iGaming & Gambling Compliance in Lithuania

Lithuania's online gambling market is open but tightly licensed. Any company organising remote casino, slots, betting, totalisator or bingo for players in Lithuania needs a national remote licence and permit; a licence from another EU country does not authorise play in Lithuania.

The Gaming Control Authority under the Ministry of Finance licenses and supervises operators and is also their AML supervisor. Suspicious activity is reported to the Financial Crime Investigation Service (FNTT), Lithuania's financial intelligence unit.

The biggest obstacle for a new entrant is the combination of high entry costs (paid-up capital of up to EUR 1,158,000 plus the licence tax) and a player onboarding flow that must deliver remote identification, age and self-exclusion checks, source-of-funds information and mandatory limits before the first stake.

1. Who regulates this sector

The Authority licenses operators under the Gaming Law (No IX-325, Article 4) and supervises their AML compliance under the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275, "AML Law", Article 4(3)). Ten companies held remote permits (5 November 2026).

2. Licensing and authorisation

Only a public or private limited company (or the Lithuanian branch of an operator authorised in another EEA state or Switzerland) may organise gambling. Remote gambling is one of six licence types (Article 5(1)(6)); a company may hold all of them.

Three conditions for online operation

To offer remote table games, slots, betting, totalisator or bingo, a company needs (Article 8¹, Article 20¹(1)):

• a licence to organise remote gambling;
• a permit to organise remote gambling, listing websites, payment accounts, server addresses and the certified platform (Article 21(4¹));
• remote gaming regulations approved by the Authority.

Capital, tax and timing

Paid-up capital

EUR 1,158,000 for remote table games or category A slots; EUR 289,000 for remote betting, totalisator, category B slots or bingo; EUR 144,000 for remote horse totalisator (Gaming Law, Article 13).

Winnings reserve

At least EUR 72,400 set aside only for paying remote winnings, restored within 2 calendar days if it falls below that level (Article 20⁸).

Licence tax and fees

EUR 500,000 one-off tax for a remote licence, paid before issue (Law on Lotteries and Gambling Tax, Articles 5¹ and 6); gambling tax rate 22 per cent (Article 5). State fees from 3 October 2026: EUR 1,042 for the remote permit, EUR 1,266 for approving the gaming regulations.

Timeline

The licence is issued or refused within 30 days of complete documents and the opinions of the vetting bodies, which have 20 working days (Article 6(6)-(7)). A permit decision takes 30 days, 60 at most (Article 21(6)).

Shareholders and managers are vetted, and shareholders must evidence the origin of their funds (Articles 6(1) and 7¹). The licence has no expiry date (Article 6(9)) but is revoked if activity does not start within a year (Article 7²(8)(7)).

3. AML, KYC and customer due diligence

Gambling and lottery companies are obliged entities under the AML Law. The Authority's binding instructions (Order No DIE-450 of 17 June 2020, consolidated from 1 January 2026) apply it to gambling.

When identity must be established

• Business relationship: before it begins (AML Law, Article 9(1)(1)). For online gambling, the remote gambling contract starts the relationship, so identification comes before the first stake.
• Gambling transactions above EUR 1,000: identify, verify and register the customer when a stake is paid in, winnings are paid out or cash is exchanged for chips (or back), including linked operations within a day (Article 9(9) and 9(11)(6)-(7)).
• Casino entry: every person entering a casino is identified and registered (Article 9(9)).
• Doubts or suspicion: whenever earlier data look wrong or money laundering is suspected (Article 9(1)(7)-(8)).

Know your customer and source of funds

Operators collect at least name, personal code, date of birth, citizenship, contact details, politically exposed status, source of funds, whether the customer plays on their own behalf, and the purpose of the relationship (DIE-450, point 38⁴). The Authority's 2026 decisions treat collecting source of funds before play, and matching stakes to it, as core. Stakes may be capped by risk (points 39-56); while a customer withholds requested information (the deadline must be at least 5 working days), the operator may stop all play (points 57-57¹).

Reporting and records

• Suspicious activity: report to FNTT no later than one working day after the suspicion arises; suspend a suspicious transaction and report within 3 working hours (AML Law, Article 16(1)-(2)).
• Cash: report any single cash receipt of EUR 15,000 or more to FNTT within 7 working days (Article 20(3) and (5)).
• Registers: keep a register of customers and operations above the EUR 1,000 threshold (Article 19(4)) and report stakes and winnings above it to the State Tax Inspectorate (Gaming Law, Article 20(4)).
• Retention: identity documents, live video recordings and registers for 8 years after the relationship ends; transaction documents for 8 years from the transaction (AML Law, Article 19(10), (11) and (13)).

