On 6 March 2026 the Bank of Lithuania announced that Paytend Europe UAB, an electronic money institution, had lost its license and could provide no financial services from 3 March. Its inspectors found that alerts pointing to suspicious activity were not consistently analyzed in time, internal investigations stayed formal or unfinished, and no suspicious transaction report went to the Financial Crime Investigation Service despite indicators. In the AML law, alert review sits in arts. 9(16) and 17. The missing reports breach art. 16(1).
Who regulates AML in Lithuania? Authorities and regulations
As with AML rules in other jurisdictions, the Lithuanian law names its supervisors: art. 30(1) lists the FCIS, the Bank of Lithuania and seven sector bodies.
| Authority | Role under the AML law | Who it covers (in force, November 2026) |
|---|---|---|
| Financial Crime Investigation Service (FCIS; in Lithuanian FNTT), under the Ministry of the Interior (art. 3) | Financial intelligence unit: receives suspicious transaction reports (art. 16) and cash and crypto asset reports (art. 20); supervisor (art. 30(1)(1)) | All financial institutions and other obliged entities |
| Bank of Lithuania | Issues AML instructions and supervises (arts. 4(1), 30(1)(2)); fines under art. 39 | The art. 4(1) list, including banks, electronic money and payment institutions, currency exchange operators, crowdfunding and peer to peer lending platforms, life insurers, financial brokerage firms and CASPs |
| Department of Cultural Heritage, Gaming Control Authority, Lithuanian Bar, Lithuanian Chamber of Auditors, Chamber of Notaries, Chamber of Bailiffs, Lithuanian Assay Office | Supervisors within their competence (art. 30(1)(3)) | Other obliged entities in each field |
| State Security Department | Collects and analyzes terrorist financing information (art. 6); receives FCIS leads on possible terrorist financing within one working day (art. 16(11)) | No direct supervision |
The FCIS, in Lithuanian Finansinių nusikaltimų tyrimo tarnyba (FNTT), works under the Ministry of the Interior, not the Ministry of Finance (art. 3). The Bank of Lithuania, the country's financial regulator, supervises the market participants listed in art. 4(1).
Three texts carry the rules. The Law on the Prevention of Money Laundering and Terrorist Financing, No VIII-275 (Pinigų plovimo ir teroristų finansavimo prevencijos įstatymas) was adopted on 19 June 1997; its current consolidated edition has been in force since 30 June 2026. The Law on International Sanctions, the Description on UNSC Sanctions and FCIS Order V-191 set the freezing steps MONEYVAL reviewed in December 2024.
The Bank of Lithuania's instructions of 6 June 2023 added sanctions rules for financial market participants, required them to follow EBA guidelines EBA/GL/2021/02 and EBA/GL/2022/05, and took effect mostly from 1 September 2023.
Who must comply with the Lithuanian AML law?
The law names two groups. Financial institutions (art. 2(7)) include credit institutions, payment and electronic money institutions, currency exchange operators, crowdfunding and peer to peer lending platforms, life insurers, branches of foreign institutions and CASPs. Other obliged entities (art. 2(10)) include auditors, bailiffs, accountants and tax advisers, notaries and lawyers for listed deals, trust and company service providers, traders paid €10,000 or more in cash, gambling firms, real estate agents, virtual currency operators, art traders and free zones.
Picture an electronic money institution licensed in another member state that serves Lithuanian customers through local agents. It is a financial institution under art. 2(7). Art. 22(5) makes it set up or name a central contact point in Lithuania once it meets any criterion in art. 3(1) of Delegated Regulation (EU) 2018/1108.
What are the AML obligations in Lithuania, article by article?
For each duty, the right hand column names the matching control in complead, formerly Sanction Scanner. Sanction Scanner, the screening product, is part of complead.
