[email protected]
+44 7563 115980 (phone and WhatsApp)
PSD3, the third Payment Services Directive, replaces PSD2 and the Second E-Money Directive with one framework. Every electronic money institution (EMI) and payment institution licensed by the Bank of Lithuania will need to show its supervisor that it meets the new rules within 27 months of PSD3 entering into force. Institutions that do so are treated as authorised under PSD3. Those that do not must stop the services concerned.
For Lithuanian EMIs the change goes further than paperwork. E-money issuance becomes one payment service among others, the five business day safeguarding allowance disappears, a winding-up plan joins the file, and PSD3 states plainly that an institution must have its head office in its home country and carry out at least part of its payment business there. This guide sets out what that means for Bank of Lithuania licence holders and the order in which to prepare. Our general PSD3 re-authorisation guide covers the process across the EU.
Lithuania licenses more EMIs than almost any other EU country. The table below counts firms with a current home licence in Lithuania on the EBA Central Register at 30 October 2026, taken from the Buckingham register of licensed EU payment and e-money firms.
| Firms with a home licence in Lithuania | Number |
|---|---|
| E-money institutions | 69 |
| Payment institutions | 34 |
| E-money institutions under a national waiver | 2 |
| Payment institutions under the national exemption | 8 |
| Registered account information firms | 3 |
| Firms passporting into at least one other country | 84 |
The Bank of Lithuania's own review of the sector, covering 2025, counted 73 active EMIs and 44 payment institutions. Revenue from licensed activity rose 14% to EUR 652.7 million and payment volume rose 8% to EUR 166 billion, but the top 10 institutions earned about EUR 389 million of that revenue and 53 institutions, 48% of the sector, reported losses. At year-end one institution was below its minimum capital requirement and 11 were close to it. The Bank of Lithuania issued 3 new licences in 2025 and carried out 11 targeted inspections, with AML and counter-terrorist financing, safeguarding, fraud controls and governance as its stated priorities.
The AML priority deserves a word of its own. The PSD3 file includes the institution's internal controls for money laundering and terrorist financing, and the Bank of Lithuania has used licence revocations and fines against EMIs for AML weaknesses in recent years. An open AML finding is likely to be the first thing raised when an institution's PSD3 file is reviewed, so closing it is part of PSD3 preparation.
Those numbers frame PSD3 in Lithuania. A large sector with concentrated revenue and thin capital at the smaller end means the supervisor will receive many files at once, and many of them from institutions with limited headroom.
| Step | Timing |
|---|---|
| Council adopts its first reading position on PSD3 and the PSR | 29 October 2026 |
| European Parliament approves the texts in plenary | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| PSD3 applies through national law; the PSR applies directly | 21 months after entry into force |
| Transition for existing institutions ends | 27 months after entry into force, extendable by up to 3 months in exceptional cases |
Every date runs from entry into force. If the texts are published early in 2027, PSD3 would apply around the end of 2028 and the transition for existing institutions would end in the first half of 2029. Lithuania must also pass national legislation to transpose PSD3, replacing the current Law on Electronic Money and Electronic Money Institutions and Law on Payment Institutions provisions. As of October 2026, commentators in Lithuania noted that there was still no national law under which re-registration could take place, so claims that Lithuanian EMIs are already late are not correct. The work that can be done now is the substance: gap analysis, capital, safeguarding, governance and the winding-up plan.
PSD3 requires an institution to have its head office in the member state that authorises it and to carry out at least part of its payment services business there. The recitals explain that part means a proportion that can be less than the majority of the business, so PSD3 does not require most activity to sit in Lithuania. It does require real activity, not a registered office with management and operations elsewhere.
