--- title: "Estonia (EE) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/estonia/ source_html: /jurisdictions/estonia/index.html description: "Financial integrity intelligence for Estonia (EE): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: e09215587e651b27eb577c6671d79476761d521c5668911f96a4e57fbc9d7fe3 generator: "fe-fleet/md-twin@1.0" --- # Estonia (EE) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # Estonia EE Domains covered 8 of 8 Sources 127 Role actions 8 Horizon <90d 1 Jurisdiction profile FATF status: Compliant Tier: B Risk direction: Stable Enablement vs enforcement: Mixed Estonia implements AML/CFT via the MLTFPA, supervised by the EFIU and Finantsinspektsioon (EFSA); a MONEYVAL 5th-round MER (Dec 2022) rated Estonia partially compliant on effectiveness, placing it in enhanced follow-up through at least two FURs (2024, 2025), with persistent gaps in targeted financial sanctions (R.7) and beneficial ownership enforcement. Key deficiencies - Targeted financial sanctions (asset-freezing) provisions remain partially compliant across two follow-up rounds - No enforceable measures for supervisors/competent authorities to obtain accurate basic and beneficial ownership information from companies - Company Service Provider (CSP) sector poorly supervised despite being the primary vehicle for e-Residency-enabled shell company formation - VASP/CASP sector historically served large volumes of non-resident, offshore-linked clients with weak state awareness of ML/TF patterns Recent developments (18m) - 2nd enhanced Follow-Up Report adopted by FATF/MONEYVAL (Dec 2025, published Mar 2026) with partial technical-compliance re-ratings - Estonian Navy boarded and detained the sanctioned shadow-fleet tanker Kiwala in Estonian waters (April 2025) - Danske Bank A/S announced conclusion of its US DOJ corporate probation (Dec 2025), closing the final chapter of the Estonia-rooted 2007-2015 laundering scandal - Estonian Border Guard documented an armed Russian civilian tanker (Marshal Vasilevskiy) with heavy machine guns and FSB-linked personnel sailing near Estonian territorial waters (May-June 2026) - EFIU issued two revised sanctions-implementation guidelines in 2025 - VASP-to-CASP MiCA transitional licensing regime approaching its 30 July 2026 hard deadline Law made at European Economic Area level that applies in Estonia is covered once, on the [European Economic Area](/jurisdictions/eea/) page. This page covers Estonia’s own layer: implementation, national authorities, national options and local enforcement. Brief ## Lead signal #### Lead Signal Estonia's parliament, the Riigikogu, passed a financial fraud prevention and combating law (936 SE) on or about 21 October 2026, with 76 votes in favour. The instrument gives credit institutions and payment and e-money institutions a statutory basis, previously absent from Estonian law, to detect fraud ahead of a payment being executed and to delay or refuse that payment where fraud is suspected. It also creates a formal gateway for those institutions to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with Estonia's national computer emergency response team, CERT-EE. Credit providers and credit intermediaries gain a parallel data-exchange right in relation to loan fraud. The structural significance is that Estonian banks and payment firms currently have no legal basis to hold a payment on suspicion alone; this law supplies one for the first time, and it does so through a data-sharing architecture that functions as an anti-money-laundering control even though it is framed publicly as a consumer-fraud measure. Read full brief #### Lead Signal Estonia's parliament, the Riigikogu, passed a financial fraud prevention and combating law (936 SE) on or about 21 October 2026, with 76 votes in favour. The instrument gives credit institutions and payment and e-money institutions a statutory basis, previously absent from Estonian law, to detect fraud ahead of a payment being executed and to delay or refuse that payment where fraud is suspected. It also creates a formal gateway for those institutions to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with Estonia's national computer emergency response team, CERT-EE. Credit providers and credit intermediaries gain a parallel data-exchange right in relation to loan fraud. The structural significance is that Estonian banks and payment firms currently have no legal basis to hold a payment on suspicion alone; this law supplies one for the first time, and it does so through a data-sharing architecture that functions as an anti-money-laundering control even though it is framed publicly as a consumer-fraud measure. The law has been adopted by the legislature but has not yet been published in the Riigi Teataja, the official gazette, so its entry into force is not yet confirmed; its practical effect is accordingly prospective and tracked as a near-term horizon item rather than an in-force obligation. #### Other Developments A supervisory precept against a listed bank. Coop Pank AS disclosed that Finantsinspektsioon, Estonia's financial supervisor, issued a precept following an on-site inspection, requiring the bank to remediate its governance, internal control, risk management, regulatory reporting and lending procedures, with deadlines running into 2027. The disclosure comes from the bank itself; Finantsinspektsioon's own public notice has not been independently located, and the precept does not on its face name anti-money-laundering or counter-terrorist-financing failings as a driver. It is recorded here as a general supervisory-intervention data point against a credit institution operating in a jurisdiction already under heightened scrutiny, rather than as a confirmed financial-crime finding. Standing architecture, unchanged this cycle. Estonia continues to operate its money-laundering and terrorist-financing prevention regime under the existing national Act pending direct applicability of the EU's new Anti-Money Laundering Regulation from 10 July 2027, and remains under enhanced follow-up to its fifth-round mutual evaluation. Neither position moved this cycle; both remain the backdrop against which the new payment-fraud law should be read. #### Cross-Monitor Connections The payment-hold and data-sharing power created by 936 SE sits squarely on the boundary between consumer-protection and financial-crime architecture: a mechanism built to intercept authorised-push-payment fraud in real time also functions as a new inter-institutional intelligence-sharing channel, the kind of infrastructure that typically strengthens detection of layering and mule-account activity even where that is not its stated purpose. The Coop Pank precept, concerning a credit institution's governance and risk-management posture, is the kind of supervisory intervention that other monitors tracking institutional stability or consumer confidence in the same bank would also want visibility on, even though the precept itself is not framed as an anti-money-laundering enforcement action. #### Outlook The immediate item to watch is formal publication of 936 SE in the Riigi Teataja, which will fix the law's entry-into-force date and convert the current horizon entry into a confirmed, in-force obligation; this was expected by the end of 2026 as at the close of this cycle, though the precise commencement date had not been confirmed. Once in force, the practical test will be how actively credit institutions and payment firms use the new hold-and-share power, and whether Finantsinspektsioon or the Police and Border Guard Board publish any guidance on its operation alongside existing anti-money-laundering duties. On the supervisory side, the deadlines attached to the Coop Pank precept running into 2027 mean that bank's remediation progress is a standing item for the cycles ahead. Earlier periodic briefs (5) 25 Oct 2026 · fim-2026-10-25 #### Lead Signal Estonia's parliament, the Riigikogu, passed a financial fraud prevention and combating law (936 SE) on or about 21 October 2026, with 76 votes in favour. The instrument gives credit institutions and payment and e-money institutions a statutory basis, previously absent from Estonian law, to detect fraud ahead of a payment being executed and to delay or refuse that payment where fraud is suspected. It also creates a formal gateway for those institutions to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with Estonia's national computer emergency response team, CERT-EE. Credit providers and credit intermediaries gain a parallel data-exchange right in relation to loan fraud. The structural significance is that Estonian banks and payment firms currently have no legal basis to hold a payment on suspicion alone; this law supplies one for the first time, and it does so through a data-sharing architecture that functions as an anti-money-laundering control even though it is framed publicly as a consumer-fraud measure. The law has been adopted by the legislature but has not yet been published in the Riigi Teataja, the official gazette, so its entry into force is not yet confirmed; its practical effect is accordingly prospective and tracked as a near-term horizon item rather than an in-force obligation. #### Other Developments A supervisory precept against a listed bank. Coop Pank AS disclosed that Finantsinspektsioon, Estonia's financial supervisor, issued a precept following an on-site inspection, requiring the bank to remediate its governance, internal control, risk management, regulatory reporting and lending procedures, with deadlines running into 2027. The disclosure comes from the bank itself; Finantsinspektsioon's own public notice has not been independently located, and the precept does not on its face name anti-money-laundering or counter-terrorist-financing failings as a driver. It is recorded here as a general supervisory-intervention data point against a credit institution operating in a jurisdiction already under heightened scrutiny, rather than as a confirmed financial-crime finding. Standing architecture, unchanged. Estonia continues to operate its money-laundering and terrorist-financing prevention regime under the existing national Act pending direct applicability of the EU's new Anti-Money Laundering Regulation from 10 July 2027, and remains under enhanced follow-up to its fifth-round mutual evaluation. Neither position moved; both remain the backdrop against which the new payment-fraud law should be read. #### Cross-Monitor Connections The payment-hold and data-sharing power created by 936 SE sits squarely on the boundary between consumer-protection and financial-crime architecture: a mechanism built to intercept authorised-push-payment fraud in real time also functions as a new inter-institutional intelligence-sharing channel, the kind of infrastructure that typically strengthens detection of layering and mule-account activity even where that is not its stated purpose. The Coop Pank precept, concerning a credit institution's governance and risk-management posture, is the kind of supervisory intervention that other monitors tracking institutional stability or consumer confidence in the same bank would also want visibility on, even though the precept itself is not framed as an anti-money-laundering enforcement action. #### Outlook The immediate item to watch is formal publication of 936 SE in the Riigi Teataja, which will fix the law's entry-into-force date and convert the current horizon entry into a confirmed, in-force obligation; this was expected by the end of 2026 as at the close of this cycle, though the precise commencement date had not been confirmed. Once in force, the practical test will be how actively credit institutions and payment firms use the new hold-and-share power, and whether Finantsinspektsioon or the Police and Border Guard Board publish any guidance on its operation alongside existing anti-money-laundering duties. On the supervisory side, the deadlines attached to the Coop Pank precept running into 2027 mean that bank's remediation progress is a standing item for the cycles ahead. 