KYB on EU Crypto & Payment Entities: Reviewing Estonian OÜs, Czech s.r.o.s and Offshore Holding Structures

A European counterparty's documents can all be genuine and still leave the key questions unanswered. A company extract proves that a company exists. It does not prove the company may run a crypto exchange, that the ownership chart is complete, or that the people behind the holding companies can be identified. KYB for crypto companies and payment firms in the EU comes down to four separate checks, each against its own official source:

1. corporate existence and representation, from the national company register
2. regulatory authorization for the activities actually performed, from the regulator and ESMA
3. ownership and control traced to natural persons, from registers where they are accessible and from supporting documents where they are not
4. screening of the entity, its controllers and connected parties

This guide shows how to run those checks on an Estonian OÜ, a Czech s.r.o. and an offshore holding chain, as at October 2026, and how to document the decision.

Three frameworks, kept separate

A Canadian MSB or PSP reviewing a European company is working under three different sets of rules.

FINTRAC requirements apply to the Canadian reporting entity, and only where the relevant trigger applies. If the European company is a client whose identity you must verify, FINTRAC's beneficial ownership guidance (updated July 30, 2026) requires you to obtain beneficial ownership information when you verify the entity's identity. That means, among other things:

• for a corporation, the names of all directors
• the names and addresses of everyone who directly or indirectly owns or controls 25% or more of the shares
• information establishing ownership, control and structure

You must also take reasonable measures to confirm the information is accurate. Those measures "cannot be the same as the measures you used to obtain the information", and for high-risk entities they "must go further". The guidance gives several examples:

• official documents, such as shareholder registers, articles and certificates of status
• registry searches
• open-source research
• a document signed by the client confirming the information's accuracy

How far you go depends on your risk assessment. For a complex foreign structure, a signed confirmation alone will rarely be enough. A corporate chart is an input to the review, not proof. For identity verification itself, see FINTRAC identity verification methods.

EU regulatory status decides whether the counterparty is allowed to provide the services it claims. These are the counterparty's obligations, not yours. A Canadian PSP does not become subject to MiCA or EU AML law because it has a European partner. But a partner operating without the authorization it needs is a risk you have to assess.

Your internal controls fill the gap: risk-based procedures, banking-partner expectations and contract terms. Most of the registry searches below fall into this category. They are how you take reasonable measures and manage risk, not checks that FINTRAC prescribes one by one.

The relationship decides how much of this applies:

The general concepts are covered in KYC, KYB and CDD. The rest of this guide is about the European sources.

What changed in 2026

• The MiCA transition is over. Under Article 143 of the Markets in Crypto-Assets Regulation, firms already providing crypto services under national law could continue until July 1, 2026, or until their MiCA application was granted or refused. Member States could shorten that period. Since July 2026, crypto-asset services in the EU require a MiCA authorization, or a notification route available to certain already-regulated financial firms.
• Estonia. Finantsinspektsioon confirmed that from July 1, 2026, only firms authorized by it or by another EEA supervisor may provide crypto-asset services in Estonia. Unauthorized firms may not accept new clients or open accounts. The Financial Intelligence Unit (FIU) cancelled the register data for the old virtual currency service provider licences on that date. FIU licences had already fallen from 641 in mid-2021 to 36 at the start of 2026.
• Czech Republic. The Czech National Bank (CNB) announced on July 1, 2026 that it had granted MiCA authorization to 11 entities, out of 251 applications and notifications. Unauthorized entities must stop onboarding clients and wind down. Firms authorized in another Member State can serve Czech clients cross-border.
• The EU AML Regulation does not yet apply. Regulation (EU) 2024/1624 has entered into force, but under Article 90 its requirements generally apply from July 10, 2027. The existing EU and national AML framework continues to govern the relevant activities in October 2026.
• The EU travel rule has applied since December 30, 2024 to EU crypto and payment firms' own transfers. Its scope and thresholds are not Canada's. For counterparty review, the relevant question is whether a CASP partner can send and receive the information each side's rules require.

Verifying an Estonian OÜ

An osaühing (OÜ) is a private limited company. Estonian e-Residency is a digital identity for running a company remotely, and it is not a licence.

Company register. Search the e-Business Register by name or registry code. Use the registry code, because names can be similar or change.

A clean register entry establishes existence and representation. It does not establish operating substance, AML compliance or legitimacy.

