Insurance & Insurtech Compliance in Lithuania

Lithuania is open to digital insurers and insurtechs. Licensing, conduct and AML supervision of the sector sit with one authority, the Bank of Lithuania, while the Financial Crime Investigation Service (FNTT) receives suspicious transaction reports and coordinates financial sanctions.

The biggest practical obstacle for a new online life insurer is the fixed statutory list of remote identification methods. Remote onboarding is designed around electronic identity, qualified signatures or live video under FNTT technical rules, so a product built on generic document and selfie checks needs one of those methods added.

1. Who regulates this sector

2. Licensing and authorisation

Under the Law on Insurance (No IX-1737, consolidated version from 2 July 2026) art. 12, an insurance or reinsurance undertaking may operate only with a licence issued by the Bank of Lithuania. The licence is valid in every other EEA state through branches or the freedom to provide services. Under arts. 73 and 74, an insurer from another EEA state may serve Lithuania or open a branch once its home supervisor has sent the required documents to the Bank of Lithuania. Art. 16 requires the Bank of Lithuania to decide within six months of receiving a complete application. Art. 8 prohibits one undertaking from carrying on both life and non-life insurance, subject to narrow exceptions, so a composite insurtech needs two licensed entities.

Distribution licences and registrations

Art. 2(29) recognises two types of insurance intermediary: insurance broker firms and insurance agents. Under art. 158⁶, a broker firm may operate from the day the Bank of Lithuania enters it in the list of broker firms. An agent may operate from the day an insurer enters it in that insurer's list of agents, which the insurer must publish on its website.

Embedded insurance sold alongside goods or services usually falls under the ancillary insurance intermediary category in art. 2(61¹): a person who distributes insurance as a secondary activity, where the cover complements a good or service and does not include life or liability cover unless it complements that person's main professional activity. Staff and agents involved in distribution must meet the knowledge and competence requirements of art. 158¹.

3. AML, KYC and customer due diligence

The Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275, consolidated version 30 June to 31 December 2026) art. 2(7) defines financial institutions to include insurance undertakings carrying on life insurance, insurance broker firms intermediating life insurance, and Lithuanian branches of foreign ones. Non-life insurers and non-life brokers are not obliged entities. Insurance agents are not named separately, so the insurer's own programme covers customers onboarded through its agents.

When to identify

Art. 9: before starting a business relationship, before occasional transactions of EUR 15,000 or more, and whenever there is suspicion or doubt about earlier data.

Payout beneficiary

Art. 9(6): record a named beneficiary's name, personal code (or date of birth) and citizenship. For beneficiaries designated by class, collect enough information to identify them at payout.

Enhanced checks at payout

Art. 14(7): at payout, assess the beneficiary's risk and identify a legal-entity beneficiary's beneficial owner. If a politically exposed person poses higher risk, inform senior management and apply enhanced monitoring.

Simplified checks

Art. 15: life policies with a low annual or single premium are a lower-risk factor. Neither the law nor the Bank of Lithuania instructions set a euro figure.

Beneficial ownership

Under art. 2, a natural person holding 25% plus one share, or more than 25% of the customer's ownership, directly or through controlled companies, is a beneficial owner, as is anyone who controls the customer by other means.

Reporting and records

Under art. 16, a suspicion must be reported to FNTT immediately and no later than one working day after it arises. A suspicious transaction must be suspended and reported within three working hours of suspension, whatever its amount. Under art. 20(1), financial institutions report to FNTT any single or linked cash transactions of EUR 15,000 or more. Art. 19 requires identity document copies, beneficiary data and live video recordings to be kept for eight years from the end of the relationship, and business correspondence for five years.

Bank of Lithuania instructions

Board Resolution No 03-17 of 12 February 2015 (new version from 1 March 2020, consolidated from 18 March 2025) sets binding AML instructions for financial market participants, expressly including life insurers and life brokers. Point 3 requires firms to apply them together with EBA guidelines EBA/GL/2021/02 on risk factors, whose Guideline 14 is specific to life insurance undertakings, and EBA/GL/2022/05 on AML compliance officers.

4. Identity verification and onboarding

In person, art. 10 of the AML law requires a Lithuanian or foreign identity document, a Lithuanian residence permit, or an EEA driving licence that meets Annex I of Directive 2006/126/EC. The document must show name, surname, personal code (for foreigners, date of birth and residence permit details), photo, signature and citizenship.

