The European Commission’s Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (20 July 2026), and the accompanying Code of Practice on Transparency of AI-generated Content – what they mean in practice, and when AI-generated content must be marked and labeled.

Summary

• Four duties, two owners. Providers must design interactive systems to disclose themselves (Article 50(1)) and embed an invisible, machine-readable mark in synthetic output (Article 50(2)); deployers must notify people exposed to emotion-recognition and biometric categorization systems (Article 50(3)) and add a visible label on deep fakes and on public-interest text (Article 50(4)). The duties are cumulative, none discharges another, and the same organization frequently owes several.
• Not every AI output has to be marked. Standard editing and minor alterations, AI translation, formatting, source code, single words and captions, machine-to-machine data, and genuine closed-loop internal B2B material all fall outside the scope of duty. That is where most of the practical relief lies.
• AI-generated or manipulated public-interest text deserves particular attention. AI-touched investor and sustainability reports on a company website need a visible label unless genuine human review and editorial responsibility are both documented – and that exception collapses the moment AI edits the text after editorial sign-off.
• Article 50 does not stop at the EU border. A provider or deployer established outside the EU owes the same duties where the output of its system is foreseeably used in the Union – so a third-country group entity generating content targeted at EU audiences is in scope.
• A label is not a license. Marking and labeling answer the question “is this AI?”, not “is this allowed?”. A properly labeled deep fake can still be unlawful on other grounds, and a 50(3) notice does not legitimize a deployment prohibited under Article 5 or unlawful under data protection law.
• One deadline has passed, one is coming – and the fines are real. Chatbot and voice-assistant disclosure under Article 50(1) has been required since 2 August 2026, with no grandfathering; providers of generative systems already on the market have until 2 December 2026 to bring Article 50(2) marking into conformity. Non-compliance amounts to EUR 15 000 000 or 3% of the total worldwide annual turnover, whichever is higher, with RRT supervising in Lithuania.

Since 2 August 2026, a new layer of Regulation (EU) 2024/1689 (the “AI Act”) applies to almost every business that lets customers talk to a chatbot, generates images or text with artificial intelligence (AI), or edits media with AI tools.

Article 50 of the AI Act imposes a set of transparency obligations: people must be told when they are dealing with AI, and AI-generated or manipulated content must be marked and, in defined cases, visibly labeled. On 20 July 2026, the European Commission (the “Commission”) adopted detailed Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (the “Guidelines”), complemented by the Code of Practice on Transparency of AI-generated Content (the “Code of Practice”).

The Guidelines are non-binding – only the Court of Justice can give an authoritative interpretation of the AI Act – but they are the clearest practical map of what is in scope, what is out of scope, and who has to do what.

This article walks through the four obligations, with the emphasis on the question clients actually ask: what has to be marked or labeled as AI, and by whom? It pays particular attention to the financial market and its participants – banks, payment and electronic money institutions, investment firms, crypto-asset service providers, insurers and listed issuers – for whom AI-touched investor communications, corporate and sustainability reports, client-facing chatbots, marketing content and biometric onboarding tools sit squarely inside Article 50, on top of the disclosure and conduct duties they already owe under financial services regulation.

The four obligations at a glance

Article 50 contains four distinct transparency duties, each attaching to a different type of AI system or output, and each falling on either the provider (the entity that develops the system and places it on the market under its own name) or the deployer (the entity that uses the system under its own authority, unless the use is purely personal and non-professional). The distinction matters because the same organization can be both at once – for example, a firm that builds an in-house generative tool and then uses it to produce deep fakes wears both hats. The deployer side reaches wider than most clients assume: businesses, public-sector bodies, media outlets, advertising and marketing agencies, and any other legal or natural person using AI content in a professional or economic activity – including influencers monetizing social media. Purely personal, non-professional use is outside Article 50 altogether.

• Article 50(1) – interactive AI. The provider must design the system so that a person is informed that they are interacting with an AI. Think chatbots, voice assistants, and AI agents.
• Article 50(2) – marking of synthetic content. The provider must ensure that AI-generated or manipulated audio, images, videos, or text are marked in a machine-readable format and detectable as artificial.
• Article 50(3) – emotion recognition and biometric categorization. The deployer must inform people exposed to such a system that it is operating.
• Article 50(4) – deepfakes and certain text. The deployer must clearly and visibly label deepfakes and AI-generated or manipulated text published to inform the public on matters of public interest.

A single system can trigger several of these at once. An image generator embedded in a chatbot engages 50(1) and 50(2) for the provider; if the deployer uses it to create a deep fake, 50(4) applies on top. The obligations are cumulative, not alternative.

Article 50 does not stop at the EU border. A provider or deployer established outside the EU is caught where the output of its AI system is used in the Union – so a third-country group entity generating content that is disseminated to, or targeted at, EU audiences owes the same duties as an EU actor. The trigger is foreseeable use of the output in the Union: a deployer who directs or authorizes EU distribution, including by posting deep fakes on the open internet, is in scope, whereas purely incidental or unforeseeable downstream use that reaches the Union through channels outside the actor’s control is not.

Two kinds of “marking” – and why the difference matters

The word “marking” serves two very different functions in Article 50, and conflating them is the most common source of confusion. It is worth pinning down the distinction before going further.

Machine-readable marking (Article 50(2)) is invisible plumbing. It is a technical signal – a watermark, metadata, a cryptographic provenance tag, a fingerprint – embedded in the content so that software can later identify it as AI-generated. It is the provider’s job, and it applies to essentially all synthetic audio, image, video and text output of the system.

Visible labeling (Article 50(4)) is a disclosure a person can see or hear – a caption, a banner, a spoken statement – telling the audience that a deep fake or a public-interest text is artificial. It is the deployer’s job, and it applies to a much narrower set of content.

The Guidelines are explicit that these do not substitute for one another. A deployer cannot discharge the 50(4) labeling duty by pointing to the provider’s machine-readable mark, because that mark is not perceptible to the ordinary viewer without special tools. Conversely, a visible label does not relieve the provider of the duty to provide a machine-readable marking under 50(2).

What must be marked under Article 50(2)

This is the obligation with the widest reach, and the one clients most often ask about. It applies where all of the following are true: the system is an AI system; it generates or manipulates synthetic content; the content is audio, image, video or text (an exhaustive list, but one that includes multimodal, 3-D, and virtual and augmented reality (VR/AR) output); and none of the exceptions applies.

Crucially, content does not have to be wholly AI-generated to count. Content mixed with human-created material still qualifies as synthetic if the AI-generated or manipulated part falls within one of the four modalities. “Generation” means creating new material (an AI-drawn image, a synthesized song); “manipulation” means altering existing content beyond standard editing (a face swap, a voice clone).

Marking is only half of it. Article 50(2) imposes two cumulative duties: the provider must mark the output in a machine-readable format and ensure a means of detection is available to the people exposed to it, one that returns a human-readable result indicating whether the content is AI-generated or manipulated. A mark that no one can read back is not compliance. Where the provider relies on another actor for detection, it remains responsible for ensuring that the solution works and that the result is clearly shown at first exposure.

In scope – must be marked

• AI-generated summaries of text, or paraphrasing/rewriting that changes style, structure or meaning.
• Removal, replacement or insertion of objects or persons in images and videos that change the substance; face replacement or substantial facial modification.
• Synthesis of a specific person’s voice, or a realistic video of events that did not occur; altering a person’s body shape or skin color.
• Composite images or clips that modify the depiction of persons, objects, events or facts.
• AI agent output that is perceptible to a person as audio, image, video or text.

Out of scope – no marking required

The Guidelines carve out a long list of things that do not have to be marked, which is just as useful to know:

• Standard editing and minor alterations – grammar and spell-checking, minor stylistic polishing, AI-generated translations, formatting and format conversion, noise reduction, minor cropping or color correction, red-eye removal, background blurring, video stabilization, and converting black-and-white to color.
• Non-substantial changes – anything that does not significantly alter the input data or its meaning, style or intent.
• Source code – code in any programming, scripting, markup, query or configuration language (including SDKs, SQL, YAML, JSON, APIs), and integral comments.
• Very short outputs – single words, image captions, alt-text, UI labels, icon-scale graphics.
• Machine-to-machine output processed automatically and never perceived by a person; internal analytical extraction and structuring of data; mere reproduction, ranking or arrangement of existing content (playlists, recommender systems).
• Closed-loop and industrial output – strictly technical, business-to-business (B2B) output, perceived only by a limited pre-defined set of professionals inside the organization, not shared externally, with appropriate safeguards. Real-time ephemeral content (e.g. in games or VR) consumed immediately and not stored may also be exempt where marking is not technically feasible, and an in-experience notice is provided.
• Law enforcement use authorized by law to detect, prevent, investigate or prosecute criminal offences.

The technical solution must be effective, interoperable, robust and reliable, as far as technically feasible and in line with the state of the art. Providers may rely on an adequate Code of Practice to demonstrate compliance; those who do not adhere to one must provide equivalent alternative measures and should expect closer scrutiny and more information requests.

What must be labeled under Article 50(4)

This obligation sits on deployers and concerns visible, perceivable disclosure. It has two limbs.

Deepfakes

A “deepfake” is AI-generated or manipulated image, audio or video content that (i) appreciably resembles (ii) an existing (iii) person, object, place, entity or event, and (iv) would falsely appear to a person to be authentic or truthful. “Existing” is read broadly: something that exists, plausibly could exist, or could have plausibly existed. Content that defies physics or biology – a dragon, an elephant driving a car – is not a deepfake, because it cannot mislead.

Minor or cosmetic AI manipulation of existing content does not make it a deepfake in the first place, where the change has too little effect on how a viewer perceives the content’s authenticity or truthfulness – for example, editing out a background passer-by, adjusting lighting or color, noise reduction, re-scaling or file compression. This is a threshold question, not an exemption: such content is simply not a deep fake, so no labelling duty arises. Whether a given edit stays on this side of the line is context-dependent: the Guidelines contrast these cosmetic operations with substantial AI editing of journalistic images, where the expectation of authenticity is high enough that a similar change may affect perceived authenticity and cross into deep fake territory.

The fourth criterion is assessed objectively and in context; the deployer’s intention to deceive is not required. Where the foreseeable audience does not expect the content to be authentic – for instance, standard special effects in a movie – the content may not “falsely appear” authentic and so falls outside the definition. But fully AI-generated actors, digital replicas of real or deceased actors, de-aging, or non-authentic depictions in documentaries generally will be deepfakes.

Deepfakes must be clearly and distinctly labeled. A lighter regime applies to content that is evidently artistic, creative, satirical, fictional or analogous: the disclosure need only be made in a manner that does not hamper enjoyment of the work, but disclosure is still required, and the “evidently” threshold is read strictly. Two limits keep this regime narrow. Where content mixes an informative and a creative character, the informative character prevails labeling, and full labeling applies; and the lighter regime is, in any event, subject to appropriate safeguards for third-party rights, so it is no justification for disregarding data-protection or intellectual-property obligations.

Public-interest text

AI-generated or manipulated text published to inform the public on matters of public interest must also be labeled. “Published” means accessible to an indeterminate, fairly large group; “public interest” covers politics, public administration, justice, fundamental rights, public health and safety, the environment, consumer safety, and economic, financial, scientific or cultural developments meriting public debate.

There is an important exception: text that has undergone genuine human review or editorial control and for which a natural or legal person holds editorial responsibility need not be labeled. Both conditions are cumulative. A superficial spell-check, an automated review, or a mere editorial policy will not do – the review must engage with the substance, and fact-checking is the minimum. If AI makes any substantive change after editorial sign-off, the exception falls away.

For a regulated financial entity, note the concrete examples the Guidelines give as in scope: AI-manipulated corporate reports containing investor information on a listed company’s website, and AI-generated sustainability reports – both of which need labeling unless the human-review/editorial-responsibility exception is satisfied. Conversely, an AI-manipulated advice text prepared by a consultant for a single client on regulatory compliance is not “published” and falls outside 50(4).

How to label in practice

Article 50 does not dictate wording. The Code of Practice does the practical work: the AI Office has published three EU icons – AI involved, fully AI-generated, and human content modified by AI – free to use, and testing showed that an icon on its own is not enough. The icon plus a few plain words are what people actually understand. “AI” is the only abbreviation to use.

What that looks like in practice. An icon and “Image created with AI” in the caption of a social media post – not in the small print. A spoken line in the first seconds of a podcast produced with a synthetic voice. A badge at the top of an AI-drafted news summary, not in the website footer. A mark that stays in the corner of the screen while an AI presenter is speaking. Give the icon alt text so a screen reader conveys it, leave a temporary label up long enough to be read, and use the same icon and the same words everywhere.

