MiCA License in Lithuania 2026

Minimum own-funds thresholds under MiCA are typically structured as follows:

• Class 1 — €50,000: for lower-risk services such as reception and transmission of orders, placing, advice, portfolio management, and transfer services relating to crypto-assets;
• Class 2 — €125,000: for execution of orders, exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets;
• Class 3 — €150,000: for custody and administration of crypto-assets on behalf of clients and operation of a trading platform for crypto-assets.

Capital must be demonstrable, lawful in origin, and normally injected in fiat, not in volatile crypto-assets. Founders often underestimate that regulatory capital is only the floor: the real launch budget also includes legal work, compliance tooling, local staffing, accounting, audit, and ICT security implementation.

You will generally need a Lithuanian legal entity, most often a UAB, with a registered office and a governance setup that supports effective supervision. A formal address alone is not enough if the actual management, compliance, and operational control sit elsewhere with no local accountability.

In practice, the Bank of Lithuania and banking providers look for real substance: clear decision-making lines, accessible management, documented outsourcing oversight, and a credible local operating model. Depending on your business model, that may include local directors or senior managers, a local AML function, or at least a practical supervision footprint in Lithuania. Incorporation itself often takes 1-3 weeks, but substance planning should start before filing.

The Bank of Lithuania will assess whether shareholders, beneficial owners, directors, and key function holders are fit and proper. This review usually covers:

• good repute and criminal-record status;
• relevant experience in crypto, payments, financial services, risk, or compliance;
• time commitment and role clarity;
• source of wealth and source of funds for founders and capital providers;
• conflicts of interest and governance independence.

A weak management file is one of the most common reasons for delay. A strong file usually contains detailed CVs, role descriptions, evidence of prior regulated experience, clean background documentation, and a governance map that matches the actual business model.

A Lithuania CASP must maintain a business-specific AML/CFT framework aligned with the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing, MiCA conduct expectations, and the operational realities of crypto-assets. A generic template is not enough.

• business-wide ML/TF risk assessment;
• CDD, EDD, sanctions screening, and ongoing monitoring;
• blockchain analytics / KYT controls;
• suspicious transaction reporting procedures to FCIS / FNTT;
• record retention, training, and independent review cadence;
• Travel Rule controls under Regulation (EU) 2023/1113.

You will usually need a clearly designated AML officer or MLRO-equivalent function with sufficient authority, expertise, and access to management. Whether this role must be locally based depends on the concrete setup, but effective local supervision and responsiveness are critical in practice.

In 2026, a CASP application without serious ICT governance is structurally weak. The regulator expects you to show how your platform manages availability, integrity, confidentiality, key management, incident escalation, outsourcing risk, and business continuity.

• ICT risk management framework and asset inventory;
• access control, privileged-access logging, and segregation of duties;
• wallet architecture description, including MPC, HSM, or cold-storage controls where relevant;
• incident response, crisis communications, and evidence preservation;
• business continuity and disaster recovery with target RTO/RPO;
• third-party ICT register and vendor oversight aligned with DORA.

A practical nuance many competitors miss: if you outsource core wallet, KYC, or transaction-monitoring functions, the regulator will still expect your board and control functions to understand and supervise those providers rather than treat outsourcing as a compliance shortcut.

Your application must explain exactly what you do, for whom, where, and how. The Bank of Lithuania will compare your narrative against your policies, customer journey, custody model, and revenue assumptions. Inconsistencies create immediate review friction.

A strong package usually includes:

• service-by-service MiCA classification;
• client journey and onboarding flows;
• target jurisdictions and passporting plan;
• outsourcing map and vendor dependencies;
• 3-year financial projections with realistic assumptions;
• liquidity, safeguarding, complaints, and wind-down logic.

One underappreciated issue is negative-space analysis: you should also identify what your company does not do, for example whether you avoid custody, avoid dealing in own account, or do not issue tokens. This helps prevent overbroad regulatory interpretation.

If your model involves custody or control over client crypto-assets or client funds, safeguarding becomes central. The regulator will expect a clear description of wallet ownership, signing authority, reconciliation, insolvency ring-fencing logic, and segregation of client assets from proprietary assets.

Typical focus points include:

• separate wallet/account architecture for client assets;
• daily or near-real-time reconciliation procedures;
• incident and loss-allocation logic;
• client disclosures on custody risk and recovery process;
• access matrix for key holders and emergency procedures.

CASP authorization does not automatically solve token-issuance questions. If your project also plans an ART, EMT, or admission-to-trading strategy, separate MiCA analysis is required in parallel.

A Lithuania MiCA license improves credibility with banks and EMIs, but it does not guarantee account opening. You should prepare a banking strategy early, especially if your model needs fiat on-ramp/off-ramp, client-money segregation, or merchant acquiring.

Founders typically need:

• corporate account for paid-up capital and operations;
• payment partner or EMI relationship for fiat settlement;
• clear AML narrative for expected flows, geographies, and customer types;
• evidence that crypto-fiat controls, sanctions checks, and source-of-funds reviews are operational.

RUE regularly aligns licensing and banking workstreams together because a technically licensable model can still fail commercially if its fiat rails are not credible.