What Parliament actually passed
In early November 2026 the Riigikogu adopted the financial fraud prevention and suppression act, bill 929 SE. The bill amends the Law of Obligations Act and related laws, and 76 members voted in favour. The Riigikogu's press release gives the number as 929 SE. The 936 SE figure that appears in some Riigikogu agendas may refer to a related first-reading bill.
The release says banks can now "identify fraud before a payment transaction takes place and, if there is a fraud risk, postpone the payment." Banks can also refuse a transaction when the money is likely to reach a fraudster. The release states the starting point plainly: until now, banks had no legal basis to stop a payment. Payment and e-money institutions may exchange fraud-suspicion information with other credit, payment and e-money institutions, with the Police and Border Guard Board (PPA), and with the CERT-EE unit of the Information System Authority (RIA). Parliament added data exchange between credit providers, intermediaries and credit institutions during the bill's passage.
The Finance Ministry's legislation page describes the result as a "clearer right" to refuse a payment where there is justified suspicion that a client is being defrauded or manipulated. It also says shared information may include banking secrets. Neither the Riigikogu release nor the ministry page states an entry-into-force date, and neither gives a maximum hold period. The explanatory memorandum aimed for 1 July 2026, which has clearly slipped. Readers should treat the commencement date and the hold mechanics as unconfirmed until the promulgated text is published.
The strongest case for the law
The case for intervention is strong. The Riigikogu release says Estonians lost nearly 29 million euros to fraudsters last year. ERR reported in February that 3,685 known victims lost more than 29 million euros in 2025, mostly to phone and investment scams. In a later piece, ERR said only a few percent of the money was recovered.
In push-payment scams the victim authorises the transfer, so the bank sees no unauthorised transaction. Once the money leaves, it is gone within minutes. A bank that sees a pensioner wiring a large sum abroad to a new payee, following a script from a caller, could previously do little without risking a contract dispute. Giving banks explicit authority removes that legal risk. It is also the kind of targeted, bounded power that a pro-innovation view can accept, because the harm is concrete and the intervention is narrow.
Where proportionality can fail
The risks sit in the design, not the principle. A payment hold is a restriction on a person's own money, and it works only if it is rare and accurate.
The first risk is the false positive. The Estonian Banking Association's fraud prevention lead, Sandra Horma, told ERR that holds will apply "only in cases where we already have a fraud suspicion." She gave large sums moving abroad suddenly, or investments on platforms with strong fraud suspicion, as examples. She also acknowledged that the change "may not initially please every client." Most victims are convinced they want to complete the transaction. That is the design problem. The victims the law targets will object loudly to a hold, and so will legitimate customers caught by a crude model.
The second risk is the bank's incentive. A bank that faces no cost for a wrongly held payment but bears reputational and possibly refund costs for a missed scam will tilt toward over-blocking. Small businesses, freelancers paying foreign suppliers and people buying from new overseas merchants would bear most of that cost. The public material I could verify does not describe an appeal route, a hold deadline or a duty to give reasons. Those are the features that keep a safety tool from becoming a general permission to delay.
The third risk is data sharing. Passing banking secrets to other institutions, the PPA and CERT-EE is useful for tracing mule accounts. It also builds a shared suspicion list. Without clear rules on accuracy, retention and correction, a mistaken flag could follow a customer across institutions.
The EU overlay
Estonia is not acting in isolation. In November 2025, Parliament and Council negotiators reached a deal on the Payment Services Regulation and PSD3. It requires payment service providers to check that a payee's name matches the account identifier, and to refuse the order if they do not match. It makes providers liable for customers' losses if they lack appropriate fraud prevention. It requires a full refund in bank-impersonation cases when the customer reports to police and to the provider. It also says the receiving provider must freeze transactions it finds suspicious. The Parliament page notes that formal adoption by both institutions was still required when it was published.
ERR's February reporting said that holding suspicious payments becomes mandatory in the EU from 2028. It also said the Estonian change could lead to disputes with Brussels. I could not verify that date against an EU text. The Finance Ministry's own initial analysis, as ERR reported it, was that Estonia does not conflict very much with existing European rules. The pragmatic reading is that Estonia is moving early on a power the EU is heading toward. Tallinn should therefore build holds that can be mapped onto the EU's liability and refund rules, rather than invent a parallel regime that banks must unwind in a couple of years.
What to watch
A good implementation has four features. Holds should be time-limited, with a short statutory ceiling. Customers should get a prompt, specific explanation and a human they can reach, a point the EU deal also stresses. A customer who confirms after a real conversation should usually be able to proceed. And the Financial Supervision Authority should publish hold and release statistics, including how many held payments turned out to be legitimate.
Those numbers are the real test. If holds stop a meaningful share of the roughly 29 million euros in annual losses and false positives stay low, Estonia has built a model other small digital states can copy. If holds are frequent, slow and unexplained, the law will tax the open, low-friction payments market that Estonia built its reputation on, without much effect on fraud. ERR's own headline gets the limits right: the law will not stop every fraud. Its value will come from how narrowly and transparently banks use the power.