The September edition of RegRally covers the data protection and information and communication technology (ICT) developments of August that matter most to businesses processing personal data in Lithuania and across the EU.

This month at a glance

• Automated decisions: the Dutch Data Protection Authority fined Uber nearly EUR 825 million under Article 22 GDPR for deactivating drivers by automated decision-making without meaningful human intervention.
• Retention and erasure: noyb sent SCHUFA a cease-and-desist letter over an alleged shadow database, demanding genuine erasure, complete access responses and transparency, and opened an interest list for a possible class action.
• Video surveillance: Lithuania’s National Cyber Security Centre (NKSC), together with the Second Investigation Department under the Ministry of National Defence (AOTD) and the State Security Department (VSD), published recommendations on the secure use of video surveillance cameras.
• Plain-language GDPR: VDAI published material explaining data protection requirements in accessible language, useful for internal policies, staff training and privacy notices.

Uber’s EUR 825 million GDPR fine for automated decisions

Date: 21 August 2026 | Source: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Link | Link

What happened?

On 21 August 2026, the Dutch Data Protection Authority fined Uber EUR 824,990,000, nearly EUR 825 million, for the fully automated deactivation (blocking) of drivers. It is one of the largest GDPR penalties ever issued.

The decision turns on Article 22 GDPR. Drivers were deactivated by automated decision-making with no meaningful human intervention, and without the safeguards and transparency that provision requires for decisions producing legal effects or similarly significantly affecting data subjects.

Why does it matter for businesses?

The decision is significant for organizations using AI-supported or other algorithmic decision-making tools affecting individuals, including in HR, onboarding, offboarding, fraud prevention, compliance, risk scoring and account termination. It also confirms that regulators will treat the absence of genuine human review as a substantive breach of Article 22 GDPR rather than a mere procedural defect.

Recommended actions

Businesses using automated decision-making should:

• prepare an inventory of the decisions the organization makes about individuals without human involvement, for example blocking an account, terminating a contract or refusing a client on risk grounds
• assess for each whether Article 22 GDPR allows it to be taken on a fully automated basis
• make sure the human review behind an automated decision is genuine and can be evidenced: the reviewer should see the underlying data, have authority to change the outcome and leave a record of the review
• remember that a formal sign-off alone does not meet the Article 22 GDPR standard, as this was the central failing in the Uber decision
• check that privacy notices tell individuals when a decision about them is automated and what logic is involved
• keep a working procedure through which individuals can contest an automated decision and obtain human review, and document the safeguards in writing

SCHUFA and the GDPR: retention, erasure and access requests

Date: 26 August 2026 | Source: noyb (European Center for Digital Rights)
Link

What happened?

On 26 August 2026, noyb sent a cease-and-desist letter to the German credit information agency SCHUFA over an alleged shadow database and opened an interest list for a prospective class action. noyb demands that SCHUFA stop storing data beyond its own published retention periods, provide affected individuals with their historical data in response to access requests under Article 15 GDPR, and ensure transparency about its processing practices.

SCHUFA rejected the demands, so noyb has confirmed it will file for an injunction, and an interest list has been opened for a possible damages class action.

Why does it matter for businesses?

The dispute turns on retention and genuine erasure, and on the completeness of access responses. The allegation is that records which should have been deleted are only hidden from view and still used, including to develop and test scores.

Recommended actions

Businesses holding personal data should:

• map every dataset in which the organization holds personal data, including archives, backups and historical records
• check that the retention period the organization itself publishes is actually applied, and that data is genuinely erased at the end of that period, not merely hidden from everyday view while remaining available for other uses
• make sure responses to access requests under Article 15 GDPR cover all personal data held about the individual, including archived and historical records, not only what appears in the active system
• state in the privacy notice how long each category of data is kept and on what basis
• where historical data is reused for a further purpose, for example to develop or test scoring models, confirm that the further use has its own lawful basis and is disclosed to the individuals concerned

Video surveillance cameras: security recommendations from Lithuanian authorities

Date: 26 August 2026 | Source: National Cyber Security Centre (NKSC)
Link | Link

What happened?

On 26 August 2026, NKSC, AOTD and VSD jointly published recommendations on the secure use of video surveillance cameras, framing the issue as running from privacy to national security. The authorities stress that even a single unprotected camera can serve both as a source of valuable information and as an access point into the whole network of a home, company or organization.

Cameras deployed for security and monitoring are themselves attractive targets. Attackers who gain access can collect sensitive information for criminal purposes or in the interests of foreign states. The authorities point to the Dutch intelligence services’ July 2026 disclosure of systematic Russian digital espionage operations exploiting internet-connected cameras in the West and in Ukraine, where intercepted video feeds were used to identify military vehicle routes, weapons delivery routes and troop positions.

Why does it matter for businesses?

Poorly configured or unpatched devices create both a personal data exposure and a national security exposure. For businesses, camera security raises both GDPR and ICT security issues. The guidance also highlights the growing focus of public authorities on supply-chain security risks associated with connected devices and surveillance technologies.

Recommended actions

The baseline recommendations issued by the authorities are in substance the following:

• change the factory administrator password on every device to a strong and unique password that is not reused across units, and change it periodically
• update camera software and firmware regularly, and do not use devices the manufacturer no longer supports, replacing them with newer equipment from reliable manufacturers
• make sure there are no abandoned or unmonitored cameras still connected to the network
• where there is no genuine need, do not allow the camera to be reached directly from the internet. For remote access use only the manufacturer’s recommended solution or a VPN, and keep surveillance equipment in a separate network segment
• do not install or upgrade to surveillance equipment from untrusted manufacturers, in particular devices produced in China, Russia or Iran
• use features such as partial blurring where the image may otherwise reveal sensitive information, for example GPS location, and limit the camera’s field of view so that it does not capture excessive detail, such as an exact address, or confidential detail, such as computer screens or documents
• monitor whether cameras that do not belong to the organization have appeared on its property or are pointed at it
• include camera systems in the assessment of security of processing under Article 32 GDPR and, where the organization is subject to ICT rules such as the NIS2 Directive or the Digital Operational Resilience Act (DORA), also in its ICT risk management and incident reporting arrangements

VDAI explains data protection in plain language

Date: 28 August 2026 | Source: State Data Protection Inspectorate (VDAI)
Link

What happened?

On 28 August 2026, VDAI published material explaining data protection requirements in plain and accessible language, as part of its ongoing effort to make GDPR obligations comprehensible to controllers and data subjects.

Why does it matter for businesses?

The material shows how the Inspectorate itself explains key GDPR principles, and is useful when reviewing internal policies, staff training materials and privacy notices.

Recommended actions

Businesses processing personal data should:

• review the Inspectorate’s material and circulate it internally to the staff who handle personal data
• use it as a reference when reviewing internal policies, staff training materials and privacy notices

What should businesses take from this month’s developments?

The Uber decision is relevant to any business that uses automated decisions about individuals. If an account can be blocked, a contract terminated or a client refused without a person genuinely reviewing the decision, human review has to be real, evidenced and capable of changing the outcome.

Retention promises have to be kept in practice. The SCHUFA dispute turns on exactly that pattern: data kept beyond published retention periods, hidden from everyday view but still in use, and access responses that stop at the active system.

Camera systems can raise both data protection and ICT security issues. They belong in the Article 32 GDPR assessment of security of processing, and, for organizations under the NIS2 Directive or DORA, in ICT risk management and incident reporting arrangements.

How ECOVIS ProventusLaw can help

ECOVIS ProventusLaw advises businesses on telecommunications, IT and data protection matters, including GDPR compliance, automated decision-making, retention and erasure practices, privacy notices and the ICT requirements applying to connected devices.

For financial institutions, our team also covers data protection in fintech companies. As your legal advisors, we will be happy to assist with all questions related to these developments, including legal advice as well as the revision and preparation of your internal documents.

The post RegRally Insights: Personal Data Protection & ICT Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

This edition of RegRally covers the period from 1 to 31 August 2026 and is written for businesses and international investors operating or investing in Estonia.

This month at a glance

• Investment support: the general threshold for large-scale investment support was lowered from EUR 100 million to EUR 70 million, with EUR 35 million for priority technology projects and EUR 20 million for defense industry projects, and the job creation requirement reduced from 30 to 20. The amendment entered into force on 8 August. The grant cap is EUR 20 million per project, and supported activities must not begin before the application is submitted.
• Construction: the Building Code reform took effect on 1 August. Building notice validity was extended from two to four years, one use permit can cover several buildings, and a use notice replaces the use permit for one- and two-apartment dwellings. Requirements became stricter for certain alterations of residential buildings with three or more apartments.
• AI Act: Article 50 transparency obligations apply from 2 August. The AI Omnibus moved the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), and systems placed on the market before 2 August 2026 must meet the Article 50(2) marking requirements from 2 December 2026.
• Packaging: the EU Packaging and Packaging Waste Regulation entered general application on 12 August, including limits on PFAS in food-contact packaging. Most recyclability, labeling and reuse requirements follow in later stages, predominantly from 2028 or 2030.
• Electricity: from 1 August, consumption points with a bidirectional meter are billed on 15-minute net quantities, which changes the economics of on-site generation.
• From 1 September: online traders must offer consumers a clearly visible withdrawal button. The Consumer Protection and Technical Regulatory Authority flagged this at the end of August as an immediate preparation item.

Large-scale investment support expanded

Date: 8 August 2026 | Source: Minister of Economic Affairs and Industry Regulation No. 25, Riigi Teataja
Link

What happened?

Minister of Economic Affairs and Industry Regulation No. 25 of 3 August 2026 amended the conditions for large-scale investment support. The amendment was published on 5 August (RT I, 05.08.2026, 1) and entered into force on 8 August.

Estonia’s large-scale investment support thresholds after the August 2026 amendment:

• General investment threshold: lowered from EUR 100 million to EUR 70 million
• Priority technology projects: EUR 35 million, where previously the general EUR 100 million threshold applied
• Defense industry projects: EUR 20 million, where previously the general EUR 100 million threshold applied
• Jobs to be created: at least 20, down from at least 30

The thresholds concern eligible project costs. An applicant must be registered in the Estonian Commercial Register, and may be an Estonian company owned by a foreign investor. Priority projects include strategic digital and net-zero technologies, deep and biotechnology, and food and beverage production.

The grant cap is EUR 20 million per project. The standard maximum intensity is 10%. Up to 15% may apply outside Harju County, the region around Tallinn, where the average gross salary for newly created jobs exceeds 1.5 times the benchmark referred to in the regulation. Location outside Harju alone does not qualify a project for 15%. Applicable State aid ceilings must also be checked.

Supported project activities must not begin, and commitments for their implementation must not be undertaken, before the application is submitted. Pre-consultation and pre-assessment with the Estonian Business and Innovation Agency (EIS) must be completed before applying. A binding order or investment commitment may therefore jeopardize eligibility even if construction or equipment delivery has not yet started.

