yes, there have been some pending litigation and decided judgments in Estonia in relation to virtual currency. Here are a few examples:

In 2020, the Estonian FIU froze the accounts of a virtual currency exchange, BTC-Alpha OÜ, and its related companies. The Estonian FIU alleged that the companies were involved in money laundering and terrorist financing activities. The case is currently pending in the Estonian courts.
Prosecutor’s Office v. K. and T: In 2019, the Tallinn Circuit Court ruled in this case involving the theft of virtual currency from an Estonian company. The court found that virtual currency is a digital asset that can be the subject of a criminal offense and awarded damages to the victim.
Eesti Pank v. AS LHV Pank: In 2020, the Estonian Supreme Court ruled in this case involving the taxation of virtual currency transactions. The court found that virtual currency transactions are subject to value-added tax in Estonia, and that the tax should be calculated based on the market value of the virtual currency at the time of the transaction.

7. Government outlook on virtual assets and crypto-related activities in Estonia

The regulation of virtual assets in Estonia began to take shape with the amendment of the MLTFPA in 2019. The Estonian government has introduced new regulations for virtual currency service providers, requiring them to obtain a license from the Estonian FIU and comply with AML/CTF measures.

Additionally, Estonia has implemented EU Directive 2015/849, which established a European legal framework for virtual currencies. The FSA has indicated that it is keeping a close eye on DeFi activities and has emphasised the need for service providers to adhere to the same standards of customer protection and market integrity as traditional financial services providers. These events suggest that the government of Estonia has taken a positive approach to regulating virtual assets and crypto-related activities.

8. Advantages of setting up a VASP in Estonia

According to a report by Statista, the global virtual currency market size is projected to reach over $4.3 billion by 2027, growing at a compound annual growth rate of 12.8% from 2020 to 2027. This growth is expected to be driven by factors such as increasing acceptance of virtual currencies as a mode of payment, growing demand for remittance solutions, and rising investment in virtual currency startups.

High Level of Digital Adoption: Estonia is a highly digital society, with a high level of digital adoption among its citizens. According to the World Bank, Estonia ranks first in the world for the number of online services offered by the government. This high level of digital adoption can benefit VASPs in terms of customer acquisition and operational efficiency.
Competitive Business Environment: Estonia has a competitive business environment, with a simple and efficient business registration process. According to the World Bank’s Doing Business report, Estonia ranks 18th out of 190 countries for ease of doing business. This can help VASPs to establish and operate their business efficiently.
Strong Cybersecurity Framework: Estonia has a strong cybersecurity framework, with a high level of technical expertise. According to the Global Cybersecurity Index, Estonia ranks 5th out of 194 countries for its commitment to cybersecurity. This can benefit VASPs in terms of security and operational resilience.
Favorable Tax Environment: Estonia has a favorable tax environment, with a corporate income tax rate of 20% and a 0% tax rate on retained and reinvested profits. According to a report by KPMG, Estonia ranks 1st out of 137 countries for its tax competitiveness. This can help VASPs to reduce their tax liability and reinvest their profits in their business.