Beneficial ownership in Estonia. The register has a beneficial owners query. Estonia's Ministry of Finance planned to restrict this data from July 10, 2026, limiting it to competent authorities, obliged entities and people with a legitimate interest. On July 10, Estonian Public Broadcasting (ERR) reported that the Ministry had postponed the change, with no new date set, and confirmed that the existing access arrangements remain in place until a new framework takes effect. The July announcement gave no replacement date. Some register help material still refers to the originally planned July 10 change, so the current access conditions should be checked directly before relying on a search. Check the access rules on the day you search, and record what you could see. Even where the data is visible, it is the company's own declaration to the register. Reconcile it against the shareholder chain rather than treating it as confirmation.

Authorization: a separate search. Check Finantsinspektsioon's crypto-asset service provider lists. These list providers authorized in Estonia and cross-border providers authorized elsewhere in the EEA. Then check the ESMA interim MiCA register (below). The possible outcomes are:

• authorized in Estonia
• authorized in another EEA state and providing services cross-border
• an eligible financial firm providing crypto services through notification
• formerly registered with the FIU, and nothing current
• not regulated, because its actual activity does not need authorization

Establish the activity before you conclude anything. An OÜ that builds wallet software is in a different position from one holding client assets.

Verifying a Czech s.r.o.

A společnost s ručením omezeným (s.r.o.) is a limited liability company. The Czech search process differs from Estonia's in three ways: the identifier, the register in transition, and restricted beneficial ownership data.

Search steps:

1. Search by IČO, the eight-digit identification number, not by name. Czech names are often shortened or rendered without diacritics in contracts and on websites. The IČO is the reliable match key.
2. Use the public register at or.justice.cz. It remains the official source while the Ministry of Justice's new public registers portal, in trial operation since April 2026, is phased in.
3. Pull both the current and the complete (historical) extract. The complete extract shows earlier executives, shareholders and addresses. That helps spot recent changes that a supplied chart omits.
4. Check the statutory executives (jednatelé) and the method of representation. It may require two executives to sign jointly. A contract signed by one executive alone may be the first discrepancy.
5. Review shareholders (společníci) and their stakes, as recorded for the s.r.o.
6. Open the collection of deeds (sbírka listin) for filed financial statements and constitutional documents. Missing financial statements are themselves a finding.
7. Check the separate insolvency register (ISIR) for proceedings.

Beneficial ownership in the Czech Republic. The Ministry of Justice closed public access to the beneficial owner register on December 17, 2025, citing court rulings on privacy. Remote access continues for registered persons, privileged users and obliged persons under the Czech AML Act. Others must prove a legitimate interest before a court. Being a FINTRAC reporting entity does not, by itself, give a Canadian business privileged access to the Czech register. Access depends on its status under Czech law and the access arrangements that apply to it. Do not use third parties to get around the restriction. Instead, ask the company for:

• a current extract of its own register entry, which the registered entity can obtain
• the shareholder documents filed in the collection of deeds
• an ownership chart, signed and dated by an authorized executive
• documents for each intermediate owner

Authorization. Search the CNB's JERRS lists of regulated and registered financial market entities. The CNB says MiCA-authorized entities are listed there once its decisions become final. Check the specific category: payment institution, small-scale payment service provider, electronic money institution or crypto-asset service provider. Then check the ESMA register for crypto authorizations. A trade licence (živnostenské oprávnění) or a business activity listed in the commercial register does not count as authorization.

Crypto authorization is not payment authorization

Notification routes. MiCA (Article 60) lets certain already-regulated firms provide some crypto-asset services by notifying their regulator instead of seeking a separate CASP authorization. Those firms include credit institutions, investment firms, e-money institutions, fund managers and market operators. The services allowed depend on the firm's existing licence. An EMI's route, for example, is narrower than a bank's. Verify both the notification and the specific service.

Cross-border services. A CASP authorized in one Member State may provide services in others after notification through its home regulator (Article 65). Check the host-state list, such as Estonia's cross-border list, as well as the home regulator.

The ESMA register. ESMA publishes an interim MiCA register as CSV files. It covers authorized CASPs, white papers, token issuers and non-compliant entities, updated weekly from national regulators' data. A withdrawn authorization stays listed with its withdrawal date. ESMA notes that national listings may not appear immediately, so a missing entry is a reason to check the home regulator, not proof that the firm is unauthorized.

Match on exact legal name and national identifier. A group may hold the authorization in one entity while contracting through another.

Tracing offshore holding structures

An offshore holding company is not suspicious in itself. Holding structures are common for tax, financing and investor reasons. The question is whether ownership and control can be understood and evidenced down to natural persons. FINTRAC's guidance states that beneficial owners "cannot be other corporations, trusts or other entities", and that it may be necessary to search through many layers.

Calculating effective interests (hypothetical). An EU operating company is 80% owned by Offshore Holding A and 20% owned directly by Individual C. Individuals A and B own 40% and 60% of Holding A.

