How to Comply With AML Regulations and Licensing Requirements in Lithuania—an EU Fintech Hub

Lithuania issues more fintech licenses than any other EU member state. In 2026, it is also one of the hardest places in the EU to keep one.

The pressure is local and recent. The Bank of Lithuania's 2026 inspection plan put AML/CTF at the top of the list and arrived with standardized templates for use during inspections. In August 2026, the supervisor wrote to the heads of financial market participants setting out what its 2025 inspections had actually found, and in the same month it barred an electronic money institution from serving both new and existing customers while an inspection was still running. The crypto sector went from hundreds of registered providers to a handful of licensed ones in roughly eighteen months. Lithuania is also under a Council of Europe MONEYVAL evaluation running from October 2026 to May 2028, so the supervisor is being graded at the same time as the firms it supervises.

Two EU deadlines land harder in Vilnius than in most capitals. The AMLR single rulebook and the sixth AML Directive apply in full from July 10, 2027, and they remove the national variation that let some jurisdictions run a faster, lighter route to market. That variation is part of what drew firms to Lithuania in the first place, and after 2027 the rulebook reads the same in Vilnius as it does in Frankfurt. The second date is December 31, 2026, the reference point that determines which institutions the new EU Anti-Money Laundering Authority (AMLA) supervises directly from 2028. Payment institutions and electronic money institutions sit inside that reporting population, and Lithuania holds the EU's largest concentration of them, so a meaningful share of the first cohort is likely to be Lithuanian-licensed. The position being measured is the one a firm holds right now.

This guide covers who regulates AML in Lithuania, what obliged entities must do, how to build a program that survives an inspection, and what each license type requires.

How did Lithuania become a fintech hub?

Lithuania's fintech sector grew out of a deliberate set of choices the Bank of Lithuania made from 2016 onward, at a moment when Brexit had firms across Europe shopping for an EU license.

Four of those choices mattered most:

• CENTROlink. The central bank's payment system gives EEA-licensed payment and e-money institutions direct technical access to SEPA, without routing through a commercial bank. That removed the single biggest cost and dependency for a new payments business, and it let institutions safeguard client funds at the central bank.
• The Newcomer Programme. Launched in 2016, it gave prospective applicants a one-stop consultation channel with the supervisor before filing, rather than after.
• The regulatory sandbox. Operating since 2018, it let firms test products in a live, supervised environment.
• Process, not just policy. Applications can be submitted in English. The Bank of Lithuania built an e-licensing tool, and it committed to statutory review timelines that run faster than most EU regulators.

Lithuania also created a specialized bank license with a lower capital requirement than a universal bank. Revolut took one in December 2018 and later upgraded it, and the license has since been used by several other digital-first banks.

At the end of 2025, Invest Lithuania counted 248 active fintech companies employing about 7,800 people, with 231 of those companies based in Vilnius. Fintechs licensed in Lithuania serve roughly 40 million customers across the EU. Payments processed by electronic money and payment institutions reached €166 billion by the end of 2025, up 60% from 2022. Specialized bank assets hit €1.665 billion in Q3 2025, 182% above end-2022 levels.

The shift from volume to quality

Company numbers edged down in 2025 while headcount held and average company size grew. That is consolidation, and it is intentional.

The crypto sector shows the shift most starkly. Lithuania once hosted hundreds of virtual asset service providers registered with the Centre of Registers under light-touch oversight – over 800 by some counts in 2022, and more than 370 still on the register in 2025, of which only about 120 were actually trading and filing accounts. The Law on Markets in Crypto-Assets moved authorization to the Bank of Lithuania and set a transitional deadline of December 31, 2025.

Only around 100 MiCA applications were filed during 2025, and roughly 30% of them arrived in October–November. A handful of CASP licenses had been granted by early 2026. The Bank of Lithuania's own feedback pointed to the same failures each time: unverified source of wealth for owners, reputation requirements not met, and application packs of poor quality.

The message for anyone arriving now is that the license is still obtainable on a reasonable timeline. Keeping it depends on whether the compliance function is real.

