Fintech & Digital Payments Compliance in Lithuania
How e-money and payment institution licences, the five remote identification methods, FNTT live video and live photo rules and verification of payee shape onboarding for payment apps in Lithuania.
Key takeaways
- Issuing e-money or providing payment services in Lithuania requires a licence from the Bank of Lithuania (the central bank, which also supervises the financial market) or a passport from another European Economic Area (EEA) country. An e-money institution needs at least EUR 350,000 of initial capital; a payment institution needs EUR 20,000 to EUR 125,000 depending on its services.
- Customers can be onboarded online, but only through methods the anti-money laundering law lists: live video or live photo capture under technical rules set by the Financial Crime Investigation Service (the financial intelligence unit), an EU electronic ID, a qualified electronic signature, reliance on another regulated firm, or a first payment from the customer's own account at an EU (or equivalent) institution plus a certified ID copy.
- Suspicious activity must be reported to the Financial Crime Investigation Service within one working day; a suspicious transaction must be stopped and reported within three working hours. Onboarding records, including live video recordings, are kept for eight years.
- Several changes are close: e-money and payment institutions must send and receive euro instant transfers by 9 April 2027, the EU Anti-Money Laundering Regulation applies from 10 July 2027, and a new version of the consumer credit law applies from 20 November 2026.
- Enforcement against fintechs is frequent and public: the Bank of Lithuania fined one e-money institution EUR 1.8 million in December 2025, partly for remote identification failures, and revoked the licences of two firms in 2026.
Lithuania is open to digital payment and e-money firms: the Bank of Lithuania reports that it supervises 80 e-money institutions, and those with an unrestricted licence may operate across the EU. Licensing is national, and the Bank of Lithuania both authorises firms and supervises their anti-money laundering controls, alongside the Financial Crime Investigation Service (FNTT), which receives reports and coordinates financial sanctions.
The biggest obstacle for a new entrant is not the licence itself but sustaining the controls behind it. Remote onboarding is limited to a fixed list of methods with detailed capture rules, and many recent enforcement actions against e-money and payment institutions concern customer due diligence, monitoring and sanctions controls.
1. Who regulates this sector
| Regulator | Remit | Level | Official site |
|---|---|---|---|
| Bank of Lithuania (Lietuvos bankas) | Licenses e-money and payment institutions; keeps the public list of consumer credit providers; supervises these firms and peer-to-peer lending platforms, including their anti-money laundering compliance | National | lb.lt |
| Financial Crime Investigation Service (FNTT) | Financial intelligence unit; receives suspicious transaction and cash reports; sets remote video identification rules; coordinates financial sanctions | National | fntt.lrv.lt |
| State Data Protection Inspectorate (VDAI) | Data protection supervision, including identity and biometric data | National | vdai.lrv.lt |
| Anti-Money Laundering Authority (AMLA) | Drafts EU technical standards under the Anti-Money Laundering Regulation | EU | amla.europa.eu |
| European Banking Authority (EBA) | Guidelines that Lithuanian law and Bank of Lithuania instructions apply: remote customer onboarding, ML/TF risk factors, AML/CFT compliance officer | EU | eba.europa.eu |
2. Licensing and authorisation
The Law on Electronic Money and Electronic Money Institutions (No XI-1868) prohibits anyone who is not an authorised e-money issuer from issuing e-money (art. 5). The Law on Payments (No VIII-1370) defines payment services (art. 5) and prohibits anyone who is not a payment service provider from providing them (art. 7); payment institutions are licensed under the Law on Payment Institutions (No XI-549). The Bank of Lithuania issues both licences.
