Travel & Hospitality Compliance in Lithuania

Lithuania is open to online travel and accommodation businesses, and no separate online licence exists. The legal identity burden falls on the accommodation provider at check-in and on air carriers at booking and boarding, not on a financial crime regime.

The principal authorities are the Ministry of the Economy and Innovation (tourism policy and the National Tourism Information System), the State Consumer Rights Protection Authority (certificates, lists and fines), and the State Border Guard Service and Migration Department for entry and stay.

The biggest practical obstacle for a new entrant is building a check-in flow that captures document data reliably and pushes it to the state system within 24 hours, for every guest including Lithuanian citizens.

1. Who regulates this sector

Passenger name record (PNR) data goes to the police unit designated by the Police Commissioner General (Law on the Fundamentals of Transport Activities, art. 19¹(2)): the Passenger Information Unit of the Lithuanian Criminal Police Bureau. The NTIS is operated on the Ministry's behalf by the public institution "Keliauk Lietuvoje", appointed by Minister of the Economy and Innovation Order No 4-25.

2. Licensing and authorisation

The Law on Tourism (Turizmo įstatymas, No VIII-667, consolidated version from 1 November 2025) sets four entry routes. None distinguishes online from offline sales. The "institution authorised by the Government" that runs them is the State Consumer Rights Protection Authority (its regulations, Government Resolution No 1333, para. 12).

Tour organisers

A tour organiser's certificate, decided within 20 working days of a complete application (art. 9). The organiser must hold insurance or a credit-institution guarantee issued in the EU or EEA (art. 12). The minimum is EUR 3,000 for domestic and inbound operators and EUR 50,000 for outbound operators (EUR 20,000 where the last four quarters' revenue was under EUR 1,000,000); outbound and inbound operators must hold the largest of several amounts calculated under art. 13.

Travel retailers and linked arrangements

Travel retailers (travel agents) file a declaration (art. 19). Sellers of linked travel arrangements (turizmo paslaugų rinkinys) file a declaration and hold insurance or a bank guarantee (arts. 21 and 24). Both appear on public lists.

Star-rated accommodation

Hotels, motels, guest houses and campsites need a classification certificate and at least five rooms or pitches (arts. 31 and 33).

Non-classified accommodation

Hostels, rural tourism, holiday homes and private accommodation (short-term lets) file a notification before opening and join the list the next day (art. 34).

The Authority publishes lists of all these providers. While a tour organiser's certificate is suspended, it may take on no new obligations to travellers (art. 10(4)). Currency exchange in hotels or at airports is a separate activity: currency exchange operators are financial institutions under the AML Law, with AML requirements set by the Bank of Lithuania.

3. Identity framework (AML rules do not apply)

Tour organisers, travel retailers, airlines and accommodation providers are not obliged entities under the Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275, consolidated version 30 June to 31 December 2026). The trade-based category in art. 2(10) covers dealers in goods and other assets worth EUR 10,000 or more paid in cash, which does not cover the sale of travel and accommodation services.

The exception is currency exchange. Currency exchange operators are financial institutions (art. 2(7)), and the Bank of Lithuania sets their AML requirements (art. 4(1)). They must identify and verify the customer before a business relationship, before occasional transactions of EUR 15,000 or more, and before cash currency exchange of EUR 3,000 or more, whether in one or several linked operations (art. 9(1)).

For the rest of the sector, identity is governed by three non-AML frameworks:

• Guest registration under the Law on Tourism, art. 32, and the NTIS regulations (Order No 4-25).
• Border and stay control under the Law on the Legal Status of Aliens (No IX-2206) and EU Schengen rules.
• Passenger data under the Law on the Fundamentals of Transport Activities (No I-1863), art. 19¹, which applies to air carriers.

Financial sanctions apply to every business, AML-obliged or not. Under the Law on International Sanctions (No IX-2160, consolidated from 30 June 2026), FNTT informs the natural and legal persons implementing sanctions about entities subject to them, so bookers, payers and corporate clients should be screened.

4. Identity verification and onboarding

Accommodation: the 24-hour rule

Since 1 January 2024 (Law No XIV-1464, art. 2(2), which replaced the earlier paper registration cards), every accommodation provider must ensure that each guest, except minor children travelling with them, confirms their identity by presenting a valid identity document. Within 24 hours of the day of accommodation, the provider must submit the data in the document electronically to the NTIS, in the way the Minister of the Economy and Innovation sets (Law on Tourism, art. 32(1)(3)). The rule covers Lithuanian citizens as well as foreigners. The data also serves Article 45(1)(b) of the Convention implementing the Schengen Agreement.