| Obligation | Legal basis (AML law No VIII-275) | What a program must do | How complead does it |
|---|---|---|---|
| Internal controls and risk assessment | art. 29(1), (2), (5) | Written procedures for the ten art. 29(1) areas; customer, product or transaction, and country risk assessed; approval by a senior manager or the management body | Rules scoped to a product, segment or jurisdiction, each change versioned with the person, the date and the reason |
| Customer due diligence (CDD) | art. 9(1) | Identify and verify the customer and the beneficial owner before a relationship starts, at the euro lines below, and on doubt or suspicion | Onboarding screening that consults 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes |
| Beneficial owners and JADIS | arts. 2(14)(1)(a), 12(8), 12(11), 12(12) | Identify each beneficial owner holding 25 percent plus one share or more than 25 percent, directly or through companies, or in control by other means; use JADIS; tell the client about a mismatch; start no relationship or occasional transaction while JADIS data is missing or differs | KYB and UBO verification climbs through owners, parents and controlling entities, layer by layer, until it reaches natural persons |
| Politically exposed persons | art. 14(1)(2), 14(4) | Enhanced due diligence; once the person leaves office, risk based measures for at least 12 months and until the PEP risk is gone | PEP screening, with ongoing monitoring switched on or off per name through API triggers |
| High risk third countries | art. 14(1)(3), (4), 14(4¹) | Enhanced due diligence for persons in third countries on the Commission's high risk list or on the FATF lists; after a risk assessment, not needed for an EU firm's majority owned branches or subsidiaries in a Commission listed country that follow equivalent group wide rules (art. 14(1)(3)) | Onboarding, screening and monitoring results land in one risk score per customer |
| Ongoing monitoring and unusual transactions | arts. 9(16), 17, 19(14) | Monitor relationships and transactions; examine complex, unusually large or unusually structured ones and record the findings, kept 5 years | Monitoring rules tried on 30, 60 or 90 days of history before they go live |
| International sanctions | art. 29(1)(4); Law on International Sanctions | Written sanctions procedures; freeze without delay (Description on UNSC Sanctions, art. 20) and report frozen assets to the FCIS (FCIS Order V-191, arts. 5.7, 5.8), as MONEYVAL cited them in December 2024 | Payments screened through the API, sender and receiver, while the transfer is processed |
| Suspicious transaction reports | art. 16(1), (2), (3) | Report within one working day; suspend and report within 3 working hours (clock below) | Reporting support within case management |
| Cash and crypto asset reports | art. 20(1), (5) to (8) | Financial institutions report cash or crypto asset operations of €15,000 or more, single or linked, within 7 working days; not for a customer that is a financial institution, including one from another member state, or, at the institution's choice, for large regular operations that meet the FCIS director's criteria, outside the sectors art. 20(8) lists | Threshold rules with conditions, built without code, for the €15,000 line |
| Record keeping | art. 19(10), (11), (13); 19(12), (14); 19(16) | 8 years for registers, identity and beneficial owner data and transaction records; 5 years for correspondence and art. 17 findings; up to 2 more years on a reasoned instruction | Each search logged with the user, the query, the time and the result, no match included |
| Responsible staff and training | art. 22(1), (2) | Managers named, plus a board member under a board; FCIS told within 7 working days; continuing training | Rule changes and case decisions carry the name of the person who made them |
| FCIS requests | art. 22(6) | Secure systems that answer FCIS requests within 14 working days, or sooner where the law sets a shorter term | Case evidence and work log kept, with the record showing who decided |
Article references: wording read in the consolidated AML law in force from 16 May 2025; article and paragraph numbering checked against the edition in force from 30 June 2026.
How fast must a suspicious transaction be reported?
| Stage | Clock (in force, November 2026) | What happens | Who decides |
|---|---|---|---|
| Knowledge or suspicion that property of any value stems from crime or is linked to terrorist financing | Without delay, at the latest within one working day | Report to the FCIS (art. 16(1)) | Obliged entity |
| A customer carries out a suspicious transaction | Suspend it, then report within 3 working hours of the suspension, or of detection if suspension is objectively impossible | Report to the FCIS; lawyers report to the Lithuanian Bar, which forwards within one working day (art. 16(2), (9)) | Obliged entity |
| A customer intends or tries a suspicious transaction | Immediately | Inform the FCIS, or for lawyers the Bar (art. 16(3)) | Obliged entity |
| FCIS review | Within 10 working days; data it requests is due within one working day | The FCIS may order a suspension of up to 10 working days (art. 16(4), (6), (12)) | FCIS |
| No restriction ordered | After 10 working days | The transaction resumes unless property rights are restricted under the Code of Criminal Procedure (art. 16(7)) | Authorities under the Code of Criminal Procedure |
A suspicious transaction report under art. 16(1) is due within one working day even when nothing is paused. Notaries, auditors, bailiffs, accountants and tax advisers are exempt from art. 16(1) to (3) for what they learn while assessing a client's legal position or representing the client in criminal, administrative or civil proceedings, including advice on starting or avoiding them. Lawyers are exempt when they assess a client's legal position or defend or represent the client in or about court proceedings, including advice on starting or avoiding them, whenever they learned it (art. 16(10)). Staff who report in good faith face no liability or discipline (art. 16(13)).
Which euro thresholds apply in 2026?
- €15,000: occasional transactions, single or linked within a day (art. 9(1)(2), 9(11)); cash and crypto asset reports by financial institutions to the FCIS (art. 20(1)).