| Licence | Initial capital | Scope and limits |
|---|---|---|
| E-money institution | EUR 350,000 (art. 22, e-money law) | E-money, including e-money tokens under the EU Markets in Crypto-Assets Regulation, plus payment services; can passport across the EEA |
| E-money institution, restricted activity | No initial capital or own funds requirement (art. 14(1)) | Lithuania only; average outstanding e-money up to EUR 900,000 (art. 14); any other payment services capped at EUR 3 million a month (art. 14(2) with art. 7(1), payment institutions law) |
| Payment institution | EUR 20,000 (money remittance only), EUR 50,000 (payment initiation only) or EUR 125,000 (Law on Payments art. 5(1)-(5) services: cash, transfers, issuing and acquiring) (art. 14, payment institutions law) | Payment services; can passport across the EEA |
| Payment institution, restricted activity | No initial capital requirement | Lithuania only; average payment volume up to EUR 3 million a month (art. 7(1)) |
The Bank of Lithuania must decide on a licence within three months of receiving the application (e-money law art. 13(6); payment institutions law art. 5(6)). Applicants must show a sound governance framework, clear organisational structure and internal controls (e-money law art. 13(4)). Client funds must be safeguarded by segregation, insurance or a guarantee (e-money law art. 25; payment institutions law art. 17).
EEA e-money and payment institutions operating in Lithuania through agents or distributors are subject to the Bank of Lithuania's anti-money laundering instructions and supervision (Law on the Prevention of Money Laundering and Terrorist Financing, arts. 4(1) and 30(1)(2)).
Lending apps also need, under the Law on Consumer Credit (No XI-1253), entry in the Bank of Lithuania's public list of consumer credit providers (art. 22(1); art. 39(1) in the version applying from 20 November 2026).
3. AML, KYC and customer due diligence
E-money institutions, payment institutions, peer-to-peer lending platform operators and crowdfunding service providers are "financial institutions" under the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275) (art. 2(7)). The Bank of Lithuania and FNTT both supervise their compliance (AML Law arts. 4(1) and 30(1)); the Bank of Lithuania does so through its instructions to financial market participants (Board Resolution No 03-17 of 12 February 2015, consolidated from 18 March 2025), which apply together with the EBA ML/TF risk factors guidelines (EBA/GL/2021/02) and the EBA guidelines on the AML/CFT compliance officer (EBA/GL/2022/05) (point 3).
When customer due diligence applies
Article 9(1) requires identification and verification of the customer and beneficial owner:
- before establishing a business relationship;
- before occasional or linked transactions of EUR 15,000 or more;
- before cash currency exchange of EUR 3,000 or more;
- for cash money remittances above EUR 600;
- for transfers, under Regulation (EU) 2023/1113;
- on doubts about earlier identity data, or on suspicion.
For low-risk customers an account may be opened before verification ends, but no transactions may run until it does, within one month at most (art. 9(5)).
Simplified and enhanced due diligence
Credit and e-money institutions may apply reduced measures to low-risk e-money products only if every condition in art. 9(4) is met: a non-reloadable instrument, or a monthly limit of EUR 150 usable only in Lithuania; a maximum stored value of EUR 150; use only for buying goods or services; no funding with anonymous e-money; and no cash redemption. Enhanced due diligence is mandatory for cross-border correspondent relationships with third-country institutions, politically exposed persons, customers in high-risk third countries identified by the European Commission or listed by the Financial Action Task Force (FATF), and where the firm's risk assessment finds higher risk (art. 14(1)).
Beneficial ownership
A natural person holding 25% plus one share, or more than 25% of the ownership, directly or indirectly, or controlling the customer by other means, is a beneficial owner (art. 2).
Reporting and record keeping
Suspicious activity
Report to FNTT immediately and no later than one working day after the knowledge or suspicion arises (art. 16(1)). Suspend a suspicious transaction and report within three working hours (art. 16(2)); FNTT then has ten working days to act (art. 16(4)).
Threshold reports
Report cash or crypto-asset operations of EUR 15,000 or more, single or linked, to FNTT within seven working days (art. 20(1) and (5)).
Retention
Keep ID copies, beneficial owner data, live video recordings and other identification data for eight years after the relationship ends; business correspondence for five years (art. 19(11) and (12)).
4. Identity verification and onboarding
Accepted documents and data
For a natural person, firms require a Lithuanian or foreign identity document, a Lithuanian residence permit, or an EEA driving licence that meets Directive 2006/126/EC (AML Law art. 10(1)). The document must show, among other data, the customer's name, surname and personal code (for foreigners, date of birth and any unique identifier); if it does not show citizenship, the firm must ask the customer for it (art. 10(11)). Firms may obtain identification data directly from Lithuanian and other states' information systems and registers (art. 10(4)); the Bank of Lithuania's FAQ states that data from commercial databases or service providers do not meet this provision.
