Lithuania's VASP registration regime is gone. Since 1 January 2026, if you want to provide crypto-asset services in or from Lithuania, you need a crypto-asset service provider (CASP) license from the Bank of Lithuania under MiCA — or another valid basis under the Regulation.
That changes what a "Lithuania crypto license" means. It is no longer a fast registration with a financial crime unit. It is a full MiCA authorization, assessed by a regulator that has said publicly it wants only mature providers in the market.
This guide goes over what the license covers, whether you need one, what the Bank of Lithuania expects from your structure and your application, and what happens after you're licensed.
The legacy regime, in brief
Before MiCA, Lithuania did not license crypto businesses. It registered them. A company could be listed with the Register of Legal Entities as a virtual currency exchange operator or a depository virtual currency wallet operator, and it reported to the Financial Crime Investigation Service (FNTT) under Lithuanian anti-money laundering law.
Those registrations were never MiCA licenses. The Law on Markets in Crypto-Assets originally set 1 June 2025 as the cut-off for registered operators, and in May 2025 the Seimas extended the transitional period to the end of 2025.
That window has closed. According to the FNTT's notice of 10 December 2025, operators without a CASP license by 31 December 2025 can no longer provide crypto-asset services in Lithuania from 1 January 2026, and the Centre of Registers removed the related activity entries on 2 January 2026. The FNTT also warned that unlicensed financial activity can bring criminal liability under Article 202 of the Criminal Code, for individuals and for the company.
In practice, if your structuring plan still refers to a VASP registration in Lithuania, it describes a route that no longer exists.
What replaced it
The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 (MiCA), applies directly in every Member State. Lithuania did not adopt it early or late. What Lithuania did was pass the Law on Markets in Crypto-Assets (No XIV-2879, 11 July 2024), which designates the Bank of Lithuania as the supervisory authority and sets the national procedure around MiCA.
The CASP regime has applied since 30 December 2024 under Article 149 of MiCA. Across the EU, the maximum transitional period under Article 143(3) ended on 1 July 2026. Lithuania closed its own window six months earlier.
If Lithuania is your home Member State, the usual routes are a CASP license from the Bank of Lithuania under Article 63 or, for eligible financial institutions, the Article 60 notification route. A CASP authorized in another EU Member State may also provide services in Lithuania through Article 65 passporting. Third-country firms have only the narrow reverse-solicitation exception in Article 61, which applies where the client initiates the service at its own exclusive initiative and falls away as soon as you solicit or market in the Union.
Do you actually need a CASP license?
Not every crypto business does. Under Article 3(1)(15) of MiCA, a CASP is a legal person or other undertaking whose occupation or business is providing one or more crypto-asset services to clients on a professional basis. If that describes you, and no other route applies, you need authorization.
The 10 crypto-asset services
Your license will name the specific services you may provide, and the services you choose set your minimum capital class under Annex IV.
Custody has a specific meaning here. Under Article 3(1)(17), it is the safekeeping or controlling, on behalf of clients, of crypto-assets or of the means of access to them, such as private keys. A wallet where you never hold or control the client's keys is a different analysis.
Staking is not on the list either. If your product involves staking, the analysis turns on how it works — who controls the assets, whether you transfer or manage them, and how rewards flow. It may touch custody, transfer or portfolio management, or it may sit outside the CASP perimeter.
When a CASP license may not be your route
- You issue or offer a token, but provide no services. Issuing or publicly offering a Title II crypto-asset requires a white paper and a legal entity under Article 4, not a CASP license.
- You are already a regulated financial institution. Under Article 60, credit institutions, investment firms, electronic money institutions, UCITS managers, AIFMs, central securities depositories and market operators can provide certain crypto-asset services after notifying the Bank of Lithuania at least 40 working days in advance. Each can only provide the services MiCA assigns to its type.
- Your service is fully decentralized, with no intermediary. Recital 22 of MiCA puts these outside the Regulation. It is a high bar, and a front-end, upgrade keys or a fee usually point to an intermediary.
- Your asset is a financial instrument. Then MiFID II applies, not MiCA.
One more flag if you plan to work with e-money tokens. The Bank of Lithuania also points to the EBA's position that certain activities involving EMTs may qualify as payment services under PSD2, and therefore require an appropriate payment-services authorization in addition to the relevant MiCA permissions.
Why founders still consider Lithuania
Image source: Freepik
Lithuania may be attractive if you can support a genuine EU operating presence and meet the Bank of Lithuania's supervisory expectations. It is not a shortcut, and the regulator has been clear about that.