18 Oct 2026 · fim-2026-10-18 #### Lead Signal The dominant financial-integrity event for Estonia this cycle is a change of ultimate ownership at a systemically significant institution, cleared rather than contested. The European Commission approved, under the EU Merger Regulation simplified procedure (Case M.12586), the acquisition of sole control of Luminor Holding AS of Estonia by OTP Bank Nyrt. of Hungary. The clearance moves Luminor Bank, incorporated in Tallinn and the third-largest pan-Baltic banking group, from a Blackstone-managed private-equity consortium and DNB Bank into a Central European banking group whose footprint now extends to fourteen countries. No competition or anti-money-laundering conditions attach to the clearance on the facts available. The analytical significance of the transaction lies less in the transaction itself than in what its clean passage signals about the standing of Baltic banking assets inside EU merger control. A bank domiciled in a jurisdiction that remains, per MONEYVAL, in enhanced follow-up on its anti-money-laundering and counter-terrorist-financing framework changed hands at EU level without any AML/CFT-specific scrutiny surfacing in the public record of the clearance. That is not evidence of a gap; it is evidence that merger control and AML/CFT supervision run on separate tracks, and a reader should not infer from the former that the latter was tested. #### Other Developments Baltic consolidation reshapes bank ownership without a visible compliance overlay. The OTP/Luminor transaction was signed 20 July 2026 and the Commission's clearance followed on 13 October 2026. Luminor's own announcement frames the deal as OTP's entry into the Baltic markets, lifting total group assets by more than ten percent and bringing euro-zone operations to half of group activity. None of the available reporting on the transaction discloses the consideration paid, and no financial-integrity-specific undertaking was identified in the clearance record. Estonia's AML/CTF technical-compliance trajectory continues to improve while formal status is unchanged. MONEYVAL's second Enhanced Follow-Up Report, adopted 15-18 December 2025, re-rated seven FATF Recommendations upward: Recommendations 2, 12, 18, 22, 25, 26 and 27 moved from Partially Compliant to Largely Compliant, and Recommendations 14, 32 and 33 moved from Partially Compliant to Compliant. Estonia nonetheless remains in enhanced follow-up and continues to report back to MONEYVAL on its AML/CFT implementation, with a further report expected around December 2026. The improving-but-not-yet-resolved posture is the more accurate reading than either a clean bill of health or a standing deficiency. #### Cross-Monitor Connections The OTP/Luminor clearance is a commercial-activity event with direct relevance to the World Payments Monitor's coverage of industry structure and commercial intelligence in the Baltic banking sector, since the same transaction changes the ownership of a licensed payment-services provider. It carries no sanctions, beneficial-ownership, or conflict-finance signal on the evidence reviewed this cycle, and no cross-reference to crypto-asset activity arises from the transaction itself. #### Outlook Watch for whether the EU Commission's clearance record is followed by any prudential or AML/CFT-specific conditions imposed separately by Estonia's or the ECB's supervisory channels, since merger clearance does not itself constitute supervisory sign-off on the acquirer's compliance programme. Estonia's MONEYVAL enhanced follow-up status is due for further reporting around December 2026, which will be the next formal checkpoint on whether the improving technical-compliance trajectory continues. 11 Oct 2026 · fim-2026-10-11 #### Lead Signal Estonia's financial-integrity posture this cycle is defined by a diplomatic sanctions-scope episode rather than an enforcement action. At Estonia's request, EU ambassadors agreed on 7 October 2026 to exclude a Russian rare-earth-metals supplier to Estonian firm NPM Silmet, and a linked individual, from the newest Russia sanctions package, which otherwise designated 743 individuals and 826 entities. This is probable rather than confirmed: the finding is corroborated by two independent press reports but no EU Council Official Journal primary text was retrieved this cycle. The episode is analytically significant as architecture, not incident: it shows Estonia actively shaping the scope of EU autonomous listings for domestic industrial-policy reasons, carving a supply-chain dependency out of a sanctions package it otherwise supports. A second structural development concerns the limits of Estonian domestic AML supervisory power. The Supreme Court of Estonia is reported to have declared unlawful, on 8 January 2026, a blanket Financial Intelligence Unit directive from late 2022 that sought bulk information from all licensed trust and company service providers, holding that an information request cannot create new analytical-document obligations not already required by law. This claim rests on a single non-Tier-1 legal-commentary source, with the underlying Riigikohus decision not independently retrieved, and is therefore carried at an uncertain tier. #### Other Developments MiCA transition sunset completes. From 1 July 2026 Estonia's transitional period for legacy FIU-licensed virtual-currency service providers ended. Of 36 legacy licensees remaining at the start of 2026, only Lightspark Payments Europe AS obtained a standalone MiCA CASP authorisation by the deadline. The finding is corroborated across two independent sources, though no direct Finantsinspektsioon or FIU primary notice was retrieved this cycle. This probable development materially consolidates Estonia's crypto-asset gatekeeping onto Finantsinspektsioon, reducing a historically high-volume, FIU-run VASP licensing population to a single standalone CASP holder — a structural narrowing of the population Estonian authorities must actively supervise, rather than an enforcement signal in itself. Commercial precursor to the sole CASP outcome. Lightspark acquired the Tallinn-based crypto-banking API firm Striga on 14 October 2025, ahead of becoming the only company holding a standalone Finantsinspektsioon MiCA CASP authorisation in Estonia by the 1 July 2026 deadline. This rests on a single deal-data aggregator source with deal terms undisclosed, and is treated as uncertain. Read alongside the MiCA sunset, the acquisition is the commercial substrate behind the regulatory consolidation: a single well-capitalised, M&A-backed entity now occupies the licensing position previously held by a much larger, more fragmented population of legacy VASPs. #### Cross-Monitor Connections The Silmet supplier exclusion sits at the intersection of sanctions architecture and conflict-adjacent commodity flows; a rare-earth-metals supply chain carved out of an EU Russia sanctions package for domestic industrial reasons is the kind of structural exception that ERM-style commodity-flow monitoring and SCEM-style conflict-finance tracking would want visibility on, even though no direct conflict-finance claim is asserted here. The MiCA sunset and the Lightspark/Striga consolidation have a natural WDM and crypto-monitor adjacency: a single-licensee outcome in a jurisdiction that previously hosted a large legacy VASP population changes the technical and supervisory surface that crypto-infrastructure monitoring would track going forward, though no crypto-monitor finding is drawn from this cell this cycle. #### Outlook The Silmet exclusion is likely to remain a live issue as subsequent EU sanctions packages are negotiated; whether the carve-out is treated as a one-off accommodation or a precedent for further industrial-policy exceptions is not yet resolved from the material available. On the enabler-jurisdiction side, the Supreme Court ruling, if its reported effect holds, narrows the FIU's practical reach over trust and company service providers absent new legislative authority, a constraint worth watching into subsequent cycles as the underlying primary decision is sought. On crypto, with the legacy VASP population now resolved to a single standalone CASP holder, the open question is whether further entrants pursue MiCA authorisation in Estonia or whether the market consolidates further around the Lightspark/Striga outcome. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Estonia's crypto-asset service-provider base thinned sharply on 1 July 2026, when legacy FIU-issued VASP licences were cancelled with no automatic conversion to a MiCA CASP authorisation. Against roughly 369 legacy licence records held as of 2022, only Lightspark Payments Europe AS held a standalone CASP authorisation at the deadline. Finantsinspektsioon becomes the sole crypto-asset prudential authority going forward, distinct from the Estonian FIU (Rahapesu Andmeburoo), which remains the designated national financial intelligence unit. #### Other Developments Beneficial-ownership access tightened. From 10 July 2026, Estonia's e-Business Register (TEKSA) ends free public access to beneficial-ownership data; access now requires a defined basis, such as status as a competent authority, an obliged entity, a contractual partner, or a demonstrated legitimate interest. This implements the AMLD6 beneficial-ownership-register milestone at the national level and represents a structural shift away from open registry access. Naval posture toward sanctions-evasion shipping softened. Estonia's navy commander stated in April 2026 that Tallinn would refrain from detaining Russian shadow-fleet vessels in the Baltic given escalation risk, and in June 2026 authorities reported a militarised, machine-gun-equipped shadow-fleet vessel transiting Estonian waters. This follows 2025 attempts to detain the sanctioned tankers Kiwala and Jaguar, the latter of which triggered a Russian fighter-jet incursion. The shift widens the practical enforcement gap between the EU sanctions architecture governing the oil price-cap regime and Baltic littoral-state risk tolerance for direct interdiction. AML/CFT technical compliance continues incremental improvement under enhanced follow-up. Estonia remains under MONEYVAL 5th-round enhanced follow-up, with the first follow-up report adopted December 2024; the 2025 follow-up rates roughly seven FATF Recommendations as compliant, twenty-one as largely compliant, and twelve as partially compliant. #### Cross-Monitor Connections The VASP-to-CASP transition connects directly to the crypto monitor's own licensing tracking of the same cutover, and to world-payments' subscribed stablecoin and digital-money slot, which this financial-integrity sub-brief does not itself narrate. The shadow-fleet enforcement-posture shift is architecturally significant beyond Estonia alone: it illustrates how EU/G7 sanctions architecture depends on littoral-state willingness to act, a dependency that other Baltic and Nordic sanctions-enforcement contexts share. The beneficial-ownership register access change sits within the broader EU AML Package transition described in the D2 sub-brief below. #### Outlook AMLA begins direct supervision of selected high-risk cross-border obliged entities from January 2028; whether Estonian obliged entities fall within that direct-supervision perimeter has not yet been determined and is a key structural question for Estonian AML architecture over the next two years. Watch also for whether the authorised CASP population widens beyond the single standalone authorisation confirmed at the 1 July 2026 cutover, and whether Estonia's naval posture toward shadow-fleet vessels shifts again in response to further militarisation incidents. 