How to Obtain a MiCA CASP Licence in Lithuania (2026 Crypto Licence Guide)

What a Lithuanian MiCA CASP licence is

A Lithuanian crypto licence today means authorisation as a crypto-asset service provider (CASP) under the EU Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, granted by the Bank of Lithuania. It covers the crypto services named in the authorisation, such as exchange, custody, a trading platform or transfers, and lets the firm serve clients in every other EU member state by notification, known as passporting.

The Bank of Lithuania is the central bank and the competent authority for MiCA. It authorises CASPs, issuers of asset-referenced tokens and issuers of e-money tokens, and supervises them after authorisation. Lithuania is one of the most frequently chosen EU home states for fintech firms, and the Bank of Lithuania has authorised a large number of electronic money and payment institutions since 2017.

At a glance

From VASP registration to MiCA authorisation

Before MiCA, crypto firms in Lithuania registered as virtual asset service providers (VASPs) under the national anti-money laundering law. Registration checked AML controls and the people involved, with modest capital, and the Financial Crime Investigation Service (FCIS, in Lithuanian FNTT) oversaw compliance.

MiCA replaced this with full prudential authorisation by the Bank of Lithuania. Lithuania chose a 12-month transitional period for firms already registered, as shown in ESMA's list of national periods. That period ended at the end of 2025, and the FCIS confirmed that a MiCA licence has been mandatory for crypto-asset services in Lithuania from 1 January 2026. The EU-wide maximum period ended on 1 July 2026, so no transitional route remains in any member state.

A firm that held a Lithuanian VASP registration and did not obtain MiCA authorisation was required to stop providing services and wind down in an orderly way, as ESMA set out in its statement of 17 April 2026. Every new entrant now applies for full CASP authorisation before serving any client.

Who needs a CASP licence in Lithuania

Any firm providing one or more of MiCA's ten crypto-asset services on a professional basis, from Lithuania or to clients in Lithuania, needs CASP authorisation or must rely on an authorisation from another member state passported into Lithuania. The test is what the firm does, not how it describes itself.

Banks, investment firms and electronic money institutions already authorised in Lithuania can use the Article 60 notification route instead, notifying the Bank of Lithuania at least 40 working days before they start. An EMI using this route is limited to custody and transfer of the e-money tokens it issues.

Non-EU groups apply through an EU company. A Lithuanian subsidiary needs a registered office in Lithuania, effective management in the EU and at least one director resident in the EU, and in practice the Bank of Lithuania expects the key people to work in Lithuania.

Minimum capital

Capital is set by MiCA itself, not by the Bank of Lithuania, and is the same in every member state. A firm providing services in more than one class holds the highest amount.

The ongoing requirement is the higher of that minimum and one quarter of the previous year's fixed overheads, recalculated annually; a new firm uses its projected fixed overheads. It can be met with own funds, an insurance policy or a combination. The Bank of Lithuania provides prudential requirement and reporting tables in Excel, currently in Lithuanian only, which applicants complete for the application date and three years of forecasts.

Worked example

A Vilnius exchange offering custody and crypto-for-euro exchange is a Class 2 firm with a €125,000 minimum. With projected fixed overheads of €700,000 a year, one quarter is €175,000, so it holds €175,000 plus a buffer. A firm adding a trading platform moves to Class 3, and its minimum rises to €150,000.

What the Bank of Lithuania looks for

The Bank of Lithuania assesses applications against MiCA and its own licensing rules. Its published grounds for refusal show what it tests: whether the management body supports sound management and controls money laundering risk, whether directors and shareholders with 10% or more meet the fit and proper criteria, whether the firm meets Title V of MiCA, and whether laws of any non-EU country involved would prevent effective supervision.

Substance and people

• A real office in Lithuania and local decision-making by the board.
• A chief executive or managing director, a compliance officer and an MLRO (money laundering reporting officer) based in Lithuania, with relevant crypto and financial services experience.
• Directors who can explain the business, its risks and its controls at interview.
• Staff giving information or advice who meet the Bank of Lithuania's knowledge and qualification requirements, set in its Resolution of 16 December 2025.

