Banking & Digital Banking Compliance in Lithuania

Lithuania is open to digital banks and neobanks, including specialised banks that serve customers in other EU states from a Lithuanian licence. The market is licensed and supervised in the same way as any euro-area banking market: authorisation runs through the Bank of Lithuania and the European Central Bank, and anti-money laundering (AML) supervision is shared between the Bank of Lithuania and the FNTT.

The main obstacle for a digital entrant is not the licence but the remote identification rules. Lithuanian law lists exactly which remote methods may be used, and the FNTT sets detailed technical requirements for video identification. The Bank of Lithuania has fined banks for weak customer due diligence, including a EUR 3.5 million fine on a specialised bank in April 2025.

1. Who regulates this sector

Under Article 30 of the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275), both the FNTT and the Bank of Lithuania supervise banks for AML purposes.

In December 2024 MONEYVAL ended its compliance enhancing procedures for Lithuania on targeted financial sanctions.

2. Licensing and authorisation

Only a credit institution may accept deposits and other repayable funds from non-professional market participants; a bank is licensed under the Law on Banks (No IX-2085).

Bank licence

All licensed financial services, unless restricted by law. Minimum own funds under Regulation (EU) No 575/2013 of EUR 5 million (Law on Banks, Art. 40(1)).

Specialised bank licence

Only the 12 services listed in Art. 4(5), including deposit-taking, lending, leasing, payment services, guarantees, currency exchange and e-money issuance; no investment services. Minimum own funds of EUR 1 million (Art. 40(2)). Authorisation and supervision are otherwise identical.

The applicant files with the Bank of Lithuania. If the national conditions are met, the Bank of Lithuania proposes a draft decision to grant the licence, which is deemed adopted by the ECB unless the ECB objects within ten working days; otherwise the Bank of Lithuania rejects the application (Regulation (EU) No 1024/2013, Art. 14). A decision is due within six months, and in any case within 12 months of receipt (Law on Banks, Art. 9(11)). A state levy of EUR 4,157 is payable for issuing a bank licence (Government Resolution No 1458, point 3.90.1, consolidated from 3 October 2026).

Deposits at Lithuanian banks are insured under the Law on Insurance of Deposits and Liabilities to Investors (No IX-975) by an insurer designated by the Government, and the law defines the covered deposit as the part of an insured deposit not exceeding EUR 100,000. Fines under the Law on Banks reach 10% of total annual income for legal persons and EUR 5 million for managers and other individuals (Art. 74).

3. AML, KYC and customer due diligence

Credit institutions are financial institutions and obliged entities under Law No VIII-275 (consolidated version in force 30 June to 31 December 2026).

When identity must be established

Article 9(1) requires a bank to identify and verify the customer and beneficial owner:

• before starting a business relationship;
• before occasional transactions of EUR 15,000 or more, single or linked;
• before cash currency exchange of EUR 3,000 or more;
• for cash remittances above EUR 600;
• for transfers of funds, under Regulation (EU) 2023/1113;
• whenever there are doubts about identity data already held, or a suspicion of money laundering or terrorist financing.

Linked transactions are aggregated per day (Art. 9(11)). The bank must also obtain the purpose and intended nature of the relationship (Art. 9(14)), keep data up to date (Art. 9(17)) and monitor every relationship on an ongoing basis (Art. 9(16)). Where due diligence cannot be completed, the bank may not start or continue the relationship and must consider reporting to the FNTT (Art. 9(18)). Where risk is low, an account may be opened before verification is complete, provided no transactions run until it is, and verification is finished within one month (Art. 9(5)).

Beneficial ownership

A natural person holding 25% plus one share, or an ownership interest of more than 25%, is a direct owner; indirect holdings and control by other means also count, with a senior manager as the fallback (Art. 2). Article 12 requires the beneficial owner to be identified in every case and the customer's information to be checked against reliable and independent sources.

For corporate customers, banks must also obtain beneficial owner data from the Information System of Legal Entities' Participants (JADIS) (Art. 12(8)). Where JADIS and the bank's own information differ, the bank tells the customer and invites it to file accurate data with the JADIS operator (Art. 12(11)). A bank may not start the business relationship or carry out an occasional transaction if a Lithuanian legal entity's beneficial owners have not been filed in JADIS as Article 25 requires, or if the filed data do not match the bank's information (Art. 12(12)).

Enhanced and simplified due diligence

Article 14(1) requires enhanced due diligence for cross-border correspondent relationships with third-country institutions, politically exposed persons (senior manager approval, source of assets and funds, enhanced monitoring), persons in high-risk third countries identified by the European Commission or listed by the FATF, and any case the bank's own risk assessment rates higher risk. Simplified measures are allowed where risk is assessed as low (Art. 15).