11 Sep 2026 · fim-2026-08-05 #### Lead Signal Estonia's financial-integrity architecture moved on two fronts simultaneously this cycle in a way best read as a single structural realignment rather than two unrelated developments. The e-Business Register's beneficial-ownership data shifted from free public lookup to a purpose-based access model effective 10 July 2026, implementing 6AMLD constraints and the 2022 CJEU ruling on unrestricted public access to ownership data, via a Ministry of Finance TEKSA amendment. In parallel, Estonia's legacy virtual-asset-service-provider licensing regime fully sunset on 1 July 2026, with Finantsinspektsioon's MiCA CASP authorisation becoming the sole valid pathway for crypto-asset service provision and no automatic grandfathering of existing FIU-issued licences. Read together, these two developments mark Estonia's transition away from its historically maximal-openness posture, on both corporate-transparency and crypto-licensing fronts, toward EU-harmonised, access-controlled market infrastructure. This is an architecture-level finding: the significance is not any single enforcement action but the structural repositioning of two adjacent transparency regimes on a near-identical timetable. #### Other Developments FIU enforcement ahead of the MiCA cutover. The Estonian Financial Intelligence Unit revoked the VASP licence of BB Trade Estonia OU, licence FVT000209, on 29 June 2026, citing non-compliance with a corrective precept, days before the legacy regime sunset entirely. The action is a directly sourced primary enforcement event and demonstrates that the FIU continued active supervision of the legacy population through to the final days of the transition window rather than allowing the sunset date alone to do the work of exit. A visible gap between sanctions-list growth and Baltic interdiction posture. Estonia's Navy has adopted a de-escalatory posture toward Russian shadow-fleet tankers transiting the Gulf of Finland and wider Baltic, declining to board suspected vessels there given the permanent presence of armed Russian naval patrols and prior escalation incidents, while reserving physical interdiction for the North Sea, the Atlantic, and cases of imminent danger. This sits alongside the EU's 20th Russia sanctions package, adopted 23 April 2026, which added 46 vessels to the shadow-fleet designation list for an EU-wide total of 632. The combination is analytically significant under an architecture-over-incident lens: sanctions-designation capacity is expanding faster than practical enforcement capacity in the waters where Estonia has the most direct exposure, and the absence of Baltic boarding action is itself a signal, not merely an absence of news. A standing technical-compliance gap. Estonia remains in enhanced follow-up under its fifth-round FATF/MONEYVAL mutual evaluation, with Recommendation 7 on targeted financial sanctions rated Partially Compliant due to asset-freezing scope gaps. This is a primary-sourced, high-confidence finding that predates this cycle's shadow-fleet posture news but sits in direct tension with it: the same jurisdiction expanding its non-interdiction posture in contested waters carries an unresolved, FATF-identified gap in how it freezes assets tied to sanctions targets. #### Cross-Monitor Connections The e-Business Register access change has a direct read-across to payments-sector know-your-business infrastructure: institutions that have relied on frictionless free lookup of Estonian corporate beneficial-ownership data for onboarding and counterparty due diligence will need documented legitimate-interest or obliged-entity access workflows from 10 July 2026 onward, a plumbing-level change tracked jointly with payments-infrastructure monitoring. The shadow-fleet and sanctions-designation developments connect to conflict-finance and state-capture monitoring more broadly: an enforcement-capacity gap opening between EU-level designation growth and a coastal state's practical interdiction posture is precisely the kind of structural finding that recurs across sanctions-evasion architecture tracked in adjacent monitors covering the wider Baltic shadow-fleet ecosystem. #### Outlook Three dates anchor the coming cycle. The e-Business Register's purpose-based access regime took formal effect 10 July 2026, and its practical operation, including how obliged entities and legitimate-interest claimants actually exercise access, is the next verification point. The MiCA CASP transition, effective from 1 July 2026, leaves open the question of how many of Estonia's legacy VASP population complete authorisation versus exit the market, a question the BB Trade Estonia revocation suggests the FIU is prepared to force where non-compliance persists. Estonia's FATF enhanced-follow-up status, with Recommendation 7 still Partially Compliant, remains an unresolved structural gap independent of the shadow-fleet posture story, and is the more durable of this cycle's technical-compliance signals. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion Estonia occupies a front-line transit position on the Gulf of Finland corridor used by the Russian shadow-fleet oil trade, and this cycle registered both a physical interdiction and a documented escalation within that standing risk picture. In April 2025 the Estonian Navy boarded and detained the sanctioned tanker Kiwala in Estonian territorial waters, an action over the vessel's insurance status and shadow-fleet membership that became a reference case for the subsequent Baltic-wide crackdown. More recently, the Gazprom-linked tanker Marshal Vasilevskiy was photographed by Estonian Border Guard personnel carrying heavy machine guns and FSB and military-linked crew, sailing as close as 13 nautical miles from the Estonian coast without interdiction, constrained by law-of-the-sea limits on stopping a vessel absent a clear legal trigger. This is an architecture-level finding, not an isolated incident: it demonstrates that Russia is now willing to arm civilian-flagged tankers transiting near a NATO member's territorial waters, raising the practical and legal stakes of the standing corridor. Continue reading This physical evasion architecture sits alongside a persistent legal gap in Estonia's own sanctions-implementation regime. Estonia's targeted-financial-sanctions freezing regime under FATF Recommendation 7 has been rated only partially compliant across both the 2024 and 2025 MONEYVAL follow-up reports, with freezing obligations applying only in limited circumstances and no bona fide third-party protections. This is a structural gap inside an EU and NATO member state directly on a Russia-adjacent transit corridor, not a technical formality; it undermines the practical enforceability of UN 1718 and EU proliferation-related sanctions regardless of designation volume. The EU Council's addition of 41 further shadow-fleet vessels on 18 December 2025, bringing its total to almost 600, and the wider 19th sanctions package adopted 23 October 2025, which introduced an EU-specific ban on crypto and fintech services capable of enabling sanctions circumvention, both expand the designation architecture without directly closing Estonia's own freezing-regime deficiency. Divergent EU, UK, and US shadow-fleet vessel lists, respectively near 600, 544, and 155 vessels from a single OFAC action, create enforcement seams that reflagging can exploit, seams now more consequential given documented armed escort of shadow-fleet vessels. A rare jurisdiction-specific listing this period was the EU cyber-sanctions designation of three individuals on 27 January 2025 for malicious cyber-attacks against Estonia specifically, illustrating that Estonia is treated by the EU sanctions architecture as both a transit-risk jurisdiction to be monitored and a direct target of hostile state activity to be defended. #### Outlook Estonia's Recommendation 7 freezing-regime deficiency is due to be tested again at the next FATF/MONEYVAL enhanced follow-up report, expected around the fourth quarter of 2026, following the second enhanced follow-up report adopted in December 2025. Whether that report finally re-rates the freezing gap, after two consecutive partial-compliance findings, will be the clearest available signal of whether Estonia's sanctions-implementation architecture is closing or remains structurally exposed. In parallel, the shadow-fleet corridor risk is unlikely to recede: armed escort of tankers signals an escalatory posture that outpaces the slower cadence of legal-regime remediation, and the divergence among EU, UK, and US designation lists remains an exploitable structural seam independent of any single jurisdiction's compliance trajectory. Judgment: No Estonia-specific sanctions-architecture development identified this cycle. Uncertain #### Beneficial Ownership and Corporate Transparency MONEYVAL's second enhanced Follow-Up Report, adopted December 2025 and published March 2026, confirms that Estonia still lacks enforceable measures for authorities to obtain accurate, current beneficial-ownership information from companies or foreign trusts. This deficiency has a concrete architecture behind it: the Company Service Provider sector, which forms the structural gatekeeper of Estonia's e-Residency company-formation pipeline, has been documented by the MONEYVAL evaluation team forming companies, obtaining virtual-asset service provider licences on their behalf, and then selling the resulting ready-made corporate shells to non-resident and e-resident purchasers whose real board members, beneficial owners, and operations are located abroad. This is architecture-level opacity, distinct from any single enforcement failure: the exploitability exists at the point of company creation itself, before any transaction monitoring or downstream due diligence can intervene. Compounding the access problem, Estonia's beneficial-ownership register imposes a per-company access fee of roughly one euro, placing it among seven EU states that paywall beneficial-ownership data, a modest but structurally telling barrier to the transparency the register nominally provides. Continue reading As a standing structural matter, the EU AML Package consists of three distinct legal instruments that together reshape the beneficial-ownership and corporate-transparency landscape across the bloc, including Estonia. The AML Regulation, Regulation (EU) 2024/1624, is directly applicable across all member states and becomes the single rulebook governing customer due diligence and beneficial-ownership standards from 10 July 2027, superseding the current national patchwork of enforcement approaches. The sixth AML Directive requires transposition into each member state's domestic law on its own timeline; Estonia's specific transposition vehicle and enactment status were not established in this research cycle and remain an open evidentiary gap rather than an assumed compliance point. The AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority itself, which is expected to begin direct supervision of selected cross-border obliged entities around 2027-2028, shifting the supervisory perimeter from a purely national model toward a hybrid EU-level regime. Estonia's Financial Intelligence Unit and Financial Supervision Authority are reported to be actively developing a joint risk-based-approach model with AMLA specifically for virtual-asset service provider and crypto-asset service provider supervision, ahead of that formal perimeter build-out. This three-instrument architecture is the durable backdrop against which Estonia's beneficial-ownership deficiencies must be read: it establishes a fixed, dated remediation horizon that did not exist when the underlying MONEYVAL findings were first made. A related enforcement-chain event closed this cycle when Danske Bank's US Department of