VASP to CASP after 1 July 2026: what to do when your Estonian crypto licence is gone

The Estonian Financial Intelligence Unit states it plainly: all licences it had issued for the provision of virtual currency services, "kõik Rahapesu Andmebüroo väljastatud tegevusload virtuaalvääringu teenuse osutamiseks", lost their validity on 1 July 2026. The register entries were not left to lapse quietly. The FIU invalidated them on the day.

Finantsinspektsioon announced the same change on 30 June 2026: from 1 July, crypto-asset services may be provided in Estonia only by undertakings authorised under the EU crypto-asset markets regulation MiCA, either by Finantsinspektsioon itself or by the supervisory authority of another European Economic Area state.

Those two statements close the question that most pages written before July still get wrong. The old Estonian licence is not being phased out, and it is not pending conversion. It stopped authorising anything, and the public record no longer shows it as valid. If your last compliance memo was written in the spring, this is the paragraph that invalidates it.

No, and almost certainly no. There is no grandfathering left and no automatic conversion into a MiCA authorisation. A company that held an FIU licence on 30 June 2026 and did nothing else holds no authorisation at all today.

That reprices the shelf-company market. Buying an Estonian company because it "has a crypto licence" now buys a company with a cancelled register entry, whatever the listing says. The only asset worth paying for is a live MiCA authorisation held by an entity that has passed a supervisor's assessment, and acquiring control of an authorised CASP is itself a supervised event rather than a share transfer you complete quietly.

Before any payment, ask for the authorisation decision itself and check the entity in the supervisor's register. ESMA also publishes a MiCA register that includes entities flagged by national supervisors as providing crypto-asset services without authorisation, which is worth reading before you take on a counterparty as well as before you buy a company.

Finantsinspektsioon addressed this case directly in its announcement: virtual-currency providers that are still applying for authorisation in Estonia "peavad oma aktiivset tegevust piirama kuni tegevusloa otsuseni", they must limit their active operations until the authorisation decision.

In practice that means running the book down rather than growing it: servicing and returning existing client positions rather than onboarding new clients, and not marketing the service into the EU while the file is open. The exact boundary is a supervisory conversation, and the safe move is to agree it in writing with the authority rather than to infer it from silence.

Then keep the file moving. The decision clock only starts once the application is complete, so every round of follow-up questions you make necessary is time your business spends in this restricted state.

Whatever the business looked like on 30 June, the choice today reduces to four routes. They differ in cost, speed and control, not in whether authorisation is needed.

The most common plan we are asked to bless is the quietest one: keep the website up, stop calling it marketing, and serve the EU clients who come anyway. It does not survive contact with the rule.

The exception covers the narrow case of a client in the EU approaching a third-country firm entirely on their own initiative. It cannot be combined with marketing into the EU, it is read strictly, and it does not stretch to cover an existing EU client base you built while you were licensed. A business plan resting on it is a business plan resting on a supervisor's forbearance.

The practical tell is simple. If you would need the traffic to keep arriving in order to make payroll, you are not relying on an exception, you are operating a service.

Applications go to Finantsinspektsioon through its portal, which has been the submission channel since 18 March 2026, in Estonian or in English with the declaration the authority requires.

The review runs on two clocks. Finantsinspektsioon assesses completeness within 25 working days of receiving the application, then has 40 working days to reach a decision once the file is complete, and may pause the clock for up to 20 working days while it waits for information it has asked for. The processing fee for a crypto-asset service provider application is EUR 3,000. Incomplete files are how those timelines quietly turn into quarters.

The file itself is the eighteen categories of information listed in Article 62(2) of MiCA: articles of association, a programme of operations, governance arrangements, fit-and-proper evidence for the management body, shareholder information, internal control and risk-management mechanisms, ICT and security documentation, custody arrangements, and the service-specific policies that match what you actually intend to offer.

Capital sits underneath all of it. Minimum own funds are set by class of service, and a CASP must hold the higher of the class minimum or one quarter of its previous year's fixed overheads.

Providing crypto-asset services to clients in the EU without authorisation after the deadline is unlawful, not merely unregistered. That is the starting point for everything that follows, and it is why the commercial damage usually arrives before any enforcement decision does.

National supervisors report firms operating without the required authorisation, and ESMA publishes them in its MiCA register of entities flagged as non-compliant. That listing is public and it is read by precisely the banks, payment providers, exchanges and custodians the business depends on. In our experience the account closures land first, the supervisory correspondence second.

An unauthorised period also follows the founders. Every later application asks what the management body was doing in the months after the deadline, and "still serving EU clients" is an expensive answer to have to give to the supervisor you are asking to trust you.

An orderly exit is a project with its own obligations, and it is not the same thing as switching off the website. The parts that go wrong are almost always the ones that were treated as administrative.

If this article describes your position, the sequence below is the one we would run, in this order, starting today.