CASP License in Lithuania
A CASP license in Lithuania is the hardest one in the Baltics to get, and the regulator says so out loud.
A CASP license in Lithuania is the hardest one in the Baltics to get, and the regulator says so out loud.
A CASP licence in Lithuania is a MiCA authorisation granted by the Bank of Lithuania under Regulation (EU) 2023/1114 and Law No. XIV-2879, in force since 25 July 2024. Capital follows the class: EUR 50,000 for advice, brokerage and transfers, EUR 125,000 for exchange and custody, EUR 150,000 for a trading platform. The application fee is about EUR 2,400, and the annual supervisory charge is 0.7% of revenue with a EUR 3,000 floor. The Bank's own estimate for assessment is four to five months; nine to ten months end to end is the planning assumption, against a statutory clock of 25 plus 40 working days. The transitional regime ended on 31 December 2025. As of the ESMA interim register of 16 September 2026, the Bank of Lithuania has authorised 6 CASPs; see the register in numbers. The regime fits firms with real capital, a resident AML officer and a business the file can describe. Protegra prepares the file and runs the regulator dialogue, from EUR 45,000.
| Item | Figure | Basis |
|---|---|---|
| Regulator | Bank of Lithuania (Lietuvos bankas) | Law No. XIV-2879, in force 25 July 2024 |
| Capital by class | EUR 50,000 / 125,000 / 150,000 | Annex IV of Regulation (EU) 2023/1114 |
| Application fee | about EUR 2,400 | Bank of Lithuania |
| Annual supervisory fee | 0.7% of revenue, minimum EUR 3,000 | Draft legislation; confirm before committing |
| Timeline | 25 + 40 working days statutory; 9–10 months realistic (assessment 4–5 months, the Bank's own estimate) | Article 63 of Regulation (EU) 2023/1114; Bank of Lithuania |
| Licences granted | 6 CASPs, from 102 applications in 2025 | ESMA interim register, release 16 Sep 2026 |
| Corporate tax | 17% from 1 January 2026 (7% under EUR 300,000 revenue) | Lithuanian corporate income tax |
Sources: Bank of Lithuania (Lietuvos bankas); ESMA interim register, release 16 Sep 2026; Annex IV and Article 63 of Regulation (EU) 2023/1114; Law No. XIV-2879.
Two institutions matter here and they are easy to confuse. The Bank of Lithuania grants CASP authorisation under MiCA. The old virtual-asset register, the one that made Lithuania famous, was kept by FNTT — the Financial Crime Investigation Service — under anti-money-laundering law. FNTT no longer licenses anybody, but it still supervises AML, and the two now coordinate.
Lithuania also moved early. The implementing law was adopted in July 2024, months ahead of several member states, and Robinhood Europe held the first Lithuanian CASP license by May 2025. Five more followed: Coingate, Nuvei Liquidity, Micar Assets, Newrails and Blue Emi.
The transitional period ended on 31 December 2025. It had been set for 1 June 2025 first and pushed back once by the Seimas, and that was the last extension Lithuania granted.
At the end of 2022 the Lithuanian register held 758 virtual asset service providers, more than any other country in the European Union. Estonia had 381. Poland had 346. Registration was cheap, the requirements were thin, and the register filled up the way such registers do.
Then it was emptied, in four moves, by two different institutions.
The first move was capital, and it came from parliament rather than a regulator. From January 2023 the statutory minimum rose from EUR 2,500 to EUR 125,000 — fifty times higher, applied retroactively to companies that had signed up under the old figure. Within months the register was down to roughly 200. By December 2023 it was back at 540, and at 580 by March 2024, because new applicants kept walking in through a door that was still open.
The second move closed that door. FNTT, which kept the register, said in public that more than half the companies on it showed signs of being fictitious, and gave an example that settled the argument: 79 of them shared one address. Firms then had until 31 May 2024 to prove their EUR 125,000 was money in an account rather than a number in a filing.
The third move was MiCA. In May 2025 the chairman of the Bank of Lithuania, Gediminas Šimkus, put the survivors at roughly 70 out of some 400 remaining firms. Over that year the Bank received 102 applications from 55 companies — several of them filing again after being turned down.
Six did.
The fourth move is the one still running. Since 1 January 2026 the Bank of Lithuania can order the blocking of websites belonging to unlicensed providers, and firms without authorisation must stop taking on new clients. There is no register left to sit in quietly.
the peak, December 2022, first in the EU
EUR 2,500 to EUR 125,000, January 2023
filed by 55 companies during 2025
You would rather be examined properly than approved casually. This regulator spent four years shrinking its own market and explaining publicly why.
You already live in payments. Lithuania hosts one of the deepest EMI and payment-institution communities in the EU, and that ecosystem is where a crypto company here actually banks.
