eCommerce & Marketplaces Compliance in Lithuania

The Lithuanian market is open to online retailers and marketplaces. Identity duties do not come from anti-money laundering law: they come from the EU Digital Services Act, which requires marketplaces to verify the traders who sell through them, from EU tax rules on platform reporting, and from Lithuanian alcohol and tobacco control laws, which decide whether and how age-restricted goods can be sold remotely.

The principal authorities are the State Consumer Rights Protection Authority, which enforces the seller verification duty, the Communications Regulatory Authority as Digital Services Coordinator, and the State Tax Inspectorate for platform reporting. The biggest practical obstacle for a new entrant is building seller onboarding that satisfies both the trader traceability and the tax reporting rules from the first listing.

1. Who regulates this sector

Article 25 of the Law on Information Society Services (No X-614, version from 30 June 2026) splits Digital Services Act enforcement between the consumer authority (including Articles 30 to 32), the State Data Protection Inspectorate (including Articles 27 and 28(2) and (3)) and the Office of the Inspector of Journalistic Ethics (Articles 14(3) and 28(1)).

2. Licensing and authorisation

Lithuania has no general licence for online retail or marketplaces:

Marketplaces and platforms

No authorisation, but the Digital Services Act (Regulation (EU) 2022/2065) applies, and marketplaces must register with the EU Safety Gate Portal and name a product safety contact point (General Product Safety Regulation (EU) 2023/988, Article 22).

Platform tax registration

A non-EU reporting platform operator registered in Lithuania loses that registration if it does not report after two State Tax Inspectorate reminders (VMI Order No VA-95, point 13.4).

Alcohol

Remote retail sale is permitted under an alcohol retail licence and its conditions (Drug, Tobacco and Alcohol Control Department, FAQ updated 29 June 2026). Retail licences are issued by the municipality's mayor or authorised administration (Article 16 of the Law on Alcohol Control).

Tobacco and e-cigarettes

Remote sale is prohibited outright, domestic and cross-border, under Article 15(1)(2) of the Law on Control of Tobacco, Tobacco Products and Related Products (No I-1143). No licence can authorise it.

Payments: the Law on Payments (No VIII-1370) does not apply to payments made through a commercial agent authorised to negotiate or conclude sales on behalf of only the payer or only the payee (Article 3(5)(2)). The Bank of Lithuania states that a platform acting for both sides can rely on the exclusion only if it never acquires or controls client funds; otherwise the activity falls within the Law on Payments.

3. Identity framework (AML rules do not apply)

Online retailers and marketplaces are not, as such, obliged entities under the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275). The law reaches them only through cash: traders in goods worth EUR 10,000 or more paid in cash are obliged entities (Article 2(10)(6)) and must identify and verify the customer and beneficial owner before such a transaction (Article 9(3), version from 30 June 2026). In practice the trigger rarely arises: the Law on Restriction of Cash Payments (No XIV-1165, in force since 1 November 2022) caps cash payments under a transaction at EUR 5,000 (Article 4(1)).

The framework that governs the sector instead: trader traceability (Digital Services Act Article 30), platform tax due diligence (Directive (EU) 2021/514, transposed by Article 61³ of the Law on Tax Administration, No IX-2112) and age checks under the alcohol (age 20) and tobacco (age 18) laws.

Sanctions apply to everyone: under Article 11(3) of the Law on International Sanctions (No IX-2160, version from 30 June 2026), the Financial Crime Investigation Service is among the authorities that ensure the implementation of financial sanctions, so marketplaces paying out to sellers should screen them.

4. Identity verification and onboarding

Verifying traders on a marketplace

Before a trader can promote or offer products to consumers in the EU, Article 30(1) of the Digital Services Act requires the marketplace to obtain:

• the trader's name, address, telephone number and email address;
• a copy of the trader's identification document, or any other electronic identification as defined in the eIDAS Regulation (Regulation (EU) No 910/2014);
• the trader's payment account details;
• the trade register and registration number, where the trader is registered;
• a self-certification that the trader offers only products or services that comply with EU law.

Under Article 30(2), the marketplace must make best efforts to assess whether the information is reliable and complete, using free official online databases or interfaces, or supporting documents from reliable sources. If the trader does not correct inaccurate or incomplete information, its offers must be suspended (Article 30(3)). Micro and small enterprises are excluded (Article 29) unless designated as very large online platforms.