A label is not a license. The Guidelines are emphatic that complying with Article 50 does not make the content or its use lawful. A properly labeled deep fake can still be unlawful on other grounds – child sexual abuse material, non-consensual intimate imagery, trademark or copyright infringement, misleading advertising – and a 50(3) notice does not legitimize an emotion-recognition deployment that is prohibited under Article 5 or unlawful under data protection law.

Marking and labeling answer the question “is this AI?”, not “is this allowed?” The two assessments are separate.

The other two obligations, briefly

When must a chatbot tell users that they are interacting with AI?

Providers of systems that interact directly with people – chatbots, voice assistants, AI companions, AI agents – must design them so the person is told they are dealing with AI, at the latest at the first interaction. The disclosure must be clear and in context: a first-turn message, a spoken statement, a persistent badge. Burying it in terms and conditions, or relying on a vague reference to an “assistant” or “this system uses LLMs”, is not enough.

There is an obviousness exception – no disclosure is needed where it would be obvious to a reasonably well-informed, observant and circumspect person that they are dealing with AI. But the Guidelines read this narrowly: general awareness that chatbots exist does not mean people recognize them in a given interaction, and the exception is unavailable where vulnerable groups (children, the elderly, the less digitally literate) may be exposed. A professional-only internal helpdesk assistant may qualify; a public-facing helpdesk chatbot generally will not.

AI agents carry an extra layer. An agent must disclose not only its artificial nature but also the person on whose behalf it acts, reflecting the need for transparency regarding both its origin and delegated authority. Where the provider cannot know in advance whether an agent will meet a natural person, it must be designed to disclose itself in every situation where interaction with a person is reasonably likely, including in multi-agent chains where another agent is the one facing the person. Agents should also re-disclose to the person instructing them at key steps such as authorization, reporting and validation, and at every new interaction.

Emotion recognition and biometric categorization – Article 50(3)

Deployers of these systems must inform the people exposed to them that the system is operating – for example, a notice at the entrance to a space where facial images are captured to infer age, or a pop-up before a game that reads the player’s emotions. This applies whether the system runs in real time or after the fact, and to any biometric categorization system (unless outright prohibited under Article 5).

Timing, accessibility and penalties

Whatever the obligation, Article 50(5) requires the information to be given clearly and distinguishably, at the latest at the first interaction or exposure, and in an accessible format. “First exposure” means the start of a video featuring a deepfake, the start of a public-interest text, or the moment a person scrolling through social media encounters the content. Where children are foreseeably in the audience, the disclosure must be child-friendly and age-appropriate.

Non-compliance is not trivial. Fines can reach EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher (EU institutions face up to EUR 750 000; small and medium-sized enterprises (SMEs) and start-ups face the lower of the two figures). Enforcement sits with national market surveillance authorities, the AI Office for systems based on general-purpose AI (GPAI) models, and the European Data Protection Supervisor (EDPS) for EU institutions.

In Lithuania, the Communications Regulatory Authority (RRT) has already issued public guidance of its own on when AI-generated content must be marked and when it need not be – an early signal that the national supervisor intends to engage with these obligations actively rather than wait for complaints.

On timing of application: Article 50 has applied since 2 August 2026 to all in-scope systems on the market on that date, regardless of when they were placed. A targeted grandfathering rule under the AI Omnibus gives providers of existing generative systems until 2 December 2026 to bring the 50(2) marking into conformity – but the 50(1) interaction disclosure had to be in place by 2 August 2026. Content generated before 2 August 2026 need not be marked or labeled retroactively, but pre-existing text published on or after that date does need labeling.

What should businesses pay attention to?

Four practical points to act on:

• Separate the two “markings”. Providers owe invisible, machine-readable markings on synthetic output (50(2)); deployers owe visible labels on deepfakes and public-interest text (50(4)). One does not cover the other.
• Get the label right – and know what needs none. The EU icon, plus a short, plain-language line (“AI” is the only abbreviation to use), placed where the content is consumed, with alt text and an audio disclaimer when there is nothing to see. Standard editing, translation, formatting, source code, short labels and genuine internal B2B output fall outside the marking duty entirely – that is where much of the practical relief lies.
• Watch the text limb closely. AI-touched investor and sustainability reports on a company website count as text published on matters of public interest, so they are squarely in scope unless the human-review and editorial-responsibility exception is properly documented – and that exception collapses if AI edits the text after sign-off.
• Consider the Code of Practice. Adhering to the adequate Code of Practice is the most predictable way to demonstrate compliance with the 50(2) and 50(4) content obligations; non-signatories should run a gap analysis against it and keep evidence of equivalent measures.

Businesses introducing AI systems should assess Article 50 alongside their wider AI governance, data protection and intellectual property obligations. ECOVIS ProventusLaw can assist with this assessment and the implementation of appropriate compliance measures.

This article reflects ECOVIS ProventusLaw’s interpretation of the Commission’s non-binding Guidelines and Code of Practice and is provided for general information purposes only. It does not constitute legal advice; specific advice should be obtained before acting on any part of it.

The post AI made it? Say so. What the Commission’s new AI Act transparency Guidelines require appeared first on ECOVIS ProventusLaw.

What must an activity (business) plan contain to obtain a financial license in Lithuania – and what the Bank of Lithuania may assess

Any business preparing to apply for a bank or specialized bank, crypto-asset service provider (CASP), electronic money institution (EMI), payment institution (PI), crowdfunding or any other license in Lithuania invests heavily long before it ever sees a decision – capital locked up to form the share capital, hiring the teams, months of drafting, and repeated rounds of comments from the Bank of Lithuania on its activity plan and program of operations. The obvious questions for such an applicant are: on what basis can the supervisor say „no”, and what does a lawful refusal actually have to contain?

The Supreme Administrative Court’s ruling gives concrete answers to both of those questions – on what basis the supervisor may say „no”, and what a lawful refusal must contain. It marks out what the Bank of Lithuania may legitimately weigh when it assesses whether a future bank will operate „safely and soundly” – and it sets a clear evidentiary standard the supervisor must meet before it can refuse on that ground. For anyone at the pre-application or authorization stage, it is a practical map of where the supervisor’s discretion ends and where an applicant’s leverage begins.

And although the case concerns a bank license, its most important lessons are not confined to banking. The ruling is directly relevant beyond bank licensing – to CASPs, PIs and EMIs, crowdfunding companies and financial brokerage companies – because both rules the Court applied – no refusals on the ground that the business is not worth doing, and no refusals without reasons – come from the Civil Code and general administrative law, not the Law on Banks. Any applicant that has received, or fears, a thinly reasoned refusal from the Bank of Lithuania should read on.

On 17 September 2025 the Supreme Administrative Court of Lithuania (the Court), sitting as an extended chamber, delivered its ruling in UAB Baltic Financial Company v. Bank of Lithuania (administrative case No. eA-111-520/2025). The judgment is a useful read for anyone advising credit-institution licensing applicants, because it confirms how wide the supervisor’s discretion is when assessing an activity plan – and, at the same time, how firmly that discretion is bound by the duty to give reasons.

Background

The applicant, a company with capital from another EU Member State (Bulgaria), applied to the Bank of Lithuania for a specialized bank license. After an extended licensing procedure – a preliminary application under the Newcomer programme, a first application withdrawn and refiled on the same day, several rounds of comments, a meeting, and five revisions of the activity plan – the Bank of Lithuania Board refused the license by Resolution No. 03-18 of 20 January 2022. The stated ground was that the applicant’s activity plan did not ensure the safe and sound operation of the future bank, contrary to Article 9(12) and Article 9(13)(2) of the Law on Banks, read together with Article 43(1)(3) of the Law on the Bank of Lithuania.

The applicant challenged the resolution and claimed over EUR 1 million in damages. The first-instance court (Vilnius Regional Administrative Court) dismissed the claim in full in June 2023. The applicant appealed.

What the supervisor may – and may not – assess

A central plank of the applicant’s case was that the refusal was, in substance, a judgment on the economic desirability of its business, which is prohibited. Two rules were invoked: Article 11 of Directive 2013/36/EU (CRD), under which Member States may not require an application for authorization to be examined against the economic needs of the market, and Article 2.79(3) of the Civil Code (a refusal to grant a license may not be based on the inexpediency of the activity and must be reasoned).

The Court drew a careful line here, and it is the part of the judgment most worth remembering.

The supervisor may not refuse a license on the basis that the market does not need another participant, or that the proposed activity is not worthwhile. That is the economic-needs test the CRD forbids.

The supervisor may, however, assess the viability and sustainability of the business model, the realism of the applicant’s projections, and the surrounding business environment – including comparable institutions, market trends and other external factors. Crucially, the Court held that examining the environment and peers is legitimate precisely because it helps the supervisor test whether the applicant’s own projections are realistic. Assessing the environment to verify the plausibility of a forecast is not the same as assessing whether the market needs the entity. The Court relied on the European Central Bank (ECB) Guide to assessments of license applications, 2nd revised edition, January 2019 (ECB Guide) and the European Banking Authority (EBA) Guidelines on a common assessment methodology for granting authorization as a credit institution (EBA/GL/2021/12), both of which expressly contemplate qualitative and quantitative review of the activity plan, peer comparison, and baseline and adverse scenarios over roughly the first three years of operation.

On this point the applicant’s argument failed. The Court agreed with the first-instance court that the Bank of Lithuania had not assessed economic need, and that the sustainability and viability of the business model are proper qualitative criteria in a licensing assessment.

Wide discretion – but not unbounded

The Court reaffirmed that decisions on whether to grant a bank license are discretionary in nature. Assessing whether an activity plan ensures safe and sound operation involves complex economic and financial judgment, and it serves a significant public interest – the stability of the financial system, which the Constitutional Court has repeatedly recognized as a significant public interest.

The Court also drew on Court of Justice of the European Union (CJEU) case law on decisions taken by the ECB in the exercise of a wide margin of appraisal. Judicial review of such a decision does not substitute the court’s assessment for the supervisor’s; it checks whether the decision rests on materially accurate facts, whether there is an error of law, a manifest error of assessment, or a misuse of powers, and whether the supervisor examined all the relevant elements carefully and impartially and observed the procedural guarantees. Discretion, the Court stressed, is never an unreasoned or unconstrained choice.

Where the resolution failed: the duty to give reasons

Having upheld the supervisor’s power to make the assessment it made, the Court found the decisive flaw in how the assessment was expressed.

The applicant had submitted an activity plan with baseline, growth and adverse scenarios, together with financial projections for each, and had provided further argument on the plan’s realism. Against that, the resolution:

• asserted only in the abstract that the applicant had failed to substantiate its ability to reach the planned lending volumes, without engaging with specific provisions of the plan or the explanations given;
• referred to the competitive environment – the number of active specialized banks in the consumer-lending market, the incumbent’s pre-existing client base, the applicant’s lack of a track record in Lithuania – without naming the entities, quantifying their activity, or tying any of this to concrete provisions of the applicant’s plan;
• raised the negative yield on securities without explaining what effect that would actually have on the safety and soundness of the applicant’s overall planned activity; and
• did not assess at all the adverse-case scenario that the applicant had itself submitted, even though the ECB Guide envisages review under both baseline and adverse scenarios.

In short, the conclusion that the plan did not ensure safe and sound operation was not underpinned by concrete data or linked to specific provisions of the plan set against a data-based picture of the business environment.

The Court held this to be a breach of Article 10(5)(5) and (6) of the Law on Public Administration (the requirement to state the factual basis and the reasons for an administrative decision) and of Article 2.79(3) of the Civil Code. Referring to the CJEU, it recalled that the duty to give reasons – an expression of the right to good administration under Article 41 of the EU Charter of Fundamental Rights and of effective judicial protection under Article 47 – exists so that the addressee can assess whether the decision is flawed and so that the reviewing Court can exercise its control. A supervisor’s duty to reason its own decisions cannot be shifted onto the Court that later reviews them.

Outcome

The Court partially upheld the appeal. It set aside the first-instance judgment, annulled the Bank of Lithuania resolution for inadequate reasoning, and remitted the damages claim to the first-instance court for fresh examination – the essence of that claim not having been examined below, and the applicant needing to specify which defendant it targets and on what basis. The requests to refer questions to the CJEU and to the Constitutional Court were refused, the former partly because the deadline-related questions rested on facts the applicant had not proven. The ruling is final.

Takeaways

The principal takeaway is that the Court mapped out what the Bank of Lithuania may and may not examine.

• It may not refuse a license on the ground that the market does not need another participant, or that the proposed activity is not worthwhile – that is the economic-needs test the CRD forbids.
• It may examine the viability and sustainability of the business model; the realism of the applicant’s financial projections; the applicant’s ability to reach its planned volumes; and the surrounding business environment – comparable institutions, market trends and other external factors – but the environment may be examined only as a tool for testing whether the applicant’s own projections are plausible, not as a proxy for market need. It may also review the plan qualitatively and quantitatively, compare it against peers, and test it under both baseline and adverse scenarios over roughly the first three years of operation.

