Custodial wallet / SaaS in Lithuania
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Lithuania with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Registration with FCIS as a custodian virtual currency wallet operator required
- Minimum €125,000 registered share capital required (increased Nov 2022)
- Robust internal AML/CTF rules aligned with Lithuanian AML Law and EU directives
- Documented risk assessment of ML/TF risks specific to the business model
- Customer Due Diligence (CDD) procedures including identification, verification, UBO identification, and ongoing monitoring
- Enhanced Due Diligence (EDD) for high-risk customers, PEPs, and complex/unusual transactions
- Transaction monitoring systems and procedures for suspicious activity detection
- Obligation to report suspicious transactions (SARs) to the FCIS
- Record keeping for at least 8 years for customer identification data and transactions
- Appointment of a dedicated MLRO who must be a permanent resident of Lithuania
- If the SaaS handles fiat (e.g., e-money issued to clients), an EMI or PI license from Bank of Lithuania may also be required
Key Restrictions
- Must be a legal entity (e.g., UAB) incorporated in Lithuania
- Must have a registered office in Lithuania
- MLRO must be a permanent resident of Lithuania
- Key personnel (e.g., CEO, board members) may need to demonstrate strong connection to Lithuania
- Minimum €125,000 registered share capital required
- If the custodial wallet SaaS touches fiat currency at any point (e.g., issuing e-money wallets to white-label clients' end users), an EMI or PI license from the Bank of Lithuania may be required in addition to FCIS registration
Key Risks
- Dual-regulatory risk: FCIS registration for crypto custody + potential Bank of Lithuania EMI/PI licensing if fiat is involved — unclear boundary for hybrid models
- Substance requirements (MLRO residency, local office, management links) may be challenging for remote-first or distributed teams
- The €125,000 minimum capital requirement (vs. prior €2,500) creates a higher barrier to entry than historically
- AML obligations apply to the SaaS operator directly (not delegated to white-label clients), but SaaS may need to ensure contractual flow-down of CDD/monitoring obligations to clients — unclear how FCIS views this split
- Limited precedent on enforcement for custodial wallet SaaS specifically; FCIS has been active in registering/refusing VASPs
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Key Regulator: The Financial Crime Investigation Service (FCIS) is the main supervisory body for virtual currency exchange operators and custodian virtual currency wallet operators.
Bank of Lithuania (BoL): Supervises traditional financial institutions (including EMIs and PIs) and provides general guidance on financial innovation, but does not directly license crypto-native activities without fiat components.
Custodian Virtual Currency Wallet Operator:
Registration Regime (FCIS): For virtual currency exchange and custodian wallet operators, Lithuania operates a registration model. This means that once an applicant meets the specified criteria (primarily AML/CTF related) and submits the required documentation, they are registered and allowed to operate. It is generally a less intensive process than obtaining a full financial services license.
Legal Entity: The applicant must be a legal entity (e.g., UAB – private limited liability company) incorporated in Lithuania.
A minimum €125,000 registered share capital is required for both virtual currency exchange operators and custodian virtual currency wallet operators. This requirement was significantly increased in November 2022 from a previous €2,500.
AML/KYC Requirements: Robust internal procedures are paramount:
Internal AML/CTF Rules: Comprehensive written policies and procedures aligned with Lithuanian AML Law and EU directives.
Risk Assessment: A documented assessment of money laundering and terrorist financing risks specific to the business model.
Customer Due Diligence (CDD): Procedures for identifying and verifying customers (individuals and legal entities), beneficial owners (UBOs), and understanding the purpose and nature of business relationships. This includes ongoing monitoring.
Enhanced Due Diligence (EDD): For high-risk customers, politically exposed persons (PEPs), or complex/unusual transactions.
Transaction Monitoring: Systems and procedures to monitor transactions for suspicious activities.
Reporting: Obligation to report suspicious transactions and activities (SARs) to the FCIS.
Record Keeping: Maintaining records of customer identification data and transactions for at least 8 years.
Registered Office: Must have a registered office in Lithuania.
AML Officer (MLRO): A dedicated, qualified Anti-Money Laundering Officer (MLRO) must be appointed. This individual must be a permanent resident of Lithuania. They are responsible for implementing AML/CTF procedures, training staff, and reporting to the FCIS.
Management/Board: While not all board members need to be Lithuanian residents, the company must demonstrate sufficient substance and connection to Lithuania, and the FCIS may require certain key personnel (e.g., CEO, board members) to have a strong link to the country.
Electronic Money Institution (EMI) License: Allows issuing electronic money and providing related payment services.
Payment Institution (PI) License: Allows providing various payment services (e.g., money remittance, payment initiation, account information services).
Fiat-to-Crypto / Crypto-to-Fiat Payment Processors (or traditional payment services using crypto): If the payment processor handles fiat currency (e.g., accepting fiat payments for crypto, converting crypto back to fiat and paying out to bank accounts, or issuing electronic money backed by fiat), then they would likely need a separate license from the Bank of Lithuania as either:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator can operate in Lithuania by registering with FCIS as a custodian virtual currency wallet operator (€125k capital, local entity, MLRO resident), but any fiat touchpoints may additionally require an EMI or PI license from the Bank of Lithuania, and AML obligations on the SaaS provider directly are significant.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?