Tax data on sellers

For individual sellers, reporting platform operators must collect the name, date of birth, tax identification number and issuing state (or place of birth if none), VAT number where known, state of residence and primary address (VMI Order No VA-95, point 24; Directive (EU) 2021/514, Annex V); for entities, the legal name, address, tax and business registration numbers. Due diligence must be completed by 31 December of the reportable period.

Checking buyers' ages

For alcohol, sale to persons under 20 is prohibited (Article 18(4)(3) of the Law on Alcohol Control), and Article 18(5) allows sellers to ask every buyer for an identity document and requires them to ask when there is doubt that the buyer is 25 or older; a buyer who does not produce one must be refused. The Drug, Tobacco and Alcohol Control Department states that a buyer's online confirmation of being 20 or over is insufficient and that age must be checked at delivery.

5. Digital channels: what's different

Bottom line: selling online in Lithuania adds duties that a shop counter never faces: marketplaces must verify traders before listing, platforms must report seller income, tobacco cannot be sold remotely at all, and alcohol buyers' ages must be checked at the doorstep.

Remote sale of tobacco is closed

Article 15(1)(2) of the tobacco law prohibits trade in tobacco products and related products under distance contracts, including domestic and cross-border distance sales. The Drug, Tobacco and Alcohol Control Department confirms that this covers electronic cigarettes, refill containers and smokable hemp products, and can order such content removed or blocked (Article 19¹).

Alcohol is open, with conditions at the doorstep

Article 18(3)(10) and (11) bans retail alcohol sales on 1 September and outside 10:00 to 20:00 Monday to Saturday and 10:00 to 15:00 on Sunday. The Department applies these hours to remote orders, payment and handover, which may only be to sober persons aged 20 or over, with transport documents issued for delivery. Age assurance at checkout supports, but does not replace, the handover check.

Electronic identification for traders

Article 30 accepts eIDAS electronic identification instead of an identity document copy, so traders can be onboarded through an eID means or a European Digital Identity Wallet, which each Member State must provide by 24 December 2026 (Regulation (EU) 2024/1183, Article 5a(1)) [Adopted, due 24 Dec 2026]. Very large online platforms that require user authentication must accept wallets at the user's request once they are provided; Article 5f(3) sets no separate deadline. Other marketplaces, except micro and small enterprises, that must use strong user authentication by law or contract must accept wallets by 24 December 2027 (Article 5f(2)) [Adopted, applies 24 Dec 2027].

6. Data protection and biometrics

The General Data Protection Regulation applies, supervised by the State Data Protection Inspectorate. Relevant points for online retail:

• Children's consent: where information society services are offered directly to a child, consent-based processing is lawful only if the child is at least 14 (Law on Legal Protection of Personal Data No I-1374, version from 30 June 2026, Article 6).
• Personal code: the national personal identification code may not be made public, and its processing for direct marketing is prohibited (Article 3).
• Platform duties: under Digital Services Act Article 28, platforms accessible to minors must ensure their privacy, safety and security and may not target them with profiling-based advertising.

Trader data collected under Article 30 must be stored securely for six months after the contractual relationship ends and then deleted (Article 30(5)). Biometric data processed to uniquely identify a person, as in face matching, is a special category under Article 9(1) of the General Data Protection Regulation and needs an Article 9(2) exception such as explicit consent.

7. Sector-specific obligations

Annual seller reporting (DAC7)

Article 61³ of the Law on Tax Administration (version from 1 July 2026) requires reporting platform operators to report sellers' income from platform activities once a year for the previous calendar year. Reports are filed through the Inspectorate's TIES portal by 31 January of the following year (VA-95, point 16). Sellers that are public bodies, listed entities, and sellers of goods with fewer than 30 sales and no more than EUR 2,000 of consideration in the period are not reported.

If a seller does not provide the information within 60 days of the first of two consecutive reminders, the platform must close the seller's account and prevent re-registration, or withhold payment of consideration until the information is provided (Article 61³(5); VMI Order No VA-95, point 40). Operators must check the data against their records and free validation interfaces such as VIES (point 28) and keep seller information for 5 years after the reportable period (point 38).

Traceability in the interface

Marketplaces must design interfaces that let traders provide the information required by EU product safety and consumer law (Digital Services Act Article 31) and keep internal product safety processes (General Product Safety Regulation Article 22).

Licensed alcohol sellers on platforms

The Law on Alcohol Control defines an internet platform as an electronic interface through which licensed alcohol traders' product information is stored and shown to consumers who may conclude distance contracts for delivery (Article 2, as amended by Law No XIV-2621 of 9 May 2024). Platforms listing alcohol should therefore confirm that each alcohol seller holds a valid retail licence.