Why does it matter for businesses and investors?

Lower thresholds make Estonia a realistic candidate for medium-sized international industrial projects as well. Grant eligibility, site rights and the order of contract signing should be integrated into one investment plan.

Recommended actions

Businesses considering an application should:

• verify eligible costs, salary conditions and the timing of commitments before applying
• complete EIS pre-consultation and pre-assessment before submitting the application
• not begin supported activities or undertake binding commitments, including orders, before the application is submitted
• check the applicable State aid ceilings

Additional sources: Invest Estonia announcement

Construction procedures became more flexible

Date: 1 August 2026 | Source: Act amending the Building Code and related legislation (RT I, 11.07.2026, 3)
Link

What happened?

The Act amending the Building Code and related legislation reduced procedural burden in several situations. The changes affect both new developments and the reconstruction and regularization of existing buildings, as set out in the Ministry of Climate explanation.

What changed on 1 August 2026:

• Building notice validity: extended from two to four years, so there is less need to repeat proceedings if construction is delayed
• Design conditions (projekteerimistingimused): their use was expanded, and where permitted, the solution can be refined without amending the detailed plan
• Use permits: a single use-permit application can cover several buildings in the same project, so they can be commissioned together
• One- and two-apartment dwellings: the use permit was replaced by a use notice
• Small non-residential buildings and selected structures: requirements were eased, with the procedure depending on the structure’s size, type and intended use

The reform is not a blanket simplification of all construction works. Requirements for a building permit became stricter for certain alterations and extensions of residential buildings with three or more apartments. Project schedules should therefore be based on the procedure applicable to the specific activity, not on the reform’s general purpose.

For buildings constructed before 1 July 2015, regularization continues to focus on safety. Buildings constructed before 22 July 1995 are treated as lawful. The EUR 500 state fee for registering a previously unregistered building was abolished. The publication of personal data in the Building Register was also clarified: personal data may be disclosed only where necessary for the proceedings or to demonstrate compliance.

Why does it matter for businesses and investors?

The four-year building notice validity gives developers more time to start construction after the notice has been submitted. This can reduce the need to repeat the procedure where a project is delayed.

When acquiring real estate, compare the physical situation with registry data, permits and planning instruments. Simplified procedures may help remedy defects, but the purchase agreement must still allocate responsibility, remediation duties and deadlines clearly. The availability of design conditions does not automatically guarantee the desired development rights.

Recommended actions

Developers and buyers should:

• base project schedules on the procedure applicable to the specific activity
• check whether previously unregistered buildings can now be registered, as the EUR 500 state fee was abolished

Additional sources: Land and Spatial Development Board on Building Register changes

AI transparency obligations began to apply

Date: 2 August 2026 | Source: Regulation (EU) 2024/1689 (AI Act), European Commission
Link

What happened?

Article 50 of the EU Artificial Intelligence Act applies to certain providers and deployers of AI systems. It is relevant to customer-service chatbots, AI-enabled software, and synthetic marketing or media content.

Who has to do what under Article 50:

• Provider of an AI system interacting directly with people: ensure the person is informed that they are interacting with AI, unless this is obvious from the circumstances
• Provider of a system generating synthetic content: ensure machine-readable marking and detectability of AI origin to the applicable extent
• Deployer of a deepfake system: disclose that content was artificially generated or altered, subject to statutory exceptions
• Deployer publishing AI text on a matter of public interest: observe the disclosure duty and the human-review or editorial-control exception

The European Commission’s guidance helps define roles, exceptions and practical compliance methods. Neither the guidance nor the voluntary code of practice replaces the obligations laid down in the Regulation.

The AI Omnibus, which entered into force on 27 July 2026, changed the implementation calendar for high-risk systems. Requirements under Annex III of the AI Act apply from 2 December 2027. Requirements for high-risk systems integrated into regulated products under Annex I apply from 2 August 2028. It is therefore inaccurate to say that all high-risk AI requirements applied from 2 August 2026.

Article 50 has its own narrow transition rule. For providers of systems placed on the market before 2 August 2026, the marking and detectability requirements under Article 50(2) must be met from 2 December 2026. This is not a general four-month extension covering all transparency obligations.

Why does it matter for businesses and investors?

An AI-using business should identify its role for each solution, verify user-facing notices, and agree with its supplier on content marking and the delivery of compliance information. In a technology acquisition, this review should form part of legal due diligence.

A business does not need to build AI to be affected. The duty follows from how a bought chatbot, drafting tool or content generator is used, and a company can be a deployer for one system and a provider for another. The contract should clearly allocate responsibility for marking, detectability and the information needed to demonstrate compliance.

Recommended actions

Businesses using or acquiring AI systems should:

• identify whether each relevant system makes the business a provider or a deployer and which Article 50 obligations apply
• review user-facing notices, marking and labeling arrangements, including the 2 December 2026 transition for systems placed on the market before 2 August 2026
• allocate compliance responsibilities and access to the required evidence in supplier and technology agreements

New EU packaging rules started to apply

Date: 12 August 2026 | Source: Regulation (EU) 2025/40 (PPWR), European Commission
Link

What happened?

The new Packaging and Packaging Waste Regulation entered general application on 12 August. It affects packaging manufacturers, importers, food businesses, retailers and e-commerce operators.

One requirement applies already in August. Food-contact packaging may not be placed on the market where its content of per- and polyfluoroalkyl substances (PFAS), the group of persistent chemicals used for grease and water resistance, exceeds the applicable limits. Businesses must be able to assess and demonstrate packaging compliance.

According to the Commission’s implementation guidance, having produced stock before 12 August does not, by itself, allow packaging that fails the PFAS requirements to be placed on the market later. The production date and the first placing on the market must be distinguished. Packaging placed on the market before 12 August may remain there under the guidance and does not have to be recalled solely because of the new PFAS restriction.

The PPWR did not apply all of its objectives at once in August. Harmonized sorting labels and several recyclability, recycled-plastic, empty-space and reuse requirements take effect in later stages, predominantly from 2028 or 2030, subject to the specific deadlines of each provision.

Why does it matter for businesses and investors?

The restriction applies at the first placing on the market.

Check packaging composition evidence, supplier confirmations and the timing of placing existing stock on the market. Supply agreements should address compliance documents, packaging replacement and cost allocation. A harmonized EU framework may support investment in compliant packaging and circular-economy solutions.

Recommended actions

Businesses placing packaged goods on the market should:

• distinguish production dates from the first placing on the market when managing existing stock
• map which later PPWR requirements, predominantly from 2028 and 2030, affect the product range

Electricity billing moves to 15-minute netting

Date: 1 August 2026 | Source: Electricity Market Act amendment, Elektrilevi
Link

What happened?

At consumption points with a bidirectional meter, grid and electricity bills are based on the difference between electricity taken from and fed into the grid during each 15-minute trading period. For example, 4 kWh taken from the grid and 3 kWh fed into it result in net consumption of 1 kWh for that period. This is not monthly or annual netting.

Why does it matter for businesses and investors?

The effect depends on the timing overlap between generation and consumption, so identical savings cannot be assumed for every producer. For businesses with on-site generation, the new methodology feeds directly into project economics.

Recommended actions

Businesses with on-site generation should:

• check their August billing under the new methodology
• update project economics using actual 15-minute data rather than monthly totals

Additional sources: Lõuna-Eestlane overview

E-commerce withdrawal button required from 1 September

Date: 1 September 2026 | Source: Consumer Protection and Technical Regulatory Authority (TTJA)
Link

What happened?

From 1 September 2026, an online trader must enable consumers to submit a withdrawal statement through a clearly visible withdrawal button or an equivalent function. The Consumer Protection and Technical Regulatory Authority highlighted the need to prepare for this at the end of August.

The solution must allow the consumer and the contract to be identified, confirm submission of the withdrawal statement, and immediately send an acknowledgement on a durable medium stating the content and time of submission.

Why does it matter for businesses and investors?

The requirement covers more than the button itself: identification, confirmation and the durable-medium acknowledgement all have to work end to end.

Recommended actions

Online traders should:

• implement the withdrawal button or an equivalent clearly visible function
• ensure the solution identifies the consumer and the contract, confirms submission, and immediately sends an acknowledgement on a durable medium with the content and time of submission
• test the entire workflow from button to acknowledgement, on a real order

Additional sources: TTJA guidance for consumers

What international investors should take from August

The strongest combined effect of the August changes is on industrial and technology investments: a lower support threshold may improve financing, the construction reform may facilitate delivery, and the new electricity methodology may change the economics of on-site generation. The impact must be assessed project by project.

Large-scale investment support does not replace foreign investment clearance. Under the existing framework, an investor from a third country may require clearance for an investment in a designated target undertaking, and a company established in the EU but controlled by a third-country person may also qualify as a foreign investor. The regime covers, among other things, the acquisition of significant participation or control and certain asset transactions. This is an existing framework, not a new August requirement.

Four checks for management:

• Investment project: verify eligible costs, salary conditions and the timing of commitments before applying
• Real estate: update the permit schedule and check consistency between the physical building and registry documents
• AI and packaging: assign responsibility, identify applicable requirements and collect supplier evidence
• Energy and e-commerce: verify the new billing method and the actual operation of the withdrawal function

How ProventusLaw can help

ProventusLaw advises businesses and international investors on entering the Estonian market, structuring investments and transactions, including through Estonian investment funds, assessing support conditions and clearance requirements, and on corporate, construction, tax and technology law. Cross-border projects can be coordinated across the Baltics and through the ECOVIS network.

If an investment, development or compliance question in Estonia touches your plans, our team can help you assess it before binding commitments are made.

The post RegRally Insights: Legal and Investment Update in Estonia, September 2026 appeared first on ECOVIS ProventusLaw.

This edition also covers the State Labour Inspectorate’s reminder that violence and harassment prevention duties adopted three years ago are still not implemented everywhere, and an EU case on dress codes that any employer with a uniform or appearance policy will want to watch.

The September edition of RegRally covers the month’s employment law developments for employers, HR teams and in-house lawyers working in Lithuania.

This month at a glance

• Pay structure deadline: by 31 December 2026, all employers, irrespective of size, sector or nature of activities, must approve or review their pay structure (darbo apmokėjimo sistema, DAS) under Article 140(3) of the Labour Code, grouping positions by objective and gender-neutral criteria.
• Pay transparency reporting: Order No A1-433 sets up the Pay Transparency Notification (Form SDUP), submitted to Sodra monthly via EDAS. The first form is due by 28 February 2027 for January 2027, and from 1 March 2027 employees may request their own and their category’s monthly indicators.
• Violence and harassment: a VDI survey of nearly 300 employers found that some have still not implemented obligations that have been mandatory for over three years, from conduct rules and a named contact person to training every three years.
• EU case law: Advocate General Ćapeta considers that a tattoo ban combined with a skirt requirement for women’s ceremonial uniforms amounts to direct sex discrimination. The Court’s judgment will follow.

