Lithuania CASP Licence in 2026: MiCA Authorisation by the Bank of Lithuania
A 2026 guide to the crypto licence in Lithuania under MiCA: how the old VASP register ended, what the Bank of Lithuania checks, capital classes, substance, timelines, Travel Rule, DORA and AML, and how Lithuania compares with other EU CASP jurisdictions.
From a VASP register to a MiCA licence
For years, a crypto licence in Lithuania was not a licence at all. Firms registered as virtual asset service providers in the Register of Legal Entities, and the Financial Crime Investigation Service (FCIS) supervised them for anti-money laundering purposes only. Registration was fast and cheap, and the register grew to around 850 crypto companies by late 2022.
MiCA, Regulation (EU) 2023/1114, replaced that model. On 11 July 2024 the Seimas adopted the Law on Markets in Crypto-Assets, which makes the Bank of Lithuania (Lietuvos bankas) the authority that licenses and supervises crypto-asset service providers. The transition was first planned to end in June 2025 and was later extended to 31 December 2025. Since 1 January 2026, providing crypto services in Lithuania without a MiCA licence, or a passport from another member state, counts as illegal financial activity under the Criminal Code.
About 850
Crypto companies registered in Lithuania in late 2022, under the AML-only regime.
102 applications
Filed with the Bank of Lithuania in 2025 by 55 companies, about 30% of them in October and November.
A handful of licences
Three CASP licences had been granted by January 2026. Robinhood Europe UAB was the first, in 2025.
The numbers tell the story. Lithuania went from one of the easiest places in Europe to register a crypto business to a jurisdiction where the regulator reads every file like a bank licence application.
Building a business on this licence?
See what the platform covers for it: the regulator's IT questions, rails, providers and the technical part of your application.
Request demo
What a Lithuanian CASP licence covers
The licence is a standard MiCA authorisation. The Bank of Lithuania grants it for one or more of the ten crypto-asset services listed in Article 3 of MiCA, and the licence carries the EEA passport under Article 65. The most common combinations for retail products are:
- Custody and administration of crypto-assets on behalf of clients, which is what a wallet app does.
- Exchange of crypto-assets for funds or for other crypto-assets, for buy, sell and swap features.
- Transfer services for moving crypto between clients and to external addresses.
- Execution and reception and transmission of orders, typical for brokers that route orders to a liquidity provider.
- Operation of a trading platform, for firms running an order book that matches third-party interests.
A CASP licence does not allow issuing e-money tokens or taking deposits. Euro stablecoin issuance needs a credit institution or e-money institution licence, and lending needs a banking licence.
Capital and prudential requirements
Annex IV of MiCA sets the minimum capital by class. Your class depends on the most demanding service you provide, and own funds must stay at the higher of the class floor or one quarter of the previous year's fixed overheads (Article 67).
| Class | Typical services | Minimum capital |
|---|---|---|
| Class 1 | Reception and transmission of orders, execution of orders, advice, placing, transfer services, portfolio management | EUR 50,000 |
| Class 2 | Class 1 services plus custody and administration, or exchange against funds or other crypto-assets | EUR 125,000 |
| Class 3 | Class 2 services plus operation of a trading platform | EUR 150,000 |
Client funds received in euro must be placed with a credit institution or a central bank by the end of the next business day (Article 70). Plan the client money account early, because Lithuanian and EU banks take time to onboard crypto firms.
The Bank of Lithuania process and timeline
- Scope and structure. Decide which services you need and set up a Lithuanian company. Article 59 of MiCA requires a registered office in a member state where you provide services, effective management in the EU and at least one director resident in the EU. In practice the Bank of Lithuania wants a team that actually runs the business from Lithuania.
- File preparation. Programme of operations, business plan, governance and fit and proper documents for managers and qualifying shareholders, AML/CTF policies, ICT and security documentation, custody policy, complaints handling, conflicts of interest, outsourcing and an orderly wind-down plan.
- Completeness check. Under Article 63 the Bank of Lithuania has 25 working days to confirm that the application is complete or to ask for missing items.
- Assessment. 40 working days from a complete file to decide. Requests for more information can suspend that clock for up to 20 working days.
- Licence and launch. Once licensed, you appear on the Bank of Lithuania and ESMA registers and can notify the passport for other EEA countries.
The statutory clock looks short. What makes real timelines long is the number of rounds needed before a file counts as complete. Budget several months of preparation and more for questions.
Where Lithuanian applications fail
Reviewing the 2025 wave of applications, the Bank of Lithuania pointed to the same weaknesses again and again:
- Shareholders and money. Owners not clearly identified, their reputation not assessed, sources of funds not disclosed.
- Management. Managers without the competence to run a regulated crypto business, and weak governance structures.
- AML/CTF documents that did not fit the actual business model.
- IT and operational risk management described in general terms, without a link to the systems the company really runs.
- Empty shells. Companies with a Lithuanian address and nothing behind it.
The last two points are where substance and technology meet. A regulator that has seen hundreds of registrations disappear wants to see real people in Vilnius running a real system.
Travel Rule, AML and DORA
Three sets of rules sit next to MiCA and shape your technology choices.
- Travel Rule. Regulation (EU) 2023/1113 applies since 30 December 2024. Every crypto transfer must carry originator and beneficiary information, with no minimum amount. For transfers above EUR 1,000 to or from a self-hosted wallet, you must check that the address belongs to your client.
