Lithuania: technology regulation at a glance

Framework: EU Regulation 2023/1114 (MiCA) directly applicable; nationally implemented by the Law on Markets in Crypto-Assets of the Republic of Lithuania (adopted 11 July 2024). Competent authority: Bank of Lithuania (Lietuvos bankas). AML/CFT supervision by the Financial Crime Investigation Service (FNTT/FCIS) under the Law on the Prevention of Money Laundering and Terrorist Financing. Tax treatment under the Law on Personal Income Tax and Law on Corporate Income Tax administered by the State Tax Inspectorate (VMI).

Crypto is legal in Lithuania and is regulated under the EU MiCA framework, which is fully applicable from 30 December 2024 with the national Law on Markets in Crypto-Assets transposing competent-authority and supervisory arrangements. Lithuania did not use the optional MiCA grandfathering grace period in full: it set a hard cutoff of 1 January 2026, after which all crypto-asset service providers operating in or from Lithuania must hold a Bank of Lithuania CASP authorisation. The Bank of Lithuania supervises CASPs, EMT and ART issuers, while FNTT handles AML/CFT and tax follows ordinary PIT/CIT rules (15% standard rate).

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable; national implementation via amendments to the Law on Technology and Innovation and the Law on Information Society Services (January 2025); market surveillance authority: Communications Regulatory Authority (RRT); notifying authority: Innovation Agency

Lithuania applies the EU AI Act as the primary comprehensive AI governance framework, which entered into force on 1 August 2024 and is phased in through August 2026. In January 2025 the Seimas enacted national implementing amendments designating the Communications Regulatory Authority (RRT) as AI market surveillance authority and the Innovation Agency as notifying authority, making Lithuania one of the first EU member states to formally designate competent bodies. Lithuania also maintains a 2019 national AI strategy and is establishing an AI regulatory sandbox and a public-sector AI Competence Centre.

Framework: EU GDPR (Regulation 2016/679) directly applicable, supplemented by the Republic of Lithuania Law on Legal Protection of Personal Data (in force 16 July 2018); supervised by the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)

Lithuania's data protection regime rests on the directly applicable GDPR as the primary instrument, supplemented by the national Law on Legal Protection of Personal Data (2018), which exercises GDPR opening clauses on employment, journalistic freedom, children's consent age, personal codes, and public-sector fines. A separate national act transposes Directive (EU) 2016/680 for law-enforcement data processing. The independent VDAI is the primary supervisory authority, with the Inspector of Journalist Ethics holding concurrent jurisdiction over press-related processing.

Framework: Law on Payments (Mokėjimų įstatymas), Law on Electronic Money Institutions (Elektroninių pinigų įstaigų įstatymas); Bank of Lithuania (Lietuvos bankas) as competent authority; PSD2 (Directive 2015/2366) fully transposed; EU PSD3/Payment Services Regulation provisionally agreed November 2025, national applicability targeted Q2-Q3 2028

Lithuania operates one of the EU's most comprehensive fintech licensing regimes, with the Bank of Lithuania supervising 100+ licensed payment institutions (PIs) and electronic money institutions (EMIs) under a clear statutory framework derived from PSD2 and national implementing laws. The country hosts 248 active fintech companies processing over €166 billion in payments annually, and is the EU's largest PI/EMI licensing hub per capita. The EU PSD3 Directive and Payment Services Regulation, provisionally agreed in November 2025, will further consolidate this regime with applicability expected by 2027-2028.

Framework: Law on the Legal Status of Aliens (Įstatymas dėl užsieniečių teisinės padėties), as amended effective 1 July 2024; administered by the Migration Department (Migracijos departamentas, migracija.lt). EU freedom-of-movement rules apply for EU/EEA/Swiss nationals.

Lithuania has no dedicated digital nomad visa. Non-EU remote workers can lawfully reside long-term through a Temporary Residence Permit (TRP) under the self-employment/individual activity ('individuali veikla') legal-activity category, or via the Startup Visa or Investor (Golden) Visa routes. July 2024 amendments to the Law on the Legal Status of Aliens tightened eligibility and reduced the annual third-country-national work quota to 24,830 for 2025.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065, in force 17 Feb 2024) implemented nationally via amendments to Lithuania's Law on Information Society Services (adopted by Seimas 13 June 2024); supplemented by the Law on the Protection of Minors Against the Detrimental Effect of Public Information. Competent authorities: RRT (Communications Regulatory Authority) as Digital Services Coordinator; Office of the Inspector of Journalist Ethics (ŽEIT) for minors' protection; State Data Protection Inspectorate for profiling rules; State Consumer Rights Protection Authority for product safety/consumer-deception on platforms.

Lithuania applies the EU Digital Services Act directly as its primary online safety and content-moderation framework, with the DSA entering into force nationally on 17 February 2024 and national implementing amendments adopted by the Seimas on 13 June 2024. The Communications Regulatory Authority (RRT) serves as the national Digital Services Coordinator, coordinating enforcement alongside three other sectoral competent authorities. Active enforcement is under way: more than 2,000 pages of illegal content were removed via DSA mechanisms in 2024 alone, and three organisations have been granted trusted-flagger status.

Framework: Law on Cybersecurity of the Republic of Lithuania (amended 11 July 2024, in force 18 October 2024), transposing EU NIS2 Directive (2022/2555); supplemented by Government Resolution on Implementation (in force 12 November 2024). Competent authority and national CSIRT: National Cyber Security Centre (NKSC/NCSC) under the Ministry of National Defence.

Lithuania fully transposed the EU NIS2 Directive through an amended Law on Cybersecurity that entered into force on 18 October 2024, with implementing technical/organisational requirements following on 12 November 2024. The National Cyber Security Centre (NKSC) acts as the single national cybersecurity authority, CSIRT, and supervisory body, with enforcement powers including binding instructions, on-site inspections, and fines. Entities classified as essential or important face tiered compliance timelines, organisational measures within 12 months of registration, technical measures within 24 months.

Framework: Law on Companies of the Republic of Lithuania (No. VIII-1835); administered by VĮ Registrų centras (State Enterprise Centre of Registers) under the Ministry of Justice

Lithuania offers one of the most accessible business-formation environments in the EU for foreign nationals. A private limited liability company (UAB) can be incorporated fully online within 1-3 business days with no foreign-ownership restrictions, no local-director requirement, and a state registration fee under €100. The Centre of Registers' digital self-service portal accepts remote applications from non-residents using an EU-recognised e-signature or Smart-ID.