All employers must have a compliant pay structure by 31 December 2026

Source: Labour Code, Article 140(3) | Deadline: 31 December 2026
Link | Our overview of the Pay Transparency Directive implementation in Lithuania

What happened?

31 December 2026 is the deadline for employers to approve, or review and, where necessary, amend the pay structure (darbo apmokėjimo sistema, DAS) under Article 140 of the Labour Code and Article 23(4) of Law No XV-969. By that date, all employers, irrespective of their size, sector or nature of activities, must have objective and gender-neutral pay systems ensuring employees’ right to fair remuneration.

The pay structure will be mandatory for all employers and must be made available to all employees. Before approving or amending it, the employer must complete the information and consultation procedures required under the Labour Code.

The pay structure must group positions according to objective and gender-neutral criteria and set out the forms of pay, salary amounts or ranges, rules for additional remuneration, allowances and bonuses, and the criteria and procedure for salary indexation and increases. Employers with fewer than 50 employees are exempt from the obligation to set salary increase criteria and procedure.

Positions involving the same work or work of equal value must be assigned to the same position group, and equal pay must be ensured for men and women performing the same or equal-value work.

Why does it matter for employers?

There is no small-company exception. A business with three employees needs a pay structure by the same date as a group with three thousand.

The grouping decisions made now will carry forward. The same position categories will be used for pay transparency reporting from 2027, so inconsistencies in the grouping will carry into the reported data.

Recommended actions

Employers should:

• complete the preparation or review of their pay structure by 31 December 2026 and ensure that all positions are grouped using objective and gender-neutral criteria in line with Article 140(3) of the Labour Code
• map all existing roles against the pay structure and assign each employee to the appropriate position group
• check whether information and consultation procedures are required before approval or amendment
• align the internal categories with the categories that will later be used for pay transparency reporting

Pay transparency reporting takes shape: Form SDUP goes to Sodra monthly from 2027

Source: Ministry of Social Security and Labour (SADM), Order No A1-433 | Date: 17 July 2026, in force from 31 July 2026
Link

What happened?

SADM adopted Order No A1-433 of 17 July 2026 approving the Procedure for the collection and publication of information on employees for the purpose of implementing their right to fair remuneration and for the joint pay assessment. The Order is the implementing measure for the pay transparency amendments to the Labour Code (Law No XV-969 of 21 May 2026, transposing Directive (EU) 2023/970).

The Procedure introduces the Pay Transparency Notification (Form SDUP), submitted monthly to Sodra via EDAS by the last day of the month for the preceding month. It defines the key data concepts: the category of workers (grouped under the objective, gender-neutral criteria of Article 140(3) of the Labour Code and denoted by its number in the pay structure), gross monthly pay, gross complementary pay and paid working time.

The Order sets out the full methodology by which Sodra calculates average hourly pay, pay gaps, medians and quartiles, returns monthly indicators by the 15th day of the month and annual indicators, and lists the additional data required when the form is completed for the first time.

Key dates: the first Form SDUP is due by 28 February 2027 for January 2027. From 1 March 2027, an employee may request their own and their category’s monthly indicators, earlier than the annual indicators, which apply from 2028 for employers with 150 or more insured employees and from 2031 for those with 100 to 149.

Chapter VIII sets out the joint pay assessment procedure, which applies where an unjustified pay gap of 5% or more within a category of workers is not remedied within six months. Temporary employment agencies do not receive Sodra indicators but must calculate them themselves and submit Form SDUP by 1 March.

Why does it matter for employers?

Pay transparency is now a monthly payroll obligation with fixed dates and a defined data format.

From 1 March 2027, employees can request their own and their category’s monthly indicators, well before any annual indicators are published. And a gap of 5% or more within a category that stays unjustified for six months triggers a joint pay assessment.

Recommended actions

Employers should:

• prepare in advance for the new monthly data reporting obligation and the new employee category requirement
• review the pay structure, assign all positions to objective and gender-neutral categories, and ensure the internal categories correspond to the data that will have to be submitted in Form SDUP via EDAS
• map existing roles against the pay structure and confirm each employee’s category before the first reporting period, so the payroll team can generate consistent monthly data for submission to Sodra

VDI: some employers still have not implemented mandatory violence and harassment prevention

Source: State Labour Inspectorate (VDI) | Date: 26 August 2026
Link

What happened?

VDI published the results of an anonymous survey of nearly 300 employers conducted in May 2026. The finding: although employers take violence and harassment prevention seriously, a number have still not implemented obligations that have been mandatory for over three years.

All employers, regardless of size, must comply with Article 30 of the Labour Code and the Violence and Harassment Prevention Measures Regulation: declare the prohibition of violence and harassment, adopt conduct and ethics rules, designate a responsible contact person, establish complaint reporting and investigation procedures, provide legal and emotional support to affected employees, and organise mandatory training every three years.

Employers with 50 or more employees must additionally adopt a formal prevention policy covering identification, complaint handling, protective measures and conduct standards. VDI expects employers to move beyond documentation: to carry out psychosocial risk assessments, monitor whether the measures actually work, and handle every complaint seriously and promptly.

Why does it matter for employers?

These duties have been mandatory for over three years, and VDI expects more than documentation. Employers should be able to show that the training cycle ran, the risk assessment was done and complaints were actually investigated.

Recommended actions

Employers should:

• verify the Article 30 package is in place and current: prohibition declaration, conduct rules, named contact person, complaint procedure and support arrangements
• check the three-year training cycle has not lapsed, and that employers with 50 or more staff have the formal prevention policy adopted
• document the psychosocial risk assessment and keep evidence that the measures are monitored, not merely adopted on paper

Advocate General: a tattoo ban plus a skirt requirement can amount to sex discrimination

Source: Advocate General’s Opinion, Case C-320/25 (Lertimene) | Date: 3 September 2026
Link

What happened?

Advocate General Tamara Ćapeta delivered her Opinion in Case C-320/25 (fictitious name “Lertimene”), concerning a candidate excluded from Italian police recruitment because a small tattoo on her calf would have been visible under the women’s ceremonial uniform, a skirt and court shoes. Male candidates with tattoos in the same location were not excluded, because the men’s ceremonial uniform, trousers, would not reveal it.

The Advocate General took the view that the combined application of the tattoo ban and the requirement for women to wear a skirt at ceremonies amounts to direct discrimination on grounds of sex under the Equal Treatment Directive (2006/54/EC): had the candidate been a man, the same tattoo would not have led to exclusion.

She further considered that this could not be justified as a “genuine and determining occupational requirement”, since ceremonial duties make up only a small part of police work, female officers already wear trousers as part of their standard operational uniform, and senior officers could in any event authorise a female officer to wear trousers at a given ceremony. The Opinion is not binding on the Court, which will now deliberate and deliver judgment at a later date.

Why does it matter for employers?

A rule that is neutral on paper, here a tattoo ban applied to everyone, can become discriminatory when combined with another rule that in practice affects only one sex. The same logic applies to any dress code, uniform or appearance policy.

Tradition and organisational identity did not carry the justification here, which is worth remembering for any employer defending a differentiated appearance rule.

Recommended actions

Employers with dress codes, uniform policies or appearance requirements, including public-sector and uniformed employers, should:

• review whether any appearance or uniform rule, even if facially neutral, has a different practical effect on men and women, for example a rule that only bites for one gender’s mandated clothing
• be cautious about justifying differentiated appearance rules by reference to tradition or organisational identity alone, since the Advocate General found such justifications insufficient where the practical impact falls disproportionately on one sex
• watch for the Court’s final judgment, since it will clarify how far “genuine occupational requirement” justifications can stretch to cover appearance and uniform policies EU-wide

What should employers take away?

The pay transparency requirements arrive in sequence: the pay structure by 31 December 2026, the first Form SDUP for January 2027 by 28 February 2027, monthly reporting after that, and employee access to the indicators from 1 March 2027. The reporting will use the categories set in the pay structure, and an unjustified pay gap of 5% or more that is not remedied within six months leads to a joint pay assessment.

On violence and harassment, employers should ensure that the Article 30 package is in place and current, the three-year training cycle has not lapsed, the formal prevention policy is adopted where the company has 50 or more staff, and the psychosocial risk assessment is documented with evidence that the measures are monitored, not merely adopted on paper.

How ECOVIS ProventusLaw can help employers

Our Employment & Migration team helps employers in Lithuania with:

• preparing or reviewing the pay structure under Article 140(3) and setting up Form SDUP reporting with payroll and HR
• checking employment practices against the Labour Code and identifying compliance gaps
• drafting and updating employment contracts, internal policies and other HR documents
• internal workplace investigations and disciplinary matters
• planning collective redundancies, reorganisations and business transfers
• executive contracts, exits and settlement agreements
• working time, pay and benefits questions, including the new pay transparency requirements
• occupational safety and health duties, including violence and harassment prevention
• representing employers in labour disputes and during regulatory investigations and VDI inspections
• employee data protection and workplace privacy

If you have questions about the 31 December deadline, SDUP reporting, the prevention obligations or any other topic in this edition, our team will be happy to assist.

The post RegRally Insights: Employment & Migration Law Updates, September 2026 appeared first on ECOVIS ProventusLaw.

At EU level, the new Anti-Money Laundering Authority (AMLA) is reaching payment institutions (PIs) and electronic money institutions (EMIs) directly, through the eligibility data collection that will decide who faces direct supervision and a survey on Central Contact Points. The September edition of RegRally covers what this means for PIs, EMIs and fintech groups in the Baltics and across the EU.

This month at a glance

• Lithuania enforcement: following an inspection, the Bank of Lithuania ordered EMI Verified Payments to restore capital adequacy by 1 October 2026 and, pending a separate decision, prohibited it from taking on new clients, encumbering assets and lending. The same bulletin licensed crowdfunding provider Finance EU (brand Florrid), Lithuania’s 16th, placing the country fifth in the EU.
• Lithuania sanctions methodology: draft amendments to the fine-calculation procedure and the minor-breach criteria are on public consultation, going directly to the amount of supervisory fines and the threshold for escalation. The industry association filed a joint position in August.
• Lithuania draft law: amendments to the Law on Financial Institutions would extend the shareholder-meeting deadline for approving annual accounts from 3 to 5 months and allow initial share capital to be deposited in an accumulation account at a licensed EMI or PI, not only a credit institution.
• AMLA direct supervision: the European Banking Authority (EBA) published the draft reporting framework for the 2027 eligibility data collection that will determine selection for AMLA direct supervision. PIs and EMIs are within the reporting population, with 31 December 2026 as the reference date.
• Passporting: AMLA surveyed payment service providers and EMIs operating through agents and distributors on Central Contact Points until 15 September 2026, feeding technical standards that will determine when a host state may require a CCP.