This matters more in Lithuania than in most countries. Many Lithuanian EMIs belong to groups based in other countries, and some run product, technology, customer support and even compliance from those locations. Re-authorisation is a natural moment for the Bank of Lithuania to look again at where decisions are made and where work is done.
| Question the supervisor may ask | Evidence that helps |
|---|---|
| Where does the management body meet and decide? | Board minutes held in Lithuania, resident executives, delegated authorities |
| Which payment activity is carried out in Lithuania? | Operations, safeguarding, reconciliations or customer onboarding performed by Vilnius staff |
| Are control functions local and effective? | Compliance, MLRO and risk staff in Lithuania with direct board access |
| What is outsourced to the group? | Outsourcing register, intra-group agreements, oversight reports |
Institutions that already meet the Bank of Lithuania's governance recommendations for EMIs and PIs will be close to the line. Those with a thin local presence should decide now whether to add people and functions in Lithuania, move the licence to the country where the business actually operates, or restructure the group so the licensed entity matches the activity. Each option takes longer than the paperwork, which is why it comes first.
Until 2025, many Lithuanian institutions kept customer funds in accounts at the Bank of Lithuania connected to its CENTROlink payment system. The Bank of Lithuania announced in August 2024 that it would no longer provide dedicated safeguarding accounts, and institutions had to move safeguarded funds to credit institutions by April 2025. CENTROlink settlement accounts continue to be used for SEPA transactions.
PSD3 builds on that position in three ways. First, EMIs lose the EMD2 allowance of up to five business days: funds still held at the end of the business day after receipt must be safeguarded. Second, institutions must try to avoid holding all customer funds with one credit institution and must manage concentration risk, with EBA standards to follow. Third, central banks may open safeguarding accounts at their discretion, and a refusal must be justified. Whether the Bank of Lithuania will use that discretion is not yet known, so Lithuanian institutions should plan on a second safeguarding bank rather than a return to the central bank.
Safeguarding is an area the Bank of Lithuania has enforced for years, including fines for improper safeguarding of client funds. Under PSD3 it sits in the authorisation file itself, so a recent reconciliation history, signed bank acknowledgement letters and a written procedure for each inflow route are the minimum. Our PSD3 safeguarding rules guide sets out the rule in full.
Initial capital changes under PSD3. E-money issuance carries EUR 250,000, the core payment services carry EUR 150,000, and the amounts add together, so an EMI that also provides card payments and transfers moves from EUR 350,000 today to EUR 400,000. Ongoing own funds for e-money stay at 2% of average outstanding e-money, and payment services use the volume-based method by default. Our PSD3 capital requirements guide has worked examples.
For a sector where nearly half of institutions were loss-making in 2025, the capital question is not only the minimum. Regulators expect a projection over the next three years showing the institution stays above the requirement with a buffer. Where shareholders need to inject capital, and the injection changes ownership above the qualifying thresholds, the Bank of Lithuania must approve the change of control first.
The winding-up plan is new for most Lithuanian institutions. It must suit the size and business model and must provide for returning safeguarded funds in a disorderly wind-down. Plans that assume a sale, ignore group dependencies or understate the time needed to repay inactive customers are the weak points other supervisors have already found. Our PSD3 winding-up plan guide covers what a credible plan contains.
Buckingham Capital Consulting has advised payment and e-money firms since 2013 on licensing, compliance and banking, including Own Solutions' EMI licence from the Central Bank of Ireland and FCA authorisations for Nexpay, Orbital and Hryze. We prepare PSD3 gap analyses, re-authorisation files, safeguarding reviews, capital projections and winding-up plans for Lithuanian institutions, and we help groups decide whether to strengthen their presence in Vilnius or move the licence. See our Lithuania EMI licence and Lithuania payment institution licence guides, or contact us to discuss your institution.
They need to show the Bank of Lithuania that they meet PSD3 within 27 months of entry into force. If they do, they are treated as authorised payment institutions with e-money issuance as a listed service.
No. PSD3 and the PSR set no 2026 deadline for existing institutions, and Lithuania has not yet passed its transposing law.
PSD3 requires the head office in the home member state and at least part of the payment business carried out there. Part can be less than the majority, but it must be real activity.
Not in dedicated safeguarding accounts since April 2025. PSD3 allows central banks to offer such accounts at their discretion, but institutions should plan on credit institutions.
EUR 250,000 for e-money issuance alone, rising to EUR 400,000 with the core payment services, plus ongoing own funds of at least 2% of average outstanding e-money.
It must stop providing the services concerned once the transition ends, unless the regulator grants an exceptional extension of up to three months.
Get in touch: +44 7563 115980 (phone and WhatsApp) or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)