Lithuania LT

Lead Signal

Lithuania's anti-money-laundering framework illustrates, this cycle, a structural feature of EU-member regimes that is easy to overlook when attention is fixed on domestic legislative calendars: the enhanced due diligence perimeter can expand without any domestic legislative act at all. The Law on the Prevention of Money Laundering and Terrorist Financing (No VIII-275), in its article 14(1)(3), requires enhanced due diligence toward customers and beneficial owners connected to jurisdictions named on the European Commission high-risk third-country list, and because that reference is a live incorporation rather than a fixed schedule, the Commission's own updates propagate directly into Lithuanian obliged-entity obligations. Commission Delegated Regulations 2026/46 and 2026/83 added Russia, Bolivia and the British Virgin Islands to that list, with Russia's listing taking effect from 29 January 2026; the preceding Delegated Regulation 2025/1184 had already reshaped the list's composition, adding ten jurisdictions including Algeria, Kenya, Lebanon and Venezuela while removing eight others, among them Panama, the Philippines and the UAE. Lithuanian obliged entities inherit each of these changes automatically.

The architectural point is sharpened by the fact that Lithuanian law maintains a second, independent EDD trigger. Article 14(1)(4) of the same law requires enhanced due diligence for customers or beneficial owners connected to jurisdictions identified by the Financial Action Task Force as high-risk, a determination that runs on its own track and need not align with the Commission list. A jurisdiction can therefore be high-risk for Lithuanian EDD purposes under one basis and not the other, and firms operating in Lithuania must monitor both lists rather than treating them as a single combined feed.

Other Developments

Remote identification is governed by a closed, exhaustive list of routes. Article 11(1) of the AML Law permits establishing customer and beneficial-owner identity without physical presence only through one of five defined mechanisms: reliance on a third party under article 13, an EU electronic identification scheme at high or substantial assurance level, a qualified electronic signature, live video capturing the original identity document together with an advanced electronic signature or a captured face image, or a first payment from the customer's own account at a qualifying EU or equivalent credit, payment or e-money institution accompanied by a certified paper copy of the identity document. An asynchronous onboarding journey built around document upload plus a selfie check is not independently compliant under Lithuanian law; it must be structurally mapped onto one of these five routes before it can be relied upon. The precise wording of the five limbs rests on an unverified translation, and further local-language confirmation would be needed before this reading is treated as settled in all its particulars.

Low-risk electronic money attracts a bounded customer due diligence derogation. Articles 9(4) and 9(5) of the AML Law permit credit and e-money institutions, where their own risk assessment and management procedures establish low money-laundering or terrorist-financing risk, to depart from the standard identification requirements of articles 10 to 12 for non-reloadable e-money instruments with stored value capped at EUR 150, restricted to goods-and-services use, with no anonymous funding and no cash redemption. Article 9(5) separately permits opening an account on limited data, with full identification completed within one month, subject to ongoing monitoring obligations. Lithuanian law does not carry a separate EUR 50 remote-payment limb that appears in some comparator regimes; the derogation is built around the EUR 150 non-reloadable instrument alone.

Record retention for customer due diligence material runs to eight years. Articles 19(10) and 19(11) require that registration log data, in paper or electronic form, be kept for eight years from the end of the transaction or business relationship, with shorter five-year periods applying to certain correspondence. This retention period sits at the longer end of what comparator jurisdictions apply to equivalent material, with implications for data-minimisation planning by firms operating across multiple EU markets with differing retention floors.

Cross-Monitor Connections

The automatic incorporation mechanism under article 14(1)(3) is the kind of structural finding that routes naturally to other monitors tracking EU-level list governance: any future Commission delegated regulation altering the high-risk third-country list will, by the same mechanism, alter obligations across every EU member state simultaneously, making the Commission's own listing process a more consequential single point of regulatory change than any one member state's domestic legislative calendar. Where other monitors track sanctions-list or conflict-finance exposure tied to jurisdictions newly added to the Commission's high-risk list, the Lithuanian incorporation mechanism demonstrates concretely how such a listing decision converts into binding firm-level EDD obligations across the bloc without further domestic process, a pattern worth cross-referencing wherever a newly-listed jurisdiction's financial exposure through EU-domiciled correspondent or payment channels is being assessed.

Outlook

The most immediate open question for Lithuania is the transposition status of the sixth Anti-Money Laundering Directive and the jurisdiction's alignment timeline with the directly-applicable AML Regulation and the Anti-Money Laundering Authority build-out; this was not established in the present research cycle and remains a gap. Until that timeline is confirmed, Lithuania's AML Law No VIII-275 continues to operate as the operative national instrument, with the Commission high-risk third-country list and FATF findings as its two live external EDD triggers. Firms with Lithuanian exposure should expect the EDD perimeter to continue moving in step with future Commission delegated regulations rather than with any domestic legislative schedule, and should treat the article 11(1) remote-identification list as closed rather than illustrative when designing or auditing onboarding journeys.