Bank of Lithuania restricts EMI Verified Payments and licenses crowdfunding provider Finance EU

Date: 5 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Financial Market Supervision Committee decisions bulletin of 5 August contained two decisions: supervisory instructions to an electronic money institution and a new crowdfunding license.

Following an inspection of Verified Payments, UAB, the Bank of Lithuania found the institution had failed to comply with the own funds (capital adequacy) requirement for a significant part of the inspected period, and that the breach remains unremedied. The institution had systematically granted significant loans to its shareholder for personal needs without applying effective credit risk management, and the inspection identified circumstances casting reasonable doubt on the sole shareholder’s financial capacity to ensure sound and financially sustainable management.

Without waiting for a final decision, and to protect clients’ interests immediately, the Bank of Lithuania ordered the institution to restore capital adequacy by 1 October 2026, to prepare and implement a plan acceptable to the supervisor for resolving shareholder-related issues, to report capital adequacy and financial data more frequently, and to notify the Bank of Lithuania in advance of any planned capital-increase actions and not carry them out until it raises no objection. Pending a separate decision, the institution is prohibited from establishing business relationships with new clients, providing them payment services or issuing electronic money, encumbering its financial assets, securing other persons’ obligations and lending its own funds.

In the same bulletin, a crowdfunding service provider license was granted to UAB “Finance EU”, which under the brand Florrid intends to offer investment in crowdfunding projects secured by real estate. The Bank of Lithuania noted that 16 companies now hold such licenses in Lithuania, placing the country fifth in the European Union by that measure.

Why it matters for payment institutions and EMIs

The case shows how much can happen before any final decision. Supervisory doubt about the shareholder alone, combined with an unremedied capital breach, was enough for a new-client ban, asset restrictions and a lending prohibition, all as interim measures.

It also puts related-party lending squarely on the supervisory map. Loans to a shareholder for personal needs, without credit risk management, read as a capital problem and a governance problem at once.

Recommended actions

EMIs and payment institutions should:

• be able to evidence continuous compliance with the own funds requirement between reporting dates, not only at period end
• treat related-party (shareholder) lending as a high-risk area governed by credit-risk policy, arm’s-length terms and documented approval, since it was central to this case
• ensure the financial capacity and suitability of shareholders can be substantiated, since supervisory doubt on this point alone can trigger a new-client ban and asset restrictions as interim measures
• monitor the institution’s communications and consider concentration risk (clients holding balances with a restricted EMI)
• note the increasingly competitive Lithuanian licensed population (prospective crowdfunding applicants)

Bank of Lithuania consults on how fines are calculated and when breaches count as minor

Date: August 2026 | Source: Lietuvos bankas (draft Board resolutions, public consultation)

What happened?

The Bank of Lithuania placed on public consultation draft amendments to two enforcement instruments: the Procedure for the Calculation of Fines and the Procedure for Determining When a Breach of a Legal Act Is Considered Minor.

Together these determine how the supervisor sets the amount of a fine and when it may treat a breach as minor and refrain from imposing an enforcement measure. The amendments therefore go directly to the quantum of supervisory sanctions and the threshold for escalation. The consultation attracted sector comments, including a joint position submitted by the industry association in August 2026.

Why it matters for payment institutions and EMIs

This is the math behind every future enforcement case. How a fine is calculated, and where the minor-breach line sits, changes both the realistic exposure of any finding and the calculus around self-reporting.

Recommended actions

Supervised entities should:

• review the draft methodology now and model its effect on realistic fine exposure, rather than waiting for the final resolutions
• reassess internal breach-classification and self-reporting practice against the revised minor-breach criteria
• consider responding to the consultation, individually or through an association, while the calculation methodology is still open

Draft law would ease incorporation and reporting deadlines for financial institutions

Date: 3 August 2026 | Source: Ministry of Finance / Government of the Republic of Lithuania
Link

What happened?

A draft law amending Articles 27 and 43 of the Law on Financial Institutions (No. IX-1068) was registered on 3 August 2026 (project No. 26-10473), prepared by the Ministry of Finance and submitted to the Seimas by the Government. Consultation with institutions and the public ran from 3 to 17 August 2026.

If adopted, two changes follow. The deadline for the general meeting of shareholders to approve annual financial statements and decide on profit distribution would be extended from 3 to 5 months after the financial year end, aligning it with the Law on Companies. And newly established financial institutions would be able to deposit initial share capital into an accumulation account held not only with a credit institution but also with an electronic money institution or payment institution licensed in Lithuania, again aligning with the Law on Companies and adding flexibility on incorporation.

Why it matters for payment institutions and EMIs

The accumulation-account change removes a practical bottleneck: today, setting up a financial institution depends on a bank agreeing to open the capital account. If the amendment passes, licensed EMIs and PIs can be on the other side of that service.

Recommended actions

Financial institutions should:

• note the prospective 5-month approval deadline when planning the 2026 annual accounts and profit-distribution timetable
• track adoption when advising on or setting up new financial institutions, since the accumulation-account change removes the practical dependence on a bank at incorporation
• assess the commercial opportunity in offering accumulation accounts if the amendment passes (licensed EMIs and PIs)

AMLA’s 2027 eligibility data collection includes PIs and EMIs

Date: 4 August 2026 | Source: EBA (European Banking Authority)
Link

What happened?

The EBA published, as part of release 4.4 of its reporting framework, a public working draft of the data model and taxonomy that will support the 2027 eligibility data collection underpinning AMLA’s first selection of institutions for direct supervision. Credit and financial institutions fall within the population that must report, including payment institutions and electronic money institutions.

For PIs and EMIs this introduces a concrete reporting exercise. Data gathered in early 2027 will confirm whether provisionally eligible entities still meet the criteria as of 31 December 2026, with the prospect of EU-level direct supervision from 2028. The consultation on the draft closed on 24 August 2026.

Why it matters for payment institutions and EMIs

For PI and EMI reporting teams this is a data exercise with templates, a taxonomy and a fixed reference date. The data reported in early 2027 will reflect a position that is being fixed now, against the 31 December 2026 reference date.

Recommended actions

PI and EMI compliance and reporting teams should:

• scope the reporting obligation and prepare the underlying data against the draft templates
• monitor the final eligibility criteria and thresholds
• assess governance readiness for potential AMLA direct supervision

AMLA’s Central Contact Point survey goes to the heart of the passported PI and EMI model

Date: 6 August 2026 | Source: AMLA (Authority for Anti-Money Laundering and Countering the Financing of Terrorism)
Link

What happened?

AMLA launched a survey on Central Contact Points (CCPs) directed at payment service providers and electronic money institutions that operate in host Member States through agents and distributors, drawing on Article 45(9) of the Anti-Money Laundering Directive (AMLD) and Delegated Regulation (EU) 2018/1108.

The initiative feeds regulatory technical standards (RTS) under Article 41(2) of the AMLD, determining when a host authority may require a CCP and what its functions are. That is a core operating-model question for passported PI and EMI activity, since a CCP obligation affects local representation, governance and AML/CFT accountability in each host market.

The survey closed on 15 September 2026. Crypto-asset service providers are outside its scope.

Why it matters for payment institutions and EMIs

For an institution passporting through agents and distributors, CCP rules decide how much local substance each host market demands. The future RTS will standardize that answer across the EU, and the survey is where the practical input went in.

Recommended actions

PIs and EMIs with agent or distributor networks should:

• map host-state CCP requirements against current agent and distributor arrangements
• factor potential CCP obligations into passporting strategy, local-representation and governance arrangements
• track the resulting Article 41(2) RTS, which may standardize CCP requirements across the EU

Key takeaways for payment institutions and EMIs

Verified Payments is the case to read closely. Own funds compliance is continuous, shareholder lending is a supervisory topic, and doubt about the shareholder alone can freeze a business through interim measures long before any final decision.

The domestic rulebook is moving too. The fine-calculation methodology and the minor-breach threshold are open for consultation, and the draft law on accumulation accounts would turn EMIs and PIs from bank-dependent applicants into providers of the incorporation service themselves. Both are worth engaging with while they are still drafts.

And AMLA now reaches PIs and EMIs directly. The eligibility reporting exercise fixes positions against 31 December 2026, and the Central Contact Point survey, closed on 15 September, will feed the standards on how much local substance passported models need in each host market.

How ECOVIS ProventusLaw can help payment institutions and EMIs

Our payments team supports PIs, EMIs and fintech groups across the Baltics with fintech and financial institution licensing in the EU, including:

• PI and EMI license applications and authorization strategy
• own funds, safeguarding and prudential compliance questions
• responding to inspections, supervisory instructions and enforcement
• shareholder suitability, qualifying holdings and changes of control
• passporting, agent and distributor networks, and Central Contact Point questions
• AML/CTF frameworks and AMLA readiness
• wind-down planning and regulatory reporting
• consultations and dialogue with financial supervisors

If a supervisory instruction, a capital question or an AMLA reporting obligation has landed on your desk, we can help you respond with a plan the regulator will accept.

The post RegRally Insights: Payment Services Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

This September edition of RegRally is for crypto-asset service providers (CASPs), investment firms, fund managers and crowdfunding platforms operating in the Baltics and across the EU.

This month at a glance

• Lithuania licensing: Evernord Asset Management was licensed as a management company of alternative collective investment undertakings, covering informed-investor funds, UCITS, real-estate funds and portfolio management. Nasdaq Vilnius rule amendments took effect on 1 September, with the Auction Volume Discovery (AVD) order rolling out across the Baltic markets in stages from 21 September.
• Lithuania supervision: Aria Securities received a Category C brokerage license structured without holding client funds or financial instruments. FinoMark’s crowdfunding license was supplemented with a strictly non-matching bulletin board, and the 2026 inspection plan was adjusted for two payment sector firms.
• United States: the SEC proposed Regulation Crypto Assets, with two registration exemptions (USD 5 million once over four years, and USD 75 million per 12-month period), a conditional safe harbor from the “investment contract” definition, and preemption of state registration requirements. Comments close on 20 October 2026.
• Prudential: the EBA is consulting on three draft technical standards on the EUR 30 billion reclassification threshold, related reporting from EUR 5 billion, and, for the first time, the factors competent authorities must consider when deciding whether to grant a waiver. Registration for the 30 September hearing closes on 25 September; comments close on 25 November 2026.
• Derivatives and markets: the ESAs proposed removing initial margin exchange for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC contracts, and weekly commodity derivatives position reporting went live on 3 September under XML schema v2.0.

Bank of Lithuania licenses Evernord Asset Management and approves Nasdaq Vilnius rule changes

Date: 26 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

In its Financial Market Supervision Committee decisions of 26 August, the Bank of Lithuania took two decisions relevant to investment activity.