Justice corporate probation, tied to its 2022 guilty plea over the Estonia-rooted 2007-2015 laundering scandal, formally concluded in December 2025. This closes the international enforcement chapter of the scandal that first exposed the structural vulnerabilities in Estonia's non-resident banking and corporate-formation ecosystem, even as the underlying beneficial-ownership verification gap identified by MONEYVAL remains open. #### Outlook The fixed 10 July 2027 application date for the AML Regulation, and the 2027-2028 window for AMLA's direct-supervision build-out, together give Estonia's beneficial-ownership deficiency a defined remediation horizon for the first time, rather than an open-ended finding. Whether Estonia's own domestic measures narrow the enforceable-BO-verification gap ahead of that EU-wide harmonisation, particularly with respect to the Company Service Provider sector's shell-formation pipeline, remains to be tested at the next MONEYVAL follow-up report expected around the fourth quarter of 2026. Judgment: No Estonian beneficial-ownership register change identified this cycle. Uncertain #### Enabler Jurisdictions and Professional Facilitators Estonia's role as an enabler jurisdiction this cycle is best read through the pairing of two enforcement-chain events that together expose a structural gap rather than a resolved episode. Danske Bank's US Department of Justice corporate probation, arising from its 2022 guilty plea over the Estonia-rooted 2007-2015 laundering scandal in which the bank's Estonian branch processed a vast non-resident client book, formally concluded in December 2025, closing the international dimension of the enforcement chain. Yet Estonia's own domestic prosecution covering the same 2010s Russian non-resident client book, centred on Swedbank, was closed in February 2024 after prosecutors determined the case could not proceed without evidentiary cooperation from Russian authorities. The asymmetry is analytically significant: a foreign regulator was able to conclude enforcement action against a bank for conduct rooted in Estonia, while Estonia's own domestic prosecution of parallel conduct stalled entirely on the unavailability of evidence located in an uncooperative foreign jurisdiction. This is a structural enforcement gap common to Baltic-region money-laundering cases with Russia-located predicate evidence, not a jurisdiction-specific failure of will. Continue reading The professional-facilitator architecture underlying both cases converges on the Company Service Provider sector, which MONEYVAL identifies, alongside real estate, as the most money-laundering-vulnerable class of designated non-financial business or profession in Estonia. The sector lacks enforceable measures to verify beneficial ownership for foreign trusts and non-licensed formation activity, and it functions as the structural gatekeeper for the e-Residency company-formation pipeline through which ready-made corporate shells, including some carrying virtual-asset service provider licences, are formed and sold to non-resident and e-resident purchasers. This positions Estonia's professional-services ecosystem as an enabler architecture in the strict sense: the legal framework exists, but enforceable verification duties and follow-through capacity do not yet match the scale of formation activity the ecosystem supports. Estonia's overall enforcement-versus-enablement posture remains mixed rather than uniformly permissive or uniformly rigorous. The jurisdiction is FATF-clean, conducts active naval and border-guard interdiction on the shadow-fleet corridor, and has revised its sanctions-implementation guidance twice in 2025, evidencing genuine enforcement capacity and will. At the same time, the CSP sector's supervisory weakness and the domestic prosecution gap on Russia-linked predicate evidence indicate the enabler dimension has not been closed, only partially addressed. #### Outlook Whether Estonia's professional-facilitator gap narrows will likely depend less on new domestic legislation than on the EU AML Package's harmonisation of customer due diligence standards from 2027, since the CSP-sector deficiency is fundamentally a beneficial-ownership verification problem the AML Regulation is designed to address EU-wide. In the interim, the closed Swedbank case stands as a durable illustration of the limits domestic prosecutors face when predicate evidence sits in an uncooperative jurisdiction, a limitation the AML Regulation's harmonisation cannot by itself resolve. Judgment: No Estonia-specific enabler-jurisdiction development identified this cycle. Uncertain #### Conflict Finance and Extractive-Industry Integrity Estonia's conflict-finance exposure this cycle centres on two parallel financial architectures using the Baltic transit position to sustain revenue flows tied to the Russian war economy and to evade EU trade sanctions against Belarus. The first is the shadow-fleet oil corridor itself: aging, opaquely-owned tankers transit the Gulf of Finland past Estonia carrying Russian crude to buyers in China and India in evasion of the G7 price cap, with the Estonian Navy's April 2025 interdiction of the tanker Kiwala and the subsequent documented sighting of the armed, FSB-linked tanker Marshal Vasilevskiy illustrating both Estonia's active interdiction posture and the escalating protection Russia now extends to these vessels. The direct financial consequence is straightforward: each successful transit sustains wartime oil revenue for the Russian state, and the corridor's continued function despite active interdiction efforts demonstrates the scale mismatch between enforcement capacity and shipment volume. Continue reading The second architecture is distinct in commodity type but shares the same transit geography: corporate networks linked to sanctioned Belarusian and Russian actors route oil and fertiliser through cluster companies into and through the Estonia-Latvia corridor, exploiting gaps in EU trade-sanction coverage and using mislabelled country-of-origin documentation to move commodities into EU markets that would otherwise be restricted. This pattern is corroborated by two independent investigative sources, though it lacks tier-one primary confirmation this cycle, and it illustrates a conflict-finance-adjacent mechanism distinct from direct sanctions evasion: rather than evading a listed entity or vessel, the scheme exploits documentary gaps in trade-sanction implementation to launder the true origin of restricted commodities. Both architectures depend on Estonia's transit role rather than any deliberate state facilitation; the Estonian Navy's active interdiction record and the Border Guard's surveillance documentation of the armed tanker both evidence a genuine enforcement posture operating against, not in support of, these flows. The analytical significance lies in the persistence of the flows despite that enforcement posture, indicating the corridor's structural exploitability exceeds what naval and border interdiction alone can close. #### Outlook Neither the shadow-fleet oil corridor nor the Belarus/Russia trans-shipment network shows signs of near-term closure; both depend on structural features of Baltic transit geography and EU trade-sanction implementation gaps that are not addressed by Estonia's own regulatory or enforcement posture alone. The armed escort now documented on shadow-fleet vessels suggests the conflict-finance dimension of this corridor is entering a more overtly militarised phase, a trajectory likely to generate further interdiction incidents rather than resolve the underlying revenue flow. Judgment: No conflict-finance development identified for Estonia this cycle. Uncertain #### Crypto, Digital Assets, and Financial Innovation Estonia's crypto and digital-asset sector faces a genuine structural correction this cycle as the MiCA transitional licensing window approaches its hard close. Estonia historically issued a substantial share of an estimated 3,000-plus pre-MiCA EU virtual-asset service provider registrations, a population already reduced once, to 369 valid licences as of 2022, following a 2020 crackdown that revoked 1,808 licences. The current transitional arrangement permits VASPs to continue operating under national licences temporarily, but that arrangement ends definitively on 30 July 2026, after which any Estonian VASP that has not obtained full MiCA CASP authorisation becomes legally unable to provide EU-facing services. This closes a licensing gap that had persisted for years and that historically made Estonia one of the more permissive jurisdictions for crypto-asset licensing volume within the EU. Continue reading This structural correction connects directly to the beneficial-ownership opacity documented elsewhere in Estonia's profile: the Company Service Provider sector has been found forming companies, obtaining virtual-asset service provider licences on their behalf, and then selling the resulting ready-made VASP-licensed shells to non-resident and e-resident purchasers whose real operations sit abroad. The MiCA CASP deadline does not directly resolve this beneficial-ownership dimension of the scheme, since CASP authorisation addresses licensing and prudential standards rather than the beneficial-ownership verification gap MONEYVAL has identified as unresolved; a VASP-licensed shell could in principle be reformed as a CASP-authorised entity while the underlying ownership opacity persists unless CASP authorisation processes independently apply enhanced beneficial-ownership scrutiny. A parallel compliance-technology development sits alongside the licensing correction: Estonia's Financial Intelligence Unit conducted a 2024 wallet-address analysis identifying high transaction volumes by legal persons linked to offshore jurisdictions, feeding into Estonia's pending national risk assessment update for the VASP and CASP sector. This analytics capability suggests Estonia's supervisory authorities are building independent detection capacity ahead of the CASP transition, rather than relying solely on the licensing deadline itself to correct historical risk exposure. Separately, the EU's 19th sanctions package introduced a crypto and fintech services ban aimed at preventing sanctions circumvention, an EU-specific measure creating additional compliance friction for Estonia-linked virtual-asset operators operating across both the EU sanctions and MiCA licensing frameworks simultaneously. #### Outlook The 30 July 2026 deadline is a genuine structural risk-reduction event in prospect, but the actual post-deadline contraction of Estonia's VASP population has not yet been observed, and confidence in the scale of the resulting correction is accordingly assessed as possible rather than high. Whether CASP authorisation processes independently close the beneficial-ownership verification gap associated with the historical VASP-licensed shell-sale pattern, or merely relicense the same underlying opacity under a new regulatory label, will be a key test for the next reporting cycle. Judgment: Estonia's VASP-to-CASP crypto transition closed 1 July 2026 (pre-dates window); no new delta this cycle. Probable #### Compliance Technology and Active Defence Estonia's compliance-technology posture this cycle shows genuine, if modest, forward movement set against a persistent limitation in independent verification. The Estonian Financial Intelligence Unit issued two revised targeted-financial-sanctions implementation guidelines in 2025, updating prior 2021 guidance from the Financial Supervision Authority. This improved procedural clarity for obliged entities implementing sanctions screening, though it did not resolve the underlying legal deficiency in Estonia's Recommendation 7 freezing regime, which remains rated only partially compliant. Separately, the Financial Intelligence Unit conducted a 