Since 1 January 2025 (Law No XIV-3014), rural tourism providers follow a lighter rule (art. 32(2)): they check the identity documents of foreign guests only and report foreigners' document data, plus the number of Lithuanian guests and nights, at least once a month.

The NTIS regulations (Order No 4-25, consolidated from 6 June 2026, para. 14.3) list the guest data held: name and surname, date of birth, the state that issued the identity document, the document number, the number of accompanying minors, place of residence, arrival and departure dates, whether the trip was bought through a tour organiser, and the main purpose of the trip. In May 2025 the Ministry of the Economy and Innovation said it had decided to drop the document number and address fields from the "E. turistas" subsystem (Government conclusion No NV-1130), but the order has not been amended, so integrators should confirm the fields the live interface requests.

What the law does not require

The law does not require a document copy, a selfie, liveness detection or any biometric check for guests, and it does not define an assurance level. Providers must also register advance reservations (art. 32(1)(2)).

Visas, travel authorisations and the border

Third-country nationals enter under Regulation (EU) 2018/1806. Visa-exempt travellers may stay 90 days in any 180-day period and, once ETIAS operates, need a valid travel authorisation (Law on the Legal Status of Aliens, art. 11(2)). Schengen and national visa applicants give a facial image and ten fingerprints, which are entered in the Register of Aliens (arts. 12¹(3) and 17(2)). The State Border Guard Service checks entry conditions at the border (art. 9).

5. Digital channels: what's different

Bottom line: the guest identity and reporting duties are channel-neutral, so a contactless or app-based check-in must meet the same 24-hour NTIS rule as a front desk. The real digital differences sit at EU level: ETIAS checks that carriers run through a digital gateway, and data-sharing duties for short-term rental platforms.

Contactless check-in

Article 32 requires that the guest "patvirtintų savo tapatybę" (confirms their identity) by presenting a valid identity document, and that the provider transmits the document data electronically. It does not require a physical inspection, so kiosks and online pre-check-in are not excluded, but the provider remains responsible for the document's validity and the 24-hour deadline.

Online short-term rental platforms

Regulation (EU) 2024/1028 on data collection and sharing for short-term accommodation rental services has applied since 20 May 2026. Platform data-sharing applies where a member state imposes it and runs a host registration procedure (art. 4(2)); platforms must then collect and display registration numbers before listing (art. 7). The Law on Tourism (consolidated from 1 November 2025) contains no such procedure: a private host in Lithuania is a non-classified accommodation provider that notifies the State Consumer Rights Protection Authority (art. 34), and the guest registration duty applies to every booking regardless of the platform.

ETIAS: checked digitally before boarding

Air carriers, sea carriers and international carriers transporting groups overland by coach must query the ETIAS Information System through the carrier gateway, including by mobile solutions, before boarding (Regulation (EU) 2018/1240, art. 45). [Adopted, start date not yet set] The Commission determines the start date once the conditions in art. 88 are met; no such decision had been adopted as of 9 November 2026.

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data (No I-1374, consolidated from 30 June 2026) apply to guest and passenger data, under the supervision of the State Data Protection Inspectorate. Guest registration is a legal obligation (Law on Tourism, art. 32), which gives the provider a legal basis under GDPR art. 6(1)(c) for the data that obligation covers.

The national personal code (asmens kodas) may be processed only on a GDPR legal basis, may never be published and may not be used for direct marketing (Law on Legal Protection of Personal Data, art. 3). Nothing in the tourism rules requires guest biometrics. A provider that adds face matching to check-in is processing biometric data to uniquely identify a person, which is a special category under GDPR art. 9 and needs an exception such as the guest's explicit consent (art. 9(2)(a)).

Retention is set by system rules: tourist card data in the NTIS is kept for five years (Order No 4-25, para. 37). Air carriers' PNR data is kept by the police unit for three years, or five years for high-risk flights or when the terrorism threat level is above low, and certain data elements are depersonalised and masked six months after they are recorded (Law on the Fundamentals of Transport Activities, art. 19¹).

7. Sector-specific obligations

Air carriers: passenger name records

Air carriers must send booking and departure-control data on passengers arriving in or leaving Lithuania to the Passenger Information Unit, free of charge and by electronic means, no later than 48 hours before scheduled departure and again immediately after boarding closes (Law on the Fundamentals of Transport Activities, art. 19¹(1), consolidated version 30 June 2026 to 31 December 2027). Regulation (EU) 2025/12 on advance passenger information for border control applies two years after the EU router starts operations. [Adopted, date depends on router start]

Carriers' document checks

Air and sea carriers, and coach operators carrying groups internationally on special and charter services, must ensure that foreigners they bring into Lithuania hold the travel documents required for entry, and may check them (art. 20). Once ETIAS operates, they must also verify that visa-free travellers hold a valid travel authorisation (Regulation (EU) 2018/1240, art. 45).

