Compliance Audit for Payment, E-Money and Crypto Firms

A regulated firm learns about the gaps in its compliance in one of two ways: from its own review, or from the supervisor's inspection. A compliance audit is the first way. This guide explains what an internal compliance review covers, how the scope is chosen, what the report contains, what a review commonly finds, and what happens with the findings.

The guide is general information, not legal advice. A compliance review is not a statutory financial audit and does not replace the auditor required by the Auditors Activities Act or the sector law.

What a compliance audit is

A compliance audit — more precisely, an internal compliance review — tests what the firm's policies say against what the firm actually does, and tests both against the law and the supervisor's guidelines. It is a documentary and procedural check, not an opinion on the firm's financial statements: a statutory audit looks at the numbers, and a compliance review looks at the controls. The two are carried out separately, usually by different reviewers, and a regulated firm often needs both at different points in the year.

When a review makes sense

before applying for a licence, to test the documents against the law;
in the first year after authorisation, when policies meet practice for the first time;
before a supervisory inspection, or after one, to close the findings;
when AML rules require an independent check of the internal control system (RahaPTS), or before a bank's periodic review of the firm;
before a sale, as part of the buyer's due diligence.

Scope in three classes

Class 1 scope — from €8,500: AML/CFT framework, governance and the core policies of a firm with limited services;
Class 2 scope — from €15,500: adds safeguarding or custody, outsourcing, ICT and complaints, with sample testing;
Class 3 scope — from €27,000: the full regulatory perimeter of a complex firm, including market conduct and trading platform rules where relevant.

The class of the review follows the firm's services, not its size alone; we confirm it in writing before the work starts. A firm that added a service since its last review — for example safeguarding, custody or a new distribution channel — usually needs the wider scope, even if nothing else about the firm has changed.

How long a review takes

Duration depends on the scope and on how quickly the firm answers questions and produces files for testing:

Class 1 scope — typically 3–4 weeks;
Class 2 scope — typically 4–6 weeks;
Class 3 scope — typically 6–8 weeks;
the remediation plan, once the report is final — typically 2–4 weeks.

These are typical durations for a firm whose documents and files are already in order; a firm that has to assemble its files during the review, rather than before it starts, should expect the review to run longer.

The method and the report, step by step

document review against the applicable law, regulations and supervisory guidelines;
written questionnaires to the management and key function holders, with follow-up questions by email;
sample testing of files: customer due diligence, monitoring alerts, safeguarding reconciliations, complaints;
a report with findings rated by risk, the legal basis of each, and a recommendation.

The steps run in that order: the document review sets the questions for the interviews, the interviews point to the files worth sampling, and the sampling is what the report's findings are based on. A review that jumps straight to sampling without first reading the policies tends to miss the gap between what is written and what is actually done — which is usually the more serious finding of the two.

What a review commonly finds

Across firms and sectors, the same kinds of gaps recur:

policies written for the licence application that were never updated once the business started operating differently;
monitoring alerts that are closed without a written reason, so the file cannot show why a decision was made;
safeguarding or client-money reconciliations that are not performed on the frequency the firm's own policy requires;
outsourcing or ICT arrangements that are not listed anywhere, so no one can show the supervisor the full picture on request;
a complaints register that exists on paper but is never reviewed by management.

None of these fail an inspection by themselves; the risk is in them going unnoticed until the supervisor, not the firm, finds them first.

Closing the findings

The remediation plan (from €1,700) turns the findings into a prioritised plan with owners and deadlines, and we update the documents where needed. A bank, an auditor or the supervisor who later asks about a finding will expect to see both the plan and evidence that it was carried out — not only the original report. Firms under DORA often combine the review with the DORA framework; crypto firms with ongoing MiCA compliance support. For the underlying AML and safeguarding documents, see AML rules and safeguarding for licensed companies.

What you receive

an independent compliance review report with rated findings;
where ordered, the remediation plan and updated documents.

The amounts are our fees for the standard scope; no VAT is added. All communication takes place by email.

Ready to start? Choose the scope class of the compliance audit. Order.

Official sources

The laws this article names, each linked to its official text, as read on 9 October 2026. For the Estonian acts we read the English translation in Riigi Teataja (opens in a new tab); the legally binding text is the Estonian one.

Auditors Activities Act (opens in a new tab) — Riigi Teataja (opens in a new tab), English translation

To see which of our services your company needs, open the Business Navigator.

Frequently asked questions

Is a compliance audit the same as a financial audit?

No. A compliance review checks the firm's regulatory framework and practice against the law and supervisory guidelines. It does not replace the statutory financial audit required by the Auditors Activities Act or the sector law.

What happens after the compliance audit?

The findings are rated by risk. The remediation plan turns them into prioritised actions with owners and deadlines, and we update the documents where needed.

Related guides

More on this topic: Compliance services.