It licensed Evernord Asset Management UAB as a management company of alternative collective investment undertakings. The license permits the company to manage collective investment undertakings intended for informed investors (including those intended for professional investors), to manage undertakings for collective investment in transferable securities (UCITS), to manage real-estate collective investment undertakings, and to manage portfolios of financial instruments belonging to other persons.

It also approved Baltic membership rules amendments at the request of AB Nasdaq Vilnius. Part of the amendments implement the European Commission regulation establishing requirements for the publication of market data on reasonable commercial terms. A new order type, the Auction Volume Discovery (AVD) order, is being introduced on the Nasdaq Nordic markets for use in opening and closing auctions, with the aim of increasing auction liquidity without adversely affecting price formation. It will be rolled out across all three Baltic markets in stages from 21 September. The rule amendments entered into force on 1 September 2026.

Why it matters for crypto and investment businesses

The Evernord license covers four activities under a single authorization: informed-investor funds, UCITS, real-estate funds and individual portfolio management. For anyone scoping a Lithuanian application, it is a current reference point for how widely a management company authorization can be drawn, and a reminder that individual portfolio management has to be applied for expressly.

For trading members, the AVD order and the market-data requirements come with fixed dates. The rulebook changes applied from 1 September and the AVD rollout begins on 21 September.

Recommended actions

Businesses should:

• use the scope granted to Evernord as a benchmark when scoping their own license application (managers planning Lithuanian AIFM or UCITS activity), and apply expressly for individual portfolio-management permission where the business model requires it
• update rulebook compliance, order-handling and best-execution documentation for the AVD order type (trading members on Nasdaq Vilnius)
• review market-data licensing and redistribution arrangements against the reasonable-commercial-terms requirements

Bank of Lithuania licenses Aria Securities and expands FinoMark’s crowdfunding permissions

Date: 20 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Financial Market Supervision Committee decisions bulletin of 20 August contained four decisions.

A Category C financial brokerage (investment) firm license went to UAB Aria Securities, permitting the reception and transmission of orders, management of financial instrument portfolios, provision of investment advice, and placing of financial instruments without a firm commitment basis. Ancillary services were also authorized: advising undertakings on capital structure and business strategy, advice and services on reorganizations and acquisitions, investment research and financial analysis, and other general recommendations relating to transactions in financial instruments. The firm will not hold client funds or client financial instruments.

The crowdfunding license of UAB “FinoMark” was supplemented with the right to operate a bulletin board on which registered and properly identified platform clients may advertise an intention to transfer or acquire claims relating to loans originally offered on the platform. The board will operate only as a technical facility. It will not automatically match buying and selling interests, execute client orders or conclude claim-transfer agreements.

The 2026 inspection plan was adjusted. The planned on-site inspection of electronic money institution UAB B4B PAYMENTS EUROPE will be replaced by off-site (remote) supervision. The inspection window for payment institution RIA Lithuania UAB moves from August–October 2026 to November 2026–January 2027. Senior appointments were approved at UAB SME Bank (head of the internal audit service) and Urbo bankas (board member).

Why it matters for crypto and investment businesses

Aria Securities will not hold client funds or client financial instruments, which materially narrows its safeguarding and prudential profile. Applicants often treat client asset holding as a given when it is a decision they control at the design stage.

The FinoMark decision shows how a bulletin board can be built to sit inside a crowdfunding license. The board stays passive: no automatic matching of buying and selling interests, no execution of client orders, no conclusion of claim-transfer agreements. That is the boundary that keeps such a facility outside the trading-venue perimeter under the Crowdfunding Regulation (ECSPR). Automated matching would raise a trading venue and MiFID authorization question.

Recommended actions

Businesses should:

• treat client asset holding as a design decision rather than a default (investment-firm applicants), and scope ancillary services explicitly in the application
• keep any bulletin board strictly non-matching and non-executing and document that design (crowdfunding platforms adding secondary-liquidity features), since automated matching of buy and sell interest risks triggering trading venue and MiFID authorization requirements
• re-check their slot and re-phase inspection-readiness work (PIs and EMIs named in the published inspection plan), since off-site supervision still produces data requests and remote reviews

SEC proposes Regulation Crypto Assets with two registration exemptions and a conditional safe harbor

Date: 18 August 2026 | Source: SEC (U.S. Securities and Exchange Commission)
Link

What happened?

The SEC proposed new rules titled “Regulation Crypto Assets”, intended to create a clear and fit-for-purpose framework for certain investment contracts involving crypto assets. The proposal builds on the Commission’s March 2026 interpretation of how the federal securities laws apply to crypto assets and transactions involving them.

Two exemptions from the registration requirements of the Securities Act of 1933 are proposed. The first is a one-time exemption permitting offerings of up to USD 5 million over a four-year period. The second permits offerings of up to USD 75 million in each 12-month period. Issuers under both would make principles-based narrative disclosures available to investors, and issuers relying on the second would also provide financial statements and be subject to ongoing reporting requirements.

The proposal also includes a conditional safe harbor from the “investment contract” element of the “security” definitions in the Securities Act of 1933 and the Securities Exchange Act of 1934, available once an issuer has completed or permanently ceased the essential managerial efforts it represented or promised it would undertake. Securities issued under a Regulation Crypto Assets exemption would be exempt from state securities law registration and qualification requirements, as would certain secondary market transactions.

The proposing release (Release Nos. 33-11434 and 34-106150, File No. S7-2026-27) was published in the Federal Register on 21 August 2026. The public comment period closes on 20 October 2026.

Why it matters for crypto and investment businesses

The two frameworks do different jobs, which is why they have to be mapped rather than compared. MiCA authorizes service providers and regulates offers to the public through white papers, disclosure and marketing rules. The SEC proposal is an offering regime built on a different premise: the security is the investment contract surrounding the asset, and the proposed safe harbor turns on whether the issuer has completed or permanently ceased the managerial efforts it promised. An asset that falls outside MiCA’s white-paper obligations can still form part of an investment contract in the US, and an offering structured under a proposed US exemption still needs its EU treatment worked out separately.

For smaller issuers, the caps set the shape of what a US-facing raise can look like: USD 5 million once, or USD 75 million a year with financial statements and ongoing reporting attached.

Recommended actions

Crypto-asset firms with US touchpoints should:

• test planned or completed token offerings against the two proposed exemptions and the conditions of the safe harbor, including the point at which essential managerial efforts are treated as complete
• map the interaction with MiCA for any asset offered in both markets, covering classification, white-paper and disclosure content, and marketing rules
• submit comments under File No. S7-2026-27 by 20 October 2026 if the proposed conditions would affect a planned offering
• review group structures to ensure US-facing activity is ring-fenced or appropriately authorized

EBA consults on the EUR 30 billion threshold at which investment firms become credit institutions

Date: 25 August 2026 | Source: EBA (European Banking Authority)
Link

What happened?

The EBA launched a consultation on three draft regulatory technical standards (RTS) on the reclassification of investment firms as credit institutions. Under the Capital Requirements Directive (CRD), an investment firm whose total assets exceed EUR 30 billion must obtain a credit institution authorization rather than operate under a MiFID investment firm authorization.

The first two RTS revise the methodology for calculating total assets against that threshold, at solo and group level, and the related reporting requirements. They reflect the 2024 amendments to the CRD, which clarified the scope of entities to be included in the calculation. Reporting applies from a lower level than reclassification: under Article 55(5) of the Investment Firms Regulation (IFR), it covers investment firms whose total assets exceed EUR 5 billion.

The third RTS is new. For the first time, the EBA is consulting on the factors competent authorities must consider when deciding whether to grant a waiver from the requirement to hold a credit institution authorization. Where a waiver is granted, the firm continues to operate under its investment firm authorization.

The legal bases are Articles 8a(6)(b) and 8a(7) CRD and Article 55(5) IFR. The feedback deadline is 25 November 2026. A virtual public hearing takes place on 30 September 2026 at 10:00 CEST, with registration required by 25 September 2026 at 16:00 CEST.

Why it matters for crypto and investment businesses

Crossing the threshold moves a firm out of the IFR/IFD regime and into the full CRR and CRD prudential framework, with a fresh authorization to obtain. For a firm within reach of EUR 30 billion, the calculation methodology determines when the threshold is crossed, and the proposed waiver factors may determine whether the firm can stay under its investment firm authorization. Both are worth reading before they are finalized.

The EUR 5 billion reporting level catches a much wider group. Firms above it will be reporting against the threshold long before they come close to it.

Recommended actions

Large investment firms approaching the total-assets threshold should:

• model total assets under the proposed methodology at both solo and group level and identify the point at which EUR 30 billion would be crossed
• assess the proposed waiver factors against the firm’s structure and business model, since a waiver preserves the investment firm authorization
• check the proposed reporting templates and instructions where total assets exceed EUR 5 billion
• register for the 30 September hearing by 25 September and prepare consultation comments ahead of the 25 November deadline

European Supervisory Authorities propose to simplify initial margin requirements under EMIR

Date: 3 August 2026 | Source: EBA / EIOPA / ESMA (Joint Committee of the ESAs)
Link

What happened?

The EBA, EIOPA and ESMA published a final report on draft regulatory technical standards proposing to simplify the bilateral margin requirements in Commission Delegated Regulation (EU) 2016/2251 under the European Market Infrastructure Regulation (EMIR).

The proposal concerns initial margin only, and targets counterparties below the EUR 8 billion threshold for exchanging initial margin. Under the current framework, those counterparties are exempt from exchanging initial margin on new uncleared over-the-counter (OTC) derivative contracts but continue to exchange it on existing ones. The amendments would remove the requirement for new and existing contracts alike, completing the phase-out for this group and moving the EU closer to the treatment applied in other jurisdictions. The ESAs present the change as a response to requests from market participants and part of their simplification and burden reduction work.

The final report has been submitted to the European Commission for endorsement. The RTS will then be subject to scrutiny by the European Parliament and the Council before publication in the Official Journal.

Why it matters for crypto and investment businesses

The proposed change would reduce the initial margin burden for affected counterparties. A counterparty below EUR 8 billion that is still posting and collecting initial margin on legacy uncleared trades would be able to stop, releasing collateral and retiring the associated custody and segregation arrangements.

The timing sits with the Commission and the co-legislators, so nothing changes yet. The consultation stage has passed and comments are closed, which makes this a planning item rather than a lobbying one.

Recommended actions

Derivatives counterparties should:

• confirm whether the firm sits below the EUR 8 billion initial margin threshold, and identify any legacy uncleared OTC contracts on which initial margin is still exchanged
• estimate the collateral and custody arrangements that would be released, and plan the operational steps and counterparty communications needed to unwind them
• track the endorsement timeline through the Commission, Parliament and Council, since the relief applies only once the amending RTS are published in the Official Journal

ESMA confirms 3 September go-live of weekly commodity derivatives position reporting

Date: 14 August 2026 | Source: ESMA (European Securities and Markets Authority)
Link

What happened?