Your operation is real and you can evidence it: capital with a history, staff who work, transactions that happened.
You are converting an existing Lithuanian structure and would rather fix it than move it.
You are shopping for the least demanding EU regime. Lithuania is the opposite of that as a matter of stated policy.
Your structure is thin — nominal directors, capital that lands the week before filing, an address you share with strangers. That is the exact profile the cleanup was built to find.
You need certainty of outcome. The regulator's own forecast overshot reality by a factor of ten, and no adviser can tell you which side of that line you fall on.
You want the cheapest entry in the region. Czechia charges about EUR 800 to apply and Slovakia about EUR 15, against EUR 2,400 here.
Your beneficial owners are exposed to national-security screening. A separate government commission reviews foreign investment and has rejected applications on that basis, independently of anything the Bank of Lithuania decides.
Every Lithuanian license is granted and supervised from one address: Gedimino pr. 6 in Vilnius, the seat of the Bank of Lithuania. What makes being in the same city worth anything is what grew around it. At the end of 2025 Lithuania had 73 licensed electronic money institutions and 44 payment institutions, and 248 fintech companies employing roughly 7,800 people. The central bank's own settlement rail, CENTROlink, carried more than 140 active participants from over twenty countries by May 2026 — which is the real reason a licensed crypto company here can get banked at all.
These three figures come from MiCA itself, so they are the same in Vilnius as in Prague or Valletta. Lithuania has a particular relationship with the middle one: EUR 125,000 is the number parliament imposed on the old register in 2023, and it is the number that emptied it. Choose by the services you will genuinely offer — widening the scope afterwards means a fresh trip to the regulator.
EUR 125,000 is the threshold that emptied the old Lithuanian register in 2023.
One boundary catches people, so it is worth stating plainly. Class 1 does not authorise custody as a service — and it does not exempt you from Article 70 either. Client funds passing through your hands while you execute an order still have to be safeguarded. The class decides what you may offer, not whether client money is protected.
This money is a reserve rather than a fee: it stays yours, on your balance sheet, in an EU or EEA account. Lithuania is simply the jurisdiction most likely to ask where it came from — proving the capital was real was the entire point of the exercise FNTT ran in 2024.
An AML officer resident in Lithuania. Applicants underestimate this one more often than any other requirement: the person answerable for anti-money-laundering has to be reachable by the supervisor, in the country.
Board composition is where sources disagree. Some advisers read the rules as requiring an EU-resident director, others as requiring a Lithuanian-resident one. Plan for the stricter reading until your structure is fixed.
Shareholders are free. Ownership can sit outside the EU entirely; residence attaches to the people who answer to the regulator, not to the cap table.
Fit and proper covers the management body and qualifying shareholders: no criminal record, sound finances, relevant experience, and an honest account of the hours each person will give the company.
Named owners for risk management, for ICT and information security, and for client complaints.
An office where work happens. Not a registered address — FNTT identified fictitious firms partly by the addresses they shared, and that memory has not faded.
Capital held in an EU or EEA account, with a documented trail showing where the money came from.
Outsourcing is allowed under MiCA and it does not move the liability. Risk, ICT security, compliance and key management answer to you whoever performs them.
Constitutional documents of the company.
A three-year programme of operations with financial projections the supervisor will find plausible.
Evidence that capital is paid in, plus its provenance.
AML and CFT policies written around this business, not adapted from a template.
An ICT and information security policy that meets DORA.
A risk management policy.
A complaints handling procedure.
A business continuity plan.
The custody model, described in detail, if client assets will be held.
Article 62 of MiCA sets what the pack must contain; Commission Regulations (EU) 2025/305 and 2025/306 set the detail and the forms, identically across the union. Two of these items usually need outside help long before filing: the AML function, which we also provide as an outsourced service, and the ICT documentation, which sits inside the broader DORA obligation.
Which MiCA services you apply for decides your class, your capital and most of the file. Incorporate the UAB, appoint the board, find the AML officer who will actually live in Lithuania, open the account the capital will sit in.
Programme of operations, AML and CFT policies, risk management, ICT and DORA documentation, custody model, continuity plan. The supervisor across the table spent four years removing companies whose documents described a business that did not exist, so the file has to describe one that will.
The application goes to Lietuvos bankas with the fee of about EUR 2,400.
The Bank of Lithuania puts this at four to five months, longer where the case is complex. Questions arrive throughout, and the speed of your answers is the one variable you control.
Nine to ten months end to end is the planning assumption. MiCA's statutory clock of 25 plus 40 working days counts regulator time, and the calendar counts everything else.
That four-to-five-month figure comes from the Bank itself, not from an adviser's brochure, which makes it worth more than most timelines you will read.
