On June 3, 2026, Estonia's Riigikogu passed the first reading of a draft law that rewrites how the country's e-residents prove who they are. Instead of traveling to an embassy or pickup point to collect a physical ID card and be fingerprinted in person, applicants would submit a facial image and fingerprints through a mobile app, checked remotely against government databases. The bill paves the way for a fully cardless e-Residency, with e-residents able to use a digital-only identity solution from March 2028 (Pravda Estonia/ERR reporting).
This is not a fringe tweak to a niche program. Since launching in 2014, e-Residency has enrolled more than 135,000 people and spawned over 39,000 Estonian companies, generating €124.9 million in direct state revenue in 2025 alone — an 87% jump year-over-year (Biometric Update). The friction the bill targets is real: under current rules, the Police and Border Guard Board (PPA) requires that "an applicant for an e-resident's digital ID must always collect the document in person," with fingerprinting done at issuance (PPA). For a Brazilian founder or an Indonesian freelancer, that can mean an international trip to a consulate just to start an EU company online.
The case for caution — taken seriously
The strongest argument for the in-person regime is not bureaucratic inertia; it is assurance. Physical pickup forces a human, document, and live biometric check in one place, making impersonation and synthetic-identity fraud harder. e-Residency hands holders a legally binding digital signature equivalent to a handwritten one and the keys to an EU company — attractive targets for money laundering and shell-company abuse. Critics reasonably worry that remote biometric capture, however slick, widens the attack surface: spoofed faces, injected video streams, and compromised phones are active fraud vectors. And the privacy stakes are not trivial. The PPA already retains e-residents' facial images and fingerprints in an automated biometric system for 15 years, then 60 more in archive (PPA). Expanding remote collection means more sensitive biometric data flowing through more channels.
These concerns deserve engineering answers, not dismissal. But they are arguments for getting the controls right — not for keeping a 2014-era process that forces a transcontinental flight to onboard a digital-only product.
Why the proportionate move is to digitize, with guardrails
Estonia is not proposing to drop verification; it is proposing to relocate it. The government's own framing stresses that the Police and Border Guard Board "will continue thorough background checks" and retains the option of face-to-face meetings or video interviews when a case warrants it, even after contactless biometric collection becomes the default (e-Residency). In other words, the high-risk applicant still gets the high-touch scrutiny; the routine applicant stops paying a tax of friction designed for an era before reliable remote biometrics existed.
The technical backbone is already contracted. In January 2026, Latvian software firm X Infotech won a framework agreement worth up to €3 million over 48 months to build the remote facial-image and fingerprint capture app, selected from 12 bids through a competitive-dialogue tender run by the Interior Ministry's IT centre (Biometric Update). Crucially, the solution must verify document authenticity and meet the EU's eIDAS requirements, so the resulting digital ID retains legal equivalence for authentication and qualified electronic signatures (e-Residency). This is the right architecture: bind the assurance level to a recognized EU standard rather than to the inconvenience of a physical errand.
A growth bet that lines up with the open internet
The economic logic is straightforward. Estonia's e-Residency managing director Liina Vahtras frames the goal plainly: "In the future, foreign entrepreneurs will only need a smartphone to apply for e-Residency and establish an EU company in Estonia" (e-Residency). Officials project the cardless model could lift e-resident company creation by at least 20% and add €3–9 million in annual tax revenue (Biometric Update). For a program where every euro invested reportedly returned more than twelve, removing the single biggest onboarding barrier is among the highest-leverage reforms available.
There is a broader signal here for digital-identity policy worldwide. Much of the global debate treats biometric ID as inherently a surveillance liability. Estonia's bill reframes it as infrastructure for permissionless entrepreneurship — letting someone in Lagos or São Paulo incorporate in the EU from a phone, under a standards-bound, auditable identity scheme. The open internet's promise has always been that geography should not gate participation in the digital economy; a cardless e-Residency operationalizes that.
What to watch
First reading is the start, not the finish: the bill must clear two more Riigikogu readings before the March 2028 go-live, and the biometric app itself is slated for 2027. The questions that should dominate the remaining debate are the right ones — presentation-attack detection standards, independent security audits of the X Infotech app, data-minimization and retention limits, and clear redress when remote verification fails. If Estonia answers those in the open, it will have shown that proportionate regulation and frictionless digital onboarding are not in tension. They are the same project.