Many Estonian companies are obliged entities under the Money Laundering and Terrorist Financing Prevention Act: not only banks and payment institutions but also, for example, providers of accounting or tax advice services, providers of trust and company services, real estate intermediaries and traders who accept cash payments of 10,000 euros or more. An obliged entity must have its risk assessment, rules of procedure and customer due diligence in writing. This article sets out what the act asks for, section by section, and what we prepare.
The article is general information, not legal advice. Whether a company is an obliged entity is decided from its activity; the Financial Intelligence Unit supervises.
Who is an obliged entity
The act applies to the activities of the persons listed in § 2(1) of the Money Laundering and Terrorist Financing Prevention Act. Among them:
- credit and financial institutions (clauses 1 and 2) and gambling operators (clause 3);
- traders, where a cash payment of at least 10,000 euros is made to or by them, also in several related payments within up to one year (clause 5);
- providers of accounting services (clause 7) and of accounting or tax advice services (clause 8);
- providers of trust and company services (clause 9).
The documents the act requires
- Risk assessment. The company documents its assessment of the money laundering and terrorist financing risks of its activity, covering at least the risks relating to customers, to countries and geographic areas, to products, services or transactions and to delivery channels (§ 13(1)). From it the company sets its lower- and higher-risk fields, its risk appetite and its risk management model (§ 13(3)). The steps must be proportionate to the nature, size and complexity of the business (§ 13(2)); the documents are updated where necessary (§ 13(4)).
- Rules of procedure and internal control rules. Rules that manage the risks found in the risk assessment, and internal control rules for following them (§ 14(1)). They include the procedure of due diligence — with the simplified and enhanced measures — the customer risk model, what to do on a suspicion and how to report it, data retention, and how to identify politically exposed persons, sanctioned persons and high-risk countries (§ 14(1) clauses 1–5). They may be one document or several and are established by the senior management (§ 14(3)); employees who deal with customers are trained in them (§ 14(6)).
- Customer due diligence (KYC). The measures of § 20(1): identifying the customer and verifying the data from a reliable and independent source; identifying a representative and the right of representation; identifying the beneficial owner and understanding the ownership and control structure; understanding the business relationship or transaction; finding out whether the person is a politically exposed person; and monitoring the business relationship.
- Records. The identification documents and the documents on which the business relationship was established are kept for no less than five years after the relationship ends (§ 47(1)), together with the correspondence and the monitoring data (§ 47(2)).
Compliance officer and reporting
- Who is in charge. Where the company has more than one management board member, one of them is appointed to be in charge of applying the act (§ 17(1)). Credit and financial institutions and certain other obliged entities appoint a compliance officer — the contact person of the Financial Intelligence Unit (§ 17(2)); other obliged entities may appoint one (§ 17(3)).
- Reporting a suspicion. When the company finds an activity or facts that suggest money laundering or terrorist financing, it reports to the Financial Intelligence Unit without delay and not later than within two working days (§ 49(1)) — also where no business relationship was established or no transaction was made (§ 49(2)).
What we prepare
The service AML and KYC procedures for an Estonian company, from from €2,500, prepares from the company's description of its activity:
- the risk assessment of the company's activity;
- the rules of procedure and the internal control rules;
- customer due diligence (KYC) forms and checklists;
- a register of the documents for the company's records.
Whether the company is an obliged entity is checked from its facts. The starting price is for one company; more work is agreed in writing before it starts. Not included: legal advice or a legal opinion, acting as the compliance officer, checks of the company's clients and representation before the Financial Intelligence Unit. For a payment, e-money or crypto-asset licence the AML package of that licence applies — see the payment and e-money licence and the MiCA licence.
Prices exclude VAT. All communication takes place by email.
Ready to start? The risk assessment, rules of procedure, internal control rules and KYC forms; not legal advice. Order.
Official sources
The laws this article names, by the name of their official text, as read on 9 October 2026. For the Estonian acts we read the English translation in Riigi Teataja; the legally binding text is the Estonian one.
- Money Laundering and Terrorist Financing Prevention Act — Riigi Teataja, English translation
Sources are named in the text, without links. To see which of our services your company needs, open the Business Navigator.