How to Apply for a VASP Licence in Lithuania Mica CASP Transition: Post‑31 Dec 2025

Introduction

Obtaining a VASP licence in Lithuania now means securing a full Crypto‑Asset Service Provider (CASP) authorisation under Regulation (EU) 2023/1114 the Markets in Crypto‑Assets Regulation (MiCA). Lithuania’s legacy VASP registration regime once one of Europe’s lightest touch gateways for crypto businesses has been overtaken by MiCA’s harmonised framework. Under Article 143(3), each EU Member State could set its own transitional grandfathering window; Lithuania elected a shortened 12‑month period, meaning legacy VASP protection expired at the end of December 2025.

For founders, compliance officers, and fintech teams exploring how to get a crypto licence in Lithuania, the practical consequence is clear: you must now prepare a comprehensive MiCA CASP authorisation file not a lightweight registration and submit it to the Bank of Lithuania, the designated competent authority. This page provides a step‑by‑step guide covering eligibility, capital requirements, AML officer obligations, the full documentation pack, and a realistic application timeline.

Quick Checklist

Before diving into the detail, use this at‑a‑glance checklist to orient your application project:

• Select CASP service class(es): Identify which of the eight MiCA crypto‑asset services you intend to provide.
• Form a Lithuanian UAB: Incorporate your private limited company with compliant articles of association and substance.
• Appoint local director(s): Ensure at least one locally‑resident executive or director with demonstrable suitability.
• Deposit capital & gather evidence: Meet the applicable MiCA Annex IV capital minimum and prepare bank statements.
• Appoint AML officer & draft policies: Name a qualified AML/CTF officer and finalise your programme documentation.
• Prepare the full documentation pack: Compile corporate, governance, prudential, AML, ICT, and operational files.
• Submit to the Bank of Lithuania: File via the designated BoL submission channel.
• Plan for regulator engagement: Allow 3–6 months for the completeness check, assessment, and clarification rounds.

Download full PDF checklist a one‑page condensed version and a 12‑page annotated application pack manifest are available as downloadable assets on this page.

1. Eligibility & Business Models

Which Services Fall Under MiCA?

MiCA defines eight categories of crypto‑asset services that require CASP authorisation. Your choice of service determines your prudential class and minimum capital obligation. The eight services are:

1. Custody and administration of crypto‑assets on behalf of clients
2. Operation of a trading platform for crypto‑assets
3. Exchange of crypto‑assets for funds
4. Exchange of crypto‑assets for other crypto‑assets
5. Execution of orders for crypto‑assets on behalf of clients
6. Placing of crypto‑assets
7. Reception and transmission of orders for crypto‑assets on behalf of clients
8. Providing advice on crypto‑assets and portfolio management of crypto‑assets

Applicants should map each proposed business line to one or more of these categories at the outset, as this mapping feeds directly into the capital calculation and the risk profile the Bank of Lithuania will assess.

Who Must Apply?

Any entity that is not already authorised as a credit institution, investment firm, e‑money institution, or other regulated financial entity must apply for a standalone CASP authorisation under MiCA Article 63. Entities that already hold a qualifying EU financial‑services licence may instead use the Article 60 notification route, which carries a shorter processing window but still requires submission of supplementary information covering their proposed crypto‑asset services. It is important to confirm early whether the notification or full‑authorisation path applies, as the documentary burden and timelines differ significantly.

Common Business Models in Lithuania

The most frequent Lithuanian CASP applicants operate in one or more of the following areas:

• Crypto exchange (fiat‑to‑crypto / crypto‑to‑crypto): High regulatory scrutiny on AML controls and source‑of‑funds procedures.
• Custody and wallet services: Requires robust ICT security evidence, segregation of client assets, and disaster‑recovery planning.
• Trading platform operation: The highest prudential class, requiring €150,000 minimum capital and extensive governance documentation.
• Transfer and bridging services: Travel Rule compliance and real‑time transaction monitoring are focal points for regulators.
• Portfolio management and advisory: Suitability assessments and conflicts‑of‑interest policies become central to the application.

2. Company Structure & UAB Formation Steps

Why a Lithuanian UAB Is Standard

The overwhelming majority of CASP applicants in Lithuania incorporate as a UAB (uždaroji akcinė bendrovė), the Lithuanian private limited company. A UAB offers flexible share‑capital structures, access to the Bank of Lithuania’s English‑language guidance, and once authorised full MiCA passporting rights across the European Economic Area. Lithuania’s established fintech infrastructure and relatively efficient corporate‑services ecosystem make the UAB an attractive vehicle for both EU‑resident and non‑resident founders.