AML regulations in Lithuania

Lithuania's framework sits on the Law on the Prevention of Money Laundering and Terrorist Financing (Pinigų plovimo ir teroristų finansavimo prevencijos įstatymas), which transposes the EU directives into national law and has been amended repeatedly to keep pace with them. It is read alongside the Law on International Sanctions, the Bank of Lithuania's AML/CTF guidelines for supervised institutions, and – for anyone moving crypto-assets – the Transfer of Funds Regulation, which has applied the Travel Rule to crypto transfers since December 30, 2024.

From July 10, 2027, much of that national detail gives way to the directly applicable AMLR. Rules that vary today between Vilnius, Dublin, and Valletta will be identical. Among the changes already confirmed: the customer due diligence trigger for occasional transactions drops from €15,000 to €10,000, and CASPs, crowdfunding platforms, and consumer credit providers sit squarely inside the obliged-entity list at EU level.

Who regulates AML in Lithuania?

Supervision is split, and knowing which authority owns which obligation matters in practice.

• The Bank of Lithuania (Lietuvos bankas) licenses and supervises financial market participants – banks and specialized banks, electronic money institutions, payment institutions, investment firms, crowdfunding service providers, insurers, and CASPs under MiCA. It issues AML/CTF guidelines, runs inspections, and imposes enforcement measures. Its published 2026 plan covered five inspections, four of them AML/CTF, plus up to fifteen unannounced.
• The Financial Crime Investigation Service (FNTT, also written FCIS) is Lithuania's financial intelligence unit. It receives and analyzes suspicious transaction reports and cash reports from every obliged entity, including those supervised by the Bank of Lithuania. It is also the AML supervisor for obliged entities outside the financial sector, and it runs its own inspection and penalty regime.
• Sector-specific supervisors cover the rest – the Gaming Control Authority for gambling operators, the Lithuanian Bar Association for advocates, and others named in the law.

From 2028, an EU-level layer arrives. AMLA, operational in Frankfurt since July 1, 2025, will directly supervise a selected group of cross-border institutions. The EBA published the draft data model for the 2027 eligibility collection in August 2026. The data will be gathered in early 2027 against a December 31, 2026 reference date.

AML obligations in Lithuania

A Lithuanian obliged entity has to be able to evidence all of the following:

• Risk assessment. A business-wide ML/TF risk assessment covering customers, geography, products, and delivery channels, kept current and matched to how the business actually operates. The Bank of Lithuania's August 2026 letter flagged risk assessments that did not reflect the firm's real risk profile as a recurring inspection finding.
• Customer due diligence. Identify and verify the customer before establishing a business relationship or carrying out a qualifying occasional transaction. Remote onboarding is permitted through the methods set out in Lithuanian law, including video-based identification and electronic identification means, subject to the conditions attached to each.
• Beneficial ownership. Identify and verify the UBO of corporate customers. Supervisors treat this as a category in its own right, and incomplete or stale UBO data is one of the most commonly cited gaps.
• Enhanced due diligence. Apply EDD to politically exposed persons (PEPs), their family members and close associates, customers connected to high-risk third countries, complex ownership structures, and any relationship the firm's own risk model rates high. Senior management approval and source-of-wealth checks are part of it.
• Ongoing monitoring. Transaction monitoring calibrated to the specific business, not a vendor default. The 2026 supervisory letter named untailored monitoring as a deficiency.
• Sanctions screening. Screen customers and transactions against UN and EU lists, freeze on a true match, and report. Supervisors expect a standalone sanctions risk assessment and screening that extends to ownership chains and intermediaries. Evasion through CIS states and third countries remains an active concern, and being outside Russia or Belarus is not evidence of low risk.
• Reporting to FNTT. Report suspicious monetary operations and transactions. Where a transaction is suspended under the law, the report goes to FNTT within three working hours. Linked cash operations reaching €15,000 must be reported within seven business days. Tipping off the customer is prohibited. Low or nil STR volumes are themselves treated as a red flag – firms should be able to justify their reporting levels against their scale and risk exposure.
• Governance. Appoint a money laundering reporting officer with sufficient seniority and independence, and notify FNTT of the appointment or replacement within seven working days. A senior management member must be assigned responsibility for AML implementation.
• Record-keeping. Retain customer identification data, transaction records, and due diligence evidence for eight years after the end of the relationship, as required by the AML law. Under AMLR, the requirement will be five years.
• Training and independent review. Ongoing staff training on obligations and red flags, plus periodic independent testing of the program's effectiveness.
• Responsibility for agents and distributors stays with the licensed institution. So does the obligation to verify that higher-risk customers – crypto firms, gambling operators, remittance businesses – actually hold the authorizations they claim. With MiCA's EU-wide transitional window closed since July 1, 2026, servicing a crypto client that has no MiCA authorization is a live supervisory exposure.

