Estonian Cryptocurrency Exchanges are defined in the Estonian law as Providers of Alternative Means of Payment, licensed as an Estonian Financial Institution by holding a Financial Activity License from the Estonian Financial Intelligence Unit (FIU), which is the Anti Money Laundering (AML) authority in Estonia with the ability to grant, revoke and supervise financial activity licenses. The AML and KYC requirements the service providers are subject to are set forth in the Estonian Money Laundering and Terrorist Financing Act and other legal guidelines given by the Estonian Minister of Finance.

A cardinal part of the licensing procedure, and a significant FIU consideration for granting licenses is the quality of the Rules of Procedures which according to the Act, must be meticulously drafted by the license applicant. These Rules of Procedure must comply with the Estonian law's various requirements, which require them, among other things, to include specification of customer due diligence measures the company intends to take, assessment of money laundering risk, the manner of the collection and keeping of records, internal control rules, etc.

The most generalized instruction of the Act is that the service provider must pay special attention to the activities of the customer or any person operating on their behalf, and to circumstances that refer to money laundering or terrorist financing, including high-value and unusual transactions with no sensible economic explanation.

The service provider must carry out due diligence inspections upon engaging a client, as well as upon conducting transactions over a certain amount, even if the customer was previously verified. An additional specific requirement for Providers of Alternative Means of Payment, directing them to identify a customer not only when engaging them for the first time but also when the customer conducts a certain amount of monthly transactions. The regulator also uses monetary thresholds to separate cases where the company is obligated to refuse the customer/ transaction form cases that are subject to the company's discretion.

Needless to say, when the company suspects a customer of money laundering or the authenticity of KYC documents they provided, due diligence must be meticulously carried out again.

One of the "catches" of the Estonian AML law is the requirement for a face to face or video conference meeting when engaging a new customer. However, during our legal research we found this requirement can be bypassed by taking "Enhanced" due diligence measures.

The Estonian law categorizes Estonian and EEA citizens as low risk customers and enables the Exchange to identify them by taking "Simplified" due diligence measures. This might be the reason for some Estonian exchanges' decision to mainly target EU markets.

There are specified lists of the required KYC documents for individual customers as well as corporate customers. There are also legal requirements to regularly train all employees which stand in contact with customers, and to appoint a suitable compliance officer to make sure the company complies to the law and to serve as the Regulator's Point of Contact. When applying for an Estonian license, we advise companies to pay careful attention to the person they suggest as their compliance officer, since the regulator takes this position very seriously and vets the candidate's records, experience, abilities and education.

Porat Group offers interested companies all the services needed for licensing in Estonia. <a href="https://www.porat.com/contact/">Contact us</a> for more information.