Fintech & Digital Payments Compliance in Latvia

Latvia is open to digital payment and e-money businesses, and new licences are issued regularly. The framework combines EU payment law with a national anti-money laundering (AML) statute and a government regulation that set out remote identification methods in detail.

The principal authorities are Latvijas Banka, which licenses and supervises payment and e-money institutions for prudential, AML and sanctions purposes, and the Financial Intelligence Unit of Latvia (FIU Latvia), which receives suspicious transaction reports and is the competent authority for sanctions. The biggest obstacle for a new entrant is building a remote onboarding flow that meets Cabinet of Ministers Regulation No. 392 point by point, because a flow that falls outside it turns every online customer into an enhanced due diligence case.

1. Who regulates this sector

2. Licensing and authorisation

Under the Maksājumu pakalpojumu un elektroniskās naudas likums (Law on Payment Services and Electronic Money), Section 4, a payment institution or e-money institution may start business in Latvia only after receiving a Latvijas Banka licence, unless it qualifies for registration. Latvijas Banka decides on a licence within three months of receiving a complete application (Section 24). Initial capital on the day the licence is granted (Section 12) is:

Institutions licensed in another EU or EEA state can operate through a branch, agent or cross-border services once their home supervisor has notified Latvijas Banka (Section 31). The AML law also provides for a central contact point in Latvia appointed by an EEA payment or e-money institution to secure its compliance with Latvian AML rules (Section 1, point 6.3). A licensed e-money institution may also issue, hold and transfer its own e-money tokens, following the procedure in the EU Markets in Crypto-Assets Regulation (Section 4(4)).

Latvijas Banka's published licensing roadmap starts with a free pre-application stage, where it answers questions within up to 30 days. It then checks a submitted application for completeness within 15 working days before the substantive review begins.

Non-bank consumer lending is a separate regime under the Patērētāju tiesību aizsardzības likums (Consumer Rights Protection Law), Section 8: a lender needs a special permit (licence) and paid-up share capital of at least EUR 425,000. The licensing authority moves from the Consumer Rights Protection Centre to Latvijas Banka on 1 January 2027 [Adopted, effective 1 Jan 2027]; licences already issued stay valid.

3. AML, KYC and customer due diligence

Payment and e-money institutions, other payment service providers and licensed consumer lenders are "financial institutions" and so obliged entities under the Noziedzīgi iegūtu līdzekļu legalizācijas un terorisma un proliferācijas finansēšanas novēršanas likums (Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing), Sections 1(7) and 3. Latvijas Banka supervises payment and e-money institutions for AML purposes (Section 45).

When CDD applies

Before a business relationship; for an occasional transfer of funds of EUR 1,000 or more; for other occasional transactions of EUR 15,000 or more; and on suspicion (Section 11). If due diligence cannot be completed, the firm must not open the account.

Ongoing review

Customer data must be reviewed according to risk, and at least once every five years (Section 11.1(1)(5)).

Risk scoring

Licensed payment and e-money institutions must calculate an automated numerical risk score for each customer unless Latvijas Banka agrees otherwise in writing, and all supervised institutions set product limits to match risk (Latvijas Banka Regulation No. 316, points 11 and 18).

Enhanced due diligence

Required for non-face-to-face customers unless the Regulation No. 392 conditions are met, for politically exposed persons and for customers from high-risk third countries (Sections 22 and 25.1).

Simplified measures. Identification and beneficial ownership measures may be waived for low-risk e-money only if the instrument cannot be reloaded or has a monthly limit of EUR 150 usable only in Latvia, holds no more than EUR 150, can be used only for goods or services from the issuer or its network, is not linked to a payment account, cannot be redeemed for cash or crypto-assets, and is monitored for suspicious activity (Section 27.1). Account information and payment initiation providers may apply simplified due diligence using only the data available to them (Section 26(3.1)).

Reporting. Suspicious transactions are reported immediately through FIU Latvia's online system (Section 31.4). A firm that refrains from a suspicious transaction must report by the next working day (Section 32). Payment service providers also file threshold declarations for cash transactions of EUR 7,000 or more and for cross-border payments sent or received of EUR 500,000 or more (Cabinet of Ministers Regulation No. 550, point 14.1). FIU Latvia requests must be answered within three working days when urgent and seven working days otherwise.

Records. Due diligence records, payment data and correspondence are kept for five years after the relationship ends, extendable by authorities for up to five more years, and then destroyed (Section 37).

4. Identity verification and onboarding

A natural person is identified from an identity document showing, for residents, name, surname and personal code; for non-residents, name, date of birth, photograph, document number, issue date and issuing state and authority (AML law, Section 12). The firm must confirm that the document is not listed in the Register of Invalid Documents (Section 12(3.1)) and keep a copy of it (Section 14). Private companies access the register under a contract with the Ministry of the Interior's Information Centre (Cabinet of Ministers Regulation No. 708, points 2 and 26).