Reporting and records

Copies of identity documents, beneficial owner data, live video recordings and other identification data are kept for 8 years after the relationship ends; transaction documents for 8 years from the transaction; business correspondence for 5 years (Art. 19(11) to (13)). The Bank of Lithuania's AML Instructions (Board Resolution No 03-17, consolidated from 18 March 2025) add detailed rules.

4. Identity verification and onboarding

Accepted documents

For an individual identified in person, Article 10(1) accepts a Lithuanian or foreign identity document, a Lithuanian residence permit, or an EEA driving licence meeting Annex I of Directive 2006/126/EC. The document must show name, surname, personal code (for a foreigner, date of birth and, where available, a personal number), photograph, and signature and citizenship where the document carries them; where citizenship is missing the bank must ask for it (Art. 10(1¹)).

Remote methods permitted by law

Article 11(1) allows identification without physical presence only through:

1. reliance on a qualifying third party under Article 13;
2. EU-issued electronic identification means under a scheme of "high" or "substantial" assurance under Regulation (EU) No 910/2014;
3. a qualified electronic signature;
4. live video, either capturing the original ID document with identity confirmed by at least an advanced electronic signature, or capturing the customer's face together with the original ID document;
5. a payment, before services start, from an account in the customer's name at an EU (or equivalent) credit, payment or e-money institution, plus a certified paper copy of the ID document.

For reliance and eID, the customer must earlier have been identified in person (including when the eID was issued), by live video or by first payment; for reliance, eID and qualified signatures, that earlier identification must have used the documents listed in Article 10 (Art. 11(2)). In every remote case the bank must collect additional data or documents to confirm the identity is authentic and check for enhanced due diligence triggers (Art. 11(3)). Beneficial owner data given remotely must be confirmed by eID of substantial or high assurance, a qualified electronic signature, live video, or a signature on a written document (Art. 12(5)).

Video identification standard

FNTT Director's Order No V-314 (consolidated from 12 January 2021) sets the technical requirements. Transmission must be continuous and in real time; an identity card or residence permit is shown on both sides, a passport at the photo page; the document is tilted several times to show it is genuine. Under the face-and-document route, face and document are shown together and the customer answers identity questions. Where photos are sent instead of video, software must make non-real-time submission impossible.

5. Digital channels: what's different

Bottom line: remote account opening is lawful, but only through the five methods in Article 11(1) of Law No VIII-275; relationships run remotely outside them count as a higher-risk factor, and the bank remains responsible for the result.

An exhaustive list of methods

Article 11(1) states that remote identification is possible "only" in the listed cases. Article 14(10) lists relationships or transactions conducted without physical presence in cases other than those in Article 11(1) as a higher-risk factor, and Article 14(9) requires special attention to customers not identified in person. Since 2024, financial institutions must also follow the European Banking Authority (EBA) Guidelines on the use of remote customer onboarding solutions (EBA/GL/2022/15, applicable from 2 October 2023) (Art. 11(6), added by Law No XIV-2543). For unattended solutions they expect capture at the time of onboarding, liveness detection and reliable face matching, with poor-quality evidence sent back for a restart or face-to-face check (paras. 39 to 41).

Reliance and outsourcing keep liability with the bank

Responsibility for remote identification stays with the bank (Art. 11(4)). Identification may be outsourced under a written contract to a person registered in the EU or an equivalent third country (Art. 15²).

Authentication after onboarding

Where strong customer authentication applies, such as online access to a payment account, it must combine two or more elements of knowledge, possession and inherence (Commission Delegated Regulation (EU) 2018/389, Art. 4).

What is changing

The EU Anti-Money Laundering Regulation [Adopted, applies 10 Jul 2027] accepts identity documents checked against reliable sources, or electronic identification of substantial or high assurance (Art. 22(6)). Under Regulation (EU) 2024/1183 [Adopted, applies 24 Dec 2027], banks (other than micro and small enterprises) that must use strong user authentication must accept European Digital Identity Wallets at the user's voluntary request no later than 36 months after the wallet implementing acts entered into force (Art. 5f(2)). The five implementing regulations adopted on 28 November 2024 (2024/2977, 2024/2979, 2024/2980 and 2024/2982 under Article 5a(23); 2024/2981 under Article 5c(6)) entered into force on 24 December 2024.