- €10,000: cash sales by traders in goods (art. 9(3)); art deals and monthly rents that bring dealers and agents in (art. 2(10)(9), (12)).
- €3,000: cash currency exchange (art. 9(1)(3)).
- €700: virtual currency exchange and transactions, and deposits to or withdrawals from custodial wallets, single or linked within a day (art. 9(1)(6), 9(11)(9)).
- Over €1,000: gambling stakes, winnings and chip exchanges, and lottery winnings (art. 9(9), (10)).
- Over €600: cash remittances (art. 9(1)(4)).
- €150: the stored value and monthly cap of a low risk electronic money product that may use lighter checks, among five conditions (art. 9(4)).
- Transfers of funds: CDD follows the travel rule in Regulation (EU) 2023/1113 (art. 9(1)(5)).
The latest report on Lithuania: what do MONEYVAL, the risk assessment and the FCIS say?
In December 2023, at its 66th plenary, MONEYVAL placed Lithuania in compliance enhancing procedures (CEPs) because its fourth follow up report still rated FATF Recommendation 6, targeted financial sanctions for terrorism, partially compliant. On 5 December 2024 the 68th plenary adopted the first CEPs report, which found "sufficient progress" and removed Lithuania from CEPs. Three gaps stayed open. A foreign listing request could take up to 30 days, the ban on making funds available did not cover assets owned wholly or jointly, and no proactive system alerted firms to UN 1267 list changes.
The mutual evaluation report (MER) is older. MONEYVAL adopted it on 6 December 2018, and Lithuania then sat in enhanced follow up, with reports in July 2020, December 2021, December 2022 and December 2023 that revisited its technical compliance (TC) ratings (MONEYVAL's Lithuania page).
The third national risk assessment (covering 2019 to 2022, published 30 October 2024) rated two of 30 sectors very high (4 points): virtual currency exchange and wallet operators, and electronic money and payment institutions. Real estate, money remitters and accountants, auditors and tax advisers scored 3.4. In 2024 the FCIS received 82.3 thousand STRs, against 98,588 in 2023. The 2020 edition of this guide leaned on the US INCSR of 2016 and its themes: smuggling, VAT fraud and tax evasion along the Russia and Belarus border. In 2024 the FCIS counted 305 STRs tied to EU sanctions or export limits on Russia or Belarus, up from 193.
Lithuania is not on the EU list of non cooperative jurisdictions for tax purposes: the Council's list of 9 October 2026 names eight jurisdictions, none of them an EU member state.
What are the penalties for AML breaches in Lithuania?
The Bank of Lithuania and the FCIS fine financial institutions under art. 39. The other supervisors, the FCIS among them but not the Bank of Lithuania or the Bar, fine other obliged entities under art. 40. For a group that prepares consolidated accounts, the base is consolidated income (arts. 39(3), 40(3)).
Picture an electronic money institution with €20 million in total annual income. An ordinary breach costs 0.5 to 5 percent, so €100,000 to €1 million (art. 39(1)(1)). Now make the breach systematic, gross, or a repeat within a year of an earlier sanction. Ten percent would be €2 million, less than €5.1 million, so the €2,000 to €5.1 million band applies (art. 39(1)(2)).
| Breach | Basis | Range (in force, November 2026) |
|---|---|---|
| Breach of the law by a financial institution | art. 39(1)(1) | 0.5 to 5% of total annual income |
| Systematic breach, one gross breach, or a repeat within one year of a sanction | art. 39(1)(2) | 0.5 to 10% where 10% exceeds €5.1 million; otherwise €2,000 to €5.1 million |
| Requested information or documents not given on time, or incorrect information | art. 39(1)(3) | 0.1 to 0.5% |
| Binding instructions not followed or followed improperly | art. 39(1)(4) | 0.1 to 1% |
| Acting without a required permission, or acting improperly under one | art. 39(1)(5) | 0.1 to 1.5% |
| Shareholder or management body member, for the institution's systematic, gross or repeat breaches | art. 39(2) | €2,000 to €5.1 million |
| Breach by another obliged entity | art. 40(1)(1) | 0.5 to 5% of annual income from the regulated activity |
| Systematic, gross or repeat breach by another obliged entity | art. 40(1)(2) | Up to twice the benefit where that exceeds €1.1 million; otherwise, or where the benefit cannot be set, €2,000 to €1.1 million |
| Measures other than fines | art. 36(1) to (3) | Warning; for systematic, gross or repeat breaches, removal of managers, a ban on branches and suspension or revocation of a license; restrictions on funds; the Bank of Lithuania also a temporary ban on financial services (points 1 to 7, applied with its own and the financial market laws, art. 30(3)) |
Recent enforcement by the Bank of Lithuania and the FCIS
Fines sit in arts. 39 and 40; art. 36 lists the other measures, license revocation among them (last row of the penalties table).
