CENTROlink Audit for Participants with ABIC Holders

From 1 January 2027, a CENTROlink participant can register ABIC holders only if it submits an independent audit report. This CENTROlink ABIC audit covers the participant’s anti-money laundering and counter-terrorist financing (AML/CTF), fraud prevention and sanctions measures in its relationships with ABIC holders.

When is a CENTROlink ABIC audit required?

• Before the participant can register ABIC holders.
• At least every two years after the first ABIC holder is registered.
• At any time when the Bank of Lithuania asks for it.

Our CENTROlink ABIC services

• Readiness review. Before the audit, we check your measures against the CENTROlink Rules and list any gaps.
• CENTROlink ABIC audit. We audit your measures and prepare the report for the Bank of Lithuania.
• Repeat audit. We carry out the repeat audits required by the CENTROlink Rules.
• Follow-up. If the audit finds gaps, we check whether they have been fixed.
• Communication with the Bank of Lithuania. We help you answer the Bank of Lithuania’s questions about the audit.
• Compliance and risk management support. Fixing gaps and updating policies, as a separate engagement from the audit.

Our experienced compliance team carries out the audit and works closely with our Banking and Finance and FinTech teams. It also performs our independent AML audits.

What does a CENTROlink ABIC audit cover?

The CENTROlink Rules require appropriate and effective legal, technical and organisational measures for relationships with ABIC holders, covering AML/CTF, fraud prevention and international sanctions. The audit assesses these measures as a whole. We review:

• Governance: who is responsible for AML/CTF, fraud prevention and sanctions in ABIC relationships.
• Due diligence on ABIC holders: onboarding and ongoing checks, beneficial ownership, sanctions and adverse media screening, risk classification.
• Payment controls: transaction monitoring, sanctions screening, fraud detection, escalation and suspicious activity reporting.
• Technical set-up: system configuration, data quality, access rights and how well automated controls work.
• Policies and people: internal policies, procedures, staff training and management reporting.
• Ongoing oversight: how the participant monitors its ABIC holders and what evidence it can give the Bank of Lithuania on request.

CENTROlink ABIC audit vs payment systems participation audit

The CENTROlink Rules provide for two separate independent audits, and the Bank of Lithuania may request either of them. The ABIC audit covers the participant’s AML/CTF, fraud prevention and sanctions measures in its relationships with ABIC holders.

The payment systems participation audit checks whether a payment or electronic money institution meets the requirements for participating in payment systems: safeguarding of client funds, governance and internal control, and a winding-up plan. The Bank of Lithuania may request it when the institution applies to join CENTROlink or while it participates.

Which CENTROlink participants can register ABIC holders?

From 1 January 2027, a participant can register ABIC holders if it:

• has participated in CENTROlink for at least 12 months.
• has executed at least 100,000 payment orders in its last 12 months in CENTROlink.
• has the measures described above.
• submits the independent audit report.

The first two conditions do not apply if the ABIC holder belongs to the participant’s group and both have the same ultimate beneficial owners.

Who can be registered as a CENTROlink ABIC holder

An ABIC holder must be a payment service provider that is not itself a CENTROlink participant. It must be a credit institution, payment institution or electronic money institution licensed in a Single Euro Payments Area (SEPA) country and meet at least one of these conditions:

• It belongs to the participant’s group and has the same ultimate beneficial owners.
• Its licensing country meets all of these conditions:
  • The Financial Action Task Force (FATF) rates its technical compliance and effectiveness as sufficient.
  • It is not on the FATF high-risk or increased-monitoring lists.
  • Its financial supervisor has a cooperation agreement with the Bank of Lithuania.

ABIC holders can use SEPA Credit Transfer (SCT) and SEPA Instant Credit Transfer (SCT Inst). The Bank of Lithuania notifies the participant of its decision within 20 working days after receiving all documents and clarifications.

Until 30 December 2026, existing ABIC holders operate under their agreements with the Bank of Lithuania, which may extend this to 30 June 2027 in individual cases.

CENTROlink participant obligations after ABIC registration

• Check its ABIC holders regularly.
• Make sure they meet the requirements for as long as the agreement lasts.
• Appoint the employees responsible for them.
• Inform the Bank of Lithuania without delay if anything in the head’s written confirmation changes.
• Give the Bank of Lithuania information and evidence on request.
• Keep the financial collateral in each ABIC holder’s account within the required limits.

For direct and indirect access to SEPA, fees and the documents needed to join, see SEPA connection via CENTROlink.