This is the takeaway that matters during compliance work and at the licensing stage: it tells an applicant which questions it must be ready to answer with data – and which lines of inquiry fall outside the supervisor’s remit and can be pushed back on.

The second takeaway is that a refusal must be reasoned, and the judgment says with unusual precision what a reasoned refusal looks like. It is not enough to assert in the abstract that an activity plan does not ensure safe and sound operation. The supervisor must:

• engage with the specific provisions of the plan and the explanations the applicant gave;
• name and quantify the comparators and market data it relies on, rather than referring to the competitive environment in general terms;
• explain what effect each factor it invokes would actually have on the safety and soundness of the planned activity; and
• expressly assess any adverse-case scenario the applicant itself submitted.

A wide margin of appraisal does not lower that evidentiary bar, and the supervisor cannot shift the task of reasoning onto the court that later reviews the decision.

The practical consequence is straightforward. Where those elements of reasoning are missing, the refusal is vulnerable on judicial review however defensible the underlying supervisory judgment may be – and annulment for inadequate reasoning is a realistic outcome, as it was here.

What this means for your activity plan

The third takeaway belongs to the drafting stage. The judgment does not prescribe what an activity plan must contain, but it shows what the plan will be tested against. Present a baseline, a growth and an adverse scenario with financial projections for each over roughly the first three years, and substantiate the planned volumes rather than asserting them – the assumptions behind the targets, the route to customers, and the pricing behind the projected revenue. Expect the plan to be read against peers and market data, and pre-empt that reading with your own comparison, and keep every explanation given during the licensing dialogue on the record.

The post What must an activity (business) plan contain to obtain a financial license in Lithuania – and what the Bank of Lithuania may assess appeared first on ECOVIS ProventusLaw.

At the same time, FATF is highlighting growing risks linked to stablecoins, unhosted wallets, offshore VASPs and decentralised finance, while European supervisors are increasing scrutiny of ICT and AI-related risks.

This month’s RegRally focuses on the developments most relevant to CASPs, crypto businesses, investment firms, issuers and financial institutions operating with digital assets.

Latvia issues its 10th MiCA licence to Nodu Digital

Date: 9 July 2026 | Source: Latvijas Banka
Link

Latvijas Banka issued Nodu Digital SIA both a MiCA licence for crypto-asset services and a payment institution licence. The CASP authorisation covers the exchange of crypto-assets for funds and the provision of crypto-asset transfer services on behalf of clients.

Nodu Digital became the 10th company authorised under MiCA by Latvijas Banka. Once authorised in one EU Member State, a CASP can provide its authorised services across the EU through the cross-border notification mechanism.

Why it matters

The decision illustrates the growing importance of combining crypto-asset and payment regulatory analysis for businesses operating crypto payment models. For businesses whose model involves both fiat payment services and crypto-asset services, the regulatory perimeter may require parallel authorisation strategies.

Recommended actions

• Determine whether the proposed business model requires both CASP and PI authorisation.
• Map the regulatory perimeter before preparing the licensing application.
• Use Latvijas Banka’s pre-licensing consultations to resolve classification and authorisation questions early.
• Consider whether the business model can benefit from EU-wide cross-border provision following MiCA authorisation.

ESMA launches EU-wide supervisory action on CASP custody and operational resilience

Date: 8 July 2026 | Source: ESMA
Link

ESMA launched a Common Supervisory Action (CSA) with national competent authorities focusing on the digital operational resilience of CASPs providing custody services.

The supervisory exercise will examine how CASPs manage risks associated with distributed ledger technology, including:

• governance arrangements;
• private key and storage management;
• transaction controls;
• incident detection and response;
• smart contract risks; and
• dependencies on third-party providers.

National competent authorities will conduct the exercise on a risk-based sample of authorised CASPs from H2 2026 to H1 2027, with ESMA’s consolidated report expected in H2 2027.

Why it matters

This is a clear indication that MiCA supervision is moving beyond licensing documentation towards testing the operational substance of CASP business models.

Custody arrangements, key management and third-party dependencies are likely to receive particular supervisory attention.

Recommended actions

CASPs providing custody services should:

• review key-management and wallet-storage arrangements;
• verify segregation and transaction-control mechanisms;
• test incident detection and response procedures;
• document smart-contract risk controls;
• map critical third-party dependencies, including custody technology and blockchain infrastructure providers; and
• assess their framework against both MiCA custody requirements and DORA.

ESMA clarifies MiCA rules on crypto advice, lending and token distributions

Date: 10 July 2026 | Source: ESMA
Link

ESMA published a new batch of Q&As providing important clarifications on MiCA.

Three Q&As are particularly relevant to CASPs and crypto businesses.

Crypto-asset advice – Q&A 2882

ESMA clarified that the concept of advice on crypto-assets under MiCA is broader than investment advice under MiFID II. Certain introductory or referral activities recommending a crypto-asset service to a potential investor may therefore constitute advice requiring authorisation. A general reference to a CASP that is equally accessible to all investors does not, by itself, constitute advice.

Crypto-asset lending – Q&A 2883

ESMA confirmed that CASPs may offer crypto-asset lending as an unregulated service, subject to specific conditions. In particular, clients must provide prior, express and specific consent to the use of their assets. Consent embedded only in general terms and conditions is not sufficient.

The service must also include fair, clear and non-misleading risk disclosures and adequate collateral arrangements. MiCA safeguarding requirements do not apply to assets that have been lent.

Primary token offerings – Q&A 2417

ESMA clarified that an issuer transferring crypto-assets directly from an issuance smart contract to purchasers’ wallets in a primary offering does not, by that activity alone, provide custody or transfer services requiring CASP authorisation.

Why it matters

These clarifications affect the regulatory perimeter of referral models, crypto lending products and token issuance structures.

Recommended actions

• Review referral, affiliate and introduction arrangements to determine whether they could constitute crypto-asset advice.
• Redesign crypto lending consent flows so that client consent is standalone, prominent and specific.
• Review risk disclosures and revenue-sharing arrangements for lending products.
• For token issuances, document the precise role of the issuer and determine which activities fall within the CASP perimeter.

ESMA sets deadlines for the EU move to T+1 settlement

Date: 20 July 2026 | Source: ESMA – T+1 settlement preparations
Link

ESMA published a statement on preparations for the EU’s transition to a T+1 settlement cycle, scheduled for 11 October 2027.

Two key deadlines apply:

• 7 December 2026 – requirements relating to the exchange of allocations and confirmations, including timing requirements and the default use of international communication standards;
• 11 October 2027 – requirements aimed at optimising the settlement layer, including earlier submission of settlement instructions and broader use of CSD functionalities.

ESMA stresses that preparation must cover the entire trading and settlement chain, including clients, brokers, custodians, CSDs, CCPs, trading venues, vendors and outsourcing providers.

Why it matters for crypto and investment businesses

The transition is particularly relevant for investment firms and businesses with exposure to tokenised or traditional securities, where post-trade processes may involve multiple regulated and outsourced providers.

Recommended actions

• Map the complete post-trade chain and identify dependencies.
• Confirm vendor and custodian readiness for the December 2026 deadline.
• Review Standard Settlement Instructions and reference-data quality.
• Identify operational changes required before the 2027 transition.

European Supervisory Authorities highlight AI-driven ICT risks for financial entities

Date: 31 July 2026 | Source: ESMA – ESA statement on ICT risks from frontier AI
Link

The European Supervisory Authorities published a joint statement on ICT risks arising from frontier AI models.

The statement is particularly relevant to CASPs given the increasing supervisory focus on digital operational resilience. AI-enabled cyber tools can accelerate vulnerability discovery and exploitation, target shared infrastructure and exploit single points of failure.

The ESAs recommend strengthening ICT risk management through three areas:

• Prevention – comprehensive IT asset inventories, secure-by-design architecture, proactive patching and supply-chain controls.
• Detection – continuous vulnerability scanning, behavioural monitoring and more frequent testing.
• Management – resilience testing against AI-enhanced attack scenarios, dependency mapping and clear management-body accountability.

Why it matters

For CASPs, AI-related cyber risks may directly affect private keys, custody infrastructure, smart contracts and critical third-party services.

Recommended actions

CASPs should:

• include AI/ML components in ICT asset inventories;
• update vulnerability-management and monitoring processes;
• test resilience against AI-enhanced attack scenarios;
• map dependencies on critical ICT providers; and
• ensure management bodies receive appropriate information on AI-related cyber risks.

FATF identifies growing risks around stablecoins, unhosted wallets and offshore VASPs

Date: 16 July 2026 | Source: FATF – Seventh Targeted Update on Virtual Assets and VASPs
Link

The FATF’s Seventh Targeted Update on Recommendation 15 reports continued global progress in implementing requirements for virtual assets and VASPs.

According to the report, 83% of surveyed jurisdictions have now passed Travel Rule legislation, compared with 73% in 2025.

However, significant gaps remain in supervision and enforcement.

For the crypto sector, FATF highlights several emerging risks, including:

• industrialised virtual-asset-enabled fraud;
• misuse of stablecoins, which now feature in most identified on-chain illicit activity;
• P2P transactions involving unhosted wallets;
• offshore VASPs operating outside effective oversight; and
• risks associated with DeFi.

Why it matters

The report provides a useful benchmark for the risk-based AML/CTF and sanctions controls expected from CASPs.

Recommended actions

CASPs should:

• reassess stablecoin-related risks in their ML/TF risk assessments;
• review exposure to unhosted-wallet and P2P transactions;
• assess offshore VASP counterparties;
• test the quality and completeness of Travel Rule information; and
• update transaction-monitoring scenarios to reflect current crypto-specific typologies.

FATF calls for a functional approach to DeFi regulation

Date: 21 July 2026 | Source: FATF
Link

FATF published its Targeted Report on Regulatory Challenges from Decentralised Finance (DeFi), updating its earlier guidance.

The report promotes a functional, risk-based approach: regulators should look beyond the label “decentralised” and determine whether identifiable natural or legal persons exercise sufficient control or influence over a DeFi arrangement.

Relevant indicators include governance token concentration, administrative privileges, control over protocol upgrades, and significant economic benefits.

The FATF also highlights risks arising from interactions with DeFi protocols, including chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation.

Why it matters

Calling a protocol “decentralised” does not necessarily remove it from the regulatory perimeter. CASPs and financial institutions interacting with DeFi arrangements need to understand who actually controls or influences the protocol and what risks arise from the interaction.

Recommended actions

CASPs integrating DeFi protocols should:

• conduct and document a control analysis for each relevant protocol;
• assess governance-token concentration and administrator privileges;
• identify protocol-level and counterparty risks;
• reflect DeFi exposure in the business-wide risk assessment; and
• verify that appropriate due diligence and control measures can be applied before interacting with a protocol.

EU sanctions package introduces new crypto-specific restrictions

Date: 23 July 2026 | Source: European Commission – 21st sanctions package against Russia
Link

The EU’s 21st package of sanctions against Russia introduces several measures directly relevant to the crypto-asset sector.

The package creates a new mechanism that allows third-country legal entities that provide crypto-asset services used to circumvent EU sanctions to be designated. Systematic failure to prevent sanctions circumvention may trigger designation.

The package also introduces transaction bans involving additional third-country crypto platforms and crypto-linked firms, with more than 20 crypto-asset service financial institutions added.

In addition, restrictions on the ownership, control or board membership of companies providing crypto-asset services by Russian and Belarusian nationals have been extended.

Why it matters

Crypto businesses need to consider sanctions risk not only when screening direct customers but also when assessing counterparty platforms, liquidity providers, ownership structures and management.

Recommended actions

CASPs should:

• rescreen counterparties and crypto platforms against updated sanctions lists;
• review liquidity-provider relationships;
• refresh ownership and management nationality checks;
• assess third-country crypto counterparties for sanctions-evasion risk; and
• update sanctions representations and contractual clauses where necessary.

Latvia issues investment firm licence following pre-licensing cooperation

Date: 23 July 2026 | Source: Latvijas Banka – C Capital Markets licence
Link

Latvijas Banka issued an investment firm licence to SIA C Capital Markets, a subsidiary of AS Citadele banka, for the placing of financial instruments on a non-firm-commitment basis and related ancillary services.

The licence was issued less than one month after the official application was submitted, following pre-licensing cooperation with the regulator.

Latvia now has 12 licensed investment firms.

Why it matters for crypto businesses

Although the licence concerns an investment firm rather than a CASP, the case provides a useful indication of the potential efficiency of well-prepared licensing processes in Latvia.

For businesses considering MiCA, investment firm or combined regulatory structures, early regulatory dialogue can help resolve issues before the formal application is submitted.

Recommended actions

Applicants considering Latvian authorisation should:

• use the pre-licensing consultation process;
• establish the regulatory perimeter before filing;
• prepare a complete and internally consistent application package; and
• resolve governance, ownership, business-model and operational questions before formal submission.