A note on the annual fee, because it is the line advisers leave out. Lithuania's supervisory charge is set at 0.7% of revenue with a floor of EUR 3,000 a year — a structure almost identical to Latvia's 0.6% and EUR 5,000. We have seen that figure in the draft legislation rather than in a confirmed final text, so treat it as the number to budget against and confirm before you commit.
Advisory pricing here spreads wider than anywhere nearby. Converting an existing VASP structure is quoted from about EUR 8,500. Building from scratch starts around EUR 19,900. Full-scope MiCA preparation is offered at EUR 34,900, and one firm prices the application phase alone at EUR 29,000 to 49,000. What varies is not the market — it is what is being sold, which runs from submitting a form to constructing a regulated business.
All figures are lower bounds. Exact cost follows from your service mix, your class and how much of the structure already exists. Work beyond the agreed scope is EUR 250 per hour.
Pick a class and toggle the services you need — we estimate your first-year cost, including the share-capital reserve.
From 1 January 2026. 7% while revenue stays under EUR 300,000, and 0% for the first two tax years of a newly formed company.
Crypto-to-fiat and crypto-to-crypto exchange follows the EU exemption for currency transactions. Advisory, software and custody fees do not inherit that exemption automatically.
Social contributions on Lithuanian employees, the resident AML officer among them.
Lithuania has moved this rate twice in two years: 15% historically, 16% through 2025, 17% from January 2026. A fair number of licensing pages still print 15% as though it were current, which is a useful test of when a page was last touched. Four points below the Czech 21% is worth roughly EUR 40,000 a year on a million of taxable profit — real money, and still not a reason to choose a jurisdiction by its tax line alone.
Withheld and paid over by the company, not by you. Dividends sit outside the reformed 20/25/32% progressive scale entirely.
Dividends attract no Sodra contribution of any kind. Salary does, up to a 2026 ceiling of EUR 99,422.
The first EUR 2,500 of annual gain is exempt and not even declared. 15% applies above that, up to 120 average salaries — roughly EUR 277,000 in 2026 — and 20% beyond it.
Work it through and the arithmetic is unusually clean. An owner taking EUR 100,000 out in dividends pays EUR 15,000 and keeps EUR 85,000, with nothing owed to Sodra. Measured from the other end — from company profit rather than from the dividend — that EUR 100,000 in hand costs about EUR 120,500 of pre-tax profit, a combined burden near 29.5%, or closer to 21.5% for as long as the company still qualifies for the 7% small-company rate.
There is a second asymmetry worth knowing before you decide what sits on the company balance sheet. A Lithuanian company pays 17% on realised crypto gains from the first euro, with no allowance and no lower band. An individual holding the same assets personally pays nothing on the first EUR 2,500 each year and 15% after that, up to a threshold most founders will never reach. Where the business model allows the separation, personal holdings and company holdings are worth keeping apart.
Capital and the statutory clock are the same everywhere — MiCA is a regulation and applies directly. National differences live in three columns: what you pay to apply, what you pay every year afterwards, and how the profit is taxed once the business works.
| Country | Regulator | Application fee | Annual charge | Corporate tax | Regime status |
|---|---|---|---|---|---|
| Lithuania | Lietuvos bankas | about EUR 2,400 | 0.7% of revenue, min EUR 3,000 | 17% | Running · 6 licenses from 102 applications |
| Czech Republic | ČNB | about EUR 800 | not published | 21% flat | Running · 11 licenses from 251 applications |
| Latvia | Latvijas Banka | EUR 2,500 | EUR 5,000 + 0.6% of revenue | 0% undistributed, 20% on distribution | Running |
| Estonia | Finantsinspektsioon | — | — | 0% undistributed, 20% on distribution | Running |
| Slovakia | NBS | about EUR 15 | — | 21% | Running |
| Poland | none designated | — | — | 9% / 19% | Not operating · act vetoed three times |
The Czech Republic is the comparison that matters, and it cuts both ways. Prague costs a third of Vilnius to enter and taxes profit four points higher. Its regulator granted eleven licenses out of 251 applications; Lithuania granted six out of 102. Neither is generous, and Czechia is still building its first cohort while Lithuania is on its second decade of watching this industry.
Latvia and Estonia deserve a closer look than their headline rate suggests. Both tax undistributed profit at zero and only take 20% when money leaves the company, which for a business that reinvests is a materially different proposition from a flat 17%. Latvia charges more at the door and keeps charging; Estonia went through its own consolidation before Lithuania started.
Poland is the outlier, and not on price. Its crypto-asset market act passed the Sejm three times and was vetoed three times, most recently in June 2026, and the regulator has confirmed that no Polish authority has been designated under MiCA. Firms are still being sold Polish licenses that nobody can currently issue.