Remotely, art. 11(1) allows identification only by:

• relying on a third party under art. 13;
• an electronic identification means issued in the EU under a scheme of assurance level high or substantial under Regulation (EU) No 910/2014 (eIDAS);
• a qualified electronic signature;
• live video, either capturing the original identity document and confirming identity with at least an advanced electronic signature, or capturing the customer's face together with the original identity document they show;
• a first payment from the customer's own account at an EU-regulated (or equivalent) credit, payment or e-money institution, combined with a certified paper copy of the identity document.

Art. 11(4) leaves responsibility with the insurer whichever method is used. Art. 11(6) requires financial institutions to follow the EBA guidelines on remote customer onboarding solutions.

Live video and photo transmission

FNTT Director's Order No V-314 of 30 November 2016 (consolidated from 12 January 2021) sets the technical requirements for live video identification. Transmission must be continuous and in real time. A live photo stream is allowed only with software that makes non-real-time submission impossible. The document must be tilted several times to show it is genuine. In the face-and-document mode, face and document are shown together and the customer answers identity questions on clear audio. The process must be stopped if transmission is not in real time or is interrupted, if image or sound quality prevents identification, or if the document appears forged; recordings must be protected from alteration.

5. Digital channels: what's different

Bottom line: the due diligence duties are the same online, but a life insurer may only identify a customer remotely through the five methods listed in art. 11 of the AML law, and must keep the video evidence for eight years.

No generic document-and-selfie route

An uploaded document image with a selfie is not a stand-alone method under art. 11(1). It qualifies only as part of a live video or real-time photo stream that meets FNTT Order V-314, including software that prevents non-real-time submission. EBA Guideline 14.10 likewise treats non-face-to-face sales without eIDAS-grade safeguards as risk-increasing.

Electronic delivery of policy information

Law on Insurance art. 93¹ requires pre-contract and distribution information on paper unless the conditions for electronic delivery are met. For a durable medium other than paper, the customer must have regular internet access (shown by giving an email address) and must have chosen that format. Information on a website must be addressed personally to the customer, and a paper copy must be provided free on request. This applies to life and non-life products alike.

What is changing

The EU Anti-Money Laundering Regulation [Adopted, applies from 10 Jul 2027] replaces the national list with art. 22(6): an identity document plus reliable independent sources where relevant, or eIDAS electronic identification at substantial or high level and relevant qualified trust services. AMLA's final draft technical standards on customer due diligence [Final draft, not adopted] (30 September 2026) would allow other remote document-verification tools only where neither route is available, with holder-matching, secure capture and time-stamped records, and the firm must justify each use. Separately, eIDAS art. 5f(2), as amended by Regulation (EU) 2024/1183, requires private firms other than micro and small enterprises that must use strong user authentication for online identification, including in financial services, to accept European Digital Identity Wallets on the user's request within 36 months of the wallet implementing acts. Those acts entered into force on 24 December 2024, which sets the deadline at 24 December 2027.

6. Data protection and biometrics

The EU General Data Protection Regulation (GDPR) applies as supplemented by the Law on Legal Protection of Personal Data (No I-1374, consolidated from 30 June 2026), supervised by VDAI. Law on Insurance art. 95(4) allows insurers and intermediaries to process the personal data of the insured person, the beneficiary and the premium payer without consent when concluding and performing a contract, but excludes special categories of data.

Facial images processed to uniquely identify a person are biometric data (GDPR art. 4(14)) and a special category under art. 9(1). Face matching in onboarding therefore needs an art. 9(2) condition, most commonly explicit consent under art. 9(2)(a). The Lithuanian law adds no biometric-specific conditions. Its art. 3 allows the personal code to be processed on any GDPR art. 6(1) basis, but it may not be made public or used for direct marketing.

7. Sector-specific obligations

Demands and needs before every contract

Law on Insurance art. 158²(1) requires every distributor, online or offline, to establish the policyholder's demands and needs before the contract is concluded and to offer only a contract consistent with them. Where advice is given, the recommendation must be personalised. Product oversight and governance rules under Commission Delegated Regulation (EU) 2017/2358 also apply and are enforced (see section 9).

Oversight of agents and other intermediaries

Chapter X of the Bank of Lithuania AML instructions (points 77 and 78) requires a firm selling through intermediaries to brief them on its AML policies and risks, train them to spot suspicious activity, and audit them regularly; the firm remains responsible for compliance. Chapter VII of the Bank of Lithuania sanctions instructions (Resolution No 03-98 of 30 May 2023) sets the same duties for sanctions. The Bank of Lithuania's letter of 20 August 2026 named distribution through intermediaries as a significant ML/TF risk where due diligence is delegated without effective oversight.