Remote identification is governed by Cabinet of Ministers Regulation No. 392 (as amended in June 2022). Before using it, the firm must have a documented risk assessment, an internal control system, trained staff, customer information about the process and security requirements for the technology (point 2). Point 7 lists four accepted methods:

• a secure electronic signature, qualified increased security electronic identification, or eIDAS-recognised solutions;
• video identification meeting point 10;
• identity data obtained from a credit institution or payment institution through an identification payment;
• comparison of a photo of the identity document with a selfie.

For video and selfie methods, the firm must check the document's remotely verifiable security features and compare the person biometrically (point 9). The document needs a machine-readable zone, read during the session, and optical security features, and forgery detection must be used (point 11); the captured image or video counts as the document copy. Selfie and identification-payment methods are barred where the customer or beneficial owner is linked to a high-risk third country or a low-tax jurisdiction (point 12).

Firms may outsource remote identification to a provider that follows EU AML requirements, provided they assess and monitor it (point 6); the firm stays responsible for the result (AML law, Section 23(3)). Agents that identify customers on a firm's behalf before onboarding are subject to Latvijas Banka Regulation No. 351, including an annual quality review.

Latvijas Banka's AML handbook (March 2026) adds supervisory expectations: proof that video or selfie capture is live rather than recorded; chip data treated as the most reliable source (citing EBA/GL/2022/15); checks that foreign qualified e-signatures come from an eIDAS qualified trust service provider; correct handling of residence permits; and regular testing of outsourced solutions.

Minors. Since 15 October 2026 a payment provider may open an account or issue an instrument to a minor of any age, with age-appropriate limits. Until the age of 16 a parent or legal representative opens and manages it; from 16 the minor may contract alone (Payment Services Law, Section 79.1).

5. Digital channels: what's different

Bottom line: remote onboarding is permitted, but it triggers enhanced due diligence unless the firm has the required safeguards and uses one of the four methods in Regulation No. 392, which also sets document, biometric and logging requirements.

Remote identification as an EDD trigger

Section 22(2)(1) of the AML law requires enhanced due diligence for customers not identified in person, unless the firm has mitigating policies and training and uses a Regulation No. 392 method. Section 23 adds at least one extra measure, such as further documents, a first payment from the customer's own bank account or, for residents, a secure e-signature.

Video identification standard

Video identification must run live over an encrypted audio and video stream, with the face uncovered and compared with the document photo, the document legible and verification questions asked; an interrupted stream means starting again (Regulation No. 392, point 10).

Account security and payment design

Strong customer authentication applies to online account access, payment initiation and risky remote actions, with remote payments dynamically linked to amount and payee (Payment Services Law, Section 104.4). Euro-area providers have had to offer verification of the payee since 9 October 2025 (Regulation (EU) 2024/886, Article 5c). Apps, websites and call centres must be available in Latvian, including for providers passporting in without a branch (Section 44.4).

What is changing

The EU Anti-Money Laundering Regulation [Adopted, applies 10 Jul 2027] allows verification by document or by eIDAS electronic identification at level substantial or high (Article 22(6)). Under the European Digital Identity Framework [Adopted, phased dates], wallets are due 24 months after core implementing acts that entered into force on 24 December 2024, and regulated private services using strong user authentication must accept them on request by late December 2027 (Regulation (EU) 2024/1183, Articles 5a(1) and 5f(2)). The EU payments package [Political agreement, not adopted] of 27 November 2025 would extend name-and-IBAN checks to all credit transfers and make providers liable for some impersonation fraud. AMLA's final draft standards on customer due diligence [Final draft, not adopted] would allow remote document-based checks only as a fallback, where the customer cannot reasonably present an identity document in person and has no eIDAS means at level substantial or high or relevant qualified trust service; the firm must justify this and meet listed safeguards (draft Article 7).

6. Data protection and biometrics

The General Data Protection Regulation applies in full, supervised by the Data State Inspectorate. Biometric data used to uniquely identify a person is a special category under Article 9(1), so selfie and video methods need an Article 9(2) condition; Regulation No. 392 is the national rule that requires the biometric comparison.

Due diligence data may be used only to prevent money laundering and terrorism and proliferation financing, never for commercial purposes (AML law, Section 11.1(8)). The Inspectorate's list of processing requiring a data protection impact assessment includes biometric identification combined with a high-risk criterion such as AML or fraud database screening, so biometric remote onboarding will normally need one before launch. Remote identification data, including video, must be kept unalterable for the statutory five years after the relationship ends; a firm combining e-signature with video may keep only images of the person and document (Regulation No. 392, point 16).