What non-compliance costs

Both the Bank of Lithuania and FNTT can fine financial institutions under the AML law. An ordinary breach carries 0.5% to 5% of gross annual income. Systematic breaches, a single gross breach, or a repeat within a year of an earlier sanction carry 0.5% to 10% of gross annual income where that 10% exceeds €5,100,000, and €2,000 to €5,100,000 where it does not. Most firms sit in the second branch, since 10% of income clears €5.1 million only above roughly €51 million of annual income. The Bank of Lithuania can also suspend or revoke a license.

Two cases set the benchmark. In 2025, the Bank of Lithuania fined Revolut Bank €3.5 million after a scheduled inspection found shortcomings in the monitoring of business relationships and operations, which meant suspicious transactions were not always identified properly. It remains the largest AML fine the regulator has issued.

In August 2026, it went further with UAB Lux International Payment System, temporarily prohibiting the EMI from serving new and existing customers while an inspection was still running, with authorization from the Regional Administrative Court. No final finding had been published. The supervisor does not need a completed inspection to stop a business, and identified-but-unremediated weaknesses are what turn an inspection into a restriction.

How to get AML-compliant in Lithuania

A workable sequence, in the order supervisors expect to see it:

1. Confirm whether you are an obliged entity. Not every Lithuanian company is. The test is the business model and the license, not the registration. Decide this before you build anything else, because it determines which supervisor you answer to.
2. Write the business-wide risk assessment first. Everything downstream – thresholds, monitoring rules, EDD triggers, customer acceptance – should be traceable back to it. Base geographic risk on actual activity and payment flows rather than declared residence, which is precisely the shortcut the Bank of Lithuania called out in 2026.
3. Build policies that describe what you actually do. Internal AML/CTF policies, customer acceptance rules, an EDD framework, escalation paths, and a sanctions policy. A policy set that describes an idealized firm is worse than none, because the inspection compares the document to the file.
4. Appoint the MLRO and a responsible board member. Notify FNTT within seven working days. Give the role genuine authority and direct reporting into senior management.
5. Set up onboarding and screening that produce evidence. Identity verification, UBO resolution, PEP and sanctions screening, and risk scoring at onboarding – each with an audit trail showing who decided what and on what basis. This is where most firms lose inspections: the answers exist, but they sit in fragments across separate systems.
6. Calibrate transaction monitoring to your corridors and products. Document the rationale for each rule and threshold, version your changes, and keep the tuning records.
7. Wire up reporting. Register for FNTT reporting, run through the suspension-and-report path before you need it, and check your STR volumes against firms of comparable size and risk.
8. Train, test, and remediate on a clock. At minimum, conduct annual training, independently review effectiveness, and maintain a tracked remediation log. Unclosed findings are the single clearest signal to a supervisor that management is not in control.
9. Start the AMLR gap analysis now. Map your current program against the AMLR articles, track AMLA's technical standards as they land through 2026 and 2027, and check whether you fall inside the AMLA eligibility population as of December 31, 2026.

Licensing requirements for fintechs in Lithuania in 2026

The Bank of Lithuania issues every fintech license in Lithuania. All of them passport across the EEA once granted, with one exception noted below.

✔️ Payment institution – money remittance only. Initial capital €20,000. A full PI license, passportable across the EEA, limited to the money remittance service.

✔️ Payment institution – payment initiation. Initial capital €50,000.

✔️ Payment institution – full range of services. Initial capital €125,000.

✔️ Electronic money institution. Initial capital €350,000, plus ongoing own funds of at least 2% of average outstanding e-money.

✔️ Restricted-activity PI or EMI. No initial capital requirement, and lighter management requirements. The trade-off: Lithuania only, no passporting, and monthly volume caps apply.

✔️ Specialized bank. Initial capital €1,000,000. Deposits and lending, but no investment services.

✔️ CASP under MiCA. Initial capital of €50,000, €125,000, or €150,000 depending on the class of services provided.

✔️ Crowdfunding service provider (ECSPR). €25,000, or the insurance equivalent.

