Estonia’s Security Service Challenges Bank Data Block

Estonia’s Internal Security Service, known as KAPO, is challenging restrictions on its access to a state system used to obtain bank account information.

The Justice and Digital Affairs Ministry ordered access suspended after KAPO and the Police and Border Guard Board failed to connect a mandatory tool allowing people to see which authorities had queried their data.

But KAPO Director General Margo Palloson says the law provides exceptions for national security duties and security vetting, Estonian public broadcaster ERR reported on October 28.

He has requested continued access for those purposes.

Citizens Must Be Able to Check

The dispute concerns the Enforcement Register, a channel through which authorized agencies can request banking information and arrange the seizure of funds.

The transparency requirement followed findings by Estonia’s Chancellor of Justice in 2025 that agencies had accessed confidential banking information without an adequate legal basis.

Authorities were required to implement the tracking tool by October 1.

Estonian Justice and Digital Affairs Minister Liisa Pakosta said access to sensitive banking information must carry safeguards that let individuals check how the state uses their data.

The ministry says the police and KAPO failed to complete the necessary software connections. Their use of the register in criminal proceedings was therefore suspended.

KAPO Cites a Security Exception

Palloson argues that the tracking requirement does not apply when security agencies perform certain duties under national security legislation.

His request covers information including account balances, statements, authorized users and beneficial ownership.

He said KAPO had made no register queries for criminal proceedings since October 1 and had now technically disabled that category of request.

The distinction matters: the ministry’s transparency condition governs criminal investigations, while KAPO is seeking access for separately defined security functions.

The reports reviewed do not establish that the requested access has been restored. Palloson says the service has taken measures to ensure lawful processing and oversight of the information it obtains.