Six licenses in fourteen months is not a slow regulator. It is a selective one. These are the six questions clients bring us, and the six places a file stops moving.
The services you intend to sell set your class, your capital and most of what the file has to prove. In Lithuania that conversation also settles the prior question — whether filing here is worth the money for your model at all.
The reputation belongs to a register that went from 758 companies to none. The supervisor that emptied it is the one reading your file. A programme of operations now has to survive being taken literally, line by line.
This one is underestimated more often than any other requirement: the person answerable for anti-money-laundering has to be a Lithuanian resident, reachable by the supervisor, in the country. Everyone else in the compliance function can sit anywhere you like.
No. The FNTT identified fictitious firms partly by the addresses dozens of them shared, and that memory has not faded. The office has to be a place where work happens, and the file has to show it.
25 working days for completeness plus 40 for the assessment is the statutory clock, and it stops every time the Bank of Lithuania asks a question. We answer fast and in full — but we cannot invent facts about your business, so the pace depends on both sides.
AML monitoring, MLRO reporting, DORA's ICT obligations and supervisory reporting start on the day the license is granted rather than ending there. The file is built so year one is not a second project.
Our team has advised on MiCA licensing and compliance in Poland, Latvia, Malta, the Czech Republic and the Netherlands. We hold no Lithuanian license ourselves and do not pretend otherwise. What carries over is the standard the files are built to.
About EUR 2,400 to apply, plus an annual supervisory charge set at 0.7% of revenue with a EUR 3,000 floor. Regulatory capital is EUR 50,000, EUR 125,000 or EUR 150,000 by class and stays yours. Professional support starts at EUR 45,000 with us; the local market runs from roughly EUR 8,500 for converting an existing structure to EUR 34,900 and beyond for full-scope work.
The Bank of Lithuania estimates four to five months for assessment, longer in complex cases. Allow nine to ten months from decision to license including preparation.
Six. They went to Robinhood Europe, which was first in May 2025, then Coingate, Nuvei Liquidity, Micar Assets, Newrails and Blue Emi.
Minimum capital rose from EUR 2,500 to EUR 125,000 in January 2023. FNTT, which kept the register, then required proof by 31 May 2024 that the capital was real. MiCA authorisation replaced the register at the end of 2025, and the Bank of Lithuania received 102 applications from 55 companies during that year.
The Bank of Lithuania licenses and supervises CASPs under MiCA. FNTT, the Financial Crime Investigation Service, kept the old virtual-asset register and still supervises anti-money-laundering compliance.
Yes. The person answerable for AML is expected to be resident in Lithuania and available to the regulator there. It is the requirement applicants most often discover late.
Sources differ. Some read the requirement as an EU-resident director, others as a Lithuanian-resident one. Until your structure is settled, plan for the stricter version.
Yes, including from outside the EU. Residence requirements attach to the roles that face the regulator rather than to shareholders. Note separately that a government commission screens foreign investment on national-security grounds and has rejected applications on that basis.
Yes, and a shared registered address is the wrong answer. FNTT identified fictitious firms in the old register partly by the addresses they had in common.
17% from 1 January 2026. It was 15% historically and 16% during 2025; pages still quoting 15% have not been updated.
Yes. Owning and trading crypto has never been restricted. What changed is who may sell those services to others: since 1 January 2026 that requires a CASP licence from the Bank of Lithuania, and providing them without one is unlawful — the regulator can have the websites of unlicensed providers blocked.
No. The transitional period ended on 31 December 2025, after one extension from June of that year. Since 1 January 2026 the Bank of Lithuania can have the websites of unlicensed providers blocked.
Constitutional documents, a three-year programme of operations with projections, proof and provenance of capital, AML and CFT policies, ICT and information security documentation meeting DORA, risk management and complaints procedures, a business continuity plan, and the custody model where client assets are held. Article 62 of MiCA and Commission Regulations (EU) 2025/305 and 2025/306 set the required content.
Dividends are taxed at a flat 15%, withheld and paid over by the company, and they carry no Sodra contribution of any kind. An owner drawing EUR 100,000 keeps EUR 85,000. Counting the 17% corporate tax paid before the dividend, the combined burden from company profit to personal account is about 29.5%, or roughly 21.5% while the company still qualifies for the 7% small-company rate.
On the numbers, yes. Czechia issued eleven licenses from 251 applications; Lithuania issued six from 102. Czechia is cheaper to enter, Lithuania taxes profit four points lower, and Lithuania has been supervising this industry for considerably longer.
Yes. Authorisation passports to all 27 member states on notification by the Bank of Lithuania, with no second application.
Reference: the Crypto-asset service provider licence in the Licensing Atlas.
Send us the services you intend to provide. You will get back the class you need, what the file must prove, and an honest timeline.