| Firm | Date | Authority and measure | Finding |
|---|---|---|---|
| Paytend Europe UAB (electronic money; release linked above) | No services from 3 March 2026 (release 6 March 2026) | Bank of Lithuania: license revoked | Alerts not consistently analyzed in time, no STRs despite indicators, weak internal control, incorrect information to the supervisor |
| Payeer UAB (virtual currency) | 11 July 2024 | FCIS: €8.236 million for sanctions breaches, €1.06 million for AML law breaches; appealable | Mainly Russian customers served through EU sanctioned Russian banks; virtual currency operations of €15,000 or more not reported; weak internal controls |
| Revolut Bank UAB and Revolut Payments UAB | 18 March 2022 | Bank of Lithuania: warnings, €50,000 and €150,000 | Risk factors missing from onboarding procedures and senior manager approval for higher risk customers and PEPs not always obtained (warnings); purpose and nature of relationships not always collected (fines) |
What do crypto and electronic money firms need in Lithuania? MiCA, CASP licenses and AMLA
Before onboarding a Lithuanian CASP or electronic money institution, check five points:
- The license. A CASP needs a MiCA license under Regulation (EU) 2023/1114. The Seimas extended the national transition to the end of 2025, and the EU transition ended on 1 July 2026. An unlicensed CASP may no longer serve EU clients.
- The supervisor. CASPs and electronic money institutions are financial institutions (art. 2(7)) supervised by the Bank of Lithuania (art. 4(1)).
- The risk rating. The 2024 risk assessment rated both sectors very high, crypto operators for the second assessment running.
- The reporting lines. Crypto asset operations of €15,000 or more go to the FCIS within 7 working days (art. 20(1), (5)). A CASP from another member state working through Lithuanian intermediaries names a contact person and tells the Bank of Lithuania and the FCIS within 14 working days (art. 22(5²)).
- The ownership file. Collect license and owner data with the crypto business KYB form and check the owners against JADIS (art. 12(8)).
AML and risk solutions for Lithuania: how do screening and monitoring apply?
In complead, an AI native platform for AML, KYC and fraud, two products carry the screening and monitoring duties above. Client screening and ongoing monitoring checks customers, owners and PEPs. Its fuzzy matching thresholds can differ by list type and by individual list, and API triggers put a name under ongoing monitoring or take it off. Transaction monitoring runs rules built without code. Each rule is backtested on 30, 60 or 90 days of history first, so the team sees its alert volume before it starts feeding the 3 working hour clock.
On routine cases, agents do the closing and attach the evidence, a narrative and the work log. The analyst decides the rest, and the record names who. Each screening search is logged as well, no match included.
Picture a Vilnius payment institution paying out to merchants across the EU. Each payout is screened through the API, sender and receiver, while it is processed. The alert carries the rule that fired and the signals it matched. The case shows who decided. It also shows whether an STR was prepared.
Lithuania's AML timeline: what moved in 2025 and 2026, and what lands in 2027?
What changed:
- 4 June 2025: the FCIS published its 2024 figures, including fines of more than €1.8 million on other obliged entities.
- 31 December 2025: Lithuania's CASP transition closed.
- 3 March 2026: Paytend Europe UAB lost its license.
- By 30 June 2026: the consolidated AML law gained art. 32¹ on inspections by the EU anti money laundering authority (AMLA).
- 1 July 2026: the EU MiCA transition ended.
- 2 July 2026: the Bank of Lithuania announced its new supervision division for crypto asset and investment firms.
- 9 July 2026: LRT reported that the European Commission opened infringement proceedings against Lithuania for not properly transposing the EU directive that defines money laundering offenses and penalties.
What comes next:
- 10 July 2027: Regulation (EU) 2024/1624 (AMLR) applies directly; its art. 80 limits cash payments for goods or services to €10,000, and member states may keep lower limits. Most of Directive (EU) 2024/1640 (AMLD6) is due the same day; its register access articles fell due on 10 July 2026.
- 2028: AMLA, set up by Regulation (EU) 2024/1620, starts direct supervision of selected financial firms.
Back to Paytend. A dated log of every alert, with who analyzed it, when, the decision and whether an STR reached the FCIS inside the art. 16 clocks, would have put the alert and reporting gaps in front of management while they could still be closed.
What the 2026 PDF adds. Sixteen pages: the tables above, a 14 point program checklist, and two templates for the compliance file, one for Lithuanian customer risk factors and one for recording each suspicious transaction decision. Request it through the form next to this guide.
