Skip to main content

Eesti.ee uses cookies on its websites

Our website uses cookies to improve website performance and provide a more personalised experience. Read more about our cookie policy.
By clicking 'Accept', you consent to the use of analytical cookies. By clicking 'Do not accept', you do not accept analytical cookies. You can withdraw your consent to cookies at any time on the settings page or the cookies page.

Home Accessibility
  • Eesti keeles
  • По-русски
  • In English

Trust service provider’s operating licence

Last modified 12.08.2025 | Text by Estonian Information System Authority

You need to apply for an operating licence if you want to start providing any of the following qualified services:

  1. Issuance of certificates for electronic signatures, electronic seals, website authentication, or the provision of other trust services
  2. Validation of certificates for electronic signatures, electronic seals, website authentication, or the provision of other trust services
  3. Creation of electronic signatures or electronic seals
  4. Validation of electronic signatures or electronic seals
  5. Creation or validation of electronic timestamps
  6. Provision of electronic registered delivery services
  7. Preservation of electronic signatures or certificates for electronic signatures
  8. Preservation of electronic seals or certificates for electronic seals
  9. Management of remote electronic signature creation devices
  10. Issuance of electronic attestations of attributes
  11. Validation of data transmitted through electronic registered delivery services and related evidence
  12. Recording of electronic data in an electronic ledger

and want your service to be included in the Estonian Trusted List.

The operating licence and valid service data in the trusted list must demonstrate the compliance of the trust service provider and its service with the requirements, as well as the existence of a qualified status which is to be obtained prior to the commencement of the provision of the service.

To be included in the trusted list, it is not necessary to start providing a trust service with a qualified status; a service with a non-qualified status may also be provided.

The operating licence will be granted and the relevant service data entered into the trusted list by the Information System Authority.

The trust service provider and its services will be listed for a period of two years. If the service is to continue and remain on the list after two years, its validity must be extended and a renewed operating licence must be applied for in the same way as during the initial operating licence application procedure.

Activities related to trust services are governed by the following legal acts:

Requirements for applicants

In order to obtain an operating licence, the trust service provider must meet the following requirements.

  • The applicant is registered in the commercial register or the register of non-profit associations and foundations.
  • The applicant and the service provided by the applicant must comply with the requirements set out in the eIDAS and the Electronic Identification and Trust Services for Electronic Transactions Act and with publicly approved and available standards or specifications describing the trust service. The conformity assessment referred to in Article 20 of the eIDAS is certified by a suitably accredited conformity-assessment body. A conformity assessment must be carried out at least every two years.
  • The applicant applies good security practices and organisational measures that take into account the risks associated with its activities.
  • The applicant has a liability insurance in force for the duration of providing the trust service, to the extent that the insurance coverage ensures that customers (natural or legal persons) will be compensated for damage caused intentionally or as a result of negligence. For qualified trust services, this must be at least 1 million euros for each insured event and at least 1 million euros for all insured events in aggregate, or a comparable amount of security or funds with appropriate proof. Whereas for a non-qualified service, a minimum amount is not defined.
  • The applicant has no state tax liabilities nor local tax liabilities at its place of residence or registered office.
  • The applicant has an up-to-date closure plan to ensure continuity of the service. Not required for the provision of a non-qualified service.
  • The applicant uses reliable technical systems, products, and organisational measures in providing the trust service to manage the risks related to the security of the trust services provided and to the integrity and confidentiality of the data collected.
  • The applicant has employed staff or subcontractors who possess the necessary competence, reliability, experience, and qualifications and have received appropriate training in security and personal data protection rules. Not required for the provision of a non-qualified service.

Cross-border activities

Valid trust service data and status in the trusted list ensure cross-border mutual recognition of services and the possibility to provide the service also on the territory of another EU Member State.