ESMA confirmed that the new weekly commodity derivatives position reporting framework went live on 3 September 2026. From that date, market participants submit weekly position reports under the updated requirements, technical specifications and validation rules introduced by XML schema version 2.0.

The go-live follows ESMA’s original reporting instructions and a subsequent decision to postpone the rollout, which gave firms additional time for technical and operational preparation. Updated reporting instructions and the XML schema are published on ESMA’s website.

Commodity derivatives position reporting sits within the MiFID II position limits and position management regime, and the shift to a weekly cycle increases the frequency and consistency of the data available to supervisors across trading venues.

Why it matters for crypto and investment businesses

The date has already passed. Any firm holding commodity derivative positions should be submitting weekly against schema v2.0, and a validation failure now surfaces every week instead of at a longer interval.

The earlier postponement led some firms to pause their implementation work. Where that work was not restarted in time, the gap will show in rejected or incomplete submissions from the first reporting week onwards.

Recommended actions

Firms holding commodity derivatives positions should:

• confirm that weekly submissions are running against XML schema v2.0 with the updated validation rules implemented, and resolve any rejected or incomplete submissions since 3 September
• review position-limit monitoring and ancillary-activity assessments against the more frequent data

What crypto and investment businesses should focus on now

License scope is a design choice. The Evernord authorization shows how widely a Lithuanian management company license can be drawn, and Aria Securities shows what falls away when a firm decides not to hold client assets. The FinoMark bulletin board marks where a crowdfunding license stops and a MiFID trading venue question starts.

On the SEC proposal, the work worth doing now is mapping a token’s treatment under both regimes side by side. Comments under File No. S7-2026-27 close on 20 October 2026, so there is still time to respond on the points that would affect a planned offering.

Three dates are live in the EU. Weekly commodity derivatives position reporting went live on 3 September, so any gap in submissions is already accruing. Registration for the EBA public hearing closes on 25 September, ahead of the hearing on 30 September and the consultation deadline of 25 November. The Nasdaq Vilnius rule amendments took effect on 1 September and the AVD rollout starts on 21 September.

The EMIR initial margin relief runs on a slower track. It has gone to the Commission for endorsement and applies only once the amending RTS reach the Official Journal.

How ECOVIS ProventusLaw can help crypto and investment businesses

ECOVIS ProventusLaw advises crypto-asset and investment businesses across the Baltics on fintech and financial institution licensing in the EU, including:

• MiCA authorization strategy and regulatory perimeter mapping
• scoping AIFM, UCITS and investment firm license applications, including ancillary services and client-asset choices
• crowdfunding licensing and the design of secondary-liquidity features under ECSPR
• structuring cross-border activity across the EU and US regimes
• white papers, token offerings and disclosure documents
• AML/CTF, Travel Rule and sanctions controls for crypto businesses
• DORA and ICT risk readiness
• dialogue with financial supervisors, from pre-licensing consultations to inspections

If a license application, a perimeter question or a new regulatory proposal touches your plans, we can help you scope it before the regulator asks.

The post RegRally Insights: Crypto & Investments Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

For EU-based institutions, what becomes permissible under U.S. law can remain prohibited under EU law, and the same names can now be enforced well beyond the Union. The September edition of RegRally covers what this means for financial institutions, exporters and businesses with cross-border exposure.

This month at a glance

• Lithuania: by orders of 5 August, the FNTT added three Lithuanian companies to the national list of entities owned or controlled by sanctioned persons and supplemented the grounds for two existing entries. Asset freezing applies to them despite the absence of a direct EU or UN listing.
• EU reach: two High Representative statements confirmed the alignment of third countries with EU restrictive measures on Ukraine, Belarus, human rights and terrorism, extending the practical effect of EU listings beyond the Union.
• United States: OFAC removed Syria’s State Sponsor of Terrorism designation while issuing fresh Iran-related designations the same day. EU and UK measures on Syria remain fully in force, so U.S. permissibility does not equal EU permissibility.
• U.S. enforcement: a USD 60,764 settlement with Rice Lake Weighing Systems over exports of weighing equipment to Iran through a distributor in the United Arab Emirates shows how indirect routes create liability even at modest amounts.
• Rolling U.S. actions: through August, OFAC issued designations, de-listings and General License changes across the Cuba, Iran, Venezuela, counter-terrorism and Russia programs, and its International Criminal Court (ICC)-related designations raise tension with the EU Blocking Statute.

FNTT adds three Lithuanian companies to the national list of entities controlled by sanctioned persons

Date: 5 August 2026 | Source: FNTT (Financial Crime Investigation Service)
Link

What happened?

By orders of 5 August 2026, the Director of the FNTT amended the list of legal persons and other organizations owned or controlled by a sanctioned entity.

Orders No. V-174, V-175 and V-176 added three companies to the list: UAB “Valientė” (code 305265888), UAB “Next Logistic” (code 305694948) and UAB “Litproduktai” (code 305088459).

Orders No. V-172 and V-173 supplemented the grounds for inclusion of two companies already on the list: AB “Inter Rao Lietuva” (code 126119913) and UAB “Vydmantai wind park” (code 302666616).

Inclusion on the list means the entity is treated as owned or controlled by a person subject to sanctions. Asset freezing and the prohibition on making funds available apply to it even though it is a Lithuanian-registered company.

Why does it matter for businesses?

Lithuanian registration is no safe harbour. These are local companies to which freezing measures apply without any direct EU or UN listing, so a screening set-up that only checks EU and UN lists will miss them.

The supplemented grounds matter too. The reasoning behind two existing entries has changed, so decisions taken earlier on those relationships may rest on an outdated basis.

Recommended actions

Businesses should:

• re-screen the customer and counterparty base against the updated FNTT list and check for indirect exposure through payment chains and ownership links
• where a relationship with any listed company exists, freeze and report as required, and not rely on the absence of a direct EU or UN listing
• reassess any earlier decision taken on relationships with the two existing entries, since the grounds for their inclusion have changed

Third countries align with EU restrictive measures over Ukraine’s territorial integrity

Date: 28 August 2026 | Source: Council of the European Union
Link

What happened?

The High Representative, on behalf of the EU, declared the alignment of certain third countries with EU restrictive measures concerning actions undermining or threatening Ukraine’s territorial integrity, sovereignty and independence.

Alignment means the aligning states commit to adopt corresponding measures, so the practical reach of EU listings extends beyond the Union. For institutions, this widens the set of jurisdictions in which the same names and prohibitions are effectively enforced.

Why does it matter for businesses?

Routing a transaction through an aligned jurisdiction no longer sidesteps the listings. The same names are enforced there, so correspondent and routing assessments should treat aligned states accordingly.

Recommended actions

Businesses should:

• factor the widening group of aligned jurisdictions into counterparty, routing and correspondent-risk assessments
• confirm screening fully reflects the EU restrictive-measures listings under the Russia and Ukraine program

Third countries align with EU sanctions on Belarus, human rights and terrorism

Date: 18 August 2026 | Source: Council of the European Union
Link

What happened?

The High Representative, on behalf of the EU, issued statements on the alignment of certain third countries with EU restrictive measures relating to three regimes: the situation in Belarus and its involvement in Russia’s aggression against Ukraine, serious human rights violations and abuses under the EU Global Human Rights Sanctions Regime, and measures to combat terrorism.

The statements confirm the continued extension of these three regimes to aligning partner countries, reinforcing their cross-border effect.

Why does it matter for businesses?

The three regimes were extended in parallel. A nexus to an aligned country is a factor to weigh, and screening limited to the Russia program misses the Belarus, human rights and counter-terrorism listings that are being extended in parallel.

Recommended actions

Businesses should:

• confirm screening covers the Belarus, EU Global Human Rights and counter-terrorism sanctions regimes
• treat a nexus to an aligned country as an elevated-risk indicator in onboarding and ongoing monitoring

OFAC removes Syria’s State Sponsor of Terrorism designation while EU measures stay in force

Date: 24 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC removed Syria’s designation as a State Sponsor of Terrorism and published a set of associated Sanctions List updates, marking one of the most significant easings of the U.S. sanctions posture toward Syria in years.

The change re-opens the question of how Syrian counterparties, correspondent flows and trade-finance exposure should be treated. It does not by itself lift all Syria-related prohibitions.

On the same day, OFAC issued fresh Iran-related designations and updated several Iran-related General Licenses. The Syria recalibration runs in parallel with continued pressure on Iran, not a general relaxation.

For EU-based institutions, the key point is that EU and UK measures on Syria remain fully in force and are unaffected by the U.S. step. A transaction that becomes permissible under U.S. law may still be prohibited under EU law.

Why does it matter for businesses?

Permissibility is a jurisdiction-by-jurisdiction question. A U.S. easing does not make the same transaction lawful for an EU operator.

The analysis also needs a paper trail. When regimes point in different directions, the multi-jurisdictional reasoning behind each decision is what a supervisor will ask to see.

Recommended actions

Businesses should:

• re-run sanctions screening against the updated OFAC Specially Designated Nationals (SDN) and Sanctions List files and refresh internal watchlists and payment-filter rules
• reassess any Syria-related exposure and correspondent relationships against the EU and UK frameworks before treating business as permissible, and document the multi-jurisdictional analysis
• where reliance is placed on an Iran-related General License, record its number, scope and expiry and confirm the activity fits squarely within it

OFAC’s ICC-related designations create tension with the EU Blocking Statute

Date: 18 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC issued International Criminal Court (ICC)-related designations together with a Venezuela-related designation and an ICC-related General License.

The ICC-related measures are politically sensitive and can create direct tension with EU law. Institutions with an EU nexus should be alert to the EU Blocking Statute (Regulation (EC) No 2271/96), which may prohibit EU operators from complying with certain U.S. measures. The same conduct can be required under one regime and prohibited under another.

Why does it matter for businesses?

The same conduct can be required under one regime and prohibited under another. Complying with the U.S. measure, for example by declining or exiting EU-lawful business, can itself breach EU law.

Decisions on affected relationships therefore need legal analysis before action, not after. The Blocking Statute question has to be answered first.

Recommended actions

Businesses should:

• screen against the new ICC-related and Venezuela-related designations
• where an EU nexus exists, take advice on the interaction with the EU Blocking Statute before declining or exiting EU-lawful business solely on the basis of the U.S. measure
• document the conflict-of-laws analysis for any affected relationship

OFAC settles with Rice Lake Weighing Systems over Iran exports through a UAE distributor

Date: 12 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC announced a settlement of USD 60,764 with Rice Lake Weighing Systems, Inc., resolving apparent violations of U.S. sanctions arising from the export of weighing equipment to Iran via a distributor in the United Arab Emirates (UAE) between July 2019 and November 2021.