Under FINTRAC's 25% test, Individuals A and B are reportable beneficial owners. C falls below the threshold on shares alone, but still has to be considered if C controls the company another way, for example as a director with special voting rights. Other jurisdictions use different thresholds and definitions. Estonian law, for instance, defines a beneficial owner by "final dominant influence". Apply the Canadian test for your own record, and record where the counterparty's local register reaches a different answer.

Beyond simple percentages:

• voting shares that differ from economic shares
• different share classes
• nominee shareholders or directors
• trusts, where the trustees, settlors and beneficiaries need to be established
• shareholder agreements and other contractual control
• control without a majority
• the same person appearing through several paths, so the interests must be added together
• differences between the register and the client's declaration

A chart supplied by the company is a claim to test, not evidence.

Holding companies in a third country:

1. Confirm the jurisdiction of incorporation from the holding company's own documents.
2. Identify that jurisdiction's official company registry.
3. Confirm the company exists and its status.
4. Record the directors and shareholders where the registry shows them.
5. Move to the next layer, and repeat until you reach natural persons or a recognized control arrangement such as a trust.

Registries differ widely. Many do not publish shareholders, and few publish beneficial owners. When a registry is silent, ask for:

• certified extracts
• the shareholder register
• incumbency certificates
• trust deeds
• shareholder agreements
• a signed ownership declaration

If ownership still cannot be verified, FINTRAC's guidance says you must take reasonable measures to verify the identity of the entity's chief executive officer, or the person performing that role. You must also apply the special measures for high-risk clients, including enhanced ongoing monitoring. Whether to proceed on that basis is a risk decision, not an automatic approval or refusal. Enhanced measures are discussed further in enhanced due diligence.

Sanctions, regulatory warnings and adverse media

Screen:

• the entity and its known trading names
• directors
• beneficial owners and other controlling persons
• intermediate holding companies
• material connected companies

Use the lists relevant to you: Canadian sanctions under the Special Economic Measures Act and related legislation, and the EU sanctions lists where your EU partners or your own banking relationships make them relevant. Also check:

• national regulator warnings, such as Finantsinspektsioon's alerts
• the non-compliant entities file in ESMA's register
• public enforcement notices

Keep each finding in its own category:

• an initial hit: needs review
• a false positive: discounted, with the reason recorded
• a confirmed sanctions match: triggers legal obligations
• a regulatory warning: an official statement about a firm's authorization or conduct
• adverse media: allegations to weigh by source and substance

A clean screening result does not establish that a firm is authorized or compliant.

Evidence checklist for EU crypto and payment counterparties

Discrepancies that change the decision

A failed search is not proof of wrongdoing. Before concluding, consider the register's scope, the exact legal identity, update delays and cross-border permissions.

Three worked examples

All three are fictional. Registry numbers are placeholders.

1. An Estonian OÜ with an outdated licence. "Northlake Digital OÜ" (registry code [placeholder]) sends:

• an active register extract
• an Estonian FIU virtual currency licence from 2021
• a website offering crypto custody and exchange
• a one-line ownership declaration

The live register confirms the company, its board and two shareholders. Neither Finantsinspektsioon's lists nor the ESMA register show it, and the FIU licence data no longer exist. The reviewer asks the company:

• What services are you providing today?
• Did you apply for MiCA authorization, and what was the outcome?
• Do you operate under another firm's authorization?
• Have you notified clients of a wind-down?

The company says it now provides only software to an authorized CASP. Its website still advertises custody and exchange, so the reviewer does not accept the explanation at face value. The reviewer checks four things:

• Current services. The reviewer asks for the software licence agreement with the CASP, and checks that the CASP appears on the relevant regulator list and in the ESMA register under its exact legal name.
• Control of client assets. The company confirms in writing, and the agreement shows, that it holds no private keys and no client funds. The CASP's terms name the CASP as the custodian.
• The proposed contract. The draft agreement with the Canadian business covers software support only, with no payment or crypto-asset flows.
• Marketing. The company is asked to correct its website, which still presents it as the provider of regulated services, or to make clear that those services come from the authorized CASP.

Decision: onboarding is held until the website is corrected and the documents are received. It is then approved, restricted to the software contract, with a condition that the business is told before any change of services. If the company could not show that an authorized entity provides the regulated services, or that it does not itself hold client assets, the hold would continue. If it were still operating the exchange, the relationship would be declined.