Capital is the easy part. What the Bank of Lithuania assesses is everything around it:

• A business plan the numbers support. Realistic volumes, target markets, corridors, and customer segments, with financial projections that hold together.
• Fit and proper management and shareholders. Reputation, experience, and demonstrable source of funds for qualifying holdings. Unsubstantiated shareholder finances alone can sink an application, and supervisory doubt on this point has been enough to trigger restrictions on already-licensed firms.
• A complete AML/CTF framework before authorization, not after. Policies, risk assessment, an appointed MLRO, and the onboarding and monitoring arrangements described in operational detail.
• Safeguarding arrangements for client funds, and internal control and risk management systems meeting the Bank of Lithuania's resolutions on the subject.
• ICT and operational resilience under DORA, applicable since January 17, 2025 – ICT risk management, incident reporting, resilience testing, and third-party provider oversight.
• Real substance in Lithuania. A physical office, local management presence, and operations genuinely run from the country. A letterbox entity that outsources everything will not pass.

Timelines

The statutory review period for an EMI or PI application runs to three months from receipt of a complete file, which is where Lithuania's speed advantage comes from. In practice, expect three to six months for a straightforward application and longer for complex models, because the clock effectively restarts each time the regulator sends the pack back for revision. Budget twelve to twenty weeks of preparation before you file.

A secondary market in operational Lithuanian EMIs and PIs has developed, and acquisition is now a common route to market. Change-of-control approval still goes through the Bank of Lithuania, and the acquirer inherits whatever compliance debt sits in the entity.

What to do before July 2027

• Run an AMLR gap analysis against your current program and set an owner for each gap.
• Check whether you are inside the AMLA eligibility population using December 31, 2026 as the reference date, and map your data to the draft EBA model.
• Reassess geographic risk based on actual flows rather than declared residence.
• Screen your customer book for crypto clients operating without MiCA authorization.
• Complete a standalone sanctions risk assessment and extend screening through ownership and intermediary chains.
• Close known findings before you expand into new products or markets.
• Benchmark STR volumes against your scale and be ready to explain them.

Lithuania is still one of the fastest routes to a passportable EU license. The trade-off is that the supervisor now expects the controls to be inspection-ready from the first day of trading, and it has shown what happens when they are not.

Useful links

Legislation

• Law on the Prevention of Money Laundering and Terrorist Financing (e-Seimas)
• FNTT – legal acts of the Republic of Lithuania
• Regulation (EU) 2024/1624 – AMLR
• Directive (EU) 2024/1640 – AMLD6
• Regulation (EU) 2023/1114 – MiCA

Regulators

• Bank of Lithuania – financial market supervision
• Bank of Lithuania – authorization of electronic money institutions
• Bank of Lithuania – authorization of payment institutions
• Financial Crime Investigation Service (FNTT)
• Anti-Money Laundering Authority (AMLA)
• European Banking Authority – AML/CFT

Guidance and market data

• Bank of Lithuania letter on ML/TF risks, August 20, 2026 (PDF, Lithuanian)
• Invest Lithuania – Fintech Overview 2025–2026
• MONEYVAL – Lithuania country page

AML in Lithuania FAQs

• Who supervises AML compliance in Lithuania? 

  The Bank of Lithuania supervises financial market participants, including banks, EMIs, payment institutions, investment firms, and CASPs. FNTT is the financial intelligence unit that receives suspicious transaction reports from all obliged entities, and it supervises obliged entities outside the financial sector.

• How long must AML records be kept in Lithuania? 

  Eight years after the end of the business relationship or the execution of the transaction, under the AML law. 

• What is the deadline for reporting a suspicious transaction? 

  Where a transaction is suspended under the AML law, the report goes to FNTT within three working hours. Linked cash operations reaching €15,000 must be reported within seven business days.

• Can a crypto firm still operate in Lithuania under a legacy VASP registration? 

  No. Lithuania's transitional period ended on December 31, 2025, and the EU-wide window closed on July 1, 2026. Providing crypto-asset services without MiCA authorization is unlawful, and licensed firms must verify their crypto customers' authorization status.

• How long does a Lithuanian EMI license take?

  The statutory review period is three months from a complete application. Realistic end-to-end timelines run three to six months for straightforward cases, plus preparation time before filing.