Step‑by‑Step UAB Formation Checklist

• Prepare articles of association: Draft and notarise founding documents specifying the company’s scope, share structure, and governance framework.
• Deposit share capital: Open a Lithuanian bank account and deposit the initial share capital (minimum €2,500 for a UAB, though CASP capital requirements are substantially higher).
• Appoint statutory director(s): At least one director should be a Lithuanian or EU resident; the Bank of Lithuania expects evidence of real local management.
• Register office and substance: Secure a registered address in Lithuania and establish payroll, employment contracts, and demonstrable operational activity at the premises.
• Register with the Centre of Registers: Complete legal‑entity registration and obtain a company code.
• Open operational bank account: Set up an account for ongoing business operations, distinct from any client‑asset safeguarding account.

Can Non‑Residents Form a UAB and Apply?

Yes Lithuanian law does not restrict non‑residents from incorporating a UAB or applying for CASP authorisation. However, the Bank of Lithuania expects genuine substance: at least one locally‑resident executive or director with genuine decision‑making authority, a physical place of business, and evidence that real management and AML controls operate from Lithuania. Applicants relying on virtual offices or nominee directors without demonstrable involvement are likely to face significant pushback during the assessment phase. How to set up a UAB for crypto business in Lithuania is explored in greater detail in a dedicated companion guide.

3. Governance, Capital & Prudential Requirements

Governance & Fitness and Propriety

The Bank of Lithuania assesses applicants’ governance arrangements rigorously. Board members and senior managers must demonstrate individual good repute, relevant professional experience, and collectively adequate knowledge spanning IT, risk management, compliance, and financial markets. The BoL’s guidance expects applicants to present a collective‑suitability matrix showing that the management body, taken together, covers all critical competences. Criminal‑record checks, declarations of conflicts of interest, and detailed professional CVs are standard submissions.

MiCA Prudential Framework Capital Minima

MiCA Article 67, read together with Annex IV, sets the initial capital and ongoing own‑funds minima by CASP class. As at 20 July 2026, the applicable thresholds are:

In all cases, a “higher of” test applies: the applicant must hold the greater of (a) the Annex IV minimum, or (b) one quarter of fixed overheads of the preceding year. New entrants without a full‑year trading history must supply 12‑month financial projections as the basis for the fixed‑overheads calculation. The Lithuania crypto licence capital requirement is therefore determined both by the chosen service category and by projected or actual operating costs.

Proofs Required at Application

• Paid‑up capital evidence: Bank statements demonstrating that the required capital is deposited and unencumbered.
• Audited historical accounts: Or, for start‑ups, detailed 12‑month financial forecasts prepared by a qualified professional.
• Insurance or guarantee certificates: If the applicant relies on a professional indemnity policy as part of its prudential safeguard.
• Trustee / custody arrangements: Documentation showing how client assets will be segregated and safeguarded.

Fees & Expected Ranges

The Bank of Lithuania charges both an application fee and ongoing supervision fees. Fee structures are published on the BoL FAQ portal and are subject to periodic revision. Applicants should also budget for professional advisory costs (legal, compliance, ICT audit), which can vary widely depending on the complexity of the proposed services. Exact current amounts should be confirmed directly with the Bank of Lithuania before submission.

4. AML / CFT Program Dedicated AML Officer, KYC & Transaction Monitoring

Lithuania’s AML Legal Baseline

Lithuanian CASPs must comply with the Republic of Lithuania’s Law on the Prevention of Money Laundering and Terrorist Financing, which transposes the EU’s Anti‑Money Laundering Directives and incorporates the FATF’s risk‑based approach guidance for virtual assets and VASPs. The Financial Crime Investigation Service (FNTT) is Lithuania’s national authority responsible for AML supervision and suspicious‑activity‑report (SAR) processing. The Bank of Lithuania evaluates the adequacy of the AML/CTF programme as a gating criterion for CASP authorisation.

Dedicated AML Officer Role & Fit‑and‑Proper Checks

A VASP licence in Lithuania now a MiCA CASP authorisation requires the appointment of a dedicated AML officer. This individual must be of sufficient seniority to have direct access to the management body and the authority to halt transactions. The Bank of Lithuania expects applicants to submit the AML officer’s CV, evidence of relevant qualifications (e.g., certified anti‑money laundering specialist credentials or equivalent experience), and a formal appointment letter specifying reporting lines. The AML officer is responsible for overseeing KYC/KYB processes, monitoring transaction flows, managing SAR filings to the FNTT, and conducting periodic internal risk assessments.