2024 wallet-address analysis identifying high transaction volumes by legal persons linked to offshore jurisdictions, feeding directly into Estonia's pending national risk assessment update for the virtual-asset and crypto-asset service provider sector. This analytics work represents a genuine active-defence capability: rather than relying solely on obliged-entity self-reporting, Estonia's authorities are independently generating transaction-pattern intelligence ahead of the national risk assessment cycle. Continue reading However, the evidence base available for assessing whether these compliance-technology investments have translated into material enforcement outcomes is itself constrained. Estonia's baseline evidence relies substantially on FATF and MONEYVAL technical reports together with OCCRP and press investigative journalism, rather than direct access to Estonian-language national enforcement dockets or supervisory-penalty statistics. This sourcing limitation means that while the guidance revisions and wallet-analytics work are documented as having occurred, their downstream enforcement impact, such as whether the 2025 sanctions guidance has produced measurable improvements in freezing-obligation compliance or whether the wallet-address analytics have led to supervisory action against identified entities, cannot be independently verified from the sources available this cycle. This combination of genuine technical investment and constrained verification capacity is itself an analytically relevant finding: it indicates that Estonia's compliance-technology trajectory is improving in documented activity terms, while the evidentiary basis for confirming translation into enforcement effectiveness remains thin. #### Outlook The clearest available test of whether Estonia's 2025 guidance revisions and 2024 wallet-address analytics have produced material enforcement outcomes will likely come from Estonia's next FATF/MONEYVAL enhanced follow-up report, expected around the fourth quarter of 2026, which would be positioned to assess whether procedural and analytical investments have narrowed the underlying Recommendation 7 and beneficial-ownership deficiencies. Absent access to Estonian-language enforcement dockets, independent verification of compliance-technology effectiveness will likely remain constrained until that report, or until Estonian-language supervisory-penalty data becomes available in open sources. Judgment: No RegTech/active-defence development specific to Estonia identified this cycle. Uncertain #### AML/CTF Regime Estonia's AML/CTF architecture moved this cycle through an instrument that does not present itself as an anti-money-laundering law but functions substantially as one. The Riigikogu passed a financial fraud prevention and combating law, 936 SE, on or about 21 October 2026, with 76 votes in favour. For the first time, credit institutions and payment and e-money institutions gain a statutory basis to detect fraud before a payment transaction completes and to delay or refuse that payment where fraud is suspected. Alongside the hold power, the law establishes a formal channel for those institutions to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with CERT-EE, Estonia's computer emergency response team. Credit providers and credit intermediaries receive an equivalent data-exchange right for loan fraud specifically. Continue reading Read against the standing AML/CTF regime, this is a meaningful structural addition rather than an incident. Estonia currently administers its money-laundering and terrorist-financing prevention regime through its national Act, pending direct applicability of the EU's Anti-Money Laundering Regulation from 10 July 2027, and sits under enhanced follow-up from its fifth-round mutual evaluation. Neither of those standing positions changed this cycle. What changed is that the country's payment-sector institutions now have, or will shortly have, a statutory information-sharing architecture that did not previously exist, built for a consumer-fraud purpose but structurally adjacent to suspicious-activity reporting and inter-institutional typology detection. Architecture of this kind tends to matter more for a jurisdiction's AML/CTF posture over time than a single enforcement action, because it changes what institutions are legally permitted to see and share, not just what they must report upward to a single authority. The law passed the legislature but has not yet been published in the official gazette, the Riigi Teataja, so its date of entry into force remains unconfirmed. Its current status is adopted-but-not-yet-promulgated, which means the practical start of the new hold-and-share powers is near-term but not yet operative. Separately, Finantsinspektsioon issued a supervisory precept to Coop Pank AS following an on-site inspection, requiring remediation of governance, internal control, risk management, regulatory reporting and lending procedures, with deadlines extending into 2027. This information comes from the bank's own disclosure; the supervisor's own notice has not been independently located, and the precept does not itself cite anti-money-laundering or counter-terrorist-financing deficiencies as grounds. It is recorded as a general supervisory intervention against a credit institution rather than a confirmed AML/CTF enforcement finding, but a precept of this breadth, covering governance and risk management together, is the kind of intervention that typically has downstream relevance to an institution's financial-crime control environment even when not framed that way at the outset. #### Outlook The near-term marker for this domain is publication of 936 SE in the Riigi Teataja, which will convert the current adopted-but-pending status into an in-force obligation and fix the operative date for the new payment-hold and data-sharing powers; this was expected by the end of 2026 as at the close of this cycle. Once operative, the material question is how actively credit institutions and payment firms use the new information-sharing gateway with the Police and Border Guard Board and CERT-EE, and whether that usage develops into a recognisable feeder channel into existing suspicious-transaction reporting. On the supervisory track, Coop Pank's remediation against the precept's governance and risk-management requirements runs into 2027 and is a standing item to track across coming cycles, irrespective of whether a financial-crime dimension to that precept is later confirmed. Judgment: Riigikogu passed 936 SE, a payment-fraud-prevention law giving banks/PSPs a new statutory basis to delay or refuse suspect payments and share fraud-suspicion data with other institutions, PPA and CERT-EE; this is structurally AML-adjacent though framed as an APP-fraud feeder control. Separately, Finantsinspektsioon issued a supervisory precept to Coop Pank AS. Probable #### Commercial Activity The D8 commercial event this cycle is Lightspark's acquisition of the Tallinn-based crypto-banking API firm Striga, completed 14 October 2025. The claim rests on a single deal-data aggregator source (Tracxn, T3), with deal amount and basis explicitly undisclosed, and is carried at an uncertain confidence tier. Lightspark subsequently became the only company holding a standalone Finantsinspektsioon MiCA Crypto-Asset Service Provider authorisation in Estonia by the 1 July 2026 transition deadline, placing the acquisition squarely within the regtech-and-AML-vendor sector category for commercial-activity tracking purposes. Continue reading Architecture-over-incident framing applies here in a specific sense: the acquisition itself is a single corporate transaction, but its downstream effect — one acquirer ending up as the sole standalone MiCA CASP holder in a jurisdiction that previously supported three dozen legacy VASP licensees — gives it structural weight beyond a routine M&A data point. The acquisition functions as the commercial mechanism behind a regulatory-architecture consolidation that is independently tracked under this jurisdiction's crypto/digital-assets domain. Read in isolation, a single undisclosed-value acquisition of a mid-sized fintech API firm would ordinarily carry limited significance; read against the MiCA transition timeline, it marks the commercial entry point for the entity that now occupies Estonia's sole standalone crypto-asset-service gatekeeping position. The absence of disclosed deal terms is itself a limiting factor on what can be said here. Without a disclosed amount or valuation basis, no assessment of the acquisition's financial materiality, relative scale, or market-concentration implications beyond the regulatory-licensing dimension can be supported by the available source. The single-source, T3-tier sourcing for this claim means it should be read as a reported commercial event rather than a verified one; no primary disclosure, regulatory filing, or corporate announcement has been independently retrieved this cycle. #### Outlook Further detail on deal terms, or on Lightspark's broader EU expansion strategy following this acquisition, is not available from the material gathered this cycle. The commercial event is best read alongside the D5 MiCA transition finding rather than in isolation; whether Lightspark pursues further acquisitions of legacy-licensed Estonian crypto entities that did not independently obtain MiCA authorisation, or whether other acquirers enter the Estonian market now that the standalone-CASP population has been reduced to a single holder, are the natural follow-on questions for subsequent cycles. Judgment: No financial-integrity-market commercial event identified for Estonia this cycle. Uncertain Regulatory horizon Adopted 2026-Q4 · ±quarter ### 936 SE awaiting promulgation/Riigi Teataja publication Credit institutions and payment/e-money institutions gain a statutory basis to delay or refuse payments on fraud suspicion and to exchange fraud-suspicion data with each other, the Police and Border Guard Board and CERT-EE. [Source](https://www.riigikogu.ee/pressiteated/riigikogu-kiitis-heaks-finantspettuste-ennetamise-ja-tokestamise-seaduse/) 1 dated · 3 pending date · baseline financial-integrity-2026-07-05 Role action cards MLRO ### A new statutory payment-hold and fraud-data-sharing power for Estonian banks and payment firms has been adopted but not yet promulgated. Once in force, credit institutions and payment/e-money institutions will have a legal basis to delay or refuse suspect payments and to exchange fraud-suspicion data with each other, the Police and Border Guard Board and CERT-EE, a channel that is structurally adjacent to existing suspicious-activity reporting even though it is framed as a consumer-fraud measure. 1 evidence refs Compliance ### Estonia passed a payment-fraud-prevention law creating a new inter-institutional data-sharing gateway, pending gazette publication. Compliance functions at affected credit institutions and payment/e-money institutions should expect a new statutory basis for data exchange and payment holds to become operative once the law is promulgated, alongside a supervisory precept issued to one listed bank covering governance, internal control and risk-management remediation. 2 evidence refs Legal ### 936 SE has passed the Riigikogu but awaits official gazette publication to fix its entry into force. The legal basis for the new payment-hold and data-sharing powers is adopted but not yet operative, so counsel advising affected institutions should track the Riigi Teataja publication date as the trigger for compliance obligations. 1 evidence refs Board ### A credit institution operating in Estonia is under a supervisory precept requiring governance and risk-management remediation into 2027. Boards of institutions operating in or alongside the Estonian market should note that Finantsinspektsioon has required broad governance, internal-control and risk-management remediation at Coop Pank AS, a supervisory intervention with multi-year remediation deadlines. 