What the Bank of Lithuania has signaled
In late 2025, the Bank of Lithuania reported that it had received applications from almost 50 companies that year, some reapplying after refusal, and had granted only one license. It said most applicants were not sufficiently prepared, and that recent applications failed to meet even minimum requirements.
As of September 2026, the Bank of Lithuania's licence list shows four CASP licenses: the first issued on 29 May 2025, two on 16 December 2025, and the fourth on 26 February 2026. The Bank has also said that licenses will only be granted to companies that operate transparently, fairly and lawfully, with due attention to compliance and AML/CFT.
What this means in practice: the Bank has taken a selective approach and expects applicants to arrive with a mature operating model, credible governance, and systems that already exist beyond the policy documents.
Passporting works, but it has mechanics
A Lithuanian CASP license lets you serve clients across the EU. It is not automatic. Under Article 65, you first notify the Bank of Lithuania of the Member States you intend to serve, the services, your start date, and any activities outside MiCA. The Bank of Lithuania publishes a dedicated passporting annex for this notification.
Your home authority passes the notification to the host Member States, ESMA and EBA within 10 working days. You can start once you are told the communication has been made, or at the latest from the 15th calendar day after you submitted it.
Choosing your home Member State
MiCA is harmonized, and supervisors look at substance. The right home Member State depends on where your management actually sits, where your clients are, which services you provide, and whether you can meet that regulator's expectations. Which country looks easiest on paper is not a useful test.
Key requirements for a Lithuanian CASP license
Legal form and substance
Under Article 3(2) of the Law on Markets in Crypto-Assets, a CASP licensed in Lithuania may only be a public limited liability company (AB) or a private limited liability company (UAB). Most founders use a UAB.
MiCA then adds substance requirements. Under Article 59(2), you must have:
- A registered office in a Member State where you carry out at least part of your crypto-asset services
- Your place of effective management in the Union
- At least one director resident in the Union
Note the scope: the director must be resident in the Union, not in Lithuania specifically.
Lithuania adds one structural rule worth knowing early. Under Article 3(6) of the national law, the Bank of Lithuania will refuse a license until you set up a separate company for your CASP business if your other activities could harm your financial reliability or the Bank's ability to supervise you.
In practice, a Lithuanian UAB run from outside the EU will not pass. If your decision-making sits elsewhere, expect that to be the first thing the Bank tests.
Image source: Freepik
Prudential safeguards, not just share capital
Under Article 67, you must at all times hold prudential safeguards equal to at least the higher of:
- The permanent minimum capital for your class in Annex IV (€50,000, €125,000 or €150,000)
- One quarter of your fixed overheads for the preceding year, reviewed annually — or, in your first year, your projected fixed overheads
Those safeguards can be own funds (Common Equity Tier 1), an insurance policy covering the EU territories where you provide services, a comparable guarantee, or a combination.
The practical takeaway: Annex IV is the floor, not the final number. If you plan a sizeable team and infrastructure, your overheads may set a higher requirement than your class does.
Governance, AML and ICT
MiCA's CASP requirements are about how you are run, not about market movements. Your application must evidence governance arrangements, internal control mechanisms, risk management (including money laundering and terrorist financing risks), a business continuity plan, segregation of client assets and funds, and complaints handling (Article 62(2)).
ICT requirements run through DORA. Under Article 68(7)–(8) of MiCA, you must maintain resilient ICT systems and continuity and recovery plans as required by Regulation (EU) 2022/2554 (DORA), which has applied since 17 January 2025.
As a licensed CASP, you are an obliged entity under the Law on the Prevention of Money Laundering and Terrorist Financing. That means customer due diligence, transaction monitoring, sanctions screening, and reporting suspicious transactions to the FNTT. You must also meet the travel rule in Regulation (EU) 2023/1113, which has applied since 30 December 2024.
Data protection
The GDPR applies to almost any CASP. You need a privacy notice, a lawful basis for each processing purpose, retention rules, appropriate security, a process for data subject rights, and a DPIA where your processing is likely to result in high risk.
A Data Protection Officer is mandatory only in the cases listed in Article 37 GDPR — for example, where your core activities involve regular and systematic monitoring of data subjects on a large scale. Depending on your scale and model, that may well cover you, and appointing one can be sensible even when it is not required.
Standard KYC data is personal data, but it is not automatically "special category" data under Article 9 GDPR. Treat biometric verification separately, because that can change the analysis.
