FINLAND Law and Practice Contributed by: Jon Hautamäki, Max Atallah and Mikael Huhtala, Nordic Law
limited and conditional exemptions from parts of EU financial markets regulation, including MiFID II/MiFIR and the Central Securities Depositories Regulation. Finnish entities are eligible to apply under the DLT Pilot Regime, but publicly available information indicates that uptake across the EU has been limited to date. As the post-MiCA and DORA framework matures, inter- est in structured mechanisms for testing innovative market infrastructure solutions could increase, par- ticularly for tokenised securities use cases. 1.1.3 Regulation of Blockchain Technology Finland’s regulatory attitude towards blockchain is generally constructive and innovation friendly, sup- ported by a transparent and technology neutral supervisory culture. The Finnish Financial Supervi- sory Authority, FIN-FSA, acts as the key licensing and supervisory authority for both traditional financial institutions and fintech operators, and it applies the same activity-based approach regardless of whether a service is delivered through conventional systems or blockchain-enabled solutions. This approach is reflected in Finland’s move from ear- lier transitional arrangements to fully applicable EU level frameworks. Markets in Crypto-Assets Regula- tion, MiCA, became fully applicable on 30 December 2024 and Finland’s national transition period ended on 30 June 2025, after which crypto-asset service providers must operate under the MiCA authorisation framework. Finland is generally regarded as a start-up friendly jurisdiction where digitalisation and techno- logical development are key priorities, supported by Business Finland initiatives. Blockchain technology itself is not specifically regu- lated in Finland or at EU level. Instead, regulation is triggered by the nature of the activity and the rights or services involved, reflecting the principle of tech- nology neutrality. This means regulated firms remain subject to existing governance, conduct and risk man- agement obligations even when they use blockchain- enabled infrastructure. A major horizontal require- ment is DORA, which entered into application on 17 January 2025 and introduces uniform requirements for ICT risk management, cybersecurity governance, incident reporting expectations, resilience testing and
oversight of critical ICT third-party providers. These obligations can be highly relevant where blockchain- enabled systems or providers are embedded in busi- ness operations of regulated entities. Smart contracts add a further governance layer. Fin- land does not explicitly prohibit smart contracts, but the EU Data Act, applicable from September 2025, recognises smart contracts and sets essential require- ments for smart contracts that fall within its scope. These requirements include mechanisms to stop or interrupt execution and internal functions enabling termination or suspension to reduce the risk of unin- tended execution, and they interact with data protec- tion and financial regulatory obligations in a way that can increase compliance complexity for digital finance models For decentralised finance, DeFi, the key practical issue is whether the protocol is genuinely decentral- ised or only nominally decentralised while being effec- tively centrally managed. Where there is an identifiable operator or central entity behind the arrangement, that entity is very likely to be treated as operating within the regulated perimeter, including potentially being interpreted as a MiCA crypto-asset service provider. Where a protocol is genuinely and completely decen- tralised, its operations may sit largely outside the scope of current legislation in practice, although this remains an evolving area. Data protection and record-keeping are also central themes for blockchain deployments. Finland relies pri- marily on the GDPR, supplemented by national rules such as the Data Protection Act (1050/2018), and anti-money laundering rules that can require retention of certain customer data for at least five years after the customer relationship ends for in-scope firms. A recurring compliance challenge across the EU is man- aging the tension between blockchain immutability and GDPR rights, including erasure. In practice, many implementations seek to minimise personal data on chain, for example by storing only hashed or crypto- graphically protected references on chain while keep- ing personal data off chain under controlled access, although Finland-specific blockchain tailored guid- ance on this design pattern is not typically presented as standalone rule-making.
224 CHAMBERS.COM
Powered by FlippingBook