6. Data protection and biometrics

The General Data Protection Regulation and the Law on Legal Protection of Personal Data (No I-1374, consolidated from 30 June 2026) apply. Three points bite on onboarding:

• Personal code. The Lithuanian personal code may be processed only on a GDPR Article 6(1) lawful basis, may not be published and may not be used for direct marketing (Art. 3). Law No VIII-275 requires banks to collect it (Art. 10(1)).
• Face images. Video identification captures facial images and live recordings. Where they are processed to uniquely identify the customer, such as automated face matching, they are biometric data under GDPR Article 9, whose prohibition applies unless one of the Article 9(2) conditions is met.
• Retention. Recordings are kept 8 years (Law No VIII-275, Art. 19(11)) and must be reproducible and protected against alteration or incompatible use (FNTT Order V-314).

7. Sector-specific obligations

Information sharing between banks

Financial institutions may exchange information on customers, representatives, beneficial owners, ownership structures and transactions where they suspect money laundering, terrorist financing or sanctions evasion (Art. 15¹). FNTT Director's Order No V-125 of 26 July 2024 (consolidated from 9 July 2025) sets the procedure: exchanges run through a data-exchange platform created by participating financial institutions, and can cover customers refused or exited for AML reasons.

Financial sanctions

The Law on International Sanctions (No IX-2160, consolidated from 30 June 2026) makes the FNTT the authority that supplies sanctions lists and ensures financial sanctions are implemented. Anyone who freezes funds or economic resources must inform the FNTT within 2 working days (Government Resolution No 535, consolidated from 9 December 2025).

Securities-side activity

The Bank of Lithuania also sets AML instructions for financial brokerage firms, management companies and investment companies (Law No VIII-275, Art. 4(1)), and the identification rules in Articles 9 to 12 apply to all financial institutions and obliged entities.

8. Risk indicators and red flags

Indicators from FNTT Order No V-240 (consolidated from 1 May 2024)

• Evasive identification: the customer avoids giving beneficial owner information or presents documents of doubtful authenticity.
• Unreachable customer: frequent changes of address or contacts; phone and email go unanswered.
• Unexplained funds: refusal or inaccurate answers about the origin of deposited cash or transfers.
• Transit account: incoming funds are moved on or withdrawn in cash shortly after arrival.
• Nominee patterns: one person heads, represents or owns several legal entities, or several entities are registered at the customer's address.
• Third-party payments: goods or services paid for by third parties with no apparent economic or lawful purpose.

9. Enforcement and penalties

Under Article 39 of Law No VIII-275, the Bank of Lithuania and the FNTT may fine a financial institution:

• 0.5% to 5% of total annual income for breaches of the law;
• for systematic, serious or repeated breaches (within a year of an earlier measure), 0.5% to 10% of total annual income where 10% exceeds EUR 5.1 million, or EUR 2,000 to EUR 5.1 million where it does not.

Recent public actions:

• Revolut Bank UAB, 4 April 2025. Fine of EUR 3.5 million for breaches of Articles 9(16), 16(2), 17 and 29(1)(3) of Law No VIII-275 and of the Bank of Lithuania's AML Instructions (Bank of Lithuania sanctions register).
• European Merchant Bank UAB, 8 December 2021. Fine, obligations and a warning for ineffective internal controls and insufficient due diligence and monitoring.

10. Recent changes and what to watch

• 24 December 2027: banks must accept EU Digital Identity Wallets[Adopted, applies 24 Dec 2027].
• 10 July 2027: EU Anti-Money Laundering Regulation applies[Adopted, applies 10 Jul 2027]. Review remote onboarding against Article 22.
• 11 January 2027: new regime for third-country bank branches[Adopted, effective 11 Jan 2027]. Law No XV-938 amends the Law on Banks; existing non-EU bank branch licences stay valid only if the branch meets the new requirements. Further changes under Law No XV-846 apply from 10 January 2030.
• 1 January 2027: national development bank added to AML scope[Adopted, effective 1 Jan 2027]. Law No XV-1039.
• 13 October 2026: sixth-round MONEYVAL evaluation begins[Evaluation under way]. The technical compliance questionnaire is due in March 2027 and the on-site visit is expected in autumn 2027.
• 30 June 2026: AML fines made enforceable[In force]. Law No XV-914 makes supervisors' fine decisions enforceable instruments.

11. What this means for identity verification

• Map every remote flow to an Article 11(1) method. Document capture with a selfie must meet the live video rules in FNTT Order V-314 (continuous real-time capture, document tilting, face and document together, identity questions) to count as a permitted method.
• Add liveness and face matching to unattended flows. The EBA remote onboarding guidelines, binding on Lithuanian banks through Article 11(6), expect liveness detection, reliable face-match algorithms and a fallback to face-to-face verification when evidence quality is poor.
• Block corporate onboarding on JADIS mismatches. Beneficial owner data must be filed in JADIS and match the bank's own findings before the relationship starts.
• Plan for EU eID and wallets. EU eID is permitted now and wallets must be accepted from December 2027.