Sanctions screening runs at onboarding and on list or data changes (DIE-450, point 72.1).

4. Identity verification and onboarding

Remote gambling contracts may be concluded only with natural persons, never through a representative. Before concluding one, the operator obtains identity data and checks that the person is 21 or over and not barred (Gaming Law, Article 20²(2)). It may be signed at the operator's premises or online (Article 20³(1)-(2)); each player gets one set of credentials, and the contract runs one year unless it says otherwise (Article 20³(5)-(6)).

Permitted remote identification methods

Where the customer is not physically present, the AML Law allows only these methods (Article 11(1)):

• reliance on a third party's identification under Article 13;
• an electronic identification means issued in the EU under a scheme of substantial or high assurance under Regulation (EU) No 910/2014 (eIDAS);
• a qualified electronic signature;
• live video, capturing the original identity document and either confirming identity with at least an advanced electronic signature, or capturing the customer's face together with the original document;
• a payment from the customer's own account at an EU (or equivalent) credit, payment or e-money institution, plus a certified paper copy of the identity document.

The operator remains responsible (Article 11(3)-(4)). If a player's document has expired, identity must be re-verified by an Article 11 method before winnings above EUR 1,000 are paid (Authority FAQ).

Live video and live photo requirements

FNTT Order No V-314 (consolidated from 12 January 2021) allows the face-and-document route as a continuous live video with identity questions, or as a live photo transmission through an application that makes non-real-time transmission impossible. Accepted documents are an identity card or Lithuanian residence permit (both sides), a passport photo page or a driving licence; on video the document is tilted several times to show it is genuine. The session is stopped, not resumed, on a delayed feed, a doubtful face match or a second person; a seemingly forged document is pursued only to report to FNTT. Recordings must be tagged with the customer's name, personal code, IP address and date (points 2, 5-7, 12-26).

5. Digital channels: what's different

Bottom line: the age limit and the self-exclusion bar are the same in both channels, but online play needs its own licence and permit, full remote identification before the first stake, mandatory player-set limits and payments only through the player's own account.

Mandatory limits and session information

Before playing remotely, the player must set daily, weekly and monthly deposit limits, a maximum stake and stake totals, and a session time limit. The operator may not preselect them. Increases apply after 48 hours at the earliest, decreases within 15 minutes; the screen must show a session clock and the remaining time (Gaming Law, Article 10⁴(3)-(4); Responsible Gambling Rules, Order No DIE-245, points 34-61).

Platform controls

Remote stakes come only from the player's own payment account and winnings return to it (Article 20⁵(1) and (4)). The platform requirements (Order No DIE-202, in force 1 November 2025, points 24-31) set the controls in the table above and require IP logging but no geolocation checks.

6. Data protection and biometrics

Identity copies and video recordings are kept 8 years after the relationship ends, extendable by 2 years (AML Law, Article 19(11) and (16)); platform data 8 years after the contract ends (Gaming Law, Article 16(8)); signed contracts 10 years (Article 20³(9)).

Biometric data used to uniquely identify a person is a special category under Article 9(1) of the General Data Protection Regulation (GDPR), processed only under an Article 9(2) condition. FNTT requires the customer's consent to live video transmission (Order No V-314, point 25.1). The personal code may be processed only on a GDPR Article 6(1) basis and may not be published or used for direct marketing (Law on Legal Protection of Personal Data, Article 3).

7. Sector-specific obligations

Self-exclusion register

Anyone may ask the Authority or an operator to bar them from gambling and remote gambling. The chosen period cannot be shorter than 6 months; if none is stated, the bar lasts 2 years. A request can be withdrawn or shortened only after 6 months (Gaming Law, Article 10(20)-(21)). An operator finding a barred person playing online must stop the service and notify the Authority (Article 10(10¹)). At 31 October 2026 the register held 22,352 valid requests.

Problem-gambling controls

When monitoring shows high problem-gambling risk, the operator must within 30 minutes inform the player and suspend play, including log-in, for 48 hours (Article 10⁴(1), (5)-(6)).

Blocking illegal operators

The Authority may order access to an illegal operator's content disabled and, with an administrative court's permission, order payment providers to stop all payments to it within one working day (Article 20⁷(1)-(2)); card payments for stakes and winnings may go only to operators on its published list (Article 20⁷(4)). By September 2026, 2,204 illegal sites had been blocked.

Winnings tax

Residents' gambling winnings are taxed as personal income on the year's net result (winnings less documented stakes), per the State Tax Inspectorate, to which operators report stakes and winnings above EUR 1,000 (Gaming Law, Article 20(4)).