Remote identification: an exhaustive list
Article 11(1) allows non-face-to-face identification only by:
- reliance on a third party under art. 13;
- EU electronic identification means under a scheme of "substantial" or "high" assurance under Regulation (EU) No 910/2014 (eIDAS);
- a qualified electronic signature based on a qualified certificate;
- live video transmission, either (a) capturing the original ID document and confirming identity with at least an advanced electronic signature, or (b) capturing the customer's face together with the original ID document;
- a payment from the customer's own account at an EU (or equivalent) credit, payment or e-money institution, plus a certified paper copy of the ID document.
For reliance and eID, the earlier identification must have been made in person, by live video, by method 5, or in person when the eID means was issued; for these methods and qualified signatures alike, the customer must originally have been identified from the documents listed in art. 10 (art. 11(2)). The firm must also obtain additional data to confirm authenticity and check for enhanced due diligence triggers (art. 11(3)), and remains responsible for the result (art. 11(4)). For qualified signatures, the Bank of Lithuania's FAQ does not always require an ID copy but expects controls showing that a proper identity document was used when the certificate was issued. Financial institutions also apply the EBA Guidelines on remote customer onboarding (art. 11(6)).
FNTT technical requirements for live video and live photo
FNTT Director's Order No V-314 of 30 November 2016 (consolidated from 12 January 2021) sets the capture rules for method 4:
- Transmission must be continuous and in real time, as video or as live photos through an application that makes non-real-time uploads impossible.
- ID cards and residence permits are shown on both sides, passports at the photo page, driving licences on the photo side, and the document is tilted several times to show it is genuine.
- Method 4(a) adds an advanced electronic signature on the identification form within one hour; under method 4(b), face and document are captured together and, in video mode, the customer answers identity questions.
- Only one person may take part. The process must stop if transmission is not live or is interrupted, image or sound quality is poor, the customer does not follow instructions, or the document appears altered or is a copy; a forged document is reported to FNTT.
5. Digital channels: what's different
Bottom line: online onboarding is permitted, but a customer can be identified remotely only through the five methods in AML Law art. 11(1); non-face-to-face business outside those methods is also listed as a higher-risk factor (art. 14(10)).
| Requirement | In person / land-based | Online / remote | Difference |
|---|---|---|---|
| How identity is verified | Original ID document presented (art. 10) | Only the five methods in art. 11(1) | Differs |
| Risk treatment | Risk-based | Art. 11(1) methods are not listed as higher risk; non-face-to-face business outside them is a higher-risk factor (art. 14(10)) | Differs |
| Document capture | Document checked in hand | Live capture, both sides or photo page, tilted; no uploads (FNTT V-314) | Differs |
| Signature | Not required for identification | Method 4(a): advanced e-signature within one hour | Differs |
| Liability | Firm responsible | Firm responsible, including when relying on others (art. 11(4)) | Same |
| Retention | ID copies, 8 years | ID data plus live video recording, 8 years (art. 19(11)) | Differs |
| Low-value e-money | EUR 150 conditions (art. 9(4)) | Same conditions | Same |
| Account access and payments | Not applicable | Strong customer authentication for online account access, electronic payments and risky remote actions (Law on Payments art. 58(1)) | Differs |
| Suspicious activity reporting | One working day | One working day (art. 16) | Same |
| Consumer credit contract | No separate identity rule in the consumer credit law | Remote contract with a new customer only after identity is established by law (art. 10(2)) | Differs |
No generic selfie-and-upload route
A plain document upload with a selfie is not a listed method. Automated flows fit art. 11(1)(4) only if they meet FNTT Order V-314: live capture in an application that blocks non-real-time submission, the original document shown as required, and either face and document captured together in one uninterrupted session (method 4(b)) or an advanced electronic signature completed within one hour (method 4(a)).
What is changing
From 10 July 2027 the EU Anti-Money Laundering Regulation (EU) 2024/1624 allows verification through an identity document and reliable sources or through eIDAS eID at substantial or high assurance (art. 22(6)). [Adopted, applies 10 Jul 2027]
6. Data protection and biometrics
The EU General Data Protection Regulation (EU) 2016/679 applies, supplemented by the Law on Legal Protection of Personal Data (No I-1374), supervised by VDAI (art. 7).
