Estonia
Latvia
Lithuania
Finland
Sweden
Norway
Poland
Czech Republic
Switzerland
Malta
Cyprus
Canada
Contact person, compliance officer or MLRO?
They are the same role. Estonian law says kontaktisik (contact person); the official English translation of the law says compliance officer; international iGaming groups usually say MLRO. In this article we use contact person, because that is the word the FIU and the Tax and Customs Board use.
The name matters less than one practical consequence: a group MLRO who sits in Malta, Cyprus or London does not automatically fill the Estonian role. The Estonian contact person must meet Estonian conditions, and the FIU approves the specific person.
What Estonian law requires
Two laws work together. The Money Laundering and Terrorist Financing Prevention Act (MLTFPA) makes gambling operators obliged entities and sets out who the contact person can be (§ 17). The Gambling Act turns the FIU’s approval into a condition of the licence.
Who can be the contact person (MLTFPA § 17)
- Appointed by the management board and reporting directly to it, with the competence, means and access to information the role needs.
- A person who works permanently in Estonia.
- With the education, professional suitability, abilities, personal qualities, experience and impeccable reputation the role requires.
- Approved by the FIU, which may collect information from the candidate, the employer and state databases.
- The duties may be performed by an employee or a structural unit. If nobody is appointed, the management board carries the duties itself.
How the approval fits the licence (Gambling Act)
- The licence application names the contact person, with their personal details, position and contact details.
- The Tax and Customs Board (EMTA), which issues gambling licences, asks the FIU for approval. The FIU decides within 60 days of receiving all the documents.
- If the FIU refuses, EMTA must refuse the licence. Operators licensed before the rule took effect must bring their contact person into line too, or EMTA revokes the licence.
Where operators go wrong
Most of the problems we see are not about the law itself but about how a foreign group fits it:
- Naming the group MLRO. If the person does not work permanently in Estonia, the FIU has grounds to refuse, and the licence application stalls.
- Leaving it to the end. The contact person is part of the licence application, and the FIU has up to 60 days after the file is complete. Recruiting the person after the rest of the file is ready adds months.
- Underestimating the language. Documents to the FIU are filed in Estonian, and FIU requests have to be answered without delay. A contact person who cannot work in Estonian with the FIU is a weak point.
- A name on paper. The law expects the person to report to the board and have real access to transaction data. A contact person without system access cannot file a suspicious transaction report within 2 working days.
Your options for filling the role
- Hire a full-time compliance officer in Estonia. Suits large operators with high volumes and an Estonian team. The cost and the recruitment time are the drawback: experienced AML people who know the FIU are few.
- A part-time contact person, set up by a specialist. Suits most foreign operators. The person is still your employee, with an employment contract and registered in TÖR, but the provider finds the right person, prepares the FIU approval, provides backup cover and supports the day‑to‑day work.
- A compliance unit within an Estonian group company. Possible for groups that already run a regulated business in Estonia.
What cannot be done is to hand the role, or the responsibility, to an outside firm. The law assumes an employee or a structural unit of the operator, and the operator stays responsible for its AML obligations. That is why our model keeps the employment with you and puts the support in a separate outsourcing agreement.
What the contact person does day to day
- Collects and analyses information on unusual and suspicious transactions and activity.
- Reports to the FIU through its reporting environment (RABIS): suspicious transaction reports within 2 working days, and international sanctions reports.
- Answers FIU requests without delay, and is the FIU’s point of contact for inspections.
- Reports to the management board in writing at regular intervals on how the AML framework is working, and flags gaps.
The stakes are real: failing to report a suspicion can cost an operator a fine of up to €1,000,000. The contact person does not run the whole AML programme alone, though. KYC, monitoring and the risk assessment remain the operator’s work (our AML Team Outsourcing can take that on); the contact person makes sure it happens and that the FIU hears what it must.
How MAXCORP sets it up
MAXCORP sets up the contact person for Estonian gambling operators as a fully outsourced solution, usually within about 2 weeks, whether you are applying for a licence or already hold one. Under one outsourcing agreement with the operator, we:
- Find a qualified contact person who works permanently in Estonia and works with the FIU in Estonian
- Prepare the employment contract and the TÖR registration, so the person is properly your employee
- Prepare and file the documents for the FIU approval together with the licence application
- Support the contact person day to day: FIU correspondence, report filings and backup cover
The 2 weeks are our set-up time. The FIU’s approval follows on its own clock, within 60 days of receiving all the documents.
For the licence itself, see the Estonia gambling licence. For other regulated businesses, see Compliance Officer outsourcing.
Official sources (7)
- Money Laundering and Terrorist Financing Prevention Act (official English translation)
- Rahapesu ja terrorismi rahastamise tõkestamise seadus (Estonian)
- Gambling Act (official English translation)
- Hasartmänguseadus (Estonian, in force from 1 January 2026)
- Tax and Customs Board (EMTA): applying for gambling licences and permits
- Tax and Customs Board (EMTA): employment register (TÖR)
- Financial Intelligence Unit: reporting environment (RABIS)
General information only, not legal or tax advice. Rules change; ask us about your case.