Advertising and bonuses

Gambling advertising is banned except, until 31 December 2027, short betting-brand clips and static web banners (Article 10(9)(4)); from 1 January 2028 that exemption and sponsorship announcements end (Article 10(9³)). Encouraging participation "in any form and by any means" has been banned since 1 July 2021 (Article 10(19)). Until 30 June 2025 the text expressly named promotions, discounts, gifts and trial games; the current wording drops that list, and none of its exceptions covers bonuses.

8. Risk indicators and red flags

Indicators drawn from Gaming Control Authority decisions, rules and its 2026 supervision strategy

• Unexplained stakes: large stakes with no documented or plausible source of funds.
• Escalating activity: growing gambling activity, especially from a customer rated high risk.
• Losses across operators: one player losing large sums at several licensed operators at once.
• FNTT enquiry: a request for information from the financial intelligence unit about a customer.
• Shared credentials: a player letting others use their login; the contract must end, with no new contract for a year.
• Third-party funding: agreements to finance another person's play and share winnings, which the law does not allow.
• Non-EEA funding: deposits from accounts opened outside the EEA, which the Authority scores as a risky payment method.
• Prediction-market fronts: event contracts with fixed odds offered without a licence, treated as illegal betting.

9. Enforcement and penalties

Gaming Law fines start at the range midpoint, moving 0.15 per cent of revenue per mitigating or aggravating factor (Article 29²(5)); licences can be suspended and revoked (Article 7²).

Recent actions

• In April and May 2026 the Authority fined VSGA (Casino Admiral), Baltic Bet (Optibet) and Olympic Casino Group Baltija (Olympic Casino, Olybet) EUR 468,350 each for not obtaining and checking a player's source of funds, inadequate monitoring and failing to report suspicious transactions to FNTT. The decisions can be appealed.
• On 29 January 2026 (announced 2 February 2026) Baltic Bet was separately fined EUR 330,600 for failing to collect and verify a client's source of funds; the decision has been appealed. In March 2025 Olympic Casino Group Baltija was fined almost EUR 8.4 million for insufficient source-of-funds checks and only formal monitoring of one online player who lost EUR 6.4 million between 2016 and 2021.
• In December 2025 Tete-a-tete kazino was fined EUR 341,049 for failing to monitor a customer's source of funds and for terminating a remote contract without legal grounds; the decision is under appeal.

10. Recent changes and what to watch

• [Adopted, applies 1 Jan 2028]End of betting advertising and sponsorship announcements (Law No XIV-3132): betting brands lose their TV, radio and internet exemption, so player acquisition will rely on owned channels.
• [Adopted, applies 10 Jul 2027]EU Anti-Money Laundering Regulation (EU) 2024/1624: gambling providers must apply due diligence on stakes or winnings of at least EUR 2,000 (Article 19(5)), under a directly applicable EU regulation.
• [Adopted, effective 1 Jan 2027]Self-exclusion register put on a statutory footing (Law No XV-517): requests can be filed through the register's own information system, and the minimum 6-month period runs from the Authority's confirmation.
• [Issued 4 Nov 2026]Risk-based supervision strategy (Order No DIE-366, 4 November 2026): 17 risk indicators, including deposits over EUR 1,000 and from non-EEA accounts; high-risk operators inspected on site at least every 3 years.
• [In force]First prediction market blocked (8 September 2026): after the Authority found Polymarket offered betting and obtained a court decision, access was blocked and payments to its operator cut off.
• [In force]Remote contract termination guidelines (Order No DIE-208, June 2026): contracts must end when identity data are missing or false, and may end when information requests are ignored or high risk persists after a 48-hour suspension.
• [In force]Responsible-gambling reform (Law No XIV-3080, from 1 November 2025): age 21 everywhere, mandatory limits, revenue-based fines.

11. What this means for identity verification

• Verify before play, not at withdrawal. No stake can be accepted before the remote contract is in place and identity has been verified by an AML Law Article 11 method.
• Use only the permitted methods. Automated selfie-and-document capture fits the FNTT live photo route only if the app guarantees real-time, uninterrupted capture and tags each record with name, personal code, IP and date; otherwise use another Article 11 method.
• Capture source of funds at onboarding; monitor stakes against it.
• Re-verify on change. Expired documents must be refreshed by an Article 11 method before payouts above EUR 1,000. Repeat checks may rely on identity data already on file (a 2020 court ruling on casino chip exchanges, upheld on appeal; a 2026 Authority decision on venue entry).
• Keep evidence 8 years: recordings, documents, IP and login history.