Cryptocurrency License in Estonia

1. Contact details of the business owner (phone number, e-mail and mailing address), a CV.
2. Address of the provision of services and web page address.
3. Name and contact details of the person responsible for the offer.
4. Name, personal code (if not available – date of birth), place of birth and residence address of the real beneficiary of the company.
5. Procedural rules and internal control regulations developed according to Articles 29 and 30 of the Money Laundering and Terrorist Financing Prevention Act, and in case of persons with special responsibilities specified in Article 6 of the International Sanctions Act, procedural rules developed according to Section 6 of the International Sanctions Act, and the procedure for verifying their implementation.
6. Name, personal code (if not available – date of birth), place of birth, citizenship, residence address, position and contact details of the contact person specified in Part 3, Article 29 or Part 4, Article 29 of the Money Laundering and Terrorist Financing Prevention Act.
7. Name, personal code (if not available – date of birth), place of birth, citizenship, residence address, position and contact details of the person responsible for applying international financial sanctions, as determined by the business owner according to Part 9, Article 13.
8. If the business owner, the Board member, the procurator, the real beneficiary or the proprietor is a citizen of a foreign country or if the business owner is a foreign person offering services, it is necessary to submit a statement from the penalty register in one’s country of origin or an equivalent document issued by a judicial or administrative authority confirming the absence of penalties for crimes committed against government authorities, money laundering crimes or another deliberate crimes no earlier than three months ago and certified by a notary or in another similar way and legalised or approved by the certificate replacing legalisation (Apostille), unless otherwise provided by an international treaty.

In accordance with the Money Laundering and Terrorist Financing Prevention Act, amendments have been made to establish stricter boundaries for companies applying for an Estonian crypto-license.

1) Equity of a virtual currency service provider.

The authorized capital of the virtual currency service provider should be:

• at least EUR 100,000 if the virtual currency service provider provides a virtual currency exchange service (a service in which a person exchanges virtual currency for money or money for virtual currency or one virtual currency for another)
• at least 250,000 euros if the virtual currency service provider provides a virtual currency translation service (a service that allows you to make a transaction at least partially electronically through a virtual currency provider on behalf of the initiator in order to transfer the virtual currency to a virtual currency wallet or recipient account)

When establishing a company for a virtual currency service provider, the payment of the authorized capital of the company can only be money.

2) Prerequisites for the identification and verification of customer data.

The service provider must use high-security technology in identifying and verifying identity through information technology; which provides the true identity and prevents the alteration or misuse of the transmitted data.

In the identification and verification of identity by means of information technology, the natural person referred to in paragraphs 1 and 2 of Article 31 of the Law on the Prevention of Money Laundering and Financing of Terrorism or the legal representative of the legal entity shall use a document digital

Identification or other electronic identification system with a high level of reliability issued under the Act on Identity Cards is included in the list published in the Official Journal of the European Union in accordance with Article 9 of the Regulation (EC) No 910/2014 of the European Parliament and the Council on Trusts Services Required for Electronic Identification and Electronic Transactions, repealing Directive 1999/93/EC (OJ L 257, 28.08.2014, pp. 73-114)and an information technology tool with a functioning camera, microphone and hardware and software, In identifying and verifying identity, the service provider may use an information technology tool to compare biometric data.

When performing an exchange and transfer transaction, the virtual currency service provider of the originator of the transaction shall establish the identity of each customer in accordance with the provisions of articles 21 and 22 of this Law and shall collect at least the following information concerning the originator of the transaction:

• In the case of a natural person, name, unique transaction identifier, payment account or virtual currency wallet identifier, name and number of identity document, as well as personal identification code or date of birth, place of birth and address of residence;
• When performing a transaction for exchange and transfer of virtual currency, the virtual currency service provider collects unique identification data of the transaction about the recipient of virtual currency or transfer, as well as data of the payment account identifier or virtual currency wallet, if payment account data or virtual currency wallet identifier is used for the transaction.

3)  The business plan of the virtual currency provider is submitted for at least two years.

4) Requirements for the virtual currency provider’s own funds.

The Virtual Currency Provider’s own funds should correspond to one of the following sizes at any given time, whichever is larger:

1.  Size of the authorised capital
2. The amount of own funds calculated according to the calculation method:

If the virtual currency service provider provides the service specified in paragraphs 101 or 102 of part 3 of this Law, the provider’s own funds of the virtual currency service provider shall be at least equal to the sum of the following parts of the volume:

1. 4 per cent of the part of transactions made in the provision of the service that is up to or equal to 5 million euros;
2. 2.5 per cent of the share of transactions made in the provision of the service, which is more than EUR 5 million but does not exceed EUR 10 million;
3. 1 per cent of the share of transactions executed in the provision of the service, which is more than EUR 10 million, but does not exceed 100 million euros;
4. 0.5 per cent of the share of transactions carried out in the provision of the service, which is more than 100 million euros, but does not exceed 250 million euros;
5. 0.25 per cent of the share of transactions made in the provision of the service, which is over 250 million euros.