Although the amount is modest, the case is a useful enforcement benchmark. It underlines OFAC’s expectations on distributor and re-export due diligence, geographic red flags, and the mitigating value of remediation and voluntary self-disclosure.

Why does it matter for businesses?

The case sets out OFAC’s expectations on distributor and re-export due diligence and on geographic red flags. Exposure through distributors and intermediaries is judged by where the goods end up, not where the invoice goes.

It also shows the mitigating value of remediation and voluntary self-disclosure.

Recommended actions

Businesses should:

• review the enforcement findings as a benchmark for their own sanctions controls, especially indirect exposure through distributors and intermediaries
• confirm procedures for voluntary self-disclosure, escalation and remediation where a potential breach is identified
• test end-user and re-export screening for goods and services that can reach sanctioned jurisdictions through third countries

OFAC’s rolling August actions: designations, de-listings and shifting General Licenses

Date: 6 to 27 August 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

What happened?

OFAC made list changes throughout August. On 6 August it issued Cuba-related designations with a clarifying FAQ on the treatment of the newly listed parties. On 7 August it combined Counter Terrorism and Iran-related designations with same-day removals of certain Counter Narcotics designations and an amended Iran-related FAQ. On 20 August a broad multi-program round spanned the Counter Narcotics, Counter Terrorism, Cuba-related and Iran-related programs, accompanied by a new Russia-related General License and associated FAQs.

Venezuela-related General Licenses issued on 21 August were amended again on 27 August. Further Counter Terrorism designations on 26 August came with a Counter Terrorism General License and an amended Russia-related General License, which is particularly relevant to institutions still managing legacy exposure, as it can change the permitted scope or timing of otherwise restricted dealings.

Why does it matter for businesses?

Additions and removals both change screening outcomes. Stale watchlists produce missed hits and unnecessary rejects, so list maintenance has to be continuous rather than periodic.

The General License churn carries its own risk. When authorizations are amended within a week, reliance on any single version is a timing exposure.

Recommended actions

Businesses should:

• refresh watchlists to capture both the new designations and the de-listings, and re-screen recently rejected or blocked transactions that may be affected by the removals
• map exposure against the scope and expiry of the current General Licenses, diarize the amendments, conditions and any wind-down periods, and re-verify the applicable license version before executing payments
• review the accompanying FAQs for interpretation points relevant to the firm’s book of business

What businesses should take from this month’s developments

The FNTT orders are the local reminder. A company registered in Lithuania can be subject to asset freezing without ever appearing on an EU or UN list, and the grounds behind an existing entry can change, so past decisions do not stay decided.

Across borders, the pictures are moving in opposite directions. The EU’s reach is widening as more third countries align with its restrictive measures, while the U.S. is recalibrating: easing on Syria, pressing on Iran, and adjusting General Licenses week by week. The same transaction can be permissible under one regime and prohibited under another, so permissibility has to be assessed and documented jurisdiction by jurisdiction.

Screening lists need continuous maintenance covering both additions and de-listings, and any reliance on a General License needs its version, scope and expiry on record.

How ECOVIS ProventusLaw can help with sanctions compliance

Our sanctions team works with businesses across the Baltics on EU, U.S. and national sanctions questions, including:

• building and stress-testing sanctions compliance programs and risk assessments
• screening set-up, watchlist management and internal controls
• ownership and control analysis of counterparties
• exposure reviews covering Russia, Belarus and other sanctioned jurisdictions
• circumvention and third-country intermediary risk
• crypto-asset sanctions exposure and blockchain analytics findings
• export controls and trade restrictions
• handling asset freezes, investigations and supervisory enquiries
• internal policies, procedures and staff training

If an FNTT listing, an OFAC action or a divergence between EU and U.S. rules touches your business, we can help you work out what is prohibited, what is permitted and what to document.

The post RegRally Insights: Sanctions Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

The September edition of RegRally looks at what these developments mean for investment firms, distributors and platforms serving retail clients in the Baltics and across the EU.

FCA warns consumers about risky mini-bonds and loan notes

Date: 20 August 2026 | Source: FCA (Financial Conduct Authority, UK)
Link

What happened?

The FCA issued a consumer warning urging people to beware of risky mini-bonds and loan notes. These are high-risk and frequently illiquid investments. In many cases they are not protected by the Financial Services Compensation Scheme (FSCS) and can result in the loss of the entire amount invested.

The warning responds to continued marketing of speculative debt securities to retail investors, often promising high fixed returns. It reiterates that such products may sit outside key regulatory protections and the Financial Ombudsman Service.

While issued by a UK regulator, the theme is directly relevant to Baltic retail investors who access such products cross-border through online platforms.

Why does it matter for businesses?

The warning signals continued supervisory attention to how high-risk retail products are promoted. Firms marketing these products are expected to meet financial promotion standards in full, from risk warnings to appropriateness checks.

For Baltic distributors and platforms, the cross-border point is the practical one. The same products reach local retail investors online, so the same promotion and target market discipline applies regardless of where the issuer sits.

Recommended actions

Firms promoting mini-bonds or loan notes should:

• ensure their financial promotions are fair, clear and not misleading and comply with the high-risk investment marketing rules, including risk warnings and appropriateness checks
• verify the target market assessment and the prominence of risk warnings before distribution (retail distributors)

Consumers should confirm a firm’s status on the FCA Register (or the relevant national register) and check FSCS or compensation coverage before investing.

FCA flags clone firms as impersonation fraud continues

Date: 28 August 2026 | Source: FCA (Financial Conduct Authority, UK)
Link

What happened?

The FCA published a warning that reclaim-experts.com is a clone of an FCA-authorised firm targeting people in the UK. It is one of a continued wave of unauthorised-firm and clone warnings issued throughout late August 2026, including multiple entries on 27 August.

Clone firms impersonate the name, registration details and sometimes the address of a genuinely authorised firm to defraud consumers, frequently in connection with investment or reclaim and refund scams.

The persistence of these warnings underlines that impersonation fraud remains a high-volume consumer risk.

Why does it matter for businesses?

Authorised firms are targets here too. A clone trades on a real firm’s name and registration details, and every defrauded customer associates the loss with that name.

For distributors and platforms, onboarding and payment authorisation are the points where a clone can still be caught before money moves.

Recommended actions

To reduce clone-firm risk:

• consumers should verify any firm against the FCA Register and use only the contact details published there, never those supplied by the firm making the approach
• authorised firms should monitor for cloning of their identity, proactively warn customers and report clones to the regulator
• distributors and platforms should build clone-firm checks into onboarding and payment-authorisation flows

What businesses should take from this month’s developments

Both warnings point at the retail interface. Supervisors are watching how high-risk products are promoted and how easily consumers can be misled about who they are dealing with.

For firms, that translates into two checks. Promotions for high-risk retail products need current risk warnings, appropriateness checks and a documented target market assessment. And clone-firm monitoring, both of your own identity and within onboarding and payment flows, is becoming standard hygiene.

The warnings are UK-issued, but the products and the scams are cross-border by nature. Baltic firms serving retail clients online should treat them as directly applicable.

Need assistance?

Our financial services and regulatory specialists advise consumer credit providers, investment firms, distributors and platforms serving retail clients on:

• Consumer credit regulatory compliance
• Creditworthiness assessment and responsible lending
• Consumer credit agreements and documentation
• Consumer credit advertising and marketing compliance
• P2P lending regulation
• Licensing and regulatory authorisations
• Regulatory reporting and supervisory requirements
• Consumer protection and unfair commercial practices
• Regulatory inspections and remediation
• Legal advice on financial services regulation in Lithuania, Latvia and Estonia

If you would like to review how your financial promotions, risk warnings or anti-impersonation controls stand up to the issues covered in this edition, our team will be happy to assist.

The post RegRally Insights: Consumer Protection Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

The September edition of RegRally covers what matters most to financial institutions, payment and electronic money institutions, crypto-asset service providers (CASPs) and other obliged entities in Lithuania and across the EU.

This month at a glance

• Lithuania: the Bank of Lithuania’s letter, based on 2025 supervisory data and 10 AML/CTF inspections, flags formally assessed geographic risk, the need to verify authorisation under the Markets in Crypto-Assets Regulation (MiCAR), weak enhanced due diligence, disproportionately low suspicious transaction reporting and incomplete sanctions screening. The Council of Europe’s MONEYVAL 6th evaluation round starts in October 2026, and the EU AML package applies in full from 10 July 2027.
• Lithuania enforcement: the Bank of Lithuania temporarily prohibited the electronic money institution Lux International Payment System from providing financial services to new and existing customers while an inspection is ongoing, citing suspected serious deficiencies and possible AML/CTF breaches. The restriction was authorised by the Regional Administrative Court.
• Payment fraud: the Bank of Lithuania published the first results of the Verification of Payee (VoP) service, based on a survey of seven banks, two central credit unions and five electronic money institutions. VoP is seen as a useful additional measure against payment fraud, and monitoring continues.
• AMLA direct supervision: the EBA published a draft data model and taxonomy for the 2027 eligibility data collection, the basis for AMLA’s first selection of institutions for direct supervision. The reference date is 31 December 2026. Payment institutions and electronic money institutions fall within the reporting population.
• Cross-border payments: AMLA is surveying electronic money institutions (EMIs) and payment service providers (PSPs) on Central Contact Points until 15 September 2026, feeding future technical standards under Article 41(2) of the Anti-Money Laundering Directive (AMLD). Crypto-asset service providers are not in scope.
• Isle of Man: the Isle of Man Financial Services Authority (FSA) published a year-one progress report on its two-year supervisory engagement programme covering AML, countering the financing of terrorism and countering proliferation financing (AML/CFT/CPF), and set out its priorities for 2026/27. Legislative reviews touch virtual asset service providers (VASPs) and the Travel Rule, and a questionnaire on foreign politically exposed persons (PEPs) is coming.

Bank of Lithuania warns financial market participants about ML/TF deficiencies

Date: 20 August 2026 | Source: Lietuvos bankas (Bank of Lithuania), Financial Market Supervision Department
Link

What happened?

The Bank of Lithuania sent a letter to the heads of financial market participants on money laundering and terrorist financing (ML/TF) risks and prevention requirements. It is based on 2025 supervisory data and 10 AML/CTF inspections.

The letter flags several risk areas:

• geographic risk assessed too formally, based on declared residence only rather than actual activity and payment flows
• higher-risk activities (crypto-assets, gambling, remittance), where licences must be verified in official registers, including MiCAR authorisation now that the transitional period ended on 1 July 2026
• agents and distributors, where responsibility remains with the financial market participant
• cash operations, virtual IBANs (vIBANs) and Travel Rule compliance

Deficiencies found during inspections:

• business-wide risk assessments that do not match the actual risk profile
• weak enhanced due diligence
• transaction monitoring not tailored to the business
• incomplete sanctions screening, with no sanctions risk assessment

Suspicious transaction report (STR) numbers remain disproportionately low or nil in most sectors. The Bank of Lithuania also reminded firms of the cash reporting duty: linked cash operations reaching EUR 15,000 must be reported to the Financial Crime Investigation Service (FNTT) within 7 business days.