Completion and submission of the application

In order to obtain an operating licence, the following information and supporting documents must be submitted together with an application in a free format:

  • the information provided for in subsection 19(2) of the General Part of the Economic Activities Code Act;
  • status of the trust service provider and the trust service (qualified, non-qualified);
  • name of the trust service, description;
  • principles and certification policy of trust service provision. The principles and certification policy of the trust service provision must be described exhaustively. The description must be in accordance with the standards on trust service principles published by the European Telecommunications Standards Institute or other equivalent publicly accepted and available specifications;
  • certificate;
  • evidence of the competence of the conformity-assessment body and of the personnel who carried out the conformity assessment;
  • conformity-assessment report;
  • a copy of or a reference to the liability insurance policy;
  • proof of the absence of state tax liabilities and local tax liabilities in the applicant’s place of residence or seat if such data is not available from a legally constituted database;
  • a power of attorney entitling the authorised representative or the authorised contact person to submit an application;
  • Service Risk Management and Mitigation Plan;
  • process descriptions (workflows) for providing the trust service, including the roles of any cooperating partners (process flow and certificate lifecycle diagrams).

NB! The state fee should be paid before submitting the application.

The application can be submitted:

Application for trust service authorisation (.rtf)

Payment of the state fee

For reviewing the application for the initial and renewed operating licence and for the modification of data, a state fee must be paid to the Ministry of Finance’s current account with the reference number 2900082948:

  • SEB Pank EE891010220034796011 (BIC/SWIFT: EEUHEE2X)
  • Swedbank EE932200221023778606 (BIC/SWIFT: HABAEE2X)
  • LHV Pank EE777700771003813400 (BIC/SWIFT: LHVBEE22)
  • Luminor Bank EE701700017001577198 (BIC/SWIFT: RIKOEE22)

A state fee of EUR 1030 for each trust service must be paid for reviewing the application for the initial trust service licence and for inclusion in the trusted list.

A state fee of EUR 770 for each trust service must be paid for reviewing the application for the renewed trust service licence and for inclusion in the trusted list.

A state fee of EUR 65 must be paid for reviewing the application for a modification of data of a trust service provider or its services.

Processing of applications

An application for an operating licence must be submitted before commencing the provision of the service.

The submitted application will only be processed once the required data and documents have been received:

  • within 80 days in the case of an application for an initial licence;
  • within 50 days in the case of an application for a renewed licence.

You will be informed of the issuing of the operating licence by e-mail or, in exceptional circumstances, by post. The licence will be issued electronically.

If the information in the application is incomplete, you will be contacted and given the opportunity to rectify the deficiencies within the specified time.

After the deficiencies have been eliminated, the licence will be issued within 80 or 50 days.

If a licence is issued, the Estonian Information System Authority will enter the trust service provider and the trusted service into the trusted list within 10 days.

The Estonian Trusted List is electronic in both machine-readable and human-readable file format. The EU-wide trusted list is available at https://esignature.ec.europa.eu/efda/tl-browser/#/screen/home.

In order to extend the period of validity for the operating licence, an application for a renewed operating licence must be submitted to the Information System Authority by way of the State Portal in the Register of Economic Activities, by e-mail, or by a standard letter at least 50 days before the operating licence expires.

If you apply for a renewed operating licence, you will have to provide all the same information as for the initial licence.

Any change in the data provided in the application for a licence and in the application for inclusion in the trusted list must be communicated to the Information System Authority without delay. In the event of changes in the general data of the trust service (company name, etc.), the changed data and explanations must be submitted with an application for the modification of the operating licence.

In the event of changes in the content of a trust service, it is necessary to apply for a renewed operating licence for the trust service, providing all the information required when applying for the initial operating licence.

Withdrawal of the operating licence

The operating licence will be withdrawn if:

  1. the applicant applies for its withdrawal;
  2. after the operating licence has been granted, it transpires that the trust service provider or the trust service itself does not meet the requirements laid down for the service and these activities have not been brought in line with the requirements provided by the Information System Authority;
  3. the trust service provider has ceased to provide the trust service.

By withdrawing the licence, the Information System Authority renders the data related to the corresponding trust service provider and trust service in the trusted list invalid.

Termination of the trust service or economic activity

If you intend to cease the provision of a specific trust service or wind down your business in the selected area, you must inform the Information System Authority immediately before the termination and request the withdrawal of the service licence.

Submit a digitally signed written application to the Information System Authority by e-mail at [email protected], [email protected] or by post at Pärnu mnt 139a, 15169 Tallinn.

Supervision

State supervision of the activities related to the provision of trust services is carried out by the Information System Authority.

Contact details

Substantive information

Information System Authority, tel: +372 666 8862, e-mail: [email protected]

Register information and technical issues

Register of Economic Activities, tel: +372 668 7080, e-mail: [email protected]

Laws