The share of transactions performed as a service specified in Part 6 of this Article shall be calculated on the basis of one twelfth of the total amount of transactions performed as services specified in Parts 101 and 102 of Article 3 of this Law for the previous year. Venture service provider who worked less than 12 months in the previous year should split the amount of remittance and exchange transactions made in the previous year by the number of months in force in the previous year to arrive at the corresponding figure.

The virtual currency service provider is required to implement measures to ensure that its own funds can be calculated with sufficient accuracy at any time. The Financial Intelligence Unit may establish a period of time within which the virtual currency service provider must bring its own funds into compliance with the requirements established by this Law and the legal acts issued on its basis.

5) Audit of virtual currency provider.

Auditing of the virtual currency service provider’s annual reports is mandatory. The auditor’s data must be specified when applying for a license.

6) Requirements for location, location, board members and contact person of the virtual currency provider.

• The member of the board of the virtual currency service provider must have higher education and professional experience of at least two years.
• A member of the management board of a virtual currency service provider may not hold the position of a member of the management board of more than two virtual currency service providers.

7) State fee for application for cryptocurrency licence increased from EUR 3,300 to EUR 10,000.

Crypto license in Estonia 2023

New Requirements for Virtual Currency Service Providers

The amendments to the Money Laundering and Terrorist Financing Prevention Act (hereinafter the Act) that entered into force on 15 March 202  significantly increased the capital adequacy requirement for providers of virtual currency services, introduced the obligation to conduct an audit of the annual report and internal audit, and made a number of other changes.

Virtual currency providers that already held a valid activity license were given a deadline until 15 June 2022 to align their operations with the new requirements. This article discusses the most important amendments.

New types of virtual currency services

To the two existing types of virtual currency services – virtual currency wallet services and virtual currency exchange services – two new types of virtual currency services have been added:

• virtual currency transfer service and
• organization of an offer or sale in connection with the emission of a virtual currency.

These two activities are not yet regulated by law. Thus, under the new Act, providers of virtual currency services who were not previously required to hold an activity license are now required to analyse and clarify whether their activities fall under the two added types of virtual currency services.

In virtual currency transfer service, the service provider concludes on behalf of the transaction’s initiator (user) a transaction through which the virtual currency is transferred to the virtual wallet or to the recipient’s account. This includes services that allow the user to make transactions between their wallets or accounts. Such a service is also considered to be the case when several service providers are involved in the provision of the service at the same time and the transaction is carried out by each service provider separately or jointly with several service providers.

In the case of a service related to the issuance of a virtual currency, the service provider acts for or on behalf of the issuer and arranges for a public or directed offer or sale or provides a related financial service. An example of this service is the organization of an ICO (initial coin offering) and the provision of related services, if this is carried out for or on behalf of the issuer of the virtual currency.

Increase in the requirement for the statutory capital of the Estonian company

Capital adequacy requirements will increase significantly in the interest of greater reliability of service providers and better protection of creditors. The unit capital or share capital of the virtual currency service provider that previously was EUR 12,000 must now be at least EUR 100,000 if a wallet service, exchange service or a virtual currency-related public or targeted offer or sale is provided.

Since the role of the service provider in the case of a virtual currency translation service is similar to that of an electronic money institution, the capital adequacy requirement for such a service is the same as the EUR 250,000 requirement for an electronic money institution. In this case, the contribution to the unit or share capital of the provider of the virtual currency service can only be monetary.

Requirements for the own funds of the virtual currency service provider are also added as an innovation. The virtual currency provider’s own funds shall at all times correspond to one of the following, whichever is greater:

• the amount of the unit capital or share capital established in the Money Laundering and Terrorist Financing Prevention Act, or
• the amount of own funds calculated according to the calculation method established in Part 3 or Part 6 of Article 72² of the Act.

The virtual currency service provider’s own funds consist of Tier 1 fixed assets as set out in Articles 26 to 30 of Regulation (EU) No 575/2013 of the European Parliament and of the Council of the EU, together with the deductions provided for in Article 36, and the deductions are not subject to the exemptions related to the threshold set out in Articles 46 and 48 of the Regulation.

Obligation to audit the annual report and internal audit

According to the changes in the law, the audit of the annual report of the virtual currency service provider’s will become mandatory, and it must be carried out by an audit firm, which is appointed for no more than 5 years.

The audit firm verifies, as at the reporting date, that the virtual currency service provider has fulfilled the requirements set for its own funds and provides an opinion to the virtual currency service provider and the Financial Intelligence Unit by the due date of the submission of the report for the economic year of the service provider.

