Lead Signal
Estonia enters World Payments Monitor coverage as a mature, fully-integrated EEA payments jurisdiction whose settled architecture increasingly sits in tension with an AML legacy that refuses to close out. Finantsinspektsioon operates the standard PSD2/EMD2 licensing model, authorising and supervising both banks and non-bank payment institutions and e-money institutions under the Payment Institutions and E-money Institutions Act, with EEA-wide passporting rights attached to any Estonian licence. That baseline sits alongside the country's post-Danske Bank inheritance: the Estonian branch processed approximately EUR200 billion in suspicious non-resident transactions between 2007 and 2015, a scandal that produced the branch's 2019 market exit and more than $2 billion in global US and Danish settlements in 2022. Nearly a decade on, that legacy is still generating fresh legal friction rather than fading into history. In September 2024 the Harju County Court annulled a EUR300,000 Financial Intelligence Unit sanctions-enforcement fine against AS LHV Pank, ruling that the FIU had not adequately demonstrated individual board-member breach of due-diligence duties over roughly EUR2.2 million in Russia-sanctions-linked payments — a judicial pushback on enforcement evidentiary standards that sits awkwardly against LHV's own reputation as the most conservative of Estonia's four largest banks on Russia-linked wind-down. Layered on top is a second cliff-edge: Estonia's Crypto Asset Market Act rebased domestic virtual-asset regulation onto MiCA and DORA from 1 July 2024, shifting CASP supervision from the FIU to Finantsinspektsioon and setting a 1 July 2026 expiry for legacy FIU-issued VASP licences. The most recent available snapshot, from August 2025, showed zero domestic CASP authorisations granted against 25 providers registered to operate cross-border into Estonia — a figure that has not been re-verified past the transition deadline, which fell just three days before this cycle's baseline date.
Other Developments
Card-scheme access in Estonia runs on two distinct tracks. Wallester holds a Visa Principal Membership with direct network access to issue cards, is PCI DSS Level 1 certified and is licensed by Finantsinspektsioon — a direct-principal-membership route that is comparatively rare for a non-bank EMI and is used competitively as a trust signal. LHV, by contrast, provides indirect card-scheme access and collection services to roughly 200 fintech partners as a member of major UK and EU payment schemes. The bank's banking-as-a-service model has made it, by one estimate, a facilitator of roughly 7% of all instant transfers across Europe for clients including Coinbase, TrueLayer, Currency Cloud and Wise, though a more recent source cites a higher ~8% figure and reconciliation is recommended next cycle. Estonia's corridor infrastructure is fully harmonised with euro-area rails — TARGET2-Eesti/T2 for large-value settlement, STEP2 for batch SEPA credit transfers, and RT1/TIPS for instant payments — reflecting full euro-area membership since 2011 and SEPA membership since 2014. Swedbank, SEB and LHV together cover roughly 95% of interbank and intrabank credit transfers within the country. The banking sector itself remains foreign-capital-dominated, led by Swedbank (26.66% market share by total assets, EUR15.76 billion, in 2025), SEB and Luminor, alongside the domestically-owned challenger LHV. LHV's acquiring infrastructure — 3-D Secure, bank-link/QR redirect, Nets Estonia-certified POS — underpins non-bank orchestration platforms such as Montonio via virtual-IBAN-based safeguarded settlement. High-risk-sector merchants — crypto-adjacent, forex, gaming, payment processing — continue to be steered toward international EMI acquiring rather than conservative domestic bank acquiring. On the product side, Estonia's e-Residency programme now underpins nearly half of newly founded startups involving an e-resident, up from 38% in 2023. Wallester's 2025 roadmap added 24/7 instant currency exchange across ten currencies and direct Xero/QuickBooks integrations. Commercially, Wallester was ranked the #1 fastest-growing fintech in Europe on the FT1000 2026 list — 38th overall, up from 48th, on 178.9% three-year revenue CAGR, with disclosed revenue rising from EUR9.14 million in 2023 to EUR17.2 million in 2024. Montonio processed over EUR1.5 billion in 2025 payment volume, grew monthly recurring revenue by more than 60%, launched on Shopify and completed a full-product rollout across the Baltics and Poland; and Creem, an AI-focused financial-infrastructure startup, raised a EUR1.8 million pre-seed round led by Practica Capital in August 2025. On consumer protection, Estonia recorded 18,300 card-fraud incidents (EUR2.6 million lost, a rate below the EU average) against 5,800 fraudulent payment-order transactions (EUR10.6 million) in 2023, with payment-order fraud comparatively worse than card fraud relative to EU peers; the EU's PSR/PSD3 reform reached provisional political agreement in late 2025 mandating PSP reimbursement for impersonation-fraud victims and platform liability for fraud originating on online platforms, though Estonian domestic transposition has not yet been published.
Cross-Monitor Connections
Two threads in this baseline cycle are flagged for the Financial Integrity Monitor rather than developed further here. First, the Sentinel-fed AML/CFT record — the Danske Bank scandal's causal role in Estonia's post-2018 AML/CFT reform, and Estonia's 2022 FATF/MONEYVAL Mutual Evaluation finding of compliance or largely-compliance on 25 of the 40 FATF Recommendations — warrants original illicit-finance analysis beyond this monitor's payments-market-structure scope. Related correspondent-banking de-risking findings compound the picture: Deutsche Bank and Bank of America discontinued correspondent agreements with Danske Bank in 2015, years before the scandal became public, and Sweden's Finansinspektionen separately fined SEB over $107 million and Swedbank nearly $400 million for AML failures tied to non-resident account monitoring across the Baltics. Second, the MiCA/CMA CASP-authorisation transition — zero domestic authorisations against 25 cross-border registrants at last snapshot — raises a potential supervisory-gap window around the 1 July 2026 cliff-edge that may itself warrant AML/CFT licensing-gap monitoring.
Outlook
Two dates anchor the forward calendar. The 1 July 2026 expiry of legacy FIU-issued VASP licences has now passed, and next cycle should prioritise re-verifying the current domestic CASP-authorisation count rather than carrying forward the stale August 2025 snapshot. Separately, Estonia's domestic transposition timeline for the EU's PSR/PSD3 APP-fraud-reimbursement reform remains unpublished and is a gap to track. Underlying both is a structural theme worth watching across the jurisdiction: LHV's expanding role as BaaS provider, indirect scheme-access point and acquiring-infrastructure backbone concentrates commercial significance and operational-resilience exposure in a single institution, a dependency pattern that this monitor will continue to track alongside the slower-burning Danske Bank AML legacy.