MiCA transitional period has ended: unlicensed CASPs must wind down

Date: 2 July 2026 | Source: Lietuvos bankas – End of MiCA transitional period
Link

The EU-wide MiCA transitional period ended on 1 July 2026.

Unlicensed CASPs that are no longer entitled to rely on transitional arrangements must wind down their EU-facing activities in an orderly manner. During the wind-down process, firms must address client communications, positions and assets while maintaining applicable AML/CTF and Travel Rule controls.

Third-country CASPs cannot simply continue providing services to EU clients without an appropriate regulatory basis, and custody cannot be delegated to unlicensed providers.

Lietuvos bankas has also established a dedicated Investment and Crypto-Asset Firms Supervision Division, signalling a more specialised supervisory approach.

Why it matters

The end of the transitional period marks an important shift: operating in the EU crypto market now requires businesses to have a clear legal basis under MiCA or to cease the relevant activities.

Recommended actions

CASPs and crypto businesses should:

• confirm that all EU-facing crypto-asset services are provided through appropriately authorised entities;
• review whether any activities remain dependent on transitional arrangements;
• ensure orderly wind-down procedures are operational where authorisation has not been obtained;
• maintain AML/CTF and sanctions controls throughout any wind-down; and
• review outsourcing and custody arrangements to ensure that critical services are not being provided by unlicensed entities.

What crypto businesses should focus on now

The regulatory focus is shifting from “Are you licensed?” to “How are you operating?”

For CASPs and other businesses active in the crypto-asset market, the developments covered in this edition point to several immediate priorities:

• MiCA: confirm that all EU-facing activities have the appropriate regulatory basis.
• Custody: prepare for supervisory scrutiny of key management, wallet segregation, incident response and third-party dependencies.
• AML/CTF: strengthen controls around stablecoins, unhosted wallets, offshore VASPs and DeFi.
• Sanctions: review crypto counterparties, ownership structures, liquidity providers and sanctions-evasion risks.
• DORA: test ICT resilience against increasingly sophisticated and AI-assisted attacks.
• Business models: reassess referral, advisory, lending and other activities against the latest ESMA interpretations.
• DeFi: do not rely on the “decentralised” label; assess actual control and influence over the protocol.
• Licensing strategy: where authorisation is still required, use regulatory pre-licensing dialogue to resolve the perimeter and prepare a coherent application.

The direction of travel is clear: crypto regulation is becoming increasingly operational, risk-based and supervisory in practice.

Need assistance?

Our legal and regulatory specialists assist crypto-asset businesses with:

• MiCA licensing and regulatory perimeter analysis
• CASP authorisation and cross-border EU expansion
• AML/CTF and Travel Rule compliance
• Sanctions and crypto-asset sanctions screening
• DORA and ICT risk management
• Crypto custody and client-asset arrangements
• DeFi regulatory analysis
• Crypto lending and business-model structuring
• Token issuance and white-paper requirements
• Internal policies, procedures and compliance documentation

If you have questions about the regulatory developments covered in this edition or would like to assess your crypto-asset business model against the current EU regulatory framework, our team will be happy to assist you.

The post RegRally Insights: Crypto & Investments Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

Recent supervisory activity in Lithuania and Latvia, together with developments at the EU and UK levels, highlights several areas receiving particular attention: client funds safeguarding, regulatory remediation, wind-down planning, qualifying holdings, ICT resilience and the risks arising from increasingly complex technology dependencies.

This month’s RegRally highlights the developments most relevant to payment institutions (PIs), electronic money institutions (EMIs), fintech businesses and groups operating across the Baltic and wider European markets.

Lietuvos bankas imposes EUR 90,000 measure on Nayax Europe over client funds safeguarding

Date: 24 July 2026 | Source: Lietuvos bankas – Financial Market Supervision Committee decisions
Link

Lietuvos bankas concluded an administrative settlement with the electronic money institution Nayax Europe UAB, imposing a EUR 90,000 measure for breaches related to client funds safeguarding and associated internal control requirements, identified during a targeted, scheduled inspection.

Nayax Europe had already begun remediation before submitting its settlement proposal and committed to providing an audit firm’s opinion confirming remediation by 30 April 2027.

In the same set of decisions, Lietuvos bankas reported that an inspection of Perlas Finance UAB identified only minor breaches, most of which were promptly remedied. No enforcement measure was imposed.

The decisions also included several qualifying holding assessments involving financial market participants.

What this means for businesses

The different outcomes demonstrate that supervisory authorities consider not only the existence of deficiencies but also the institution’s response, the speed of remediation, and the ability to demonstrate that corrective measures have been implemented.

For EMIs and PIs, client funds safeguarding remains a key supervisory priority. Safeguarding arrangements and the internal controls supporting them should therefore be tested for effective operation, rather than assessed only on the basis of policies and procedures.

Recommended actions

EMIs and PIs should:

• review client funds safeguarding arrangements and related internal controls;
• test whether safeguarding controls operate effectively in practice;
• ensure supervisory findings are assigned to responsible persons and remediated within defined deadlines;
• maintain evidence of remediation and, where appropriate, obtain independent assurance;
• review escalation procedures for material safeguarding deficiencies.

For qualifying holding transactions, businesses should also ensure that acquisition documentation covers the complete direct and indirect ownership chain, including non-EU entities and entities undergoing corporate reorganisation.

AlphaPay licence revoked following multiple regulatory breaches

Date: 22 July 2026 | Source: Lietuvos bankas – Board resolutions
Link

Lietuvos bankas revoked the payment institution licence of AlphaPay, UAB (formerly NovaPay, UAB), following multiple breaches of regulatory requirements.

The institution no longer met licensing requirements concerning its internal control system and ICT infrastructure, failed to ensure adequate protection of payment service users’ funds and no longer complied with its own funds requirements.

AlphaPay also failed to submit its audited 2025 annual financial statements, audit opinion and shareholder resolution on profit or loss allocation within the prescribed deadlines.

The licence had been suspended in April 2026, with access to client fund accounts restricted. According to Lietuvos bankas, AlphaPay subsequently failed to comply with remediation orders. The institution was found to be insolvent, with negative equity, and Lietuvos bankas announced that it would apply to the court for bankruptcy proceedings.

What this means for businesses

The case illustrates how supervisory intervention can escalate from remediation and suspension to licence revocation and insolvency where material deficiencies remain unresolved.

It also demonstrates that regulatory compliance extends beyond customer-facing requirements. Internal controls, ICT infrastructure, safeguarding, own funds and timely financial reporting are all integral to maintaining a payment institution licence.

Recommended actions

PIs and EMIs should:

• maintain a central register of supervisory findings and remediation obligations;
• assign clear responsibility and deadlines for corrective actions;
• provide timely evidence of remediation to the supervisory authority;
• monitor own funds and solvency requirements continuously;
• ensure audited financial statements and other regulatory reports are submitted on time;
• regularly reassess whether internal control and ICT arrangements continue to satisfy licensing requirements.

Lietuvos bankas finds significant weaknesses in EMI and PI wind-down plans

Date: 17 July 2026 | Source: Lietuvos bankas – Financial Market Supervision Committee decisions
Link

Lietuvos bankas assessed the wind-down plans of 12 electronic money and payment institutions, focusing on their content, practical applicability and legal compliance.

Four plans were assessed as comprehensive and implementable, while five were considered insufficiently detailed and three overly formal and theoretical. Each institution received an individual assessment and recommendations, with aggregated findings also published by Lietuvos bankas.

The same supervisory decisions included several qualifying holding assessments, including the proposed acquisition of a qualifying holding exceeding 50% in payment institution SOLLO, UAB.

What this means for businesses

The findings indicate that a wind-down plan is expected to be operationally usable, rather than simply a formal document prepared for licensing purposes.

A credible plan should explain how the institution would actually cease its activities, including how client funds would be returned, how outstanding transactions would be handled, which persons would be responsible and which operational and ICT dependencies would need to remain available during the wind-down.

Recommended actions

EMIs and PIs should:

• reassess existing wind-down plans against the latest supervisory findings;
• ensure the plan reflects the institution’s actual business model and operational dependencies;
• document the mechanics and timing of client fund returns;
• identify responsible persons and decision-making arrangements;
• address critical banking, outsourcing and ICT dependencies;
• test the plan against realistic wind-down scenarios rather than relying solely on a theoretical document.

The decisions also reinforce the need for complete qualifying holding notifications covering all relevant direct and indirect acquirers.

Latvijas Banka grants new EMI licence as Latvian payments sector continues to grow

Date: 9 July 2026 | Source: Latvijas Banka – MOIN Payments licence announcement
Link

Latvijas Banka granted an electronic money institution licence to SIA MOIN Payments, including authorisation to provide money remittance services.

At the time of the announcement, Latvia had 12 licensed and one registered electronic money institution and 10 licensed payment institutions. Latvijas Banka had already issued four EMI licences and five PI licences during 2026.

The Latvian regulator continues to promote pre-licensing consultations for businesses preparing to enter the market.

What this means for businesses

The continued licensing activity confirms that Latvia remains an active jurisdiction for payment and e-money businesses.

For prospective applicants, early regulatory engagement and the quality of the licensing package remain important. The business model, governance arrangements, safeguarding framework, AML/CTF controls, financial resources and ICT architecture should be presented as a coherent regulatory framework rather than as separate documentation streams.

Recommended actions

Businesses considering a Latvian PI or EMI licence should:

• use Latvijas Banka’s pre-licensing consultation process at an early stage;
• clearly define the proposed business model and regulated services;
• align governance, safeguarding, AML/CTF, risk management and ICT documentation with the actual business;
• identify regulatory gaps before submitting the formal application;
• ensure the licensing package demonstrates how the proposed controls will operate in practice.

UK regulators begin oversight of critical cloud and technology providers

Date: 10 July 2026 | Source: FCA
Link

UK financial regulators began overseeing the first Critical Third Parties (CTPs) from 13 July 2026, following HM Treasury’s designation of four global cloud and technology providers:

• Amazon Web Services EMEA SARL;
• Google Cloud EMEA Limited;
• Microsoft Ireland Operations Ltd;
• Oracle Corporation UK Limited.

The Bank of England, PRA and FCA will jointly oversee the resilience of critical services provided by these organisations to the UK financial sector, focusing on systemic risks, coordination and information sharing.

The regime complements, rather than replaces, existing outsourcing and operational resilience requirements. Regulated firms remain responsible for their own third-party risk management, due diligence and contingency planning.

The UK regulators have also established arrangements for cooperation with comparable regimes, including the EU’s DORA framework.

What this means for businesses

For financial institutions operating across the EU and UK, ICT third-party oversight is becoming increasingly cross-border and systemic.

The designation of a cloud provider as a critical third party does not transfer the regulated firm’s responsibility for managing outsourcing and ICT risks. PIs and EMIs must still understand their dependencies, assess concentration and exit risks, and maintain appropriate contingency arrangements under DORA.

Recommended actions

Financial groups with UK operations should:

• identify whether critical ICT providers are used across their UK and EU operations;
• map material ICT dependencies and concentration risks;
• maintain accurate outsourcing and ICT third-party registers;
• assess contractual arrangements and contingency measures for critical providers;
• distinguish provider-level regulatory oversight from the firm’s own DORA and operational resilience obligations.

EU regulators call for stronger ICT risk management against frontier AI threats

Date: 31 July 2026 | Source: ESMA
Link

The European Supervisory Authorities — EBA, EIOPA and ESMA — published a joint statement calling for a consistent, risk-based approach to ICT risks arising from frontier AI models.

The authorities highlighted the ability of AI-enabled cyber tools to rapidly identify and exploit vulnerabilities, target shared infrastructure and exploit single points of failure across financial entities.

The ESAs recommend strengthening ICT risk management across three areas:

• Prevention: asset inventories, secure-by-design practices, proactive patching and supply-chain standards.
• Detection: continuous vulnerability scanning, behavioural monitoring and more frequent testing.
• Management: resilience testing against AI-enhanced scenarios, dependency mapping and management-body accountability.

The authorities emphasise that measures should be proportionate to the institution’s size, risk profile and the nature, scale and complexity of its services, consistent with DORA’s proportionality principle.

What this means for businesses

AI-related cyber risk is increasingly becoming part of the core DORA ICT risk management framework.

For PIs and EMIs, periodic cybersecurity reviews may no longer be sufficient where vulnerabilities can be identified and exploited at significantly greater speed. ICT risk management should account for AI-assisted attacks that affect multiple systems, shared infrastructure, and critical third-party providers.

Recommended actions

PIs and EMIs should:

• review ICT risk assessments against AI-enhanced attack scenarios;
• assess whether vulnerability scanning and patching cycles remain sufficiently frequent;
• map critical ICT dependencies and potential single points of failure;
• test business continuity and incident-response arrangements against AI-assisted attacks;
• ensure management bodies receive timely information on material ICT risks;
• consider AI-driven threats when reviewing risk appetite and DORA compliance frameworks.