Owners and funding

The application shows the full ownership chain up to the individuals at the top, with good repute evidence for every shareholder with 10% or more, and documented source of funds and source of wealth for the capital invested. Clear ownership and funding evidence is one of the areas the Bank of Lithuania examines most closely.

Controls built for the business

The AML framework, custody arrangements, ICT security and outsourcing should reflect the firm's own products, clients and flows. Generic policies adapted from another firm lead to extra rounds of questions.

The application file

Applicants provide the information listed in Article 62(2) of MiCA. The Bank of Lithuania's licensing rules organise it into seven annexes.

1. Application: company details, legal form, articles of association, services requested and the crypto-assets each relates to.
2. Programme of operations: the business model, clients, marketing and distribution, the countries to be served and three-year financial projections.
3. Organisational structure and internal control: governance, management body, compliance, risk management and internal audit.
4. Prevention of money laundering and terrorist financing: the business-wide risk assessment, customer due diligence, monitoring, sanctions and Travel Rule procedures.
5. ICT risk management: the ICT and security framework under DORA, with a non-technical description.
6. Outsourcing and ICT third-party risk: the providers used, the contracts and the oversight.
7. Operating a trading platform: operating rules and market abuse detection, for applicants running a platform.

Alongside the annexes the file includes fitness files for directors, shareholder documents, the capital evidence and the prudential tables, client asset segregation procedures, complaints handling, and service-specific policies such as the custody policy, exchange pricing policy and execution policy. Every document should describe the same business, with the same numbers.

Preparing for the Bank of Lithuania's questions

Most applications receive questions before they are accepted as complete, and the themes are predictable. Answering them in the first submission is the most reliable way to shorten the process.

• The client base: which countries clients will come from, how they are acquired, and how onboarding controls work for non-Lithuanian clients and higher-risk countries.
• Realism of the plan: volumes, revenues and staffing that tie together, with fixed overheads that match the prudential calculation.
• Group relationships: what the Lithuanian entity decides itself, what the group provides under outsourcing, and how the local board oversees it.
• Custody: who controls keys, how many signatures are needed, where cold storage sits and how assets are returned to clients.
• Source of funds: the origin of the capital and of the founders' wealth, with documents.
• Wind-down: a plan that names the steps, the people responsible and how client assets move to another authorised CASP or to client-controlled wallets.

Answers should be consistent with the annexes, and any change made in response to a question should be reflected across every affected document.

Combining a CASP with an EMI or payment licence

Many Lithuanian groups hold a CASP authorisation alongside an electronic money institution (EMI) or payment institution licence, with the same regulator. This matters most for stablecoin flows. Services involving e-money tokens, such as transferring them for clients, can also be payment services under PSD2, the EU Payment Services Directive, and the European Banking Authority's transition for CASPs to obtain that authorisation ended on 2 March 2026.

An EMI needs initial capital of €350,000 and may issue e-money tokens itself. It can add custody and transfer of the tokens it issues by notification under Article 60, while a separate CASP covers exchange and trading. The Lithuanian EMI licence guide covers that route.

How long it takes

The Bank of Lithuania applies MiCA's statutory timetable, which runs to about four months from submission. With 2 to 3 months to prepare a complete file, and the rounds of questions that most applications receive before completeness, firms should plan around 3 to 5 months from submission to decision.

The Bank of Lithuania holds regular contact and meetings with applicants during the assessment. The fastest applications are those submitted with the people in post, capital ready and policies written for the business, so that completeness is confirmed in the first round.

The process step by step

1. Scope the services. Map the product to the ten MiCA services and confirm whether any flows are payment services or e-money, which need separate authorisation.
2. Engage early. The Bank of Lithuania runs a Newcomer Programme for firms considering entry, which is the natural first contact.
3. Set up the company. Incorporate a Lithuanian company (UAB), register it with the Register of Legal Entities, secure an office and open a bank account for capital.
4. Appoint the team. Board, EU-resident director, chief executive, compliance officer and MLRO, with fitness files prepared.
5. Build the financial model. Three-year projections, fixed overheads and the prudential tables.
6. Write the annexes and policies. Programme of operations, governance, AML, ICT, outsourcing and, where relevant, trading platform rules.
7. Submit and answer questions. Respond fully and on time, keeping all documents consistent.
8. Authorisation and launch. Complete any conditions, appear on the ESMA register, file passport notifications and start services within 12 months, after which an unused authorisation is withdrawn.

