Lithuania
Lithuania pairs one financial supervisor with sector bodies. The Bank of Lithuania licenses banks (with the European Central Bank), payment, e-money, crypto and insurance firms and supervises their anti-money laundering controls with the Financial Crime Investigation Service, which receives suspicious activity reports. Remote onboarding uses five methods set in law. The Gaming Control Authority oversees gambling; telecoms, healthcare, travel and public services follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
The Bank of Lithuania supervises banks, payment and e-money institutions, crypto-asset service providers and life insurers, alongside the Financial Crime Investigation Service (FNTT), the financial intelligence unit. The Gaming Control Authority supervises gambling operators. FNTT receives suspicious activity reports, which are due within one working day, and coordinates financial sanctions, which apply to every business, whether or not it is covered by the AML law.
Yes, but firms covered by the AML law may identify a customer remotely only through five methods set in law: reliance on another regulated firm, an EU eID at substantial or high assurance, a qualified electronic signature, live video under FNTT technical rules, or a first payment from the customer's own EU account plus a certified ID copy. A document upload with a selfie is not a method on its own.
Banks, payment and e-money institutions, crypto-asset service providers and insurers need a Bank of Lithuania licence (banks also need the European Central Bank's approval) or a passport from another EEA country. The national crypto registration regime ended on 31 December 2025. Online gambling needs a national remote licence and permit; a licence from another EU country does not count. Online shops and marketplaces need no licence.
Usually. Face images processed to uniquely identify a person are biometric data, a special category under Article 9 of the General Data Protection Regulation, so a face match needs an Article 9(2) condition, most often explicit consent. Lithuanian data protection law adds no extra biometric conditions. The personal code may not be published or used for direct marketing, and children can consent to online services from age 14.
Telecom operators, healthcare providers, online shops and marketplaces, travel and accommodation businesses, non-life insurers and public bodies are not obliged entities. Their identity duties come from sector rules instead, such as prepaid SIM identification, remote consultation procedures, Digital Services Act trader checks, 24-hour guest registration and eIDAS assurance levels. Traders taking EUR 10,000 or more in cash and currency exchange operators are covered.