Image source: Freepik
Step-by-step: the application process
Step 1: Build your application package
This is not a startup business plan. Under Article 62(2) of MiCA and the Bank of Lithuania's Licensing Rules for Crypto-Asset Service Providers (Resolution No 03-157), you submit:
- The application form (Annex 1)
- A programme of operations, including where and how you will market your services (Annex 2)
- Your organizational structure and internal control system (Annex 3)
- AML/CTF procedures (Annex 4)
- ICT risk management (Annex 5)
- Outsourcing and ICT third-party arrangements (Annex 6)
- Trading platform rules, if you operate one (Annex 7)
On top of that, you need proof of your prudential safeguards, suitability evidence for your management body and qualifying shareholders, your segregation and complaints procedures, and service-specific policies such as custody, execution or pricing. The Bank of Lithuania also provides prudential and reporting tables to complete, currently in Lithuanian only.
Expect to provide financial information, including audited historical accounts where applicable, together with capital evidence and management and shareholder suitability documentation. A freshly incorporated company will not have the same history to show as an established one.
Step 2: Set up the company
Incorporate a UAB (or AB) with the Register of Legal Entities, open a bank account, and complete tax registration.
VAT registration has its own triggers. According to the State Tax Inspectorate (VMI), you must register once your VAT-taxable supplies in Lithuania exceed €45,000 in the current or previous calendar year. Intra-EU acquisitions and cross-border services have separate triggers, and you can register voluntarily.
Step 3: Submit to the Bank of Lithuania
You apply to the Bank of Lithuania as your home competent authority. Under the Licensing Rules, the Bank confirms receipt within five working days. If documents are missing or not prepared as required, it can return the application without reviewing it.
Step 4: Completeness check and assessment
MiCA sets statutory assessment periods once a complete application has been submitted, but the actual timeline depends heavily on your readiness, governance, substance, and the quality of the file. The Bank of Lithuania says so itself: duration depends on the scope and quality of the application. Preparation time sits entirely outside these periods.
Step 5: Pay the state fee and receive the decision
A state fee applies to the issue of a CASP license, set in the Government's list of state fees (Resolution No 1458). It is the smallest line in your budget. The real costs are prudential capital, qualified staff, local substance, and the AML and ICT build.
National-security clearance is also part of the Lithuanian licensing architecture. The application form (Annex 1) asks for a conclusion of the Commission for Coordination of Protection of Objects Important for National Security on your investors. Depending on the ownership structure, relevant investors and controlling persons may need to be assessed by that Commission, including where the applicable 25% ownership or voting-rights threshold is reached.
If the Bank grants the license, the decision specifies the particular crypto-asset services you are authorized to provide.
Common issues with Lithuania crypto license
Arriving underprepared
The Bank of Lithuania's refusals are the most common problem, and the regulator has said why: applicants who are not ready to operate. A document set assembled from templates, without real people and systems behind it, will not survive a 40-day substantive review.
Language requirements
Many Bank of Lithuania licensing materials are available in English. But under paragraphs 7–8 of the Licensing Rules, certain client-facing documents must be drafted in Lithuanian and provided to clients before you start — including your segregation, complaints, custody, execution and pricing documentation where relevant. The Bank may also request other documents in Lithuanian.
In practice, certain filings and supporting documents may need to be submitted in Lithuanian or accompanied by Lithuanian translations, depending on the applicable Bank of Lithuania rules. Budget for it.
Staffing the AML function
Image source: Freepik
MiCA requires at least one director resident in the Union, not in Lithuania. Neither MiCA nor the Law on Markets in Crypto-Assets requires your AML officer to be a Lithuanian resident. What the Bank of Lithuania does expect is real governance and an effective AML function, and a compliance officer who cannot work closely with the Bank and the FNTT will struggle to show that.
Your AML officer needs working knowledge of Lithuanian AML/CTF law, sanctions obligations, and the Transfer of Funds Regulation. The new EU AML package is coming, but not yet: Regulation (EU) 2024/1624 applies from 10 July 2027, and most of Directive (EU) 2024/1640 must be transposed by the same date.
After you're licensed
Your obligations don't end at authorization. Plan for:
- Supervisory reporting. Financial, capital adequacy and activity reports under Bank of Lithuania Resolution No 03-121 (26 August 2025).
- Staff knowledge requirements. Under Article 3(8) of the national law and Resolution No 2025/03-162 (16 December 2025), staff giving advice or managing portfolios must have the required knowledge and competence and keep it up to date.