Key takeaways for payment institutions and EMIs

The latest regulatory developments point to several priorities for the payments sector:

• Safeguarding must be effective in practice.
  Client funds arrangements and the controls supporting them remain a significant supervisory focus.
• Remediation needs to be demonstrable.
  Institutions should be able to show that supervisory findings have been addressed promptly and effectively.
• Wind-down plans must be operationally credible.
  A plan should explain how the business could actually be wound down, including client fund returns, responsibilities and critical dependencies.
• Regulatory reporting is part of licensing compliance.
  Late or incomplete financial reporting can contribute to serious supervisory consequences.
• ICT third-party risk is becoming increasingly systemic.
  DORA compliance requires institutions to understand and manage their dependencies on critical technology providers.
• AI is changing the ICT threat environment.
  PIs and EMIs should consider whether their current vulnerability management, monitoring, resilience testing, and incident response arrangements are adequate for AI-enhanced attacks.
• The Baltic payments market remains active.
  Both Lithuania and Latvia continue to licence and supervise payment and e-money institutions, while cross-border acquisitions and changes of control remain subject to detailed regulatory scrutiny.

Need assistance?

Our payment services and fintech specialists advise PIs, EMIs and other regulated businesses on:

• PI and EMI licensing and regulatory authorisations
• Payment services and e-money regulatory compliance
• Client funds safeguarding
• DORA and ICT risk management
• AML/CTF and risk management frameworks
• Wind-down and exit planning
• Regulatory inspections and remediation
• Qualifying holdings and changes of control
• Regulatory reporting and supervisory communications
• Baltic market entry and cross-border regulatory matters

If you have questions regarding the developments covered in this edition or would like to assess your payment institution’s regulatory readiness, our team will be happy to assist.

The post RegRally Insights: Payment Services Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

This month’s RegRally highlights the developments most relevant to consumer credit providers, credit intermediaries, P2P lending platforms and other businesses providing financial services to consumers in Lithuania and Latvia.

Lithuania: new consumer credit rules to apply from November 2026

Date: 16 July 2026 | Source: Lietuvos bankas
Link

Lietuvos bankas approved amendments to its resolutions regulating consumer credit. The amendments will enter into force on 20 November 2026 and implement the revised Lithuanian Consumer Credit Law adopted by the Seimas on 16 April 2026, which transposes Directive (EU) 2023/2225 on consumer credit agreements.

The amendments also introduce changes concerning the regulation of peer-to-peer lending platform operators.

One important change concerns interest-free and fee-free consumer credit. The EU Consumer Credit Directive removed the previous exemption for such products, which are used in practice, among other things, by telecommunications companies.

The revised creditworthiness assessment and responsible lending rules, therefore, introduce a specific exception to the general 40% debt-service-to-income (DSTI) limit. Lenders may apply a DSTI ratio of up to 60% where:

• the credit is provided under a linked interest-free and fee-free agreement; and
• the credit finances the purchase of a phone, modem or router required for voice or internet access services.

The amendments also introduce more detailed requirements for the statutory consumer credit advertising warning “Dėmesio! Skolintis pinigus kainuoja.” They further refine reporting requirements and the public lists of consumer credit lenders, P2P platform operators and consumer credit intermediaries.

What this means for businesses

The changes require affected businesses to review not only their legal documentation, but also how consumer credit products are structured, assessed and advertised in practice.

Businesses offering interest-free or fee-free financing linked to telecommunications products should specifically determine whether their products qualify for the new 60% DSTI exception and ensure that the qualifying conditions are consistently documented.

The revised advertising requirements also mean that existing marketing materials should not simply be carried forward after November 2026 without review.

Recommended actions

Consumer credit providers and relevant P2P operators should:

• prepare for the 20 November 2026 entry into force;
• review creditworthiness assessment and responsible lending procedures against the revised rules;
• identify products that may qualify for the 60% DSTI exception and document the eligibility criteria;
• update consumer credit advertising templates and mandatory warning statements;
• review agreements, customer journeys and internal procedures affected by the revised Consumer Credit Law;
• verify reporting obligations and public-list registration requirements;
• ensure compliance teams and relevant business functions are prepared for the new requirements before they take effect.

Latvia: consumer financial services supervision may move to Latvijas Banka from 2027

Date: 23 July 2026 | Source: Saeima – Proposed transfer of financial consumer protection supervision to Latvijas Banka
Link

The Saeima Budget and Finance (Tax) Committee conceptually supported amendments to the Consumer Rights Protection Law that would gradually transfer supervision of consumer rights in financial services to Latvijas Banka, starting in 2027.

The function is currently performed by the Consumer Rights Protection Centre (PTAC).

Under the proposed framework, Latvijas Banka would assume responsibility for:

• licensing and supervision of consumer lenders;
• registration and supervision of credit intermediaries and their representatives;
• supervision of financial services advertising and unfair commercial practices;
• examination of consumer complaints and assistance with dispute resolution;
• supervision of compliance with consumer financial services requirements.

The proposed reform would also introduce an indefinite-term licensing model, with Latvijas Banka establishing requirements for issuing, suspending and cancelling licences.

A unified reporting system for suspected violations is also planned, with confidentiality protections for whistleblowers. Latvijas Banka would have powers to impose sanctions for significant breaches, including unlicensed lending and unregistered credit intermediation.

Most provisions are proposed to enter into force on 1 January 2027, while certain rule-making powers would apply from 1 January 2028. Existing CRPC licences and registrations would remain valid during the transition.

The proposed amendments still need to pass the remaining stages of the legislative process.

What this means for businesses

The proposed reform would represent a significant change in the supervisory model for financial consumer protection in Latvia.

Consumer lenders and credit intermediaries should prepare for a more integrated financial-sector supervisory framework, in which licensing, advertising, unfair commercial practices, and consumer complaints would fall under the supervision of the country’s central bank.

The reform is not yet final, so businesses should distinguish between proposed requirements and rules already in force. Nevertheless, the direction of travel provides a useful indication of the supervisory environment businesses should prepare for.

Recommended actions

Latvian consumer lenders and credit intermediaries should:

• monitor the progress of the amendments through the remaining legislative stages;
• assess how the proposed transfer of supervision could affect their licensing and registration arrangements;
• prepare for the transition to Latvijas Banka supervision and the proposed indefinite-term licensing model;
• review consumer credit advertising and commercial practices against the expected supervisory framework;
• assess whether internal compliance and reporting arrangements are ready for interaction with the new supervisor;
• plan for changes to supervisory fees and related regulatory costs.

Businesses should also avoid treating the proposed framework as final until the legislative process is complete.

Key takeaways for consumer credit businesses

The latest developments in Lithuania and Latvia point to several practical priorities:

• Prepare early for the Lithuanian rules.
  The revised Lithuanian consumer credit framework takes effect on 20 November 2026, leaving businesses a defined implementation deadline.
• Review products, not only policies.
  The new DSTI exception may affect how certain interest-free and fee-free financing products are structured and assessed.
• Treat advertising as a compliance issue.
  Consumer credit marketing materials and mandatory warning statements will be subject to review under the revised Lithuanian rules.
• Expect closer integration of financial consumer supervision in Latvia.
  The proposed transfer of supervisory functions to Latvijas Banka could bring consumer credit regulation closer to the broader prudential and conduct supervision framework applicable to financial institutions.
• Separate enacted requirements from proposed reforms.
  The Lithuanian changes have a confirmed entry-into-force date, while the Latvian reform remains subject to the legislative process.

Need assistance?

Our financial services and regulatory specialists advise consumer credit providers, P2P lending platforms and credit intermediaries on:

• Consumer credit regulatory compliance
• Creditworthiness assessment and responsible lending
• Consumer credit agreements and documentation
• Consumer credit advertising and marketing compliance
• P2P lending regulation
• Licensing and regulatory authorisations
• Regulatory reporting and supervisory requirements
• Consumer protection and unfair commercial practices
• Regulatory inspections and remediation
• Lithuanian and Latvian financial services regulation

If you have questions regarding the regulatory developments covered in this edition or would like to assess your consumer credit compliance ahead of the upcoming changes, our team will be happy to assist.

The post RegRally Insights: Consumer Protection Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

The latest FATF findings also highlight how virtual assets and decentralised finance are being used to move and obscure illicit funds, including in connection with sanctions evasion and the financing of the proliferation of weapons of mass destruction.

This month’s RegRally focuses on the developments most relevant to businesses exposed to Russia or Belarus, international trade, shipping, financial services, crypto-assets and higher-risk cross-border transactions.

This month at a glance

• Russia: The EU adopted its 21st sanctions package, introducing new restrictions targeting the energy sector, financial services, crypto operators, the Russian shadow fleet and sanctions circumvention. The package includes 218 new listings.
• Belarus: New measures extend restrictions affecting crypto-asset services, ownership and governance, exports and entities supporting the Belarusian or Russian defence and security sectors.
• Crypto and sanctions evasion: FATF identifies stablecoins, offshore VASPs, unhosted wallets and complex DeFi transaction structures as increasingly relevant channels for sanctions evasion and proliferation financing.
• Compliance focus: Effective sanctions compliance increasingly requires businesses to assess ownership, control, transaction flows, counterparties, geography and potential circumvention — not simply perform name screening.

EU adopts 21st sanctions package against Russia, expanding restrictions on energy, finance, crypto and the shadow fleet

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

The EU adopted its 21st package of sanctions against Russia, targeting the energy sector, financial services, crypto-assets, trade and Russia’s military-industrial complex.

The package introduces 218 new listings — 48 individuals and 170 entities — subject to asset freezes and, for individuals, travel restrictions. It also includes 51 additional anti-circumvention listings, including entities in third countries.

Key energy and shipping measures include:

• suspension of the oil price cap adjustment mechanism until July 2027, maintaining the cap at USD 44.10 per barrel;
• designation of 41 additional shadow fleet vessels;
• designation, for the first time, of vessels servicing designated shadow fleet vessels;
• transaction bans covering designated Russian ports, locks and airports;
• restrictions concerning a third-country refinery processing Russian oil;
• a notification obligation concerning the sale of LNG tankers to third countries.

The package also targets more than 100 banks and crypto operators and introduces further measures affecting Russia’s financial infrastructure.

In addition, the EU introduced legal protection measures intended to protect EU operators from certain retaliatory lawsuits connected with sanctions and requires Member States not to recognise or enforce certain Russian judgments linked to sanctions.

Why does it matter for businesses?

The new package significantly increases the number of entities, vessels and infrastructure points that businesses need to consider when assessing sanctions exposure.

Importantly, the package also targets third-country entities involved in circumvention. A counterparty, therefore, does not need to be Russian or directly listed to create sanctions risk.

For businesses involved in international trade, shipping, financial services or crypto-assets, sanctions controls increasingly need to extend beyond customer screening to transaction-level analysis and assessment of ownership, control and intermediary relationships.

Recommended actions

Businesses should:

• update sanctions screening lists without delay and rescreen existing customers, counterparties and relevant third parties;
• review exposure to newly designated banks, crypto operators, vessels, ports, refineries and other infrastructure;
• assess third-country counterparties and intermediaries for potential Russia-related circumvention risks;
• review payment and trade-finance flows involving higher-risk jurisdictions and counterparties;
• strengthen due diligence on shipping transactions involving shadow fleet vessels;
• review contractual arrangements with third-country counterparties in light of the new legal protection measures.

Businesses with material Russia-related exposure should combine automated screening with ownership/control analysis and transaction-level due diligence.

EU expands Belarus sanctions, including restrictions affecting crypto-asset services and exports

Date: 23 July 2026 | Source: European Commission / Council of the EU
Link

What happened?

Alongside the Russia measures, the EU adopted additional restrictive measures concerning Belarus, including trade-related provisions and measures intended to protect EU operators.

The package extends restrictions on crypto-asset service companies, including a prohibition on Belarusian nationals owning, controlling, or serving on the boards of companies providing crypto-asset services.

It also expands export restrictions on certain goods, including aviation-related products intended for UAVs, and designates four additional Belarusian entities that support the Belarusian or Russian defence and security sectors.

Why does it matter for businesses?

The measures create compliance implications beyond direct dealings with sanctioned Belarusian entities.

For crypto-asset service providers, sanctions compliance now requires closer attention to nationality, ownership and governance structures. For exporters, the expanded restrictions require businesses to consider not only the classification of goods but also their intended end use and end user.

The measures also reinforce the importance of checking ownership and control rather than relying exclusively on sanctions-list screening.

Recommended actions

Businesses should:

• review ownership and governance structures of Belarus-related counterparties;
• for crypto-asset service providers, verify whether Belarusian nationals hold relevant ownership, control or board positions;
• update export-control screening for newly restricted aviation and UAV-related goods;
• strengthen end-use and end-user checks for relevant exports;
• rescreen counterparties against the newly designated Belarusian entities;
• assess transactions involving Belarus for potential indirect exposure or sanctions circumvention.

FATF highlights virtual assets as an increasing channel for sanctions evasion and proliferation financing

Date: 16 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF’s Seventh Targeted Update on implementation of Recommendation 15 highlights the increasing complexity of illicit finance involving virtual assets. The report identifies sanctions evasion and proliferation-financing risks associated with stablecoins, offshore VASPs, unhosted wallets, and more complex DeFi transaction structures.

FATF highlights techniques such as chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation, which can be used to layer or obscure illicit funds within legitimate financial flows.

The report also highlights significant DPRK-linked activity. According to FATF, two major DeFi attacks attributed to the DPRK in April 2026 accounted for approximately 76% of annual virtual-asset hacking losses identified in the report, with combined proceeds exceeding USD 570 million.

Why does it matter for businesses?

For businesses dealing with crypto-assets, sanctions risk can arise even when a transaction does not directly match a sanctions list.

The risk may instead stem from the transaction path, an intermediary VASP, wallet exposure, rapid cross-chain movement, interaction with mixers or decentralised exchanges, or links to sanctioned jurisdictions or actors.

This means that sanctions compliance for CASPs and financial institutions increasingly needs to combine traditional screening with blockchain analytics and transaction-level risk assessment.

Recommended actions

CASPs and financial institutions exposed to virtual assets should:

• incorporate stablecoin-related sanctions-evasion typologies into transaction-monitoring scenarios;
• assess exposure to offshore VASPs and higher-risk P2P transactions;
• apply risk-based controls to transactions involving unhosted wallets;
• monitor for chain-hopping, cross-chain bridges, mixers and decentralised exchanges;
• ensure sanctions-risk indicators identified through blockchain analytics trigger appropriate escalation and investigation;
• assess whether existing blockchain analytics tools can identify indirect exposure, rather than only direct wallet matches.

Sanctions-evasion indicators should also feed into the wider customer and transaction risk assessment.

What businesses should take from this month’s developments

The latest developments reinforce a fundamental shift in sanctions compliance:

Screening names are necessary, but they are no longer sufficient.

The EU’s 21st Russia sanctions package demonstrates the increasing importance of ownership, control, shipping, financial flows, third-country intermediaries and anti-circumvention analysis. Belarusian measures similarly show that nationality and governance can become relevant factors in sanctions control.

FATF’s latest findings add another dimension for businesses dealing with virtual assets: sanctions evasion can occur through complex transaction structures that may not yield a straightforward sanctions-list match.

Businesses with international operations should therefore consider whether their sanctions framework can identify:

• indirect exposure to sanctioned persons and entities;
• ownership and control risks;
• higher-risk third-country intermediaries;
• shadow fleet and shipping exposure;
• sanctions-evasion patterns in payment and trade flows;
• crypto-asset transactions involving higher-risk wallets, VASPs or jurisdictions.

The practical test is whether the organisation can identify and investigate a potentially evasive transaction before it becomes a sanctions breach, rather than simply demonstrate that its screening system is operating.

Need assistance?

ECOVIS ProventusLaw advises businesses on EU sanctions and restrictive measures, including:

• sanctions compliance frameworks and risk assessments;
• sanctions screening and internal controls;
• ownership and control analysis;
• Russia and Belarus sanctions;
• sanctions circumvention and third-country exposure;
• crypto-asset sanctions compliance and blockchain-related risks;
• trade and export-control restrictions;
• sanctions investigations and regulatory response;
• sanctions policies, procedures and employee training.

If your business has exposure to Russia, Belarus, international trade, shipping, financial services or crypto-assets, our team can help assess whether your sanctions controls address both direct restrictions and circumvention risks.

The post RegRally Insights: Sanctions Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

This month’s RegRally highlights the developments most relevant to financial institutions, CASPs, fintechs and other obliged entities operating in Lithuania and across the EU.

This month at a glance

• Virtual assets: FATF identifies continuing gaps in Travel Rule implementation, VASP supervision and risk mitigation, while highlighting stablecoins, unhosted wallets and offshore VASPs as growing risk areas.
• DeFi: FATF takes a functional approach to determining when supposedly decentralised arrangements fall within AML/CFT requirements.
• EU reporting: AMLA is developing a harmonised EU format for suspicious transaction reporting and transaction data, potentially replacing fragmented national reporting approaches.
• Ongoing monitoring: AMLA is preparing horizontal guidance on customer information updates and ongoing monitoring applicable across obliged entities.
• Lithuania: FNTT’s 2025 inspections show that deficiencies in CDD, record keeping, internal controls, employee training and suspicious transaction reporting remain key enforcement risks.

FATF identifies continuing gaps in VASP supervision and highlights emerging virtual asset risks

Date: 16 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF published its seventh targeted update on the implementation of Recommendation 15 concerning virtual assets and virtual asset service providers (VASPs).

The report identifies continued global progress in implementing the Travel Rule: 83% of surveyed jurisdictions have now passed Travel Rule legislation, compared with 73% in 2025.

At the same time, significant implementation gaps remain. These include translating risk assessments into effective mitigation measures, operationalising licensing and registration frameworks, identifying persons conducting VASP activities, and ensuring effective risk-based supervision and enforcement.

FATF also highlights emerging risks involving the use of virtual assets for organised fraud and money laundering, with particular attention to stablecoins, peer-to-peer transactions involving unhosted wallets and offshore VASPs.

Why does it matter for businesses?

The report reinforces that virtual asset businesses are moving into a more mature supervisory environment. Having a Travel Rule solution or VASP licence is not, by itself, sufficient: supervisors are increasingly likely to assess whether the underlying risk assessment and controls actually address the relevant typologies.

For CASPs, exposure to stablecoins, unhosted wallets, P2P transfers and offshore counterparties should therefore be reflected in the business-wide ML/TF risk assessment and corresponding controls.

Recommended actions

CASPs should:

• benchmark Travel Rule implementation against the FATF’s identified implementation gaps;
• review whether stablecoin, unhosted-wallet and offshore-VASP risks are adequately reflected in the ML/TF risk assessment;
• test whether enhanced due diligence and transaction-monitoring controls respond to the relevant virtual asset typologies;
• assess whether existing controls remain appropriate as the business expands into new virtual asset products or transaction models.

FATF warns that DeFi is increasingly exposed to money laundering and other financial crime risks

Date: 21 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF published a targeted report on regulatory challenges arising from decentralised finance (DeFi).

The report identifies permissionless access, automated smart-contract execution, cross-border reach and pseudonymity as factors that can increase exposure to fraud, ransomware, professional money laundering and proliferation financing.

Implementation of the FATF Standards for qualifying DeFi arrangements remains limited: almost 93% of reporting jurisdictions have not yet implemented the Standards in this area.

Importantly, FATF takes a functional approach to determining whether a DeFi arrangement falls within Recommendation 15. A business or person may be subject to AML/CFT requirements where it exercises sufficient control or influence, even where the arrangement is presented as decentralised.

FATF identifies indicators of potential control both on-chain and off-chain, including governance token concentration, administrative privileges, control over upgrades, economic benefits and influence over development or infrastructure.

Why does it matter for businesses?

The report challenges the assumption that describing a product or protocol as “decentralised” automatically places it outside the AML/CFT framework.

This is particularly relevant to CASPs, financial institutions and technology businesses interacting with DeFi protocols. The regulatory analysis may need to focus on who actually controls or influences the arrangement, rather than how the protocol is marketed or structured.

FATF also states that financial institutions and VASPs should apply relevant AML/CFT controls when interacting with qualifying DeFi arrangements and refrain from interacting where compliance cannot be achieved.

Recommended actions

Businesses interacting with DeFi should:

• document an assessment of the actual control and influence exercised over each relevant arrangement;
• consider FATF’s on-chain and off-chain indicators when determining whether a DeFi arrangement falls within Recommendation 15;
• assess the adequacy of CDD, transaction monitoring and other AML/CFT controls applicable to the relationship;
• identify exposure to chain-hopping, cross-chain bridges, decentralised exchanges and mixers;
• avoid entering into or maintaining relationships where required AML/CFT controls cannot be effectively implemented.

For CASPs and financial institutions, DeFi exposure should also be reflected in the business-wide ML/TF risk assessment.

AMLA moves towards a harmonised EU format for suspicious transaction reporting

Date: 2 July 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA launched a public consultation on draft implementing technical standards establishing a common EU format for reporting suspicions and providing transaction records to Financial Intelligence Units (FIUs).

The proposed framework would introduce a harmonised set of data points for suspicious transaction reporting across the EU, replacing the fragmented national reporting formats currently used by obliged entities.

A public hearing is scheduled for 9 September 2026, while written consultation responses remain possible.

Why does it matter for businesses?

A common EU reporting format could materially change how compliance teams prepare and submit suspicious transaction reports, particularly for businesses operating across several EU jurisdictions.

For Lithuanian and Latvian businesses, the change may require adjustments to existing reporting processes and the data collected for national FIU reporting.

The impact will be particularly relevant to fintechs, financial institutions and other businesses operating cross-border, where differences between national reporting requirements currently create operational complexity.

Recommended actions

Compliance teams should:

• compare existing STR reporting processes with the proposed EU data points;
• identify information currently collected in national systems that may not map easily to the proposed format;
• assess whether existing transaction-monitoring and case-management systems can produce the required information;
• consider submitting consultation feedback where the proposed requirements create significant operational or proportionality concerns.

Businesses operating across multiple EU jurisdictions should begin considering the implications for their reporting architecture rather than waiting until implementation.

AMLA develops EU-wide guidance on ongoing monitoring of business relationships

Date: 2 July 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA held a public hearing on its draft guidelines for the ongoing monitoring of business relationships, attracting more than 1,200 stakeholders from the financial and non-financial sectors.

The draft guidance addresses customer information updates and the monitoring of transactions and activities. As horizontal guidance, it is intended to apply across obliged entities, with proportionality and the risk-based approach embedded throughout.

The written consultation remains open until 3 September 2026.

Why does it matter for businesses?

Ongoing monitoring is one area where AML frameworks often become operationally inconsistent: customer information may be updated at fixed time intervals without sufficient regard to changes in customer risk, while transaction monitoring may operate separately from KYC refresh processes.

The forthcoming AMLA guidance may therefore influence how businesses structure customer reviews, trigger events, conduct transaction monitoring, and perform periodic KYC refreshes.

Recommended actions

Obliged entities should:

• review current KYC refresh procedures against the draft AMLA approach;
• assess whether customer reviews are sufficiently risk-based rather than driven solely by fixed review cycles;
• identify trigger events that should result in an earlier review of customer information;
• assess whether transaction monitoring outcomes feed effectively into customer-risk reassessment;
• Consider submitting consultation responses by 3 September 2026, where the proposed approach creates significant operational challenges.

Fintechs and other business models with large or rapidly changing customer populations should pay particular attention to the proportionality of ongoing monitoring requirements.

FNTT enforcement data shows where Lithuanian AML controls continue to fail

Date: 16 July 2026 | Source: Financial Crime Investigation Service (FNTT)

FNTT published the 2025 activity report of its Money Laundering Prevention Board.

During 2025, FNTT conducted 20 inspections of obliged entities and imposed measures on 11 companies. Fines ranged from €2,435 to €771,400, with total fines reaching approximately €1.46 million.

The most common deficiencies concerned:

• customer identification and verification;
• record keeping;
• internal policies and control procedures;
• appointment and training of responsible employees;
• reporting requirements for transactions of €15,000 or more;
• suspicious transaction reporting;
• examination of complex, unusually large or unusually structured transactions.

Why does it matter for businesses?

This is one of the most useful indicators of current AML enforcement priorities in Lithuania because it shows the areas where deficiencies are actually identified during inspections.

The findings also demonstrate that enforcement risk does not necessarily arise from sophisticated money laundering schemes. Basic weaknesses in CDD, documentation, governance, training and escalation processes remain significant.

For obliged entities, the practical question is whether the AML framework would withstand an inspection today — not whether the required policies formally exist.

Recommended actions

Lithuanian obliged entities should test their AML framework against the FNTT’s identified enforcement areas, including:

• customer identification and verification;
• customer and business relationship risk assessment;
• record keeping and audit trails;
• internal AML policies and controls;
• appointment, competence and training of responsible employees;
• suspicious transaction identification and escalation;
• reporting of transactions subject to mandatory reporting requirements;
• assessment of complex, unusually large or unusually structured transactions.

Businesses should ensure that evidence of these controls is readily available and inspection-ready, rather than relying solely on written policies.

What businesses should take from this month’s developments

The direction of AML/CTF supervision is becoming clear: regulators are moving from formal requirements towards demonstrable effectiveness.

For virtual asset businesses, this means demonstrating that emerging risks — including stablecoins, unhosted wallets, and DeFi — are reflected in the risk assessment and control framework.

For traditional financial institutions and other obliged entities, the same principle applies to CDD, transaction monitoring, suspicious transaction reporting, ongoing KYC and internal governance.

The FNTT’s Lithuanian enforcement data is particularly clear: weaknesses in fundamental AML controls can still lead to significant financial penalties.

Businesses should therefore assess not only whether their AML framework is documented, but whether it would withstand a regulatory inspection, a complex customer-risk scenario or a suspicious transaction requiring rapid escalation and reporting.

Need assistance?

ECOVIS ProventusLaw advises financial institutions, fintechs, CASPs and other obliged entities on AML/CTF compliance, including:

• AML/CTF regulatory assessments and gap analysis;
• business-wide ML/TF risk assessments;
• AML policies, internal controls and procedures;
• customer due diligence and enhanced due diligence frameworks;
• transaction monitoring and suspicious transaction reporting;
• AML governance, MLRO responsibilities and employee training;
• CASP and virtual asset AML/CTF requirements;
• regulatory inspections and remediation of identified deficiencies.

If your organisation is preparing for increased AMLA or national supervisory scrutiny, our team can help assess whether your AML framework is not only documented but operationally effective and ready for regulatory review.

The post RegRally Insights: AML/CTF Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

This month’s RegRally focuses on developments particularly relevant to organisations that use AI, digital advertising, cloud and online services, blockchain, or process personal data at scale.

This month at a glance:

• AI: Certain high-risk AI compliance deadlines have been deferred, but AI transparency obligations remain applicable.
• AI and GDPR: The EDPB has issued guidance on anonymisation and web scraping for generative AI.
• Blockchain: The EDPB’s final guidance highlights the need to address GDPR requirements at the architecture stage.
• Cookies and tracking: European and Lithuanian regulators continue to scrutinise consent mechanisms and actual website behaviour.
• Data breaches: New EU-level reporting proposals and Lithuanian enforcement statistics underline the importance of effective incident-response processes.
• Cybersecurity: Regulators are placing increasing emphasis on continuous vulnerability management and operational resilience.

Digital Omnibus on AI enters into force: high-risk AI deadlines deferred, but transparency duties remain

Source: European Commission | Date: 27 July 2026
Link

The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and amended the EU AI Act.

The most significant change is the postponement of certain high-risk AI compliance deadlines:

• Annex III high-risk AI systems: 2 December 2027, instead of 2 August 2026;
• Embedded high-risk systems under Annex I: 2 August 2028, instead of 2 August 2027.

The deferral does not apply to Article 50 transparency obligations. Requirements concerning the disclosure of AI interactions, AI-generated content, and deepfakes remain applicable as of 2 August 2026. Obligations applicable to providers of general-purpose AI models also remain in force.

Why does it matter for businesses?

The additional time for certain high-risk AI requirements provides organisations with more room to implement compliance frameworks. It should not, however, be treated as a general postponement of AI governance.

Businesses need to distinguish between obligations whose application has been deferred and requirements that are already applicable. In particular, organisations deploying AI systems that interact directly with individuals should review whether their transparency measures are operational now.

Recommended actions

• Review AI systems against the revised implementation timetable.
• Prioritise Article 50 transparency requirements, including AI interaction disclosures and labelling requirements for AI-generated or manipulated content.
• Continue work on AI governance, risk classification, documentation and accountability rather than postponing implementation generally.
• Update internal AI compliance roadmaps and responsibility matrices to reflect the revised deadlines.

EDPB proposes a relative approach to anonymisation

Source: European Data Protection Board | Date: 7 July 2026
Link

The EDPB published draft Guidelines 02/2026 on anonymisation, intended to replace the former Article 29 Working Party Opinion 05/2014.

The draft takes a relative approach to identifiability. Whether data is anonymous may depend on the realistic means available to the organisation handling the data to identify individuals. As a result, the same dataset may potentially be considered personal data in one context but anonymous in another.

Why does it matter for businesses?

The assessment of anonymisation cannot be reduced to whether identifiers have been removed or whether a particular technical anonymisation method has been applied.

Organisations using data for AI development, analytics, research or data sharing may need to demonstrate why identification is not reasonably possible in their particular circumstances and what means of re-identification are realistically available.

Recommended actions

• Reassess existing anonymisation methodologies against the EDPB’s proposed risk-based approach.
• Document the realistic means available for re-identification when assessing whether data remains personal data.
• Review data-sharing and AI-data projects where the organisation currently relies on anonymisation to take the processing outside the GDPR.
• Monitor the finalisation of the Guidelines before making major changes solely on the basis of the draft.

EDPB clarifies GDPR requirements for web scraping used to train generative AI

Source: European Data Protection Board | Date: 8 July 2026
Link

What happened?

The EDPB published draft Guidelines 03/2026 on the use of web scraping to train generative AI models.

The Guidelines address the processing of personal data obtained through web scraping, including the need to consider lawful basis, purpose limitation and transparency.

The fact that information is publicly accessible does not, by itself, remove it from the scope of the GDPR.

Why does it matter for businesses?

This is particularly relevant to organisations developing AI systems, procuring AI models, or using datasets obtained from publicly accessible websites.

Public availability does not automatically mean that personal data can be collected and reused for AI training without further assessment. Organisations need to consider the original context in which information was collected and whether its proposed use for AI training is compatible with applicable data protection requirements.

Recommended actions

Organisations developing or procuring AI trained on scraped data should:

• identify and document the applicable lawful basis for collecting and using training data;
• assess compatibility between the original purpose of collection and the proposed AI-training purpose;
• review transparency measures and privacy notices covering AI-related processing;
• assess contractual and due-diligence arrangements where AI models or datasets are supplied by third parties.

EDPB adopts final Guidelines on blockchain and data protection

Source: European Data Protection Board | Date: 8 July 2026
Link

What happened?

The EDPB adopted its final Guidelines on blockchain and data protection, addressing how GDPR principles such as data minimisation, storage limitation, rectification and erasure apply to blockchain-based processing.

Why does it matter for businesses?

Blockchain architecture can create a structural tension with GDPR requirements where personal data is stored directly on-chain and cannot subsequently be modified or deleted.

The guidance reinforces the importance of addressing data protection at the design and architecture stage, rather than attempting to resolve GDPR compliance after a blockchain solution has already been implemented.

Recommended actions

Businesses using blockchain in connection with personal data should:

• avoid storing personal data directly on-chain where possible;
• assess whether personal data can instead be kept in appropriately secured off-chain systems;
• consider data minimisation and pseudonymisation before deploying the architecture;
• assess how the proposed architecture will support data-subject rights, particularly erasure and rectification.

EDPB requires the Belgian DPA to assess the cookie-banner complaint on its merits

Source: European Data Protection Board | Date: 14 July 2026
Link

The EDPB ruled that a GDPR complaint concerning cookie banners, lodged with the Belgian DPA, must be assessed on its merits, rejecting the argument that the complaint constituted an abuse of rights.

Why does it matter for businesses?

The decision reinforces that cookie compliance remains an active enforcement area.

For organisations, the question is not simply whether a cookie banner is present. Regulators and complainants can examine whether the underlying consent mechanism actually complies with GDPR requirements, including whether consent is freely given, sufficiently granular and capable of being withdrawn.

Recommended actions

Organisations using cookies and other tracking technologies should:

• test whether consent is genuinely freely given and granular;
• review cookie-banner design for interfaces that steer users towards acceptance;
• verify that non-essential tracking technologies are not activated before valid consent;
• review the configuration and actual behaviour of their consent-management platform.

EDPB’s common data breach notification template moves closer to implementation

Source: European Data Protection Board | Date: 5 August 2026
Link

What happened?

The EDPB’s draft common template for notifying personal data breaches under Article 33 GDPR was open for consultation until 5 August 2026.

The proposed template contains approximately 120 fields across seven sections, with predefined response options, and is intended to harmonise breach reporting across the EU/EEA.

Why does it matter for businesses?

A standardised reporting approach could increase consistency between national supervisory authorities, but it also places greater emphasis on an organisation’s ability to obtain accurate incident information quickly.

For businesses, the practical issue is not the template itself but whether their incident-response process can generate the required information within the GDPR’s 72-hour notification period.

Recommended actions

• Map the proposed information requirements against existing breach-response procedures.
• Identify information that cannot currently be obtained quickly during an incident.
• Clarify responsibilities between legal, IT, security, HR and management teams during a breach.
• Test whether the organisation can assess, document and escalate a personal data breach within the 72-hour timeframe.

Belgian DPA fines IAB Europe €250,000 over Transparency & Consent Framework

Source: Belgian Data Protection Authority | Date: 31 July 2026
Link

What happened?

The Belgian Data Protection Authority, acting in agreement with the other European data protection authorities involved in the procedure, imposed a €250,000 fine on IAB Europe concerning its Transparency and Consent Framework (TCF).

The Belgian DPA identified several GDPR compliance shortcomings, including issues relating to legal basis, DPO appointment, DPIA requirements and records of processing activities. IAB Europe disputes the findings and is considering a legal challenge.

Why does it matter for businesses?

The decision highlights an important distinction between using an industry-standard consent framework and demonstrating compliance with the GDPR as an individual controller.

A standardised consent signal does not necessarily resolve the organisation’s own obligations concerning lawful basis, transparency, accountability, DPIAs or records of processing. This is particularly relevant to publishers, adtech businesses, and other organisations that use consent management and advertising technology frameworks.

Recommended actions

Businesses relying on the TCF or similar industry frameworks should:

• monitor further developments, including any appeal;
• assess whether the consent signals they receive are sufficient for their specific processing activities;
• independently verify their legal basis and transparency requirements;
• review DPIA and accountability documentation where advertising or profiling activities present higher risks.

VDAI reports 140 personal data breaches in Lithuania in H1 2026

Source: State Data Protection Inspectorate (VDAI) | Date: 16 July 2026
Link

What happened?

The VDAI received 140 personal data breach notifications in Lithuania during the first half of 2026, affecting more than 1.64 million data subjects.

Cyber incidents accounted for 36% of reported breaches, while human error accounted for 48%. Reported examples included sending information to the wrong recipient, using “CC” instead of “BCC” and improperly anonymising disclosures.

The VDAI reported that 81% of controllers notified breaches within the required 72-hour period. The authority also imposed fines of €4,500 in March and €450,000 on a healthcare company in June for data security failures.

Why does it matter for businesses?

The figures demonstrate that data protection risk is not limited to sophisticated cyberattacks. Human error remains a significant source of personal data breaches.

This means that effective GDPR compliance depends not only on policies and technical security measures but also on access controls, employee practices, escalation procedures and the organisation’s ability to respond quickly when something goes wrong.

Recommended actions

Organisations should test, rather than merely document, their incident-response and security controls, with particular attention to:

• access management and encryption;
• employee handling of personal data;
• incident detection and escalation;
• internal responsibilities during a breach;
• the ability to assess and notify a reportable breach within 72 hours.

VDAI confirms prior consent is required for non-essential cookies

Source: State Data Protection Inspectorate (VDAI) | Date: 23 July 2026
Link

The VDAI reiterated that non-essential cookies, tracking pixels and similar technologies may only be used after obtaining the website visitor’s prior, freely given consent.

The authority expressly stated that legitimate interest cannot substitute for consent where prior consent is legally required.

Why does it matter for businesses?

Cookie compliance cannot be assessed solely by reviewing the wording of a cookie banner.

The actual technical behaviour of the website and consent-management platform matters. Organisations should verify whether tracking technologies are activated before consent, whether consent is properly recorded and whether users can withdraw it effectively.

Recommended actions

• Test the actual technical behaviour of websites and applications before and after consent is given.
• Verify that non-essential cookies and tracking technologies are blocked until valid consent is obtained.
• Check that consent can be withdrawn as easily as it was given.
• Review whether any processing currently relies on legitimate interest where prior consent is legally required.

NKSC urges organisations to strengthen cyber resilience

Source: National Cyber Security Centre (NKSC) | Date: 28 July 2026
Link

The NKSC highlighted the increasingly short period between the discovery of vulnerabilities and their exploitation. The authority noted that AI-assisted tools are enabling attackers to identify and exploit security weaknesses more rapidly.

Organisations are being encouraged to strengthen continuous infrastructure monitoring, vulnerability management and incident response.

Why does it matter for businesses?

The speed of exploitation makes periodic security reviews increasingly insufficient for organisations exposed to significant cyber risk.

Vulnerability management needs to operate as an ongoing process, with the ability to identify, prioritise, and remediate critical vulnerabilities before they are exploited.

Recommended actions

Organisations should assess whether:

• vulnerability monitoring is sufficiently continuous;
• critical vulnerabilities are prioritised according to actual business risk;
• patching processes can respond quickly to newly disclosed vulnerabilities;
• incident-response procedures can operate effectively alongside vulnerability management.

What businesses should take from this month’s developments

Across the EU and Lithuania, regulators are increasingly focusing on how compliance works in practice.

For businesses, the key message is not simply to update policies when new guidance or enforcement decisions are published. Organisations should be able to demonstrate that their controls work: that AI systems are appropriately governed, tracking technologies behave as intended, personal data is protected, and breaches can be assessed and reported quickly.

The same principle applies across GDPR, AI and ICT compliance: documented compliance is becoming less persuasive where operational reality tells a different story.

Need assistance?

ECOVIS ProventusLaw advises organisations on the practical implementation of data protection, AI and ICT regulatory requirements, including:

• GDPR compliance programmes and data protection governance
• AI governance and GDPR compliance for AI systems
• personal data breach assessment and incident response
• DPIAs and data protection risk assessments
• cookie and tracking technology compliance
• cybersecurity and ICT regulatory compliance
• data protection policies, procedures and accountability documentation

If you are reviewing your organisation’s GDPR, AI, or ICT compliance framework in light of recent regulatory developments, our team can help assess your current position and identify areas requiring action.

The post RegRally Insights: GDPR and ICT Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

The distinction between a Payment Institution (PI) and an Electronic Money Institution (EMI) is becoming increasingly important for fintech businesses operating in the European Union.

As the EU payment services regulatory framework evolves, licensed institutions should not rely solely on the scope of their existing authorisation. They should also assess whether their actual products, payment flows and business model remain consistent with the regulatory status under which they operate.

Why does the PI vs EMI distinction matter?

A Payment Institution is authorised to provide regulated payment services. An Electronic Money Institution can provide payment services and, importantly, issue electronic money.

This distinction can become less straightforward in practice, where fintech products combine wallets, payment accounts, stored-value functionality, card programmes, merchant services or other embedded payment solutions.

For an established fintech, the relevant question is: “Does our current business model require the regulatory permissions associated with an EMI?”

What should licensed fintechs review?

EU payment and e-money institutions should consider conducting a structured regulatory review covering:

• Products and payment flows – identify how customer funds are received, held, transferred and used;
• Electronic money analysis – determine whether any products or balances may constitute electronic money;
• Safeguarding arrangements – assess whether current arrangements remain appropriate for the activities actually performed;
• Capital requirements – consider the potential impact of regulatory classification on own-funds requirements;
• Agents, distributors and partners – review whether existing arrangements and regulatory notifications remain appropriate;
• Governance and compliance – ensure the regulatory framework, policies and internal controls reflect the actual business model.

Why 2026 is the right time to review

The EU payment services framework is undergoing significant regulatory development, while supervisory expectations around the substance of financial services activities continue to evolve. The EBA has also issued guidance on the transition between the existing and emerging payment services frameworks.

For fintech businesses, this creates a practical reason to assess regulatory positioning before changes become operationally urgent.

A proactive review can identify potential licensing or compliance gaps, clarify whether the existing authorisation remains appropriate, and help management plan any necessary regulatory engagement.

How ECOVIS ProventusLaw can help

ECOVIS ProventusLaw advises electronic money institutions, payment institutions and fintech businesses on:

• EMI and PI licensing and regulatory strategy;
• regulatory requalification and business-model assessments;
• payment services and e-money regulatory analysis;
• safeguarding and governance requirements;
• AML/CFT and compliance frameworks;
• regulatory engagement with competent authorities;
• cross-border expansion and passporting.

Our Partner Inga Karulaitytė, Head of Banking & Finance and FinTech, regularly advises financial institutions across the Baltic region on licensing, regulatory requalification and compliance.

Practical takeaway: licensed fintechs should review their products and payment flows now and confirm that their regulatory permissions continue to match the substance of their business.

Related reading:
Payment Institution Licence vs Electronic Money Licence: What EU EMIs Need to Know About the 2026 Requalification — Inga Karulaitytė, TechBullion.

The post Payment Institution vs Electronic Money Institution: What to Review in 2026 appeared first on ECOVIS ProventusLaw.

Employment law is moving beyond traditional HR compliance. Recent developments show a clear shift towards closer scrutiny of how employers manage disputes, remote and cross-border work, workplace risks, and increasingly technology-driven employment practices.

This edition of RegRally Insights: Employment & Migration brings together the key developments that employers, HR professionals, and in-house legal teams should be aware of as they review employment practices, workforce planning, and restructuring decisions.

In Lithuania, recent changes to unemployment insurance are affecting the labour market, while labour dispute statistics indicate a significant increase in employment-related claims. At the EU level, the CJEU has provided important guidance on governing law in cross-border remote work arrangements, while the European Commission is advancing the Quality Jobs Act, with AI and algorithmic management, workplace health and safety, subcontracting chains and enforcement among its priorities.

For employers, the overall direction is clear: employment compliance increasingly requires proactive risk management rather than simply reacting when a dispute or inspection arises.

Labour disputes are rising: VDI reports 17% more applications and 23% more claims

Source: State Labour Inspectorate (VDI) | Date: 30 July 2026
Link

The State Labour Inspectorate reported a significant increase in labour disputes during the first half of 2026. Labour Dispute Commissions received 5,142 applications — 17% more than in H1 2025 — and 13,074 claims, an increase of 23%.

Wage-related claims remained the largest category, accounting for approximately 71% of all claims. Claims relating to psychological violence at work also nearly doubled year on year.

The figures are particularly relevant for employers because they indicate where employment-related risks are increasingly materialising in practice.

Recommended actions

Employers should:

• Review internal anti-harassment and anti-bullying policies and reporting channels.
• Pay particular attention to payroll accuracy and timely settlement of employment-related payments.
• Consider early and constructive resolution of disputes, as 25% of claims were resolved through settlement agreements.

Unemployment insurance reform changes eligibility and benefits

Source: Ministry of Social Security and Labour | Date: 1 July 2026
Link

The Law on Unemployment Social Insurance has been substantially revised, changing both eligibility requirements and benefit calculations.

Among the key changes are a new minimum unemployment benefit of EUR 370 in 2026, changes to the earnings-related component of the benefit, and extended benefit periods for people approaching retirement age with a sufficiently long pension-insurance record. A new claim generally requires 12 months of insurance record within the previous 24 months.

Key changes include:
1. the benefit’s fixed component (independent of prior earnings) is reduced from 23.27% to 15% of the relevant base, while the earnings-linked variable component increases – to 45% of average insured income in months 1-3 (up from 38.79%), 35% in months 4-6 (up from 31.03%), and 25% in months 7-9 (up from 23.27%);

2. a minimum benefit is introduced, set at 5x the base social benefit (5 x EUR 74 = EUR 370 in 2026), and the maximum benefit is capped at 70% of the national average wage;

3. people within 5 years of old-age pension age who have at least 20 years of pension-insurance record get their benefit period extended from 2 to 6 months in total (an additional 4 months for people already receiving or resuming payments from 1 July);

4. a new unemployment benefit claim now requires a fresh 12-month insurance record within the last 24 months, and periods of receiving unemployment benefits no longer count toward that new qualifying record;

5. transitional rules apply to people who already had an unemployed status before 1 July 2026, including automatic recalculation where a continuing or resumed benefit would otherwise fall below EUR 370.

Recommended actions

HR teams handling redundancies and terminations should:

• Update employee-facing information concerning unemployment benefits.
• Take the new eligibility and benefit rules into account when planning redundancies and termination processes.
• Be aware that employees close to pension age with 20+ years of insurance record now have a materially longer benefit runway (6 months instead of 2), which may affect redundancy planning and severance discussions.

CJEU clarifies governing law in cross-border remote work

Case: Hortis GRC SA, C-768/24 | Date: 9 July 2026
Link

The CJEU provided important guidance on determining the applicable law in cross-border employment relationships involving remote work.

The Court confirmed that where the law chosen by the parties is also the law of the country most closely connected with the employment relationship, that chosen law may apply rather than the mandatory employment protections of the country where the employee habitually works.

Relevant factors may include the currency in which salary is paid, social insurance affiliation and tax residence. The choice-of-law clause itself, however, cannot establish the necessary connection.

The judgment is particularly relevant for employers managing international remote-working arrangements, where the employee, employer and employment-related obligations may be located in different jurisdictions.

Recommended actions

Employers should:

• Review governing-law clauses in cross-border employment contracts.
• Assess whether the practical arrangements genuinely support the chosen governing law.
• Review salary, tax and social insurance arrangements alongside the contractual framework.

Quality Jobs Act: EU consultation puts AI at work firmly on the agenda

Source: European Commission | Date: 20 July 2026
Link

The European Commission launched the second phase of consultation on the forthcoming Quality Jobs Act, which is expected later in 2026.

The consultation focuses on five areas:

• algorithmic management and AI at work;
• occupational health and safety;
• workers’ rights in subcontracting chains;
• fair digital and green transitions;
• enforcement and the role of social partners.

The AI-related proposals are particularly significant. They address transparency and human oversight of automated decisions, as well as protection against excessive workplace monitoring.

Recommended actions

Employers and HR/compliance teams should:

• Monitor developments relating to the Quality Jobs Act as a major upcoming EU initiative, given its likely impact on AI/algorithmic management, workplace heat and psychosocial risk rules, and subcontracting-chain liability.
• Review the use of AI in recruitment, scheduling, performance monitoring and employment decisions.
• Consider whether existing governance and human oversight mechanisms are adequate.
• Consider participating in the consultation before 28 September 2026, where relevant to the organisation.

European Commission renews focus on the future of work

Date: 22 July 2026

The European Commission has renewed its commitment to the European Pillar of Social Rights and identified several areas requiring further EU-level action.

One of the key priorities is harnessing AI for the future of work, including establishing a new high-level group to examine AI’s impact on the labour market.

The Commission also confirmed that a Quality Jobs Act will follow later in 2026, along with new indicators to measure job quality across the EU.

For employers, this reinforces the importance of treating AI governance as an emerging employment-law issue, not only a technology or data-protection issue.

Cross-border labour inspections: stronger cooperation between European authorities

Date: 21 July 2026

The Lithuanian State Labour Inspectorate participated in a European Labour Authority-coordinated inspection initiative involving authorities from eight European countries.

The inspections covered undeclared work, wage payments, posted workers’ rights, and other EU employment requirements. In total, 26 company sites were inspected and more than 150 workers interviewed.

The initiative demonstrates the growing capacity of national labour authorities to coordinate cross-border investigations.

Recommended actions

Employers using posted workers or cross-border staffing arrangements should:

• Keep posted-worker documentation, wage records and social insurance information accurate and readily available.
• Review compliance where third-country nationals are assigned to work in other EU jurisdictions.
• Treat recurring wage complaints as a potential regulatory risk, particularly where cross-border arrangements are involved.

Lithuania’s priorities for the EU employment agenda

Date: 6 July 2026

At the informal EPSCO Council meeting, Lithuania highlighted three priorities for the EU social agenda:

• continued focus on poverty reduction;
• ensuring that simplification of labour-market regulation does not weaken worker protection;
• improving labour-market inclusion for people with disabilities.

These priorities provide further context for the direction of EU employment policy and upcoming regulatory initiatives.

What should employers take away?

Recent developments point to several practical areas that deserve closer attention:

1. Employment disputes are increasing.
Wage issues and workplace conduct remain major sources of employment risk.

2. Cross-border work requires more than a well-drafted contract.
The actual economic and social circumstances of the employment relationship can determine which law applies.

3. AI is becoming an employment-law issue.
Employers should start considering governance, transparency and human oversight where AI is used to manage or evaluate workers.

4. Labour enforcement is becoming increasingly coordinated.
Cross-border employment arrangements can attract attention from multiple national authorities.

5. Proactive compliance matters.
Regular reviews of contracts, HR policies, payroll, workplace practices and employment-related technology can help identify risks before they become disputes or regulatory issues.

Need assistance?

Employment law is evolving rapidly, with new legislative requirements, court judgments and regulatory expectations affecting employers across sectors.

Our Employment & Migration Law specialists can assist with:

• Employment law compliance reviews and Labour Code gap assessments
• Employment contracts, internal policies and HR documentation
• Workplace investigations and disciplinary procedures
• Collective redundancies, restructurings and business transfers
• Executive employment, termination strategies and settlement agreements
• Working time, remuneration and employee benefits compliance
• Occupational health and safety obligations
• Employment disputes, regulatory investigations and labour inspections
• Employment-related GDPR and workplace privacy matters.

If you have any questions regarding the developments covered in this edition or would like to assess your organisation’s employment law compliance, our team will be happy to assist you.

The post RegRally Insights: Employment & Migration Law Updates, August 2026 appeared first on ECOVIS ProventusLaw.