The reviewer retains:

• the register capture
• the regulator searches, with dates
• the CASP agreement
• the website before and after correction
• the decision note

2. A Czech payment company with incomplete ownership evidence. "Vltava Pay s.r.o." (IČO [placeholder]) claims to be a payment institution. Its register entry is active, and the IČO matches. The CNB's JERRS list shows it as a small-scale payment service provider, not a payment institution. Under Czech payment-services law and CNB procedures, a small-scale payment service provider has a CNB-granted authorization recorded in the regulator's register, rather than a full payment institution licence. A statutory monthly transaction-volume limit applies. The small-scale authorization does not itself grant EU-wide passporting rights; whether a particular arrangement constitutes provision of payment services abroad depends on where and how the service is performed. Sending funds to a beneficiary outside Czechia does not, by itself, establish an unauthorized cross-border operation. Its beneficial owner register entry is not accessible to the reviewer.

The company's chart shows a single Cypriot holding company owning 100%. The complete extract lists two shareholders as recently as last quarter. The company explains that a share transfer was completed but is not yet registered, and provides the transfer agreement and the filing.

The reviewer:

• obtains the Cypriot holding's registry extract and shareholder register
• identifies the natural persons
• recalculates their interests
• confirms the change once the Czech register updates

Before any decision, the reviewer also:

• confirms which payment services Vltava Pay actually performs, and in which countries
• maps each one to what its registration permits
• asks why the company described itself as a payment institution

Decision: onboarding is held. The ownership discrepancy is documented but not yet resolved, and the proposed flows may involve providing payment services in another EEA country, but their legal scope has not yet been established. Two things are needed to move forward. First, a documented assessment of where the regulated payment service is actually provided, and evidence of appropriate authorization wherever required. Second, confirmation of the ownership change in the Czech register.

If the services issue is resolved but ownership still cannot be confirmed, FINTRAC's rule applies: verify the identity of the chief executive officer and apply the special measures for high-risk clients. Enhanced monitoring cannot make an unauthorized payment service permissible. Approval would cover only services permitted by the applicable CNB authorization and any other required permission.

3. An EU fintech owned through two offshore layers. An operating company is owned:

• 70% by Holding 1 (offshore)
• 30% by Individual D

Holding 1 is owned 50% by Holding 2 and 50% by Individual E, according to the client's chart. Holding 2's shares are held by a nominee, on behalf of Individual F.

The register for Holding 1's jurisdiction, obtained as a certified extract, shows E at 40% and a further 10% held by Individual G, who does not appear on the chart.

 Person  Calculation  Effective interest  D  Direct  30%  E  70% × 40%  28%  F, through the nominee  70% × 50% × 100%  35%  G  70% × 10%  7%

D, E and F meet the 25% test. The nominee arrangement is evidenced by a signed nominee agreement.

The chart was out of date. E transferred 10 percentage points of Holding 1 to G, which took E from 50% to 40%; F's 50% through Holding 2 was unchanged. The reviewer confirms this transfer with:

• the signed share transfer agreement
• Holding 1's updated shareholder register
• a board resolution approving the transfer
• the certified extract showing the new holdings

The reviewer then asks for a corrected chart, and records why the original one was wrong. The reviewer:

• verifies D, E and F
• screens all four individuals and both holding companies
• records the nominee arrangement as a risk factor
• rates the relationship high risk because of the structure, not because of the jurisdictions themselves

After approval: what should trigger a new review

Review frequency is set by your risk assessment. There is no universal annual rule. For the wider monitoring process, see ongoing monitoring with third-party onboarding tools.

KYB decision record

Illustrative internal record, not a FINTRAC-prescribed form.

Final checklist

• The relationship type is defined, and the FINTRAC obligations that apply to it are identified
• Existence, status and representation checked in the official register, by identifier
• Actual activities established before authorization is assessed
• Authorization checked with the home regulator, the host-state list and ESMA, matched to the exact legal entity
• Ownership traced to natural persons, with effective interests calculated and control assessed
• Register access limits recorded, and alternative evidence obtained without bypassing them
• Screening completed for the entity, controllers and holding companies; hits resolved
• Discrepancies documented with a decision
• Review triggers set; decision record signed

Frequently asked questions

What if the counterparty changes its contracting entity after approval?

Treat the new entity as a new counterparty. Verify its existence, authorization and ownership before the change takes effect, even if it belongs to the same group. A sister company may not hold the same licence or the same permitted services.

Can we rely on a vendor's European registry search?

Vendor data can speed up a review, but it is a copy of the official source, taken at a point in time. You remain responsible for the result. Confirm critical items yourself against the official register and regulator lists: status, representation and authorization. Record the date of the vendor's data, especially where registers have changed recently or restricted their access.

Cross-border counterparties test whether your customer risk framework and procedures can handle ownership that cannot be fully verified, and authorizations that have to be checked outside Canada. ComplyFactor provides AML advisory support for Canadian MSBs, PSPs and fintechs, including customer risk framework reviews, risk assessment updates and targeted procedure changes for higher-risk relationships.