- AML/CTF. CASPs are obliged entities under the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing. You run customer due diligence, ongoing monitoring and sanctions screening, and report suspicious transactions to the FCIS, which remains Lithuania's financial intelligence unit.
- DORA. Regulation (EU) 2022/2554 applies to CASPs since 17 January 2025. You need an ICT risk framework, incident classification and reporting, resilience testing and a register of information on ICT third-party providers, including your software vendors.
What your tech stack has to provide
The licence decides what you may do. Your systems decide whether you can prove it. For a Lithuanian CASP the stack needs at least:
| Requirement | What the system must do |
|---|---|
| Register of positions (Art. 75) | Hold every client's crypto on separate records from your own and reconcile them against wallet balances. |
| Custody | Keep keys on infrastructure you control or contract, with approval flows and access roles for withdrawals. |
| Client funds (Art. 70) | Track the euro owed to each client against the client money account at your bank. |
| Travel Rule | Capture originator and beneficiary data and exchange it with other CASPs, usually through a specialist provider. |
| KYC and monitoring | Onboard clients with identity checks and questionnaires, set limits, screen and monitor transactions. |
| DORA | Access control, two-factor authentication, audit trail, backups, incident handling and documented third-party arrangements. |
Crassula is one way to cover the product side. The platform gives you client crypto and euro accounts on one ledger, deposit addresses, exchange with liquidity from connected providers, euro accounts with SEPA and SWIFT through your banking partner, onboarding questionnaires, client limits, 2FA, a back office and data exports. Custody, Travel Rule messaging, screening and monitoring run through providers you connect, and the licence, the custody role and the compliance decisions stay with you. See crypto banking for Lithuanian CASPs for how this maps to the Bank of Lithuania file.
Lithuania compared with other EU CASP jurisdictions
Every CASP licence in the EU follows the same MiCA rulebook, so the real differences are the supervisor, the language and the transition history.
| Country | Authority | Transition ended | What stands out |
|---|---|---|---|
| Lithuania | Bank of Lithuania | 31 December 2025 | Hundreds of former VASPs, few licences, strict review of substance and IT. |
| Netherlands | AFM, with DNB for prudential supervision | 30 June 2025 | Shortest transition, optional pre-scan before filing. |
| Ireland | Central Bank of Ireland | 30 December 2025 | The Central Bank says an assessment takes at least ten months and expects a local board in full control. |
| Germany | BaFin | 31 December 2025 | Many authorised CASPs, DORA evidence expected in the application. |
| Estonia | Finantsinspektsioon | 1 July 2026 | Old FIU licences cancelled, wind-down plans requested from late applicants. |
| France | AMF | 1 July 2026 | PSAN registrations ended, standard MiCA procedure for new files. |
| Malta | MFSA | 30 June 2026 | In-principle approval, then pre-licensing and pre-commencement checks. |
Lithuania still has English-speaking supervisors, a deep fintech labour market in Vilnius and a central bank that knows payment and e-money firms well. The price is a review that is anything but a formality.
Planning your Lithuanian CASP launch
- Start with scope. Your service list sets your capital class and the depth of the file.
- Fix the ownership story first. Shareholders and sources of funds are the most common reason for trouble.
- Hire locally. Managers, compliance and operations people who can explain the business to the Bank of Lithuania in person.
- Pick the technology before you write the IT section. Reviewers compare the documents with the system you will run, so describe a real one.
- Line up banking and custody early. A client money account and a custody set-up take time and appear in the file.
If you are building the product side, request a demo to see a crypto and euro account stack configured for a Lithuanian CASP.
FAQ
Yes, if you provide crypto-asset services to clients in Lithuania. Since 1 January 2026 you need a CASP licence from the Bank of Lithuania or a MiCA authorisation from another member state passported into Lithuania. The old VASP registration no longer gives any right to operate.
The Bank of Lithuania (Lietuvos bankas), under the Law on Markets in Crypto-Assets adopted in July 2024. The Financial Crime Investigation Service supervised the old VASP register and remains the financial intelligence unit that receives suspicious transaction reports.
MiCA sets EUR 50,000 for class 1, EUR 125,000 for class 2 (custody or exchange) and EUR 150,000 for class 3 (trading platform). Ongoing own funds must cover the higher of that floor or a quarter of the previous year's fixed overheads.
MiCA gives 25 working days for the completeness check and 40 working days for the decision, with up to 20 working days of suspension. Real timelines are longer because most files go through several rounds of questions before they are complete.
No. The transition ended on 31 December 2025. A firm still waiting for its licence after that date had to stop providing crypto services in Lithuania and wind down or pause its business.
Yes. A MiCA licence carries the EEA passport. After notifying the Bank of Lithuania of the countries and services you plan, you can serve clients there without a separate licence.
Yes. Regulation (EU) 2023/1113 has no minimum amount for crypto transfers. Above EUR 1,000, transfers to or from self-hosted wallets also require you to check that the client controls the address.
Crassula provides white-label software for crypto and euro accounts, exchange, apps and back office, plus input for the IT, DORA and outsourcing sections of your file. Custody, Travel Rule messaging and screening run through providers you connect, and the licence stays with you.
