PSD3 will replace the Lithuanian rules that implement PSD2 and the Second E-Money Directive. Every electronic money institution and payment institution supervised by the Bank of Lithuania will have to evidence that it meets the new framework within 27 months of entry into force. This checklist is written for compliance officers, MLROs and risk teams who need to turn that into work. It assumes familiarity with the EU-wide process in our PSD3 re-authorisation guide.
Where Lithuania stands
The EBA Central Register listed 69 authorised e-money institutions and 34 payment institutions with a Lithuanian home licence at 30 October 2026, plus 2 EMIs under a waiver, 8 exempt payment institutions and 3 registered account information firms. 84 of these firms passport into other member states. The Bank of Lithuania's own review of 2025 counted 73 active EMIs and 44 payment institutions, with licensed-activity revenue of EUR 652.7 million, 48% of institutions loss-making, one institution below minimum capital and 11 close to it. Its supervisory priorities were AML and counter-terrorist financing, safeguarding, fraud controls and governance.
| Milestone | When |
|---|---|
| Council first reading position adopted | 29 October 2026 |
| European Parliament plenary approval | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| National PSD3 rules and the PSR apply | 21 months after entry into force |
| Existing institutions must have shown compliance | 27 months after entry into force (plus up to 3 months in exceptional cases) |
Lithuania has not yet adopted the law that will transpose PSD3, and commentators have noted there is no national procedure yet for re-registration. There is no 2026 deadline. The controls below can all be prepared now and will be needed whatever form the procedure takes.
Checklist 1: substance in Lithuania
PSD3 requires the head office in the home member state and at least part of the payment services business carried out there. The recitals say part can be less than the majority, but it must be genuine.
| Control | Evidence to hold |
|---|---|
| Management body decides in Lithuania | Board calendar, minutes, location of meetings, delegated authorities |
| Senior managers based locally | Employment contracts, residence, time allocation |
| Control functions effective in Lithuania | Compliance officer, MLRO and risk manager roles, reporting lines, board access |
| Payment operations carried out locally | Procedures and staff for onboarding, reconciliation, safeguarding or customer support |
| Group outsourcing overseen from Lithuania | Outsourcing register, intra-group agreements, oversight reports |
Score each line honestly. Where the institution relies on a group in another country for most functions, record the gap and the remedy, whether that is adding people in Vilnius, moving functions or restructuring.
Checklist 2: safeguarding after CENTROlink
- Confirm every safeguarding account is with a credit institution. The Bank of Lithuania stopped providing dedicated safeguarding accounts from April 2025; CENTROlink settlement accounts remain for SEPA transactions.
- Move e-money safeguarding from up to five business days to the end of the business day after receipt.
- Where all funds sit with one bank, open a second safeguarding account and set an allocation policy. PSD3 asks institutions to try to avoid single-bank concentration, with EBA standards to follow.
- Hold signed acknowledgement letters confirming the funds are held for customers and protected from the bank's set-off.
- Prepare user information on the safeguarding method and applicable insolvency law, for onboarding and before material changes.
- Keep a daily reconciliation log with breaks, causes and fixes for at least the last 12 months.
The Bank of Lithuania has fined institutions for improper safeguarding in recent years. The full control set is in our PSD3 safeguarding checklist.
A note on CENTROlink: settlement accounts used for SEPA transactions on customers' behalf are not safeguarding accounts. Funds moving through them should be traced in the safeguarding procedure, with clear cut-off times for transfer to the safeguarding bank, so that next business day timing is met even when settlement runs late.
Checklist 3: capital and own funds
- Calculate PSD3 initial capital by service: EUR 250,000 for e-money issuance and EUR 150,000 for the core payment services, added together where both apply.
- Calculate ongoing own funds: 2% of average outstanding e-money, plus the volume-based method for payment services not linked to e-money.
- Build a three-year projection with a buffer above the requirement, approved by the board.
- Where a capital injection is needed, check whether it triggers change of control approval.
- Reconcile each input to the latest audited accounts.
With nearly half the sector loss-making in 2025, this checklist is where many Lithuanian files will need board decisions. Our own funds calculation guide walks through the methods.
Checklist 4: AML and fraud
- Close every open AML finding from Bank of Lithuania inspections or internal audit.
- Refresh the business-wide risk assessment, including higher-risk corridors and client types.
- Align customer due diligence and beneficial ownership checks with the EU AML Regulation, which applies from 10 July 2027, before the PSD3 transition ends.
- Prepare for PSR fraud rules: verification of payee for credit transfers, fraud data sharing and impersonation fraud refunds.
The AML Regulation work is set out in our EU AML Regulation readiness plan.
Checklist 5: governance, ICT and DORA
- Map the governance and internal control description to PSD3 requirements and the Bank of Lithuania's governance recommendations for EMIs and PIs.
- Keep the DORA register of information current and filed.
- Evidence incident classification and reporting under DORA.
- Test business continuity and ICT recovery plans and record results.
Checklist 6: services, agents and passports
- Map every activity to the PSD3 service list. EMIs authorised only for e-money issuance will need related payment services listed expressly if they provide them.
- Confirm agent and distributor registrations and oversight.
- Align passport notifications with the PSD3 service list.
Checklist 7: the winding-up plan
- Draft a plan proportionate to size and business model, providing for return of safeguarded funds in a disorderly wind-down.
- Model severe scenarios, including loss of the safeguarding bank and sudden withdrawal of group support.
- Test the process for producing a full list of customers and balances within a day or two.
- Cost the plan and confirm capital remains above the minimum until the last customer is repaid.
Our winding-up plan guide sets out what regulators look for.
Evidence the Bank of Lithuania can rely on
A PSD3 file is easier to assess when each claim points to a document. For a Lithuanian institution the core index usually includes: the programme of operations with the PSD3 service list; a three-year business plan with capital projection; safeguarding account letters, procedures and reconciliation logs; the governance and internal control description with organisation chart and key function holder details; the AML and counter-terrorist financing control description and latest business-wide risk assessment; DORA register of information, incident procedure and continuity test results; agent and distributor list; and the winding-up plan. Keep each item dated, version controlled and approved at the right level. Where the Bank of Lithuania has previously raised a finding in that area, attach the evidence of closure.
Sequencing the work
Start with substance and capital, because they may need structural or shareholder decisions. Run safeguarding and AML in parallel, since both have long lead times with banks and systems. Finish with the winding-up plan, which draws on all the others. Our compliance support team runs PSD3 gap analyses for Lithuanian institutions, and our safeguarding team reviews arrangements and reconciliations. See also our Lithuania EMI licence and Lithuania payment institution licence guides.