Latvia: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) implemented nationally by Latvia's Law on Crypto-asset Services (Kriptoaktīvu pakalpojumu likums, adopted 13 July 2024); Latvijas Banka is the single competent authority for licensing and supervision.

Latvia operates a comprehensive, in-force crypto regulatory regime built on EU MiCA plus its dedicated 2024 national Law on Crypto-asset Services, with Latvijas Banka as the national competent authority. CASP authorisations have been issued since the regime applied on 30 December 2024 (first MiCA licence to BlockBen on 3 Dec 2025; multiple licences issued through 2026), and stablecoin issuer rules have applied since 30 June 2024. Tax treatment, AML, and the EU DAC8/CARF crypto-reporting regime (effective 1 January 2026, enforcement from 1 July 2026) complete the framework.

Framework: EU AI Act (Regulation 2024/1689, directly applicable); national supplementary laws: Law on the Development of Artificial Intelligence (Mākslīgā intelekta attīstības likums, 2025) and Law on the Latvian Artificial Intelligence Centre (Mākslīgā intelekta centra likums, in force 20 March 2025); lead authority: Ministry of Smart Administration and Regional Development (VARAM)

Latvia, as an EU member state, is subject to the directly applicable EU AI Act (Regulation 2024/1689), with prohibited AI practices enforceable from February 2025 and full high-risk provisions phasing in through 2026-2027. In parallel, Latvia enacted two national AI laws in early 2025: one establishing strategic AI development objectives and one creating a public Artificial Intelligence Centre to coordinate policy, run regulatory sandboxes, and foster public-private-academic cooperation. VARAM has been designated the national lead authority for EU AI Act implementation and European Commission liaison, with market surveillance distributed across multiple sectoral regulators.

Framework: GDPR (EU Regulation 2016/679) directly applicable; supplemented by Latvia's Personal Data Processing Law (Fizisko personu datu apstrādes likums, in force 5 July 2018); supervised by the Data State Inspectorate (Datu valsts inspekcija, DVI)

Latvia's data-protection regime is anchored in the directly applicable GDPR, complemented by the national Personal Data Processing Law that entered into force on 5 July 2018, replacing the earlier Personal Data Protection Law of 2000. The Data State Inspectorate (DVI) is the independent supervisory authority and a full EDPB member with powers to investigate, issue corrective orders, and impose administrative fines. National law exercises several GDPR derogations, most notably lowering the age of digital consent to 13 and specifying rules on employment data processing, audit-trail retention, and video surveillance signage.

Framework: Law on Payment Services and Electronic Money (Maksājumu pakalpojumu un elektroniskās naudas likums; likumi.lv id 206634), implementing EU PSD2 Directive 2015/2366/EU; supervised by Latvijas Banka as single competent authority since 1 January 2023 (following FKTK/FCMC merger)

Latvia operates a fully established, EU-compliant licensing regime for payment institutions (PIs) and electronic money institutions (EMIs), supervised by Latvijas Banka since its absorption of the FKTK/FCMC on 1 January 2023. The Law on Payment Services and Electronic Money transposes PSD2 and provides a two-tier (licensed and registered) authorisation structure with EU passporting rights. Latvijas Banka is actively issuing licences, eight in 2025 and seven already by May 2026, and is preparing market participants for the forthcoming PSD3/PSR transition.

Framework: Latvia Immigration Law (Imigrācijas likums) as amended 29 June 2022; Cabinet of Ministers Regulation on remote-work visas; administered by the Office of Citizenship and Migration Affairs (OCMA/PMLP) and Ministry of Foreign Affairs

Latvia offers a dedicated Type D long-stay visa for remote workers, enacted via amendments to the Immigration Law effective 29 June 2022, making it one of the first EU member states to formalise such a route. The visa is available to non-EU/EEA/Swiss nationals employed by or self-employed through OECD-registered entities, is valid for one year and renewable once, and does not permit local employment in Latvia. A separate self-employed residence permit and a residency-by-investment (golden visa) programme also exist, though the latter faces potential suspension following 2024-2026 legislative reforms.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) directly applicable; national implementation via amendments to the Law on Information Society Services (Informācijas sabiedrības pakalpojumu likums) in force 21 June 2024; Consumer Rights Protection Centre (PTAC) designated as Digital Services Coordinator; National Electronic Mass Media Council (NEPLP) retains complementary powers over audiovisual/broadcast and national-security website blocking

Latvia implements the EU Digital Services Act as its primary online safety and content-moderation framework, supplemented by national legislation. Amendments to the Law on Information Society Services entered into force on 21 June 2024, designating PTAC as Digital Services Coordinator with full enforcement powers including on-site inspection and fines of up to 6% of global annual turnover. NEPLP holds parallel powers to block websites threatening national security and, since late 2024, to restrict access to copyright-infringing (piracy) sites.

Framework: National Cyber Security Law (Nacionālās kiberdrošības likums), in force 1 September 2024; implementing NIS2 (EU Directive 2022/2555); competent authority: National Cyber Security Centre (NCSC) under the Ministry of Defence, supported by CERT.LV

Latvia adopted the National Cyber Security Law on 20 June 2024 (in force 1 September 2024), replacing the former Law on the Security of Information Technologies and fully transposing the EU NIS2 Directive. The law applies to over 2,000 essential and important service providers across sectors including energy, transport, banking, health, and digital infrastructure. Supplementary Cabinet Regulation No. 397 'Minimum Cybersecurity Requirements' entered into force on 2 July 2025, detailing technical and organisational measures and incident-reporting procedures.

Framework: Latvian Commercial Law (Komerclikums, likumi.lv/ta/en/en/id/5490); registration authority: Enterprise Register of Latvia (Uzņēmumu reģistrs, ur.gov.lv)

Latvia permits 100% foreign ownership of companies with no nationality or residency restrictions on founders or directors. The most common vehicle is the private limited liability company (SIA), registrable online via the Enterprise Register portal in 1-3 working days. Minimum share capital is EUR 2,800 for a standard SIA or as low as EUR 1 for a reduced-capital (mazkapitāla) SIA, making entry barriers very low.