- Supervisory contributions. Annual contributions set by Bank of Lithuania resolution.
- License amendments. Adding services beyond your license means applying to amend it, under the same procedure as the original application.
- Passporting notifications under Article 65 before you serve each new Member State.
- Ongoing AML, DORA and GDPR compliance, and preparation for the 2027 EU AML rules.
Your Lithuania CASP readiness checklist
Work through these in order.
- Does what you do match one or more of the 10 services in Article 3(1)(16)?
- Are you already a credit institution, investment firm, EMI or other Article 60 entity?
- Is your asset a financial instrument, or is your service genuinely decentralized without an intermediary?
- Will you operate through a UAB or AB with effective management in the EU and at least one EU-resident director?
- Can you fund the higher of your Annex IV minimum and a quarter of your projected fixed overheads?
- Do you have named people for management, compliance, AML and ICT who can pass a suitability review?
- Can you produce the full Annex 1–7 package, including Lithuanian-language client documents?
How to read the results. A yes to 1 and a no to 2 and 3 means you need a CASP license. A no to 4 or 5 means your structure needs work before an application is worth filing. A no to 6 or 7 is the most common reason applications fail. If you answered "it depends" to 1 or 3, resolve that first — everything else follows from it.
Conclusion about the Lithuania crypto license
A Lithuania crypto license in 2026 means one thing: a MiCA CASP license from the Bank of Lithuania. The old registration route is closed, the regulator is selective, and the file it expects is substantial.
That is not a reason to avoid Lithuania. It is a reason to arrive prepared: the right services, the right entity, real substance in the EU, and an application package that reflects how you will actually operate.
That's the kind of cross-border problem Legal Nodes is built for. Through a single point of contact, we help founders map their services to MiCA, pressure-test their structure against the Bank of Lithuania's expectations, and coordinate independent local experts to prepare the application efficiently and reduce avoidable delays. The licensing decision is always the regulator's. If you're considering Lithuania as your EU home Member State, get in touch.
FAQs about the Lithuania crypto license
Do you need a crypto license in Lithuania?
If you intend to provide in-scope crypto-asset services as a CASP with Lithuania as your home Member State, and you don't fall within the Article 60 route or another exception, yes — you need MiCA authorization from the Bank of Lithuania. An issuer-only business, a pure software provider, a genuinely decentralized model, financial-instrument activity, or an Article 60 financial institution may sit under a different regime.
Can I still operate under a Lithuanian VASP registration?
No. The transitional period ended on 31 December 2025. From 1 January 2026, operators without a CASP license can no longer provide crypto-asset services in Lithuania.
Is one CASP license enough for all crypto services?
There is one authorization framework, but the license lists the specific services you are authorized to provide. Adding services later requires an amendment.
What is the easiest country to get a crypto license?
That's the wrong question under MiCA. Which jurisdiction suits you depends on your substance, where your management sits, your business model, the services you provide, and the regulator's expectations. Supervisors look for real presence, not forum shopping.
Who regulates crypto in Lithuania?
The Bank of Lithuania is the MiCA competent authority: it issues CASP licenses and supervises license holders. The FNTT is Lithuania's financial intelligence unit and receives suspicious transaction reports. According to the Bank of Lithuania, it oversees crypto market participants in the AML/CFT field together with the FNTT.
How long does it take?
MiCA gives the Bank of Lithuania 25 working days to check completeness and 40 working days to assess a complete application, with the assessment clock capable of being suspended for up to 20 working days for an additional-information request under Article 63(12). Your total timeline depends mainly on how ready your application is.
Does Lithuania tax crypto?
Yes, but not at a flat 15%. The State Tax Inspectorate (VMI) generally treats occasional crypto disposals as sales of other non-registrable property. Where the activity is not individual business activity, the first €2,500 of annual gain is exempt.
Above that, and particularly where trading qualifies as individual activity (continuous, independent and aimed at economic benefit), the 2026 rates depend on the amount and nature of the income. From 1 January 2026, Lithuania moved to progressive personal income tax, with rates of 20%, 25% and 32% depending on annual income, and a 15% rate for certain non-employment income up to 12 average monthly wages. Individual activity has its own credit mechanism: effective rates start at 5% on taxable profit up to €20,000 and rise to 20% at €42,500, with the general bands applying above that. Get tax advice on your specific situation.
Disclaimer: the information in this article is provided for informational purposes only. You should not construe any such information as legal, tax, investment, trading, financial, or other advice.