Minimum Technical Controls

Applicants must demonstrate the deployment or concrete plan for deployment of the following controls:

• KYC / KYB: Identity verification for natural and legal persons, including beneficial‑owner identification and ongoing due diligence.
• Sanctions screening: Real‑time screening of customers and counterparties against EU, UN, and OFAC sanctions lists.
• Transaction monitoring (KYT): Automated and manual monitoring of on‑chain and off‑chain transactions for unusual patterns.
• Blockchain analytics: Integration with a recognised blockchain‑analytics provider capable of tracing crypto‑asset flows and identifying exposure to high‑risk addresses.
• Travel Rule compliance: Systems capable of transmitting and receiving originator and beneficiary information for qualifying transfers, as required by FATF Recommendation 16 and EU implementing rules.

Operational Checklist AML Policy Documents

The following policy documents are expected in every CASP application:

• AML/CTF programme: The central framework document detailing risk appetite, customer‑acceptance criteria, and escalation procedures.
• Sanctions policy: Covering screening methodology, list management, and embargo procedures.
• Customer due diligence procedures: Step‑by‑step workflows for standard, simplified, and enhanced due diligence.
• Transaction monitoring procedures: Rule sets, thresholds, alert‑handling workflows, and tuning/review schedules.
• Risk assessment: Enterprise‑wide ML/TF risk assessment and product/service‑level risk assessments.
• SAR reporting flows: Internal escalation matrix from analyst to AML officer to FNTT submission.
• Record retention policy: Retention periods and data‑handling procedures compliant with Lithuanian AML law (minimum five years post‑relationship).

AML/CFT controls & officer responsibilities for Lithuanian CASPs are covered in a companion article with an operational focus.

5. Documentation Pack

Master Annotated List

The full VASP licence documents Lithuania applicants must compile for Bank of Lithuania submission are grouped as follows:

• Corporate: Formation documents (notarised articles of association), shareholder structure chart to UBO level, beneficial‑owner declarations, company registration extract, UBO register confirmation.
• Governance: Board and senior management CVs, collective‑suitability matrix, internal control policy, outsourcing policy (including details of any outsourced critical functions), conflicts‑of‑interest policy.
• Prudential: Bank statements evidencing paid‑up capital, audited accounts or 12‑month financial forecasts, capital‑adequacy calculations per MiCA Annex IV, insurance or guarantee certificates (if applicable).
• AML: AML/CTF programme, AML officer appointment letter and CV, KYC/KYB procedure manuals, sanctions screening evidence (provider contracts and sample screenshots), enterprise‑wide risk assessment.
• ICT / Operational Security: ICT security policy, Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), DORA alignment self‑assessment, evidence of third‑party penetration testing or independent ICT audit.
• Operations: Business plan (3‑year projections, market analysis, competitive positioning), detailed service descriptions mapped to MiCA service categories, sample client agreements, custody and asset‑segregation arrangements, regulatory reporting flows.

Downloadable PDF Checklist

Two downloadable assets accompany this guide: a condensed one‑page checklist suitable for initial project planning and a comprehensive 12‑page annotated application pack manifest mapping every required document to the corresponding MiCA article and Bank of Lithuania expectation. Both are available for download on this page.

6. Application Process Where to File, Fees, Sample Timeline & Common Regulator Requests

Where to File & Submission Mechanics

The Bank of Lithuania is the competent authority for CASP authorisation in Lithuania. Applications are submitted through the BoL’s designated electronic channels. Documentation must be provided in Lithuanian or, in many cases, English the Bank of Lithuania’s published guidance and FAQ are available in both languages. Applicants should confirm current language‑acceptance policies before filing, as supporting documents in other languages may require certified translations.

Fees (Application & Supervision)

The Bank of Lithuania operates a fee schedule covering both the initial application review and ongoing supervisory levies. High‑level fee structures are outlined in the BoL FAQ, though exact amounts are subject to change and depend on the scope and complexity of the applicant’s proposed services. In addition to regulatory fees, applicants should budget for legal advisory, compliance consulting, and ICT audit costs, which collectively can represent a significant portion of total set‑up expenditure. Always verify the current fee schedule directly with the Bank of Lithuania before submission.

Sample Timeline Week‑by‑Week Expectations

Realistic commercial planning guidance: total calendar time from submission to authorisation decision is typically 3–6 months for a well‑prepared applicant. Where substantive remediation is required strengthening AML controls, restructuring governance, or addressing ICT audit gaps the process can extend materially beyond six months. The MiCA standard processing timelines (25 working days for completeness, 40 working days for decision) serve as statutory baselines, not guarantees.

Common Regulator Requests & Pitfalls

• Operational substance evidence: Screenshots or proofs of monitoring systems in production; virtual‑office setups frequently trigger deeper scrutiny.
• Source‑of‑funds for capital: BoL commonly requests detailed documentation tracing the origin of paid‑in capital, particularly where shareholders are non‑resident or corporate entities.
• Stronger AML controls: Requests to upgrade transaction‑monitoring rule sets, add blockchain‑analytics coverage, or enhance KYC workflows for high‑risk customer segments.
• ICT audit deficiencies: Missing or outdated penetration‑test reports; insufficient business‑continuity and disaster‑recovery planning.
• Director suitability concerns: Gaps in professional experience, undisclosed regulatory actions in other jurisdictions, or lack of local presence.

