FINLAND Trends and Developments Contributed by: Jon Hautamäki, Max Atallah and Mikael Huhtala, Nordic Law
business until 30 June 2025, or until formally granted a CASP authorisation provided they submitted their licence application by 30 October 2024. Although Finnish VASPs had long operated under one of the strictest regulatory frameworks in Europe, MiCA introduces even more comprehensive and granular obligations with direct provisions but also through several Commission Delegated Regulations (DLR). These include heightened requirements around governance, operational rules, risk management and capital adequacy. The seriousness with which these new requirements have been treated is reflected in the fact that certain VASPs previously registered in Finland did not submit applications to continue as CASPs under MiCA. Finland now officially counts five authorised CASPs, a development that contrasts with the rest of the Nordic region, which has seen a slower roll-out with only a handful of full MiCA authorisations published to date. Nevertheless, while MiCA marks a significant step forward, it does not eliminate all inherent risks asso - ciated with the crypto-asset market. Notably, crypto- assets remain outside the scope of the EU’s Investor Compensation Scheme, meaning end-users are not protected by the kinds of safety nets available in tradi- tional finance. Risks such as cyber-attacks, fraud and extreme market volatility continue to affect the sector. Year in Review: 2025 In 2025, the Finnish fintech and blockchain landscape was decisively shaped by the full application of major EU-level regulatory instruments and their national implementation and supervision. Together, these developments mark a transition from fragmented or transitional regimes towards a more mature, harmo- nised framework for digital finance. Digital Operational Resilience Act (DORA) A central regulatory milestone in 2025 was the full application of DORA from 17 January 2025. DORA imposed uniform and directly applicable requirements on financial entities regarding ICT risk management, cybersecurity governance, incident reporting, opera- tional resilience testing and the oversight of critical third-party ICT service providers. For Finnish fintech firms under the supervision of the FIN-FSA, DORA has
significantly elevated expectations concerning tech- nological resilience, governance structures and con- tractual control over outsourced ICT services. Regu- lation reinforces a shift towards proactive resilience management rather than reactive incident handling. Completion of the MiCA transition While MiCA became applicable at EU level on 30 December 2024, 30 June 2025 marked the decisive end of Finland’s national transition period. On that date, the grandfathering regime for previously regis- tered VASPs expired, requiring all operators to obtain full CASP authorisation in accordance with MiCA. Kvarn Capital Oy, NorthCrypto Oy and Coinmotion Oy, together constituting substantially all of Finland’s con- sumer-focused crypto-asset market, have obtained CASP authorisation under MiCA. AML/CFT framework update As of 1 July 2025, the FIN-FSA’s updated AML/CFT guidance explicitly incorporates CASPs within its scope, replacing the former national category of “vir- tual currency providers”. This update aligns Finnish supervisory practice with MiCA and with the EU’s revised Transfer of Funds Regulation (Regulation (EU) 2023/1113), which extends the travel rule to crypto- asset transfers. Finnish fintech firms and CASPs are now required to ensure that information concerning the originator and beneficiary of crypto-asset transfers accompanies transactions regardless of value. EU Data Act The EU Data Act, applicable from September 2025 (Regulation (EU) 2023/2854), introduced new obliga- tions concerning access to and use of data generated by connected products and services. For fintech com- panies, particularly those relying on automated deci- sion-making, smart contracts or data-driven business models, the Data Act requires mechanisms to inter- rupt or terminate smart contract execution and man- dates fair data-sharing arrangements. These require- ments interact closely with existing data protection and financial regulatory obligations, adding a further layer of governance complexity to digital finance. EBA no-action letter on MiCA and PSD2 In June 2025, the European Banking Authority (EBA) issued a no-action letter clarifying the interaction
240 CHAMBERS.COM
Powered by FlippingBook