Lithuanian Crypto License

Authorized Capital

Under MiCA, the share capital must be fully paid up for a company offering one of either exchange or wallet services. If the company will provide both exchanging and transfer (custodial wallet) services, the required capital is €150,000. This capital must be in cash and deposited in a bank or payment institution account before license application. You must show proof the money is in the company’s account, and after licensing the company should maintain at least this level of net equity. (Notably, earlier sources mention the capital doesn’t get frozen and can be used for operations, but regulators will monitor that it’s not depleted below required levels.)

​

Impeccable Reputation

MiCA brings even more scrutiny to the reputational integrity of all persons in positions of control. This includes shareholders with a 10% or more holding, all directors, senior executives, and especially the AML Officer. These individuals must demonstrate a clean criminal record, especially with regard to financial crime, corruption, or bankruptcy history. Background checks are enforced through a certificate of good conduct and reputational assessments, which will be reviewed by the Bank of Lithuania during the application process. Additionally, MiCA requires that such persons be fit and proper, which means demonstrating not only integrity but also competence.

​

Local AML Officer

A crucial requirement that remains unchanged is the obligation to appoint a Lithuanian-based AML Compliance Officer, who is also considered a key function holder under MiCA. This person must be a permanent tax resident of Lithuania, possess a clean record, and ideally have verifiable AML/CFT knowledge or experience. In the MiCA framework, this role gains elevated importance, as the AML Officer may also be held accountable for ensuring Travel Rule compliance, transaction monitoring systems, and coordinating with the Financial Crime Investigation Service (FNTT). One AML Officer may not serve multiple CASPs—they must be fully dedicated to one firm, and MiCA permits (and sometimes expects) that they also be appointed to management-level positions, especially where enhanced governance expectations apply.

​

Physical Presence & Remote Management

While MiCA introduces harmonized standards across the EU, Lithuania maintains a relatively flexible approach regarding foreign founders. There is no obligation for shareholders or directors to be physically based in Lithuania, with the exception of the AML Officer. However, a Lithuanian address for official service remains mandatory—usually this is arranged through a legal partner, registered agent, or rented office address. While physical presence for board meetings is not required, having local signatories or access to authorized representatives in Lithuania can ease interactions with local regulators.

​

Fit and Proper Management

Directors and senior managers must show they are competent to run a regulated crypto firm, even if MiCA doesn't impose strict educational standards. The Bank of Lithuania is likely to assess CVs, reference letters, and professional experience, especially for individuals in CEO, COO, or CCO positions. If the leadership lacks strong crypto or financial services background, adding an advisory board or engaging consultants with MiCA-relevant experience can strengthen the case. The emphasis is on collective competence, with MiCA requiring the management body as a whole to be of adequate professional standing and experience.

​

AML & Internal Control Program

Compliance under MiCA in Lithuania will build upon existing AML obligations and expand their scope. Companies must implement a robust internal AML/CFT framework that includes customer onboarding, ongoing transaction monitoring, and risk-based customer due diligence. In practice, most CASPs will apply KYC procedures at onboarding regardless of transaction thresholds. Enhanced Due Diligence (EDD) is mandatory for politically exposed persons (PEPs) or clients from high-risk jurisdictions.

All clients and transactions must be screened against EU, UN, US sanctions lists and the local Lithuanian terrorism list. Internal audit or periodic independent AML audits are strongly advised—this is likely to become a formal requirement under MiCA. Additionally, firms must comply with the FATF Travel Rule, which under EU implementation means capturing and transmitting originator and beneficiary information for crypto transfers above €1,000 (or even lower based on risk). Lithuania is already aligning national practice with this standard.

​

IT Systems & Cybersecurity

MiCA elevates the importance of operational resilience and IT security for CASPs. The company must operate secure and robust IT systems tailored to the services provided. If offering wallet services, secure key management systems (such as cold storage, multi-signature protocols, HSMs) must be in place. For exchanges, platform integrity, uptime, and trade fairness are expected to be demonstrably supported by sound infrastructure. While the MiCA license application doesn’t require full code audits or security certifications up front, Lithuanian regulators will expect a detailed IT infrastructure and risk management description, and any security breaches post-licensing may be grounds for enforcement action or license review.

​

Scope of Services

MiCA defines specific categories of crypto-asset services including custody, exchange (fiat-crypto and crypto-crypto), operation of trading platforms, execution of orders, and advisory. Once licensed in Lithuania, a CASP can operate under any combination of these permissions across the EU single market via passporting. However, this license does not cover security tokens (financial instruments under MiFID II) or e-money issuance, which require separate licensing from the Bank of Lithuania. If a project involves ICO/token issuance, it must be assessed for its legal classification; non-security tokens may be issued under MiCA as "asset-referenced" or "utility" tokens, while security-like tokens fall outside this scope and may require a prospectus and investment firm license.

​

Reporting Obligations

Under MiCA, licensed CASPs will be required to implement structured and periodic reporting to national regulators. Lithuania’s FNTT and Bank of Lithuania will require licensees to be audit-ready and responsive to data requests. This includes suspicious transaction reporting (STRs), responses to regulatory surveys, and periodic financial and operational disclosures. The AML Officer acts as the main liaison for these obligations and must ensure the company can rapidly respond to any regulatory inquiries. While under the old VASP regime, there were few routine reporting demands, MiCA introduces a regulatory reporting regime more in line with traditional financial services.