Restrictions on Russian and Belarusian citizens

The Law on the Imposition of Restrictive Measures in View of Military Aggression against Ukraine (No XIV-1888, consolidated from 3 May 2026) suspends Lithuanian visa missions abroad from accepting Schengen visa applications from Russian and Belarusian citizens unless the Ministry of Foreign Affairs intermediates, and suspends national visa applications through external service providers (art. 3). The law applies until 31 December 2027.

Entry/Exit System

The EU Entry/Exit System started on 12 October 2025 (Commission Implementing Decision (EU) 2025/1544) with a 180-day progressive roll-out (Regulation (EU) 2025/1534, art. 2(1)).

8. Risk indicators and red flags

Identity and compliance indicators in travel and accommodation

• No document at check-in: a guest cannot or will not present a valid identity document (Law on Tourism, art. 32(1)(3)).
• Data mismatch: the name or date of birth on the booking differs from the document whose data must go to the NTIS (art. 32(1)(2) and (3)).
• Unregistered occupants: more guests stay than were reported to the NTIS within 24 hours (art. 32(1)(3)).
• Long stays by visa-free visitors: repeated bookings that suggest more than 90 days in any 180-day period (Law on the Legal Status of Aliens, art. 11(2)).
• Visa support for restricted nationalities: Lithuanian missions accept Schengen visa applications from Russian or Belarusian citizens only through the Ministry of Foreign Affairs (Law No XIV-1888, art. 3).
• Sanctions exposure: a booker, payer or corporate client matching an EU or national sanctions list (Law on International Sanctions).
• Split cash exchanges: linked cash currency exchanges that together reach EUR 3,000 (AML Law, art. 9(1)).

9. Enforcement and penalties

Breaches of the Law on Tourism are administrative offences under the Code of Administrative Offences (consolidated version 1 November to 31 December 2026; arts. 128 and 129 are unchanged in all future editions published to January 2028). The State Consumer Rights Protection Authority investigates these offences (art. 589(70)) and also decides them out of court (arts. 614(2) and 615(1)); its decisions can be appealed to the district court within 20 calendar days (arts. 622 and 623). Fines are set per offence in fixed bands, with a higher band for a repeat offence.

Tour organisers also face suspension or withdrawal of their certificate (Law on Tourism, arts. 10 and 11), published with their legal basis. The Authority's register records, for example, the withdrawal of UAB "Travel Solutions" on 7 October 2026 for not remedying deficiencies within a three-month warning (art. 11(2)(3)) and of MB "Tasty Travel" on 18 June 2026 for not filing a required report (art. 11(2)(1)). GDPR fines are enforced by the State Data Protection Inspectorate.

10. Recent changes and what to watch

• ETIAS[Adopted, start date not yet set]: the Commission sets the start date by decision; visa-free visitors will then need a travel authorisation and carriers must check it before boarding.
• 5 June 2026[In force]: Order No 4-247 removed three accommodation-object fields from the NTIS regulations; guest data fields are unchanged.
• 20 May 2026[In force]: Regulation (EU) 2024/1028 applies, bringing data-sharing duties for short-term rental platforms.
• 23 April 2026[In force]: Law No XV-840 extended the visa restrictions on Russian and Belarusian citizens to 31 December 2027.
• 12 October 2025[In force]: the Entry/Exit System started, with a 180-day progressive roll-out.
• June 2025[Bill rejected]: bill No XVP-117, which would have replaced the 24-hour NTIS deadline with monthly reporting, was opposed by the Government (conclusion No NV-1130, 21 May 2025) and rejected on the Economics Committee's recommendation of 18 June 2025; the 24-hour rule stands.
• 1 January 2025[In force]: Law No XIV-3014 gave rural tourism providers a separate regime (foreign guests only, monthly reporting); all other providers keep the 24-hour rule, in force since 1 January 2024, for every guest except minor children travelling with them.

11. What this means for identity verification

• Document capture, not biometrics, is the legal core. Accommodation flows need reliable reading of the document fields the NTIS holds (name, date of birth, issuing state, document number), for every guest except accompanied minors.
• Document validity matters. The duty is to see a valid identity document, so expiry and authenticity checks on passports and ID cards (including chip reading where available) support compliance.
• Biometrics are optional and regulated. Face match at self check-in processes biometric data and is lawful only with a GDPR art. 9 exception such as explicit consent.