1 evidence refs CTO ### No material change for this persona this cycle. No material change for this persona this cycle Risk ### A new fraud-data-sharing architecture and a bank-specific supervisory precept both surfaced in Estonia this cycle. The combination of a new statutory information-sharing gateway for payment fraud and an active governance-remediation precept at a listed bank represents two distinct but structurally related risk signals in the same jurisdiction worth tracking jointly. 2 evidence refs Operations ### No material change for this persona this cycle. No material change for this persona this cycle Audit ### A supervisory precept at an Estonian bank sets governance and risk-management remediation deadlines running into 2027. Internal audit functions with exposure to Coop Pank AS or comparable Estonian credit institutions should track remediation progress against the precept as a documented control-testing item. 1 evidence refs Scenario sketches ### Illustrative AMLA-era supervisory handoff for cross-border payment firms As an illustrative orientation only, consider how a payment or e-money institution operating across several EU member states might experience the shift from purely national AML supervision toward the Anti-Money Laundering Authority's direct or indirect supervision of cross-border obliged entities, once the AMLA Regulation framework matures alongside the directly applicable AML Regulation and national transposition of the sixth AML Directive. A firm currently supervised solely by its home-state authority could, under such an architecture, face coordinated information requests spanning multiple national supervisors and the Authority, changing the operational calculus for compliance resourcing and evasion attempts that previously relied on fragmented national oversight. This is a structural illustration of how the European supervisory architecture could evolve, not a description of any observed event in Estonia or elsewhere. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture no_change No material change found for Estonia this cycle. T2 · EU AML Package / AMLA no_change Estonia operates under RahaPTS pending AMLR direct applicability 10 July 2027; no new transposition delta this cycle. T3 · FATF Grey List no_change Estonia remains in MONEYVAL enhanced follow-up under its 5th-round mutual evaluation; no new plenary outcome identified this cycle. T4 · Beneficial-Ownership Register Status no_change No Estonian BO-register change identified this cycle. T5 · Crypto & Digital-Asset Integrity no_change VASP-to-CASP transition closed 1 July 2026 (pre-dates window); ESMA register shows 3 Estonia-homed CASPs, unchanged from 24 July 2026 snapshot. T6 · Sanctions Regime Divergence no_change No Estonia-specific sanctions-divergence development identified this cycle. Registers ### Enforcement actions - 11 Apr 2025 - 13 May 2026 - 30 Jun 2025 - 15 Dec 2025 - 1 Dec 2025 - 29 Jun 2026 - Estonia's navy stopped and boarded the sanctioned, Russia-bound tanker Kiwala in the Baltic Sea over its insurance status and suspected shadow-fleet membership, anchoring it in Estonian territorial waters. 11 Apr 2025 - Estonian border guards photographed the Gazprom-linked civilian tanker Marshal Vasilevskiy, armed with heavy machine guns and carrying passengers with Russian military/FSB backgrounds, sailing as close as 13 nautical miles from the Estonian coast en route to Kaliningrad. 13 May 2026 - The EFIU issued two revised guidelines on targeted financial sanctions implementation in 2025 -- one for all natural and legal persons and one specifically for AML/CFT reporting entities -- updating prior 2021 EFSA guidance. 30 Jun 2025 - Danske Bank's corporate probation with the US DOJ, imposed as part of its 2022 guilty plea and $2 billion global settlement over the Estonia-rooted 2007-2015 laundering scandal, formally concluded. 15 Dec 2025 - FATF/MONEYVAL adopted Estonia's second enhanced Follow-Up Report, re-rating select technical compliance recommendations (R.7, R.15 requested) based on a September 2025 assessment, while other deficiencies (freezing-obligation scope, third-party protections) remained partially addressed. 1 Dec 2025 ### Sanctions changes - 18 Dec 2025 - 23 Oct 2025 - 27 Jan 2025 - 23 Apr 2026 - 7 Oct 2026 - The EU Council imposed restrictive measures on 41 additional Russian shadow-fleet vessels, bringing the total EU-listed shadow-fleet vessels to almost 600, subject to a port-access ban and broad services ban. 18 Dec 2025 - The EU adopted its 19th sanctions package against Russia, including a ban on EU operators providing crypto and fintech services that could enable Russian sanctions circumvention, transaction bans on five third-country (Central Asian) banks, a full LNG import ban from 2027, and 69 additional listings. 23 Oct 2025 - The EU Council added three individuals to its cyber-sanctions list specifically for malicious cyber-attacks against Estonia, marking a rare instance of an EU sanctions listing triggered directly by an attack on this jurisdiction. 27 Jan 2025 ### Regulatory horizon (register) - Estonia MiCA CASP mandatory transition / end of legacy VASP grandfathering - Estonia BO register purpose-based access transition (TEKSA) - Estonia MiCA CASP mandatory transition / end of legacy VASP grandfathering - AMLA direct-supervision perimeter build-out - AMLR full application and AMLD6 national transposition deadline - Bill 640 SE: MLTFPA/International Sanctions Act amendment expanding FIU database capability - 936 SE awaiting promulgation/Riigi Teataja publication - VASP-to-CASP MiCA transitional licence hard deadline - EU AML Regulation (AMLR) full application across Estonia - AMLA direct/indirect supervisory perimeter build-out - Estonia's next FATF/MONEYVAL enhanced follow-up report ### Active schemes - [CRITICAL] Baltic/Gulf of Finland shadow-fleet oil transit corridor - [HIGH] e-Residency/CSP shell-company formation-for-sale pipeline - [HIGH] UK LLP/LP shell-company layering via Estonian correspondent banking - Belarus/Russia oil and fertiliser trans-shipment via Estonia-Latvia corridor Sources - [Estonian Financial Intelligence Unit (FIU)](https://fiu.ee/en) - [FATF/MONEYVAL](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf) - [Estonian Ministry of Finance](https://fin.ee/en/news/moneyval-publishes-mutual-evaluation-report-estonia) - [Silva Hunt](https://www.silvahunt.ee/business-in-estonia/legal/beneficial-ownership-data-new-access-rules-in-estonia/) - [AML Intelligence](https://www.amlintelligence.com/2026/02/news-estonia-charges-suspects-in-major-international-money-laundering-case/) - [Logistics Middle East](https://www.logisticsmiddleeast.com/analysis/how-far-can-europe-go-against-russias-shadow-fleet) - [Asia Times](https://asiatimes.com/2026/04/russias-navy-deterred-estonia-from-boarding-its-shadow-fleet/) - [Vixio](https://www.vixio.com/insights/pc-estonian-bank-penalised-eu900000-fine-over-aml-failures) - [FATF / MONEYVAL](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf) - [Council of Europe / MONEYVAL](https://www.coe.int/en/web/human-rights-rule-of-law/-/moneyval-new-mutual-evaluation-report-on-estonia) - [Rahandusministeerium (Estonian Ministry of Finance)](https://fin.ee/en/news/moneyval-publishes-mutual-evaluation-report-estonia) - [FinTelegram](https://fintelegram.com/mica-day-one-estonia-pulls-the-plug-on-the-old-crypto-licence-era-no-licence-no-eu-clients/) - [Binderr](https://binderr.com/resources/guide-to-aml-compliance-in-estonia) - [European Union Institute for Security Studies](https://www.iss.europa.eu/publications/commentary/out-shadows-and-fire-next-steps-fighting-russias-shadow-fleet) - [Compliance7](https://blog.compliance7.com/2026/06/25/fatf-grey-list-june-2026/) - [https://mezha.net/eng/news/ac4dae84_estonia_asks_eu/](https://mezha.net/eng/news/ac4dae84_estonia_asks_eu/) - [https://www.pravda.com.ua/eng/news/2026/10/08/8057000/](https://www.pravda.com.ua/eng/news/2026/10/08/8057000/) - [https://www.fatf-gafi.org/en/countries/detail/Estonia.html](https://www.fatf-gafi.org/en/countries/detail/Estonia.html) - [https://www.coe.int/en/web/moneyval/-/estonia-has-further-strengthened-its-preventive-framework-to-combat-money-laundering-financing-of-terrorism-and-financing-of-proliferation](https://www.coe.int/en/web/moneyval/-/estonia-has-further-strengthened-its-preventive-framework-to-combat-money-laundering-financing-of-terrorism-and-financing-of-proliferation) - [https://www.eestifirma.ee/en/fiu-aml-supervision-supreme-court-estonia/](https://www.eestifirma.ee/en/fiu-aml-supervision-supreme-court-estonia/) - [https://fintelegram.com/mica-day-one-estonia-pulls-the-plug-on-the-old-crypto-licence-era-no-licence-no-eu-clients/](https://fintelegram.com/mica-day-one-estonia-pulls-the-plug-on-the-old-crypto-licence-era-no-licence-no-eu-clients/) - [https://hacken.io/discover/estonia-crypto-license/](https://hacken.io/discover/estonia-crypto-license/) - [https://tracxn.com/d/explore/fintech-startups-in-estonia/__aYjQRDgSwlRKa9U9l6HLa16aY2ArWqFveByCnKDarg8/companies](https://tracxn.com/d/explore/fintech-startups-in-estonia/__aYjQRDgSwlRKa9U9l6HLa16aY2ArWqFveByCnKDarg8/companies) - [https://ieu-monitoring.com/editorial/eu-commission-greenlights-acquisition-of-luminor-holding-by-otp-bank/1252248](https://ieu-monitoring.com/editorial/eu-commission-greenlights-acquisition-of-luminor-holding-by-otp-bank/1252248) - [https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf) - [https://www.riigikogu.ee/en/pressiteated/the-riigikogu-concluded-the-first-reading-of-a-bill-allowing-more-instant-payments-than-before/](https://www.riigikogu.ee/en/pressiteated/the-riigikogu-concluded-the-first-reading-of-a-bill-allowing-more-instant-payments-than-before/) - [https://aiaml.com/resources/updates/aml-enforcement-europe-summer-2026](https://aiaml.com/resources/updates/aml-enforcement-europe-summer-2026) - [https://legalbison.com/mica-license/estonia/](https://legalbison.com/mica-license/estonia/) - [https://www.luminor.lt/en/news/otp-bank-acquire-luminor-opening-new-chapter-baltic-financial-markets](https://www.luminor.lt/en/news/otp-bank-acquire-luminor-opening-new-chapter-baltic-financial-markets) - [Riigikogu (Parliament of Estonia)](https://www.riigikogu.ee/pressiteated/riigikogu-kiitis-heaks-finantspettuste-ennetamise-ja-tokestamise-seaduse/) - [Ministry of Economic Affairs and Communications (Estonia)](https://www.mke.ee/et/uudised-et/uus-seadus-aitab-ennetada-ja-tokestada-finantspettusi/) - [Coop Pank AS / GlobeNewswire](https://www.globenewswire.com/news-release/2026/10/21/3385118/0/en/coop-pank-to-enhance-internal-procedures-following-a-precept-issued-by-finantsinspektsioon.html) - [Legalwise](https://legalwise.ee/en/muudatused/2026-07-01) - [Outrun (MiCA CASP Tracker)](https://www.outrun.at/micar-dashboard) - [Mutual Evaluation of Estonia](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationofestonia.html) - [Estonia](https://www.fatf-gafi.org/en/countries/detail/Estonia.html) - [1 Anti-money laundering and counter-terrorist financing measures Estonia](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf) - [Estonia's progress in strengthening measures against money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Estonia-FUR-2024.html) - [Assessments](https://www.fatf-gafi.org/en/calendars/assessments.html) - [Estonia's measures to combat money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/MER-Estonia-2022.html) - [Consolidated assessment ratings](https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Mutualevaluations/Assessment-ratings.html) - [Mutual Evaluations](https://www.fatf-gafi.org/en/publications/Mutualevaluations.html) - [Anti-money laundering and counter-terrorist financing measures