In the future, providers of virtual currency services should develop and implement adequate internal controls that cover all levels of management and operations. To this end, the supervisory board of the service provider or, in the absence of a supervisory board, the management board of the service provider appoints an internal auditor to carry out the tasks of the internal control department, who will verify the compliance of the activities of the service provider, its managers and employees with legal acts, regulations of the Financial Intelligence Unit, decisions of the governing bodies, internal regulations, contracts concluded by the service provider and good tradition.

If the internal auditor becomes aware of information that indicates a violation of the law or harm to the interests of clients, he/she must immediately transmit such information to the heads of the virtual currency service provider and the Financial Intelligence Unit.

More information about the initiator of the transaction

Further, when identifying, the service provider must request at least his phone number and e-mail address as the customer’s contact information. When performing a virtual currency exchange and transfer operation, a requirement similar to the so-called travel rule requirement is applied to payment services. According to this requirement, the following data should be collected about the virtual currency transfer initiator:

• name
• unique transaction identifier
• ID code of the payment account or virtual currency wallet
• personal identification code, name and number of the identity document or date of birth, place of birth and address of residence.

In addition, the service provider must ensure that the data is stored in a way that responds to requests from the Financial Intelligence Unit or law enforcement authorities. Data and documents related to the client must be kept for five years after the end of the business relationship.

Requirements for members of the management board

A member of the management board of a virtual currency service provider may not be a member of the management board of more than two virtual currency service providers at the same time. However, in certain cases, exceptions are possible – if the positions of a board member are in the same concern or commercial partnerships in which the virtual currency service provider has a significant participation. In justified cases, the Financial Intelligence Unit may exceptionally authorize one additional board member position.

It also adds the requirement that a board member must have had at least two years of higher education and professional experience. Areas that should be considered professional include banking and finance, economics, law, accounting, auditing, public administration, financial regulation, information technology, among others. Experience can be gained in both the private and the public sector, and may consist, for example, in supervision or training, ”notes the explanatory note to the bill amending the Money Laundering and Terrorist Financing Prevention Act and other laws.

The new version of the Prevention of Money Laundering and Terrorism Financing Act also supplements the grounds for refusing to issue a licence to operate. An important innovation is that the Financial Intelligence Unit may refuse to issue a licence to operate if sufficient supervision of the applicant is prevented by a substantial link between the entrepreneur and another person, or if it is found that the entrepreneur does not intend to operate in Estonia, that his activities are not related to Estonia or that the origin of his share or share capital is questionable.

Preparation for auditing a virtual currency service provider

Since 2023, all undertakings licensed to provide virtual currency services will be subject to mandatory audit of their financial statements and the adequacy of their own funds.

In order for the company’s management and accountants to successfully complete the audit, it is necessary to prepare the software and to establish the methods for storing and presenting the data in advance, so that the auditor can gather sufficient relevant evidence during the audit, which in turn will give him the opportunity to express an opinion on the financial statements.

There are four specific areas of virtual currency accounting where auditors may have more questions than usual:

• confirmation of balances and transactions in virtual currency;
• confirmation of liabilities in virtual currencies;
• accounting and periodization of sales revenue;
• accounting for revaluation of the cost of virtual currencies.

Virtual currencies

If virtual currencies are stored on a third-party platform, it is relatively easy to confirm their existence, since some platforms (Kraken, Binance) allow to confirm the balances at the end of the year, on other platforms one can view the asset balance retrospectively or reach them through extracts from the transaction history, viewing the current state and returning from there to the state as of December 31. However, the auditor will require the platform administrator to formally sign off on the balances or, if this is not possible, the auditor must be present at the entrance to the platform and verify for himself the existence and accuracy of the balances.

If virtual currencies are stored on the undertaking’s computer, the situation is more complicated. The auditor will request for a list of all wallets (public wallet addresses) where virtual currencies were stored as of December 31.

The wallet balance can be checked using various websites of the blockchain explorer (for example, ethscan.io, which can be used to check the balances and transactions of various ERC20 – Ethereum virtual currency platform – wallets), and the wallet belonging to the entrepreneur using test records or signing using a wallet. It is also possible that the wallet allegedly used by the client as of 31 December was empty because the assets were in a different wallet. The reason may be, for example, that the client sent the assets to another wallet on December 31, the transaction was completed and reflected in the public data on the blockchain, but not in the client’s own system as of that date. Also, errors made by people who made a list of wallets may be the cause, if this is not an automatic statement from the client’s system.

It is also important to verify the recording of inventory values in the books using the year-end market price and comparing the value recorded in the books with the market price. If an undertaking has its own trading platform, it is more likely that it will store its customers’ virtual currencies on its platform. In such a case, the undertaking accounts for this liability in euros in the same way as inventories, and it is necessary to check whether the monetary value of the liabilities was correctly calculated using the market price as at 31 December.