Sanctions

Under the Law on International Sanctions (No IX-2160, consolidated from 30 June 2026), FNTT provides information on persons subject to sanctions to those who implement them. The Bank of Lithuania sanctions instructions (consolidated from 30 December 2025) apply to all financial market participants it supervises, life and non-life insurers alike, and replaced the former Insurance Supervisory Commission's sanctions instructions.

Digital operational resilience

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 to insurers and to intermediaries other than micro, small and medium-sized ones. It covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. Under an amendment adopted on 19 June 2025 (Law No XV-297), Law on Insurance art. 205 makes a breach of DORA a ground for Bank of Lithuania supervisory measures.

8. Risk indicators and red flags

Life insurance indicators (FNTT, Bank of Lithuania, EBA)

• Interest in exit, not cover: the applicant ignores policy terms but asks about early termination (FNTT Order V-240, 1.6).
• Large cash premium: a life premium, or part of one, above EUR 25,000 paid in cash (V-240, 2.19).
• Unrelated third-party payer: a premium above EUR 25,000 paid by a third party with no visible link or purpose (V-240, 2.20; also 2.7).
• Unusually large sum insured for the customer's profile (V-240, 2.34).
• Early surrender to a stranger: the policy ends soon after issue and an unrelated third party is named as payee (V-240, 2.35).
• Frequent surrenders or transfers: unexplained surrenders paid to different bank accounts, or repeated transfers to other insurers (EBA Guideline 14.8).
• Self-declared PEP status only: politically exposed persons identified solely from customer input, without verification (Bank of Lithuania, January 2021).
• Formal source-of-funds checks: documents collected without assessing whether they support the declared circumstances (Bank of Lithuania, August 2026).

9. Enforcement and penalties

Penalties are set as a share of total annual income, with fixed amounts as fallbacks:

AML law art. 36 also provides for warnings, temporary restrictions on disposing of funds and, for systematic, serious or repeated breaches, temporary removal of managers and bans or restrictions on branch activity.

Recent actions

• Compensa Life Vienna Insurance Group SE, 14 May 2026: EUR 250,000 under an administrative agreement for breaches of Law on Insurance arts. 90¹, 158², 158³ and 158⁵ and Delegated Regulation (EU) 2017/2358 art. 7 (product oversight and distribution).
• ERGO Life Insurance SE, 28 January 2025: public announcement of breaches under an administrative agreement, for financial reporting and disclosure failures (Law on Insurance art. 52(3) and Bank of Lithuania reporting rules).

As of November 2026, the measures against insurers in the Bank of Lithuania's public register concern conduct, distribution, reporting and prudential rules; none is an AML sanction.

10. Recent changes and what to watch

• 10 July 2027: [Adopted, applies from 10 Jul 2027] The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies to life insurers and to life intermediaries that collect premiums or do not act under an insurer's responsibility. Arts. 44 and 47 restate the beneficiary and politically exposed person checks at payout.
• 13 October 2026: [Evaluation under way] Lithuania's sixth-round MONEYVAL evaluation began. The technical compliance questionnaire is due in March 2027 and the on-site visit is planned for autumn 2027.
• 30 September 2026: [Final draft, not adopted] AMLA finalised draft technical standards on customer due diligence for submission to the European Commission, including the conditions for remote document-verification tools from 2027.
• 29 April 2026: [Bill, not enacted] Bill XVP-1449 to amend AML law arts. 2, 24, 25² and 28 (JADIS beneficial ownership data and the national risk assessment) was registered in the Seimas.

11. What this means for identity verification

• Method selection: remote life onboarding should use eID at substantial or high assurance, a qualified electronic signature, or live video or real-time photo capture that meets FNTT Order V-314. Asynchronous document uploads alone are not enough today; under the draft 2027 EU standards they would be a justified fallback only.
• Data set: capture name, personal code (or date of birth) and citizenship for the customer and each named beneficiary; for class beneficiaries, store enough to identify them at payout.
• Payout as a second checkpoint: identity, beneficial ownership and politically exposed person checks on the beneficiary must be completed before funds are paid.
• Retention: keep identity evidence, including video and audio, for eight years after the relationship ends, protected from alteration.
• Biometrics: face matching needs a GDPR art. 9(2) condition such as explicit consent.
• Non-life products: AML due diligence does not apply, but sanctions screening, electronic delivery conditions and demands-and-needs testing still do.