On sanctions, circumvention continues via the Commonwealth of Independent States (CIS) and third countries, and EU packages now reach third-country banks and crypto platforms. Not being established in Russia or Belarus is no evidence of low risk. The Council of Europe’s MONEYVAL 6th evaluation round runs from October 2026 to May 2028, and the EU AML package applies in full from 10 July 2027.

Why does it matter for businesses?

The letter is effectively an inspection roadmap. The flagged areas are where 2025 inspections actually found breaches, and the same areas will get attention in the run-up to the MONEYVAL evaluation starting in October 2026.

Two compliance triggers already apply. The MiCAR transitional period ended on 1 July 2026, so servicing crypto clients without MiCAR authorisation is now a live exposure. And the EUR 15,000 cash reporting duty carries a hard 7-business-day deadline.

Low or nil STR volumes are treated as a warning sign in themselves. Firms should be able to justify their reporting levels against their scale and risk profile.

Recommended actions

Lithuanian financial market participants should:

• re-do geographic risk assessments based on actual activity and payment flows
• screen the crypto client book for clients without MiCAR authorisation
• review STR volumes against the firm’s scale and risk profile and be able to justify them
• complete the sanctions risk assessment and extend screening to ownership and the intermediary chain
• remediate known deficiencies before expanding activities
• start the EU AML package gap analysis against the 10 July 2027 application date

Bank of Lithuania temporarily prohibits EMI Lux International Payment System from providing services during inspection

Date: 4 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Bank of Lithuania temporarily prohibited the electronic money institution UAB “Lux International Payment System” from providing financial services to both new and existing customers while an inspection is ongoing.

The measure was imposed because the Bank of Lithuania had grounds to suspect serious deficiencies and possible breaches of AML/CTF and other regulatory requirements. The restriction was authorised by the Regional Administrative Court.

Why does it matter for businesses?

The case shows that the supervisor does not need a completed inspection to act. Where suspected deficiencies are serious, the supervisor can impose an interim restriction before the inspection is completed, with court authorisation.

For other institutions, the practical lesson is about known weaknesses. Deficiencies that are identified but left unremediated are exactly what turns an inspection into an interim restriction.

Recommended actions

Financial institutions should:

• treat the case as a supervisory benchmark demonstrating the Bank of Lithuania’s willingness to impose interim restrictions before completion of an inspection where serious deficiencies are suspected
• ensure material AML/CTF weaknesses are escalated and remediated promptly
• ensure management can demonstrate effective control over identified regulatory deficiencies

Bank of Lithuania publishes first results of the Verification of Payee service

Date: 13 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Bank of Lithuania published the first assessment of the implementation of the Verification of Payee (VoP) service, based on a survey covering seven banks, two central credit unions and five electronic money institutions.

The initial results indicate that VoP is considered a useful additional measure for reducing payment fraud, particularly by alerting customers to discrepancies between the beneficiary name and account details before a payment is executed.

The Bank of Lithuania nevertheless emphasised that further data and experience are required to assess its effectiveness. It intends to continue monitoring both financial institutions’ and consumers’ experience with the service.

Why does it matter for businesses?

VoP has moved from go-live to supervisory review. Expectations will now be shaped by implementation data, so how a firm handles match results today is what gets benchmarked tomorrow.

The integration point matters most. A VoP check that only displays a warning, without feeding the firm’s fraud prevention and monitoring, adds little.

Recommended actions

Payment service providers should:

• review VoP implementation, including the handling of match, no-match and close-match results and customer warnings
• assess whether VoP outcomes are appropriately integrated into the firm’s fraud prevention and monitoring framework
• monitor further Bank of Lithuania communications as supervisory expectations develop based on implementation experience

EBA publishes draft reporting framework for AMLA’s 2027 eligibility data collection

Date: 4 August 2026 | Source: European Banking Authority (EBA)
Link

What happened?

The EBA published, as part of release 4.4 of its reporting framework, a public working draft of the data model and taxonomy that will support the 2027 eligibility data collection underpinning AMLA’s first selection of financial institutions for direct supervision.

The data will be gathered in early 2027 from all obliged entities provisionally identified as eligible in 2026, to confirm whether they still meet the criteria as of the 31 December 2026 reference date.

Credit and financial institutions fall within the population that must report, including payment institutions and electronic money institutions. Feedback on the draft could be submitted through the EBA feedback form until 24 August 2026, and the draft should be read alongside the templates AMLA published for the 2026 eligibility-criteria data collection.

Why does it matter for businesses?

Selection for direct AMLA supervision from 2028 will be based on this data. The 31 December 2026 reference date means the position that determines eligibility is being fixed now, not when the data is collected in 2027.

Payment institutions and electronic money institutions are explicitly within the reporting population. Firms that have not mapped their internal data against the draft model may only discover gaps once the collection exercise is already under way.

Recommended actions

Firms should:

• assess whether they are within scope of the eligibility data collection and begin mapping the required data against the draft model and taxonomy
• review the draft reporting templates alongside the templates AMLA published for the 2026 eligibility-criteria data collection
• plan governance and resourcing for possible selection for AMLA direct supervision from 2028, using 31 December 2026 as the reference date

AMLA surveys EMIs and payment service providers on Central Contact Points

Date: 6 August 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA launched a survey on Central Contact Points (CCPs), inviting electronic money institutions and payment service providers to share their experience of the current CCP framework under Article 45(9) of the AMLD and Delegated Regulation (EU) 2018/1108.

The survey supports AMLA’s preparatory work on forthcoming regulatory technical standards (RTS) under Article 41(2) of the AMLD. The standards will address when a host Member State may require the appointment of a CCP and what functions the CCP should perform.

AMLA is running a parallel survey for national competent authorities. It also confirms that crypto-asset service providers are not in scope, as the previous CCP framework did not apply to them. The survey remains open until 15 September 2026, after which AMLA will publish a report on the main findings.

Why does it matter for businesses?

For EMIs and payment service providers operating cross-border through agents or distributors, CCP requirements shape host-Member-State compliance obligations. The future technical standards will harmonise when a host state may require a CCP and what functions it performs.

The survey is the practical way to shape those standards. Problems reported now will likely influence how the harmonised rules are drafted.

Recommended actions

EMIs and PSPs operating cross-border through agents or distributors should:

• review their host-Member-State CCP arrangements and respond to the survey before 15 September 2026
• capture practical implementation challenges now, as they are likely to shape the future harmonised RTS
• monitor the follow-up report and the eventual Article 41(2) technical standards

Isle of Man FSA publishes year-one progress report on AML/CFT supervisory priorities

Date: 19 August 2026 | Source: Isle of Man Financial Services Authority (FSA)
Link

What happened?

The Isle of Man FSA published a year-one progress report on its two-year AML/CFT/CPF supervisory engagement programme. It sets out the risk-based work delivered during 2025/26 and the priorities for 2026/27.

The report covers topical thematic reviews (sanctions, terrorist financing, proliferation financing, business risk assessments, reporting and registers), sectoral reviews (estate agents, moneylenders) and legislative reviews touching Virtual Asset Service Providers (VASPs) and the Travel Rule.

Findings feed into the AML/CFT Handbook, sectoral guidance, the Island’s National Risk Assessment and preparations for the MONEYVAL mutual evaluation. The Authority also signalled a forthcoming questionnaire on foreign PEPs.

Why does it matter for businesses?

For firms within scope, the stated priorities show where the FSA’s thematic and sectoral reviews will land during 2026/27. The legislative reviews confirm continued attention to VASPs and the Travel Rule.

Recommended actions

Firms within scope should:

• review the FSA’s stated supervisory priorities and benchmark their AML/CFT/CPF frameworks against the thematic and sectoral focus areas
• confirm Travel Rule readiness ahead of continued legislative attention (VASPs and firms handling transfers)
• anticipate thematic reviews and the PEP questionnaire, and evidence remediation of known gaps

What businesses should take from this month’s developments

The Bank of Lithuania’s letter makes the expectation explicit: risk assessments, due diligence, monitoring, reporting and sanctions screening must reflect how the business actually operates, not just how it is documented.

The Lux International Payment System case shows the other side of the same expectation. Where serious deficiencies are suspected, the supervisor is prepared to stop business before the inspection ends.

At EU level, the AMLA era is arriving on two tracks. The 2027 eligibility data collection, with 31 December 2026 as the reference date, will determine which institutions face direct AMLA supervision from 2028. The Central Contact Point survey shows AMLA building the technical rules for cross-border payment and e-money business.

With MONEYVAL starting in October 2026 and the EU AML package applying in full from 10 July 2027, the remediation window is now clearly defined.

Need assistance?

ECOVIS ProventusLaw advises financial institutions, fintechs, CASPs and other obliged entities on AML/CTF compliance, including:

• AML/CTF regulatory assessments and gap analysis;
• business-wide ML/TF risk assessments;
• AML policies, internal controls and procedures;
• customer due diligence and enhanced due diligence frameworks;
• transaction monitoring and suspicious transaction reporting;
• AML governance, MLRO responsibilities and employee training;
• CASP and virtual asset AML/CTF requirements;
• regulatory inspections and remediation of identified deficiencies.

If your organisation is preparing for increased AMLA or national supervisory scrutiny, our team can help assess whether your AML framework is not only documented but operationally effective and ready for regulatory review.

The post RegRally Insights: AML/CTF Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

Meet ECOVIS ProventusLaw at IBA 2026

Our partners Inga Karulaitytė and Loreta Andziulytė will attend the IBA Annual Conference 2026 in Copenhagen.

If your clients are entering the Baltics, investing in the region or navigating financial services and FinTech regulation across Lithuania, Latvia and Estonia, let’s meet in Copenhagen.

Meet Inga →
Meet Loreta →

Inga Karulaitytė

Partner, Attorney-at-law, Financial Services, FinTech & Regulatory, CAMS

Learn more →

Inga is a leading adviser on financial services regulation, FinTech, payments, crypto-assets, AML/CTF, sanctions and technology-driven regulatory matters. She is rated and recognised by prestigious legal directories such as Chambers and Partners, Legal 500, and IFLR1000.

She leads ECOVIS ProventusLaw’s FinTech, Banking & Finance practice and helps innovative and regulated businesses turn complex legal requirements into clear, practical strategies for entering markets, launching products and scaling across the Baltics and EU.

Her experience includes advising businesses navigating fast-changing regulatory frameworks, managing licensing and compliