Estonia is one of the few countries that allow foreign people to register virtual companies. Estonia is also known to issue licenses for cryptocurrency operations.
To get a cryptocurrency license, the company is required to have good financial status and none of the board members can have criminal records. This doesn't stop malicious exchanges from having a license as most of the malicious exchanges are operated by newly established companies that have been around for less than one year so there is no mandatory yearly financial statement yet.
Malicious exchange operators usually use Estonian virtual companies to hide the true country of origin, but one of the requirements for the license is that all names of board members must be public and it doesn't require a lot of research to track which country the people are likely originally from.