FINLAND Trends and Developments Contributed by: Jon Hautamäki, Max Atallah and Mikael Huhtala, Nordic Law
Digital Operational Resilience Act and EU Data Act These developments did not occur in isolation. The full application of the Digital Operational Resilience Act (DORA) from 17 January 2025 imposed uniform requirements on financial entities regarding ICT risk management, cybersecurity governance, incident reporting, and oversight of critical third-party ICT ser- vice providers, significantly raising the bar for Finn- ish fintech firms supervised by the Finnish Financial Supervisory Authority (FIN-FSA). In parallel, the EU Data Act, applicable from September 2025, intro- duced new obligations on data access and use that interact directly with fintech business models relying on smart contracts and automated decision-making. Meanwhile, updated AML/CFT guidance from the FIN- FSA, effective 1 July 2025, brought CASPs explicitly within its supervisory scope and aligned Finnish prac- tice with the EU’s revised Transfer of Funds Regula- tion, extending the travel rule to crypto-asset transfers regardless of value. Full MiCA Implementation As of 30 December 2024, MiCA became fully appli- cable across the European Union, marking a pivotal shift in the regulatory environment for crypto-asset services. In Finland, this resulted in the repeal of the national VASP Act, replacing one of the EU’s most rig- orous domestic regimes with a harmonised framework shared across all member states. MiCA introduces a comprehensive set of require- ments governing stablecoins, crypto-asset service providers (CASPs) and initial white paper disclosures. These provisions are designed to enhance consumer protection, market integrity and financial stability, while aligning Finland’s regulatory architecture with broader European standards. For both domestic firms and international actors, MiCA brings welcome clarity and predictability, easing cross-border operations and standardising compliance obligations. A key element of MiCA’s implementation was the tran- sitional regime offered to EU member states. Finland adopted this option, allowing crypto-asset service providers already operating under the VASP Act before 30 December 2024 to continue their activities tem- porarily. Under the Finnish transitional arrangement, grandfathering period, these entities could remain in
Introduction Finland has traditionally approached the regulation of crypto-assets through clear statutory provisions rather than case law, reflecting a broader preference for rule- based legal frameworks. This approach was embod- ied in the national Virtual Asset Service Provider Act (the “VASP Act”), which imposed strict requirements on crypto businesses operating in Finland. Despite this conservative regulatory posture, Finland has long punched above its weight in global tech- nological innovation, and blockchain is no excep- tion. Finnish developers played a foundational role in shaping the global ecosystem: Martti Malmi was among Bitcoin’s earliest contributors, while Stani Kulechov founded Aave, one of the flagship proto- cols of decentralised finance (DeFi). Research-driven organisations such as Equilibrium continue this tra- dition today, developing decentralised infrastructure and compliance-oriented blockchain solutions at the frontier of the field. Historically, however, Finland’s domestic blockchain market lagged in commercial development. The strin- gent requirements of the VASP Act led many Finnish blockchain entrepreneurs to relocate abroad, seeking more permissive environments in which to innovate and raise capital. Markets in Crypto-Assets Regulation The regulatory landscape shifted decisively in 2025. The full application of the EU-wide Markets in Crypto- Assets Regulation (MiCA), and the concurrent repeal of the VASP Act, marked Finland’s transition from a nationally defined framework to a harmonised Euro- pean one. The completion of MiCA’s grandfather- ing regime on 30 June 2025 required all previously registered virtual asset service providers to obtain formal authorisation as Crypto-Asset Service Provid- ers (CASPs), bringing them within a uniform EU-level framework governing capital adequacy, governance, consumer protection, custody arrangements, and operational safeguards. Crucially, MiCA authorisation enables Finnish CASPs to passport their services across the European Economic Area, substantially reducing barriers to cross-border expansion and positioning Finland as a competitive jurisdiction for regulated crypto-asset activity.
239 CHAMBERS.COM
Powered by FlippingBook