8. Risk indicators and red flags

Marketplace and online retail identity risks

• Mismatched payout account: payment account not in the trader's name.
• Unverifiable register data: registration number absent from the trade register named.
• Invalid tax or VAT number: number fails EU or national validation.
• Unresponsive seller: no reply to data requests after two reminders.
• Prohibited listings: e-cigarettes, refills or tobacco offered for delivery.
• Age gate only at checkout: alcohol delivered without an identity check at handover.
• Shop history mismatch: newly registered domain claiming years of trading, or only an email or contact form (National Cyber Security Centre).
• Payee mismatch: bank transfer recipient name or country differs from the shop's details (National Cyber Security Centre).

9. Enforcement and penalties

• Digital Services Act: under Article 40(3) of the Law on Information Society Services, the State Consumer Rights Protection Authority can fine a provider up to 6% of its total annual income in the previous financial year for breaches of Articles 30 to 32; fines of up to 1% apply to incorrect, incomplete or misleading information (Article 40(6)).
• Consumer law: under Article 40 of the Law on Consumer Protection (No I-657, version from 31 July 2026), fines run from EUR 500 to EUR 5,000 for listed distance and consumer contract breaches, and up to 4% of annual income in the Member States concerned (or EUR 2 million if income data are withheld) for widespread infringements.
• DAC7: if a platform operator fails to report after two consecutive reminders, the State Tax Inspectorate decides, 30 to 90 days after the second reminder, to order access to the platform's website blocked under Article 98 of the Law on Electronic Communications until the breach is remedied (Article 61³(4)); Article 98(2) of that law requires prior permission from a first-instance administrative court.
• Tobacco: breaching the remote-sale ban costs a legal person EUR 4,000 to EUR 12,000, and EUR 12,000 to EUR 30,000 plus revocation of all tobacco retail licences for a repeat within three years (Article 26(8)).
• Alcohol: selling to persons under 20 costs a licence holder EUR 289 to EUR 868, and EUR 868 to EUR 1,448 for a repeat within two years (Article 34(4)); a second under-20 sale at the same place within three years revokes the retail licence for that place, with no new licence for one year (Article 34(18)). Staff face EUR 30 to EUR 120 (Code of Administrative Offences, Article 168(3)).

Recent practice: in 2025 the State Consumer Rights Protection Authority approached two of the largest online marketplaces in Lithuania over Article 30, and both corrected the shortcomings it identified; the Communications Regulatory Authority opened no formal investigations that year (annual report 2025).

10. Recent changes and what to watch

• 10 July 2027: Regulation (EU) 2024/1624 applies, capping cash payments for goods and services at EUR 10,000 across the EU [Adopted, applies 10 Jul 2027]. Lithuania's lower EUR 5,000 limit continues to apply (Article 80(3)).
• 24 December 2026: deadline for Member States to provide European Digital Identity Wallets (Article 5a(1)); very large online platforms that require authentication must then accept them at the user's request (Article 5f(3)) [Adopted, due 24 Dec 2026]. Other marketplaces bound to strong authentication follow by 24 December 2027.
• 29 June 2026: Drug, Tobacco and Alcohol Control Department FAQ (updated that day) confirms that online age self-declaration is insufficient for alcohol delivery [Published guidance]. Delivery partners need an identity check at handover.
• 10 October 2025: European Commission guidelines on Digital Services Act Article 28 treat age verification as appropriate for platforms selling alcohol, tobacco or nicotine products and state that self-declaration is not an appropriate age assurance measure [Published guidance].
• 17 February 2025: end of the 12-month period for marketplaces to collect Article 30 data from traders already active on 17 February 2024; traders still missing data must be suspended [In force].
• 13 December 2024: General Product Safety Regulation applies, adding Safety Gate registration and product safety processes for marketplaces [In force].

11. What this means for identity verification

• Verify sellers, not buyers, by default: trader identity, registration and payment account must be verified before the first listing; most buyer journeys need no identity check.
• Accept documents or eID: an identity document copy or eIDAS electronic identification satisfies Article 30; liveness and face match reduce the risk of borrowed documents but are not prescribed.
• Combine DSA and DAC7 data capture: one flow can collect contact, document, register, tax and date of birth data, validate them against official interfaces and confirm the payout account belongs to the trader.
• Plan for doorstep age checks: for alcohol, age assurance online must be paired with an identity document check at delivery.
• Re-verification triggers: changed payout details, failed tax number checks and annual DAC7 cycles.
• Retention: Article 30 data for six months after the relationship ends; DAC7 seller data for 5 years.