Estonia](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/MONEYVAL-Estonia-Mutual-Evaluation-Report-2022.pdf.coredownload.pdf) - [Mutual Evaluations](https://fatf-gafi.org/publications/mutualevaluations) - [1 Financial Crimes Enforcement Network (FinCEN)](https://www.fincen.gov/system/files/2026-05/FinCEN-Year-in-Review-2025.pdf) - [Anti-money laundering and counter-terrorist financing measures Estonia](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/MONEYVAL-Estonia-Mutual-Evaluation-Report-2022.pdf.coredownload.inline.pdf) - [Committee of Experts on the Evaluation of Anti-Money Laundering Measures (MONEYVAL)](https://www.fatf-gafi.org/en/countries/global-network/committee-of-experts-on-the-evaluation-of-anti-money-laundering-.html) - [Months After Estonia Drops Swedbank Case, Trove of Office Memos Show Laundering Was Open Joke | OCCRP](https://www.occrp.org/en/feature/months-after-estonia-drops-swedbank-case-trove-of-office-memos-show-laundering-was-open-joke) - [Austria's measures to counter money laundering, terrorist financing and proliferation financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-austria-2026.html) - [The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) - [Estonia Detains And Boards Russia-Bound Oil Tanker - Bloomberg](https://www.bloomberg.com/news/articles/2025-04-11/estonia-detains-tanker-that-was-headed-to-russia) - [From Wagner to GRU, Russian Military Men Are Manning Moscow’s Shadow Fleet | OCCRP](https://www.occrp.org/en/investigation/from-wagner-to-gru-russian-military-men-are-manning-moscows-shadow-fleet) - [Estonia Says EU Weighs New Measures to Block Russia’s Shadow Oil Fleet - Bloomberg](https://www.bloomberg.com/news/articles/2025-12-16/eu-mulls-targeting-visas-in-shadow-fleet-crackdown-estonia-says) - [European Nations Issue Warning to Russia-Linked Shadow Fleet - Bloomberg](https://www.bloomberg.com/news/articles/2026-01-27/european-nations-issue-warning-to-russia-linked-shadow-fleet) - [Eyes On The Crew: The Russian Watchmen Aboard Moscow's Sanctioned ‘Shadow Fleet’ Tankers | OCCRP](https://www.occrp.org/en/investigation/eyes-on-the-crew-the-russian-watchmen-aboard-moscows-sanctioned-shadow-fleet-tankers) - [Shadow fleet set to be interdicted in UK waters in latest blow to Russia - GOV.UK](https://www.gov.uk/government/news/shadow-fleet-set-to-be-interdicted-in-uk-waters-in-latest-blow-to-russia) - [Russia Weaponizes Civilian Tanker in Baltic Sea, Surveillance Images Show | OCCRP](https://www.occrp.org/en/scoop/russia-arms-civilian-tanker-in-baltic-sea-surveillance-images-show) - [Russian Oil: Shadow Fleet in Baltic Sea Poses Threat to Environment](https://www.bloomberg.com/graphics/2024-russia-shadow-oil-fleet-denmark-baltic-environment/) - [European Ships Keep Russia’s Shadow Fleet Afloat | OCCRP](https://www.occrp.org/en/investigation/european-ships-keep-russias-shadow-fleet-afloat) - [Russia's war of aggression against Ukraine: Council sanctions 41 vessels of the Russian shadow fleet - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [‘The Contract Factory’: Inside Danske Bank Estonia’s Money Laundering Machine | OCCRP](https://www.occrp.org/en/azerbaijanilaundromat/the-contract-factory-inside-danske-bank-estonias-money-laundering-machine) - [Inside scandal-rocked Danske Estonia and the shell-company 'factories' that served it - ICIJ](https://www.icij.org/investigations/fincen-files/inside-scandal-rocked-danske-estonia-and-the-shell-company-factories-that-served-it/) - [Estonia Charges Former Danske Bank Staff With Money Laundering | OCCRP](https://www.occrp.org/en/news/estonia-charges-former-danske-bank-staff-with-money-laundering) - [Anti-money laundering and counter-terrorist financing measures Sint Maarten](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/Sint%20Marteen-MER-Evaluation-CFATF-round4.pdf.coredownload.inline.pdf) - [Anti-money laundering and countering the financing of terrorism legislative package - Finance](https://ec.europa.eu/info/publications/210720-anti-money-laundering-countering-financing-terrorism_en) - [Patchy Progress in Setting Up Public Beneficial Ownership Registers in the EU | Global Witness](https://www.globalwitness.org/en/campaigns/corruption-and-money-laundering/anonymous-company-owners/5amld-patchy-progress/) - [Anti-money laundering and countering the financing of terrorism at EU level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en) - [Beneficial Ownership Data is Critical in the Fight Against Corruption | OCCRP](https://www.occrp.org/en/project/beneficial-ownership-data-is-critical-in-the-fight-against-corruption) - [Anti-money laundering: Council and Parliament strike deal on stricter rules - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2024/01/18/anti-money-laundering-council-and-parliament-strike-deal-on-stricter-rules/) - [Patchy progress in beneficial ownership registers in the EU | Global Witness](https://globalwitness.org/en/campaigns/corruption-and-money-laundering/patchy-progress-in-setting-up-beneficial-ownership-registers-in-the-eu/) - [Anti-money laundering and countering the financing of terrorism overview - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-overview_en) - [Directory of Open-Source Registries: Estonia - GlobE Network](https://globenetwork.unodc.org/globenetwork/en/directory-of-open-source-registries/estonia.html) - [Guidance on Beneficial Ownership of Legal Persons](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Legal-Persons.html) - [What the end of MiCA's transitional period means for crypto businesses](https://www.elliptic.co/blog/the-end-of-micas-transitional-period) - [What Is a VASP? Virtual Asset Service Provider - Chainalysis](https://www.chainalysis.com/glossary/virtual-asset-service-provider/) - [What the First Quarter of MiCA Tells Us About CASP Authorizations | TRM Blog](https://www.trmlabs.com/resources/blog/what-the-first-quarter-of-mica-tells-us-about-casp-authorizations) - [Virtual Asset Service Provider (VASP): Definition, Compliance & Examples](https://www.trmlabs.com/glossary/virtual-asset-service-provider-vasp) - [What is crypto AML compliance?](https://www.elliptic.co/blockchain-basics/what-is-crypto-aml-compliance) - [VASP Data Flat File - Chainalysis](https://www.chainalysis.com/product/vasp-data-flat-file/) - [Blockchain Legal & Regulatory Guidance Practice Note: Part Six: VASPs](https://www.elliptic.co/blog/analysis/blockchain-legal-regulatory-guidance-practice-note-part-six-virtual-asset-service-providers) - [What is DeFi compliance?](https://www.elliptic.co/blockchain-basics/what-is-defi-compliance) - [MiCA's global reach: Why every crypto company needs a strategy](https://www.elliptic.co/blog/micas-global-reach-why-every-crypto-company-needs-a-strategy) - [Markets in Crypto-assets Regulation - Finance - European Commission](https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/markets-crypto-assets-regulation_en) - [Financial Supervision Autority - Finantsinspektsioon (FI) | EU Digital Finance Platform](https://digital-finance-platform.ec.europa.eu/cross-border-services/cross-border-testing/participants/financial-supervision-autority) - [Estonia Drops Anti-Money Laundering Reform, Again | OCCRP](https://www.occrp.org/en/daily/9240-estonia-drops-anti-money-laundering-reform-again) - [Fatf-gafi](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2024.pdf.coredownload.inline.pdf) - [Cyber-attacks: three individuals added to EU sanctions list for malicious cyber activities against Estonia - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2025/01/27/cyber-attacks-three-individuals-added-to-eu-sanctions-list-for-malicious-cyber-activities-against-estonia/) - [Ministry of Finance - Estonia - European Anti-Fraud Office](https://anti-fraud.ec.europa.eu/organisations/ministry-finance-estonia_en) - [EU Sanctions Belarusian Oligarchs Investigated by OCCRP | OCCRP](https://www.occrp.org/en/daily/14680-eu-sanctions-belarusian-oligarchs-investigated-by-occrp) - [Organized Crime and Corruption Reporting Project | OCCRP](https://www.occrp.org/en) - [EU Sanctions Belarusian Oligarchs Investigated by OCCRP](https://admin.occrp.org/en/daily/14680-eu-sanctions-belarusian-oligarchs-investigated-by-occrp) - [Unseen and Unsanctioned, Belarusian Tycoons Slipped into the EU via Lithuanian Investments | OCCRP](https://www.occrp.org/en/investigation/unseen-and-unsanctioned-belarusian-tycoons-slipped-into-the-eu-via-lithuanian-investments) - [Belarusian Fertilizer Company Dodging EU Sanctions, Leaked Documents Show | OCCRP](https://www.occrp.org/en/news/belarusian-state-fertilizer-company-dodges-eu-sanctions-leaked-documents-show) - [Estonia Seeks to Expand EU Sanctions on Belarusian Oil Products - Bloomberg](https://www.bloomberg.com/news/articles/2022-02-03/estonia-seeks-to-expand-eu-sanctions-on-belarusian-oil-products) - [Days Before EU Sanctions, Belarusian Oligarch’s Family Sells its Firm and Bank | OCCRP](https://www.occrp.org/en/daily/14767-days-before-eu-sanctions-belarusian-oligarch-s-family-sells-its-firm-and-bank) - [Sanctions and Evasion Updates: Insights from OCCRP](https://gacc.occrp.org/post/sanctions-and-evasion-updates) - [Mikalai Varabei | OCCRP](https://www.occrp.org/en/people/mikalai-varabei) - [1 EXPORT-RELATED RESTRICTIONS FOR DUAL-USE GOODS AND ADVANCED TECHNOLOGIES](https://finance.ec.europa.eu/document/download/586f9b62-50c3-46e3-9940-de73ae96a24b_en?filename=faqs-sanctions-russia-export-related-restrictions-russia_en.pdf) - [EU sanctions against Russia: questions and answers - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia-explained/) - [Russia's war against Ukraine: EU sanctions - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia/) - [EU adopts 19th package of sanctions against Russia - Finance](https://finance.ec.europa.eu/news/eu-adopts-19th-package-sanctions-against-russia-2025-10-23_en) - [Questions and answers on the sixteenth package of restrictive measures against Russia - Enlargement and Eastern Neighbourhood](https://enlargement.ec.europa.eu/news/questions-and-answers-sixteenth-package-restrictive-measures-against-russia-2025-02-24_en) - [on the implementation of Council Regulation No 833/2014 ...](https://finance.ec.europa.eu/document/download/66e8fd7d-8057-4b9b-96c2-5e54bf573cd1_en?filename=faqs-sanctions-russia-consolidated_en.pdf) - [Timeline - EU sanctions against Russia - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia/timeline-sanctions-against-russia/) - [12392/2/25 REV 2 RELEX.1 LIMITE EN Council of the European Union](https://data.consilium.europa.eu/doc/document/ST-12392-2025-REV-2/en/pdf) - [EU adopts 16th package of sanctions against Russia - Finance](https://finance.ec.europa.eu/news/eu-adopts-16th-package-sanctions-against-russia-2025-02-24_en?prefLang=lt) - [Frequently asked questions - Sanctions against Russia - European Commission](https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/sanctions-adopted-following-russias-military-aggression-against-ukraine/frequently-asked-questions-sanctions-against-russia_en?f%5B0%5D=sanctions_category_sanctions_category%3A158) - [Technical Support for National Handbooks for Estonia, Lithuania, and Latvia - European Commission](https://reform-support.ec.europa.eu/what-we-do/financial-sector-and-access-finance/technical-support-national-handbooks-estonia-lithuania-and-latvia_en) - [Fiscal surveillance in Estonia - European Commission](https://economy-finance.ec.europa.eu/economic-surveillance-eu-economies/estonia/fiscal-surveillance-estonia_en) - [Fiscal surveillance in Estonia - Economy and Finance - European Commission](https://economy-finance.ec.europa.eu/economic-surveillance-eu-member-states/country-pages/estonia/fiscal-surveillance-estonia_en) - [Sanctions Programs and Country Information | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information) - [Estonia Drops Anti-Money Laundering Reform, Again | OCCRP](https://occrp.org/en/daily/9240-estonia-drops-anti-money-laundering-reform-again) - [Danske Bank Says DoJ Probation Over Estonia Scandal Has Ended - Bloomberg](https://www.bloomberg.com/news/articles/2025-12-15/danske-bank-says-doj-probation-over-estonia-scandal-has-ended) - [German prosecutors drop probe into Deutsche Bank ties to Estonian dirty money scandal - ICIJ](https://www.icij.org/investigations/fincen-files/german-prosecutors-drop-probe-into-deutsche-bank-ties-to-estonian-dirty-money-scandal/) - [‘The Contract Factory’: Inside Danske Bank Estonia’s Money Laundering Machine | OCCRP](https://www.occrp.org/en/project/the-azerbaijani-laundromat/the-contract-factory-inside-danske-bank-estonias-money-laundering-machine) - [Danske Settles Last Case in Laundering Scandal With French Deal](https://www.bloomberg.com/news/articles/2024-09-18/danske-settles-last-case-in-laundering-scandal-with-french-deal) - [Danske Bank Facing US$1 Billion Money Laundering Suit | OCCRP](https://www.occrp.org/en/daily/13161-danske-bank-facing-us-1-billion-money-laundering-suit) - [US Will Not Sanction Danske Bank Over Money Laundering | OCCRP](https://www.occrp.org/en/news/us-will-not-sanction-danske-bank-over-money-laundering) - [Estonia: Danske Bank Money Laundering Probe Expands | OCCRP](https://www.occrp.org/en/news/estonia-danske-bank-money-laundering-probe-expands) - [FATF / MONEYVAL](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-mer/MONEYVAL-Estonia-Mutual-Evaluation-Report-2022.pdf.coredownload.inline.pdf) - [FATF / MONEYVAL](https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/Estonia-FUR-2025.pdf.coredownload.inline.pdf) - [Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority) / EU Digital Finance Platform](https://digital-finance-platform.ec.europa.eu/cross-border-services/cross-border-testing/participants/financial-supervision-autority) - [Council of the European Union](https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/russia-s-war-of-aggression-against-ukraine-council-sanctions-41-vessels-of-the-russian-shadow-fleet/) - [OCCRP / Dossier Center / Delfi Estonia](https://www.occrp.org/en/investigation/eyes-on-the-crew-the-russian-watchmen-aboard-moscows-sanctioned-shadow-fleet-tankers) - [Bloomberg](https://www.bloomberg.com/news/articles/2025-04-11/estonia-detains-tanker-that-was-headed-to-russia) - [ICIJ](https://www.icij.org/investigations/fincen-files/inside-scandal-rocked-danske-estonia-and-the-shell-company-factories-that-served-it/) - [Global Witness](https://www.globalwitness.org/en/campaigns/corruption-and-money-laundering/anonymous-company-owners/5amld-patchy-progress/) Coverage gaps fim-int-2026-07-07-G001: Estonia's next MONEYVAL/FATF enhanc… fim-int-2026-07-07-G001: Estonia's next MONEYVAL/FATF enhanced follow-up report (expected around Q4 2026) would clarify whether the R.7 targeted-financial-sanctions freezing deficiency has finally been re-rated. [resolved] fim-int-2026-07-07-G002: National-level EFIU/EFSA enforcemen… fim-int-2026-07-07-G002: National-level EFIU/EFSA enforcement statistics on CSP-sector supervisory actions (case counts, penalties) would corroborate whether the beneficial-ownership verification gap identified in the 2022 MER has narrowed. [resolved] fim-int-2026-07-07-G003: Direct access to Estonian prosecuto… fim-int-2026-07-07-G003: Direct access to Estonian prosecutorial case files or a formal statement from the Estonian Prosecutor's Office on the closed Swedbank matter would confirm whether any residual civil or supervisory action followed the 2024 case closure. [resolved] fim-int-2026-07-07-G004: Estonian-language EFIU/EFSA enforce… fim-int-2026-07-07-G004: Estonian-language EFIU/EFSA enforcement dockets and penalty registers, not currently available in English-language open sources, would allow independent verification of whether 2025 sanctions guidance has produced material enforcement outcomes. [resolved] fim-int-2026-07-07-G005: Confirmation of Estonia's specific … fim-int-2026-07-07-G005: Confirmation of Estonia's specific 6AMLD national transposition vehicle and status, such as a bill number or enactment date, was not established in this research window and would refine the regime-divergence signal in the jurisdiction risk tracker. [resolved] fim-int-2026-08-05-G001: No Research evidence on Estonia's e… fim-int-2026-08-05-G001: No Research evidence on Estonia's enabler-jurisdiction/professional-facilitator dynamics this cycle. [resolved] fim-int-2026-08-05-G002: No conflict-finance/extractive-indu… fim-int-2026-08-05-G002: No conflict-finance/extractive-industry evidence surfaced for Estonia this cycle. [resolved] fim-int-2026-08-05-G003: No new RegTech/compliance-technolog… fim-int-2026-08-05-G003: No new RegTech/compliance-technology supervisory guidance evidenced this cycle beyond the standing Salv/Veriff ecosystem note. [resolved] fim-int-2026-08-05-G004: EU 20th sanctions package primary C… fim-int-2026-08-05-G004: EU 20th sanctions package primary Council Decision text (europa.eu) not retrieved; relying on T3 secondary reporting. [resolved] fim-int-2026-08-05-G005: TEKSA amendment full legislative te… fim-int-2026-08-05-G005: TEKSA amendment full legislative text and Ministry of Finance primary confirmation not retrieved; single T4 legal-advisory source only. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): No EE-specific enabler-jurisdiction (D3) finding surfaced this cycle. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D4'}): No EE-specific conflict-finance (D4) finding surfaced this cycle; domain assessed as not applicable to this jurisdiction's regime this cycle. [resolved] fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D6'}): No EE-specific compliance-technology (D6) finding surfaced this cycle. [resolved] fim-int-2026-09-28-G004: Tier-D watch check (KH, MX, CO) not… fim-int-2026-09-28-G004: Tier-D watch check (KH, MX, CO) not resolved this cycle; only Laos (LA) confirmed with no EE-linked nexus. [resolved] fim-int-2026-10-11-G001: No Estonia-specific AMLD6 national … fim-int-2026-10-11-G001: No Estonia-specific AMLD6 national transposition bill status located this cycle. [resolved] fim-int-2026-10-11-G002: EU Council Official Journal citatio… fim-int-2026-10-11-G002: EU Council Official Journal citation for the Silmet sanctions-exclusion package was not independently retrieved this cycle. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No MTA/Finantsinspektsioon primary enforcement notice or fee schedule was independently retrieved this cycle for Estonia; D1-D4 and D6 content relies on the absence of findings rather than a confirmed null. [open] fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): Final Riigikogu reading date and outcome for Bill 640 SE could not be confirmed this cycle. [open] fim-int-2026-10-25-G001: Riigi Teataja publication / entry-i… fim-int-2026-10-25-G001: Riigi Teataja publication / entry-into-force date for 936 SE could not be located. [open] fim-int-2026-10-25-G002: Finantsinspektsioon's own public no… fim-int-2026-10-25-G002: Finantsinspektsioon's own public notice on the Coop Pank precept was not independently located. [open] FIM-GAP-001 (D1): Estonia's targeted financial sanctions/pro… FIM-GAP-001 (D1): Estonia's targeted financial sanctions/proliferation-financing freezing regime (FATF R.7) remained rated partially compliant through both the 2024 and 2025 follow-up reports, with freezing obligations applying only in limited circumstances, a limited scope of covered assets, and no bona fide third-party protections. FIM-GAP-002 (D3): The CSP (company/trust service provider) s… FIM-GAP-002 (D3): The CSP (company/trust service provider) sector, identified by MONEYVAL as one of the two most ML-vulnerable DNFBP sectors alongside real estate, lacks enforceable measures for authorities to obtain accurate, current beneficial ownership information, particularly for foreign trusts and non-licensed CSPs. FIM-GAP-003 (D3): Estonia's domestic Swedbank money-launderi… FIM-GAP-003 (D3): Estonia's domestic Swedbank money-laundering prosecution -- covering the same 2010s-era Russian non-resident client book scrutinised in the Danske scandal -- was closed in February 2024 after prosecutors determined the case could not proceed without evidentiary cooperation from Russian authorities. FIM-GAP-004 (D6): Granular Estonian-language prosecutorial a… FIM-GAP-004 (D6): Granular Estonian-language prosecutorial and supervisory statistics (EFIU/EFSA enforcement case counts, penalty values, dual-use export circumvention prosecutions) are not comprehensively available in English-language open sources within the 18-month window; this baseline relies substantially on FATF/MONEYVAL technical reports and OCCRP/Delfi investigative journalism rather than direct national enforcement dockets. ## Evidence #### Confidence-tiered claims At Estonia's request, EU ambassadors agreed on 7 October 2026 to exclude a Russian rare-earth-metals supplier to Estonian firm NPM Silmet (and a linked individual) from the newest Russia sanctions package, resulting in 743 individuals/826 entities designated. [[Source 1]](#sec-sources) Probable · 1 source On 8 January 2026 the Supreme Court of Estonia declared unlawful a blanket FIU directive from late 2022 seeking bulk information from all licensed trust and company service providers, holding that an information request cannot create new analytical-document obligations not already required by law. [[Source 1]](#sec-sources) Uncertain · 1 source From 1 July 2026 Estonia's transitional period for legacy FIU-licensed virtual-currency service providers ended; of 36 legacy licensees remaining at start of 2026, only Lightspark Payments Europe AS obtained a standalone MiCA CASP authorisation by the deadline. [[Source 1]](#sec-sources) Probable · 1 source Estonia's AML/CFT regime is governed by MLTFPA, with the FIU as default supervisor and Finantsinspektsioon supervising banks, PI/EMIs, investment firms, insurers and MiCA CASPs. Estonia is under MONEYVAL's 5th-round enhanced follow-up: compliant on 7, largely compliant on 21, partially compliant on 12 of 40 FATF Recommendations (January 2026 follow-up; further follow-up published 23 March 2026, both before this window). [[Source 1]](#sec-sources) Probable · 1 source Lightspark acquired Tallinn-based crypto-banking API firm Striga on 14 October 2025; Lightspark subsequently became the only company holding a standalone Finantsinspektsioon MiCA CASP authorisation in Estonia by the 1 July 2026 deadline. [[Source 1]](#sec-sources) Uncertain · 1 source EU Commission approved OTP Bank's acquisition of sole control of Estonia-incorporated Luminor Holding AS under simplified procedure, Case M.12586 [[Source 1]](#sec-sources) Probable · 1 source First reading concluded 27 August 2026; MLTFPA/International Sanctions Act amendment expanding FIU database strategic-analysis capability [[Source 1]](#sec-sources) Probable · 1 source Remains in MONEYVAL enhanced follow-up; seven Recommendations re-rated upward in the 2nd FUR adopted December 2025 [[Source 1]](#sec-sources) Probable · 1 source Virtual currency licence FVT000209 revoked 29 June 2026 under MLTFPA §75(1)(4) for non-compliance with a supervisory precept [[Source 1]](#sec-sources) Probable · 1 source Finantsinspektsioon (FSA), not the FIU, now holds licensing role for crypto-asset service providers under MiCA [[Source 1]](#sec-sources) Probable · 1 source Passed the Law of Obligations Act and related Acts Amendment (Prevention and Combating of Financial Fraud), 936 SE, on or about 21 October 2026, 76 votes in favour. [[Source 1]](#sec-sources) Probable · 1 source Finantsinspektsioon issued a precept following an on-site inspection requiring governance, internal control, risk management, regulatory reporting and lending procedure remediation, with deadlines into 2027. [[Source 1]](#sec-sources) Probable · 1 source