7. Sector-specific obligations

Sanctions, including NATO-member lists

Under the Starptautisko un Latvijas Republikas nacionālo sankciju likums (Law on International Sanctions and National Sanctions of the Republic of Latvia), financial market participants apply UN, EU and national sanctions and, under Cabinet criteria, EU or NATO member state sanctions that significantly affect the financial market (Sections 11(6) and 13(4)). A documented sanctions risk assessment and internal control system are required (Section 13.1), and freezes must be reported to FIU Latvia immediately (Section 12(5)).

Unlicensed gambling payment blocking

Payment providers must not serve gambling operators named in a State Revenue Service decision, must stop transfers to them within three working days, and must refuse remote card payments by Latvian-resident cards to unlicensed online gambling operators, reporting refusals each year by 1 February (Payment Services Law, Section 44.2).

Fraud risk management

Latvijas Banka's February 2025 fraud risk guidelines (comply or explain) expect an annual documented fraud risk assessment, a management plan and procedures to reject, suspend and recall suspicious payments.

Buy now, pay later

From 20 November 2026 [Adopted, effective 20 Nov 2026], large enterprises offering their own deferred payment credit must register with Latvijas Banka (Consumer Rights Protection Law, Section 8.6). Creditworthiness checks apply unless payment is due within 50 days, or 14 days for large online sellers. Latvijas Banka Regulation No. 427 requires a board member responsible for the service and AML, and an AML internal control description from 10 July 2027.

8. Risk indicators and red flags

Payment and e-money indicators (FIU Latvia, 2024)

• Money mules: personal accounts used to pass on funds quickly, often to foreign payment institutions or crypto providers.
• Transit payments: funds withdrawn or forwarded shortly after they arrive.
• Shared IP addresses: different accounts operated from the same IP address.
• Crypto conversion: funds in a payment institution account mainly used to buy virtual currency.
• Nested providers: a payment institution receiving funds from other payment institutions' accounts, or with weak monitoring.
• Online gambling layering: winnings from several gambling platforms cited as the source of funds.
• Investment scams: platforms promising unrealistically high returns.
• Impersonation fraud: customers told by a "bank employee" or "police officer" to move money urgently.

9. Enforcement and penalties

For AML breaches, Latvijas Banka may fine a financial institution up to 10% of annual turnover, or up to EUR 5 million where that is higher, and responsible individuals up to EUR 5 million (AML law, Section 78(3)). Other sanctions include warnings, public statements, licence suspension or withdrawal and removal of responsible persons (Section 78(1)). Decisions stay published for five years.

On 25 June 2025 Latvijas Banka warned Paysera LT, a Lithuanian e-money institution, for internal control deficiencies and AML breaches in serving Latvia through agents. FIU Latvia's 2026 national risk assessment reports that inspections of payment and e-money institutions found significant gaps, including weak risk scoring and missing automated alerts.

10. Recent changes and what to watch

• 10 July 2027[Adopted, applies 10 Jul 2027]: the EU Anti-Money Laundering Regulation applies directly, with a EUR 10,000 occasional transaction threshold and a narrower e-money exemption for non-reloadable products up to EUR 150. The EU Anti-Money Laundering Authority selects the entities it will supervise directly in 2027, with direct supervision from 2028.
• 1 January 2027[Adopted, effective 1 Jan 2027]: consumer protection supervision of payment services, and licensing and AML supervision of consumer lenders, move from the Consumer Rights Protection Centre to Latvijas Banka.
• 20 November 2026[Adopted, effective 20 Nov 2026]: new buy now, pay later rules take effect, with registration of large-enterprise providers at Latvijas Banka.
• 15 October 2026[In force]: payment accounts for minors with age-appropriate limits are permitted; Latvijas Banka must run a reporting channel for payment law breaches.
• 30 September 2026[Final draft, not adopted]: AMLA's final report on draft standards for customer due diligence under Article 28(1) of the Anti-Money Laundering Regulation, submitted to the European Commission on 1 October 2026, limits remote document-based checks to a justified fallback with safeguards. The standards are proposed to apply six months after entry into force.
• 30 September 2026[In force]: deadline for Latvian-language documents and digital interfaces for payment services.
• 27 November 2025[Political agreement, not adopted]: the EU Payment Services Regulation and amendments to PSD2 were agreed politically; Parliament's committee approved the text on 5 May 2026, and formal adoption is pending.
• 9 October 2025[In force]: euro-area providers must send instant euro credit transfers and offer verification of the payee.

11. What this means for identity verification

• Design to the list. Map each remote flow to one of the four Regulation No. 392 methods, with machine-readable zone, security-feature and invalid-document checks.
• Route by risk. Send customers linked to high-risk third countries or low-tax jurisdictions to e-signature, eID or video identification.
• Biometrics and liveness. Prove live capture and compare faces biometrically; no certified presentation-attack standard is named, so set, test and document your own, and read the chip where possible.
• Evidence. Store all remote identification data unaltered, with timestamped name and IP logs for video and selfie sessions, for five years after the relationship ends.
• Re-verification. Refresh due diligence on material change and at least every five years.