Finland: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), directly applicable since 30 December 2024, supervised by the Finnish Financial Supervisory Authority (Finanssivalvonta / FIN-FSA). National AML framework: Act on Preventing Money Laundering and Terrorist Financing (444/2017) and the Act on Virtual Currency Providers (572/2019, now largely superseded by MiCA). Tax administration by Verohallinto (Vero).

Crypto-asset activities are legal and comprehensively regulated in Finland under MiCA, which is directly applicable as EU law and supervised nationally by FIN-FSA. Finland adopted one of the shortest MiCA transitional periods in Europe, only six months, ending 30 June 2025, after which crypto-asset services may be provided only by FIN-FSA-authorised CASPs or EEA firms passporting in. Tax treatment is settled (capital gains / income), and DAC8/CARF-aligned reporting obligations for CASPs apply from 2026.

Framework: EU AI Act (Regulation (EU) 2024/1689) as directly applicable law, supplemented nationally by the Act on the Supervision of Certain Artificial Intelligence Systems (1377/2025) and related amendments (Government Proposal HE 46/2025), in force since 1 January 2026

As an EU Member State, Finland is subject to the EU AI Act, which entered into force on 1 August 2024 and began applying in stages from 2 February 2025. Finland has enacted its national implementing package (HE 46/2025), including the Act on the Supervision of Certain AI Systems (1377/2025), effective 1 January 2026, which designates competent authorities and gives them investigative, corrective and fining powers. Finland uses a decentralised supervision model coordinated by the Finnish Transport and Communications Agency (Traficom), which is the single point of contact and operator of the national AI regulatory sandbox.

Framework: EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) as supplemented nationally by Finland's Data Protection Act (Tietosuojalaki 1050/2018), enforced by the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

As an EU Member State, Finland applies the GDPR directly, supplemented by the national Data Protection Act (1050/2018), which entered into force on 1 January 2019 and repealed the earlier Personal Data Act (523/1999). The independent supervisory authority is the Data Protection Ombudsman (Tietosuojavaltuutettu); a sanctions board composed of the Ombudsman and two Deputy Ombudsmen imposes administrative fines up to EUR 20 million or 4% of global annual turnover. Additional sector-specific rules apply for employment, electronic communications, and healthcare data, and further amendments to the Data Protection Act and related legislation were launched in 2025.

Framework: Act on Payment Institutions (297/2010) and Payment Services Act (290/2010), implementing PSD2, supervised by the Finnish Financial Supervisory Authority (Finanssivalvonta / FIN-FSA). Instant payments follow the EU Instant Payments Regulation (Regulation (EU) 2024/886); consumer credit / BNPL comes under national law aligned with the EU Consumer Credit Directive II.

Finland operates a full, in-force licensing regime for payment institutions (PIs) and electronic money institutions (EMIs) under the PSD2-based Act on Payment Institutions (297/2010) and Payment Services Act (290/2010), with the Financial Supervisory Authority (FIN-FSA) as sole competent authority. Open banking (PISP/AISP) is authorised under PSD2; SEPA Instant Credit Transfers are widely adopted and reinforced by the EU Instant Payments Regulation, and BNPL is being tightened under CCD II transposition. Preparations for PSD3 / the Payment Services Regulation are ongoing at EU level.

Framework: Aliens Act (Ulkomaalaislaki 301/2004) administered by the Finnish Immigration Service (Maahanmuuttovirasto/Migri); EU/EEA free movement under Directive 2004/38/EC. No dedicated remote-work / digital-nomad visa in force.

Finland has no dedicated digital-nomad or remote-work visa as of June 2026. Migri states explicitly that working remotely for a foreign employer is not, by itself, grounds for a Finnish residence permit. Non-EU remote workers must instead fit an existing track: a self-employed/entrepreneur permit (with a Finnish Business ID and clients), the start-up entrepreneur permit (requires a positive Business Finland eligibility statement), an employed-person permit (TTOL), specialist permit, or stay visa-free/Schengen for up to 90 days in 180. EU/EEA citizens may live and work remotely in Finland under free-movement rules, registering after three months.

Framework: EU Digital Services Act (Regulation 2022/2065) applied nationally via the Act on the Supervision of Online Intermediary Services (Laki verkon välityspalvelujen valvonnasta 18/2024); supervised by the Finnish Transport and Communications Agency (Traficom) as Digital Services Coordinator, alongside the Consumer Ombudsman and the Data Protection Ombudsman

As an EU member state, Finland is directly bound by the Digital Services Act (DSA), which has applied to all intermediary services since 17 February 2024. Finland's national implementing legislation, Act 18/2024 on the supervision of online intermediary services, entered into force the same day and designates Traficom as the Digital Services Coordinator, with the Consumer Ombudsman and Data Protection Ombudsman as co-supervisors. Sector-specific rules on child sexual abuse material, hate speech, gambling and audiovisual content protection (overseen by KAVI, the National Audiovisual Institute) complement this comprehensive EU-derived regime.

Framework: Cybersecurity Act (Kyberturvallisuuslaki, 124/2025) transposing the EU NIS2 Directive, supervised by the National Cyber Security Centre Finland (NCSC-FI) at Traficom together with sector-specific regulators; complemented by GDPR, the Information Management Act and the Act on Electronic Communications Services.

Finland has an in-force horizontal cybersecurity regime: the Cybersecurity Act (124/2025) implementing the EU NIS2 Directive entered into force on 8 April 2025 and, for the first time, consolidates cross-sector obligations that had previously been scattered across sectoral laws. Supervision is shared among Traficom/NCSC-FI (single point of contact) and specialist regulators (Energy Authority, Tukes, Valvira, Fimea), with GDPR handling personal-data breach notifications via the Data Protection Ombudsman.

Framework: Finnish Limited Liability Companies Act (624/2006) and Trade Register Act, administered by the Finnish Patent and Registration Office (PRH) and the Tax Administration jointly via the Business Information System (YTJ). From 1 January 2026, all company filings with the Trade Register must be made online.

Finland is a straightforward jurisdiction to start a business, with no restrictions on foreign ownership, no minimum share capital for the standard private limited company (Oy) since 2019, and fast electronic incorporation via the joint PRH/Tax Administration YTJ portal. As of 1 January 2026, notifications and applications to the Trade Register must be filed online, and typical processing runs 1-3 business days for electronic filings. Non-EEA founders face additional requirements (residence permit for entrepreneurs, EEA-resident board member or an exemption from PRH).