- Personal code. The Lithuanian personal code may be processed only on a GDPR art. 6(1) lawful basis, may not be published, and may not be used for direct marketing (art. 3).
- Biometric data. Face images processed to uniquely identify a person are a special category under GDPR art. 9(1); processing needs an art. 9(2) condition, such as explicit consent (art. 9(2)(a)) or substantial public interest on the basis of Union or Member State law (art. 9(2)(g)).
7. Sector-specific obligations
Instant payments, verification of payee and sanctions screening
Under Regulation (EU) 2024/886, payment service providers in the euro area, including Lithuanian e-money and payment institutions that offer credit transfers, have had to offer verification of the payee's name against the IBAN since 9 October 2025 (art. 5c). E-money and payment institutions must offer sending and receiving of instant euro transfers by 9 April 2027 (art. 5a). [Adopted, applies 9 Apr 2027] Providers offering instant transfers screen all their customers against EU targeted financial sanctions at least once every calendar day and on each change to the lists, instead of screening each instant transfer (art. 5d).
Financial sanctions
Under the Law on International Sanctions (No IX-2160), FNTT coordinates, supervises and ensures the implementation of financial sanctions in Lithuania. Anyone who freezes funds or economic resources must inform FNTT within two working days (Government Resolution No 535 of 25 May 2022, point 10). The Bank of Lithuania's sanctions instructions (Board Resolution No 03-98 of 30 May 2023) require screening of customers, counterparties, service providers, agents, shareholders and managers (point 9.4); the Bank issued warnings under them to two firms in October 2026.
Safeguarding client funds
A new version of the Bank of Lithuania's governance, internal control and client funds rules (Board Resolution No 247, as restated by Resolution No 03-33 of 6 March 2025) applies from 1 January 2026. Client funds must reach the segregated account by the end of the next working day (point 67.2), and the segregated balance must be reconciled at least on the first working day after any day with payment transactions (point 75.1).
Consumer credit and lending apps
A new version of the Law on Consumer Credit, adopted by Law No XV-822 of 16 April 2026 to transpose Directive (EU) 2023/2225, applies from 20 November 2026. [Adopted, effective 20 Nov 2026] Contracts concluded on or before 19 November 2026 stay under the old rules, except for the new information duties (XV-822 art. 4(3)).
8. Risk indicators and red flags
FNTT Director's Order No V-240 of 5 December 2014 (consolidated from 1 May 2024) lists criteria for recognising possible money laundering and suspicious operations. Those most relevant to payment and e-money apps:
Payment and e-money red flags (FNTT criteria)
- Evasive onboarding: the customer avoids giving identity or beneficial owner data, or submits documents of doubtful authenticity.
- Unreachable customer: contact details change often, the phone number never answers, emails go unanswered.
- Source of funds refused: the customer will not explain or evidence the origin of deposits.
- Transit account: incoming funds are quickly transferred onward or withdrawn as cash.
- Unrelated third parties: payments to, or funded by, third parties with no apparent link to the customer's activity.
- Shell indicators: one person is director or beneficial owner of several legal entities, or several entities share the customer's address.
9. Enforcement and penalties
AML Law fines on financial institutions are set as a share of total annual income (art. 39(1)); the Bank of Lithuania or FNTT can impose them (arts. 4(1), 30(1)):
| Breach | Fine |
|---|---|
| Breach of the AML Law | 0.5% to 5% of total annual income |
| Systematic or grave breach, or repeat within one year | 0.5% to 10% of total annual income, or EUR 2,000 to EUR 5,100,000 where 10% of income is below EUR 5,100,000 |
| Failure to provide requested information on time, or false information | 0.1% to 0.5% |
| Failure to carry out a binding instruction | 0.1% to 1% |
| Acting without a required permission | 0.1% to 1.5% |
| Shareholders or managers, for systematic or grave breaches | EUR 2,000 to EUR 5,100,000 (art. 39(2)) |
Other measures include warnings and temporary removal of managers (art. 36). Bank of Lithuania decisions can be appealed to the Regional Administrative Court within one month. Since 30 June 2026, a supervisor's fine decision is itself an enforceable document (Law No XV-914). Separately, breaches of the Law on Payment Institutions carry fines of up to 10% of total annual income for legal persons and up to EUR 50,000 for managers (art. 35).