Costs and fees

The application carries a state levy set by Government Resolution No 1458, and authorised CASPs pay annual supervisory contributions set by Bank of Lithuania resolution (No 03-115 for 2025). Confirm the current amounts on the Bank of Lithuania's CASP authorisation page before budgeting; the regulator's charges are a small part of the total.

The main cost lines

• Capital: €50,000, €125,000 or €150,000, or one quarter of fixed overheads if higher.
• Local team: chief executive, compliance officer, MLRO and operations staff in Vilnius, where salaries are below those in Western European financial centres.
• Office: a real office in Lithuania.
• Technology: custody infrastructure, blockchain analytics, transaction monitoring, sanctions screening and Travel Rule messaging.
• Assurance: external audit of the accounts and independent security testing.
• Preparation: the application file, policies, financial model and regulator correspondence.

AML, the Travel Rule and technology

A Lithuanian CASP is an obliged entity under Lithuanian AML law. It verifies clients and beneficial owners, checks source of funds, applies enhanced checks to higher-risk clients and countries, monitors transactions with blockchain analytics, screens clients and wallets against sanctions lists, and reports suspicious activity to the FCIS, Lithuania's financial intelligence unit. From 10 July 2027 the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, sets these rules directly.

The Transfer of Funds Regulation, Regulation (EU) 2023/1113, requires originator and beneficiary information with every crypto transfer, with no minimum amount, and verification of self-hosted wallets for transfers above €1,000.

Technology and custody

The ICT annex describes wallet infrastructure, key management, multi-signature controls, cold storage for client holdings, penetration testing, incident response and business continuity, in line with DORA, the EU digital operational resilience law that has applied to CASPs since 17 January 2025. Client crypto-assets are segregated from the firm's own, and client money is placed with a credit institution or central bank by the end of the next business day.

After authorisation

The CASP appears on ESMA's register of authorised CASPs and can passport. It notifies the Bank of Lithuania of the member states and services it will provide; the Bank of Lithuania forwards the notification within 10 working days, and the CASP may start at the latest 15 calendar days after submitting it. Host states cannot require a separate licence, but their marketing and consumer rules apply.

Ongoing obligations

• Maintain capital at all times and recalculate the requirement annually.
• Submit reports to the Bank of Lithuania under its reporting resolution of 26 August 2025, and audited annual accounts.
• Run AML, sanctions and Travel Rule controls, with suspicious activity reported to the FCIS.
• Meet DORA, including major ICT incident reports within 4 hours of classification and no later than 24 hours after becoming aware.
• Keep staff knowledge and qualifications at the standard the Bank of Lithuania sets.
• Notify the Bank of Lithuania before changes to the board or to shareholders with 10% or more.

Our guide to ongoing CASP compliance under MiCA covers the annual cycle in detail.

Why firms choose Lithuania

• An experienced regulator for fintech, with an English-language process and structured contact for newcomers.
• A large fintech community and compliance workforce in Vilnius.
• Lower salary and office costs than Western European financial centres.
• One authorisation that passports across the EU.
• The option to hold an EMI or payment institution licence in the same jurisdiction, with the same regulator.

The Bank of Lithuania is selective: it expects real substance and AML frameworks built for crypto. For a side-by-side view with Malta, Germany and Ireland, see our guide to the best EU country for a MiCA licence; the full EU process is in our MiCA CASP licence guide. Groups that also need e-money services can combine the CASP with a Lithuanian EMI licence, and the firm's MiCA CASP authorisation service covers the application.

Frequently asked questions

References

1. Bank of Lithuania: authorisation of crypto-asset service providers
2. Bank of Lithuania: MiCAR
3. Bank of Lithuania: Newcomer Programme
4. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), EUR-Lex
5. ESMA: Markets in Crypto-Assets Regulation and the interim MiCA register
6. ESMA statement on the end of transitional periods under MiCA, 17 April 2026
7. Regulation (EU) 2023/1113 on transfers of funds and crypto-assets, EUR-Lex

Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.

This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.