Reaffirmation of obligations

The standard approach to confirming obligation is to reconcile them with third parties. A random sample of customers and the largest customers is made, and the undertaking conducts a procedure with them to confirm the balance under the control of the auditor. Undertakings are also often the largest customers, and the likelihood of receiving confirmation of the balance from them is higher than from an individual whose counterobligation is relatively small. If the number of customers is very large and it can be difficult to obtain confirmations, then automation of this process should be provided during the development of the platform. Kraken, for example, checks wallet balances, asks users of the platform for confirmation when logging in, and the data is passed to the auditors.

In addition to the balance confirmations, the entrepreneur must also provide the auditor with an opportunity to check the undertaking’s internal control system with respect to the obligations in order to gain an understanding of how the obligations have been accounted for and how the undertaking itself is satisfied that its accounting is correct.

Accounting and periodization of sales revenue

If an entrepreneur uses a third-party platform for trading, he or she can rely on the transaction statement and compare it with what is reflected in the accounting. If an entrepreneur has an internally created platform on which he trades, then a database of all transactions is also necessary. The extract or database must contain all transaction details, including the transaction ID that can be used with the blockchain explorer, the technical details of the transactions (between which wallets and when virtual currencies were moved, what is the fee for the transaction in the network, etc.).

It is also important to self-check the conversion of sales revenue from virtual currency to money before submitting data to the auditor. Transaction fees are usually charged on the currency used in the transaction, and if the transaction used virtual currency, the resulting income must be converted into money. Whether the sales revenue is converted to cash at the time of the transaction or once a day/week/month can significantly change the reported sales revenue, and when the revenue is converted to cash, it may not be immediately clear from the company’s data. Virtual currency market prices can fluctuate significantly even during the week or day, and with large transaction volumes, small differences with market prices can lead to significant differences.

Data downloading and processing may also be difficult to check for sales revenue due to the volume of transactions. If the company is small and trades virtual currency for itself, or if the number of customers is limited, then manual verification of transactions using programs such as Excel is still possible. If the undertaking has thousands of customers and hundreds of thousands or even millions of transactions per year, it becomes more difficult to verify them, this amount is no longer covered by Excel, and the auditor can use other programs designed for large-scale databases. On the other hand, the entrepreneur must ensure that the data is accessible and transferable, which would allow the auditor to analyse and control the entire volume of transactions.

Accounting for the revaluation of the value of virtual currencies

Income or expenditure may result from changes in the market price of the virtual currency during the year, and this change in the market price affects the carrying amount of inventories. It may be that in accounting of the undertaking it is recorded by one record on December 31 as the sum of the income or expenditure, and more detailed information on that consists of this sum, isn’t present.

The auditor asks the accountants how this was calculated and will want to verify this calculation, including what market prices and exchange rates were used and whether they were used correctly. However, it is not always possible to explain the process of calculating these indicators and prove their correctness if the platforms or accounting did not have the appropriate settings.

Own funds

All providers of virtual currency services are obliged to ensure that their own funds do not fall below the criteria set out in article 72² of the Money Laundering and Terrorist Financing Prevention Act and in the activity licence. The auditors shall verify and confirm the accounting of the virtual currency service providers’ own funds with the Financial Intelligence Unit (Rahapesu Andmebüroo, hereinafter referred to as FIU) once a year on the due date of the annual report, i.e. 6 months after the end of the reporting year. The first own funds’ report shall be submitted depending on when the license of the virtual currency service provider was obtained.

Persons who had a valid license to operate before 15 March 2022 must submit the audited calculation of their own funds on the basis of the balance sheet drawn up at the end of the last reporting period no later than 1 January 2023. Management should take into account that it is practically impossible to conduct an audit for one day, and agree to conduct an audit on the balance sheet day of the last reporting period or another earlier balance sheet day.

In the case of licenses for activities that were issued after the changes in the law, it should be assumed that the audit firm should verify the fulfillment of the requirements established for the own funds  of the virtual currency service provider as of the balance sheet date (should be between 15 March 2022 – 1 January 2023), and submit the corresponding conclusion by the deadline for submission of the report for the business year of the virtual currency service provider to the virtual currency service provider itself and to the FIU.

To verify the own funds of the virtual currency service providers, the auditor must verify the correctness of the volume of transactions, assets and liabilities, as well as when auditing or inspecting the annual report, as well as the correctness of the calculation of own funds, based on the instructions published by the FIU and the Ministry of Finance.

Based on the instruction of the FIU, assets in virtual currency in the calculation of own funds are considered intangible assets subject to deduction. Own funds also do not include virtual currencies and fiat money owned by customers or other intangible property (for example, the cost of developing platforms for trading virtual assets or providing wallet services). The procedures for controlling own funds in terms of virtual currencies can be simplified or, under certain conditions, not applied, if they do not affect the correctness of the calculation of own funds.