7. Post‑Authorisation Obligations

Reporting & Ongoing Supervision

Once authorised, Lithuanian CASPs are subject to periodic financial reporting, prudential returns, and notification obligations to the Bank of Lithuania. The BoL maintains a supervisory engagement programme, and CASPs should expect regular dialogue, on‑site inspections, and thematic reviews. ESMA also collects aggregated data from national competent authorities, meaning Lithuanian CASPs contribute to EU‑wide reporting frameworks.

Safeguarding Client Assets, Audits & Annual Statements

CASPs that custody or administer client crypto‑assets must maintain segregated safeguarding arrangements and submit to independent control reviews. Annual financial statements must be audited by a qualified auditor, and internal audit functions proportionate to the firm’s size and complexity are expected to operate independently of management.

Passporting & Cross‑Border Provision

A key advantage of MiCA CASP authorisation over legacy VASP registration is the ability to passport services across the EU and EEA. A Lithuanian CASP can notify the Bank of Lithuania of its intention to provide services in another Member State; the BoL then communicates with the host‑state competent authority. MiCA passporting explained is addressed in a dedicated guide covering notification mechanics, timelines, and practical considerations for cross‑border expansion.

Continuous AML & ICT Obligations

Post‑authorisation, CASPs must maintain their AML/CTF programme on a living‑document basis updating risk assessments, calibrating monitoring rules, and filing SARs as needed. ICT security must align with the EU’s Digital Operational Resilience Act (DORA), with ongoing penetration testing, incident reporting, and third‑party ICT risk management forming part of the supervisory baseline.

Comparison: Legacy Lithuania VASP Registration vs MiCA CASP Authorisation

Key Requirements Eligibility Recap

To proceed to a VASP licence Lithuania application (now MiCA CASP authorisation), applicants must have the following in place:

• Incorporated UAB with substance: Lithuanian company with a physical office, local director(s), and demonstrable operational presence.
• Management CVs & collective suitability: Documented fitness and propriety of all board members and senior managers.
• AML officer & programme: Named, qualified AML officer with a complete AML/CTF programme and supporting policies.
• Paid‑up capital per MiCA class: Bank‑verified deposit meeting or exceeding the Annex IV minimum or one quarter of fixed overheads.
• ICT security attestation: Penetration test results, BCP/DRP, and DORA alignment evidence.
• Full documentation pack: Corporate, governance, prudential, AML, ICT, and operational documents as outlined above.
• Client‑asset safeguarding plan: Segregation, custody, and deposit arrangements for client funds and crypto‑assets.

Troubleshooting, Common Pitfalls & Practical Tips

• Weak or generic AML programme: Tailor your AML/CTF policies to the specific crypto‑asset services you intend to offer. Template documents without customisation are a red flag for the BoL.
• Insufficient local substance: Ensure at least one director with real authority is based in Lithuania. Budget for local payroll and operational infrastructure from day one.
• Under‑documented source of funds: Trace capital to its origin with bank records, audited accounts, or notarised declarations especially for non‑resident or corporate shareholders.
• No ICT audit: Commission a third‑party penetration test and prepare a DORA self‑assessment before filing; these are increasingly non‑negotiable at the completeness‑check stage.
• Poor KYC/KYB for complex structures: If your target customer base includes corporate or institutional clients with multi‑layered ownership, demonstrate that your KYB workflows can identify ultimate beneficial owners in practice.
• Unclear custody arrangements: If you safeguard client assets, present clear documentation on segregation, insurance or equivalent protections, and disaster‑recovery procedures.
• Remediation tips: Consider a pre‑application mock audit conducted by an independent compliance consultant; engage a recognised KYT/blockchain‑analytics provider early; strengthen board composition with experienced fintech or compliance professionals if collective‑suitability gaps are identified.

Sources

• Regulation (EU) 2023/1114 Markets in Crypto‑Assets Regulation (MiCA), EUR‑Lex consolidated text
• ESMA List of grandfathering periods decided by Member States under MiCA Article 143(3)
• Bank of Lithuania Authorisation of Crypto‑Asset Service Providers
• Bank of Lithuania FAQ: Crypto‑Asset Service Providers
• FATF Updated Guidance for a Risk‑Based Approach to Virtual Assets and VASPs (2021)
• Financial Crime Investigation Service (FNTT) Lithuania FAQ and AML guidance