Recent actions against e-money and payment firms, from the Bank of Lithuania enforcement register:
- UAB ZEN.COM, e-money institution (4 December 2025): EUR 1,800,000 fine and a warning, citing breaches including the live video identification rule (AML Law art. 11(1)(4)(b)), enhanced due diligence, monitoring and sanctions; the firm has filed a complaint.
- UAB Walletto, e-money institution (14 April 2026): EUR 290,000 fine for due diligence, monitoring and governance breaches.
- AlphaPay, UAB (21 July 2026) and UAB PAYTEND EUROPE (26 February 2026): licence revocations.
10. Recent changes and what to watch
- [Adopted, applies 10 Jul 2027] EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly; firms should review their art. 11 remote methods against it.
- [Adopted, applies 9 Apr 2027] E-money and payment institutions must send and receive instant euro credit transfers under Regulation (EU) 2024/886.
- [Adopted, effective 20 Nov 2026] New version of the Law on Consumer Credit (Law No XV-822) transposing Directive (EU) 2023/2225.
- [Evaluation started 13 Oct 2026] MONEYVAL's sixth-round evaluation of Lithuania began on 13 October 2026; the technical compliance questionnaire is due in March 2027 and the on-site visit is expected in autumn 2027.
- [Final draft, not adopted (30 September 2026)] AMLA's final draft technical standards on customer due diligence (AMLR art. 28(1)) await Commission adoption. The draft makes eIDAS identification means and qualified trust services the main remote route, with alternative non-face-to-face measures where a customer lacks access to them (draft arts. 6-7).
- [In force, 30 Jun 2026] Law No XV-914 makes supervisors' AML fine decisions directly enforceable.
- [In force, 1 Jan 2026] Restated Bank of Lithuania rules on governance, internal control and safeguarding for e-money and payment institutions.
- [In force, 9 Oct 2025] Verification of payee for euro credit transfers.
- [Proposed, not adopted] The EU Payment Services Regulation (procedure 2023/0210/COD) is still in the legislative procedure (November 2026).
11. What this means for identity verification
- Map every flow to a listed method. Art. 11(1) allows remote identification only by its five methods.
- Beyond onboarding. Verification of payee, and for providers offering instant transfers daily sanctions screening of the whole customer base, add identity-related checks to the payment flow itself.
How Identomat helps
Identomat runs identity verification, screening and monitoring for regulated businesses on one platform, with workflows you configure for each market. For the requirements in this guide, that means:
- Live video KYC and real-time document and face capture designed for continuous, uninterrupted sessions.
- ID document capture and verification, including NFC chip reading, with biometric liveness and face match.
- E-signatures to complete identification forms within the same onboarding session.
- AML screening against sanctions, PEP and adverse-media lists at onboarding and on an ongoing basis.
- KYB and beneficial owner verification with a configurable no-code workflow and audit trail.
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
Only if the process meets the live video rules. The AML Law allows remote identification by live video capturing the customer's face and original ID together, under the Financial Crime Investigation Service's technical requirements: capture must be continuous and real-time, the document shown in a set way and tilted, and uploads of earlier photos made impossible. A simple upload of a selfie and a document image is not a listed method.
An e-money institution needs at least EUR 350,000 of initial capital. A payment institution needs EUR 20,000 if it only provides money remittance, EUR 50,000 if it only provides payment initiation, and EUR 125,000 for cash, transfer, issuing and acquiring services. Restricted-activity licences, valid only in Lithuania and capped by volume, carry no capital requirement. The Bank of Lithuania issues all of these licences.
A suspicion must be reported to the Financial Crime Investigation Service immediately and no later than one working day after it arises. If a specific transaction is suspicious, the firm must suspend it and report within three working hours. Separately, cash or crypto-asset operations of EUR 15,000 or more are reported within seven working days. Identification records, including video, are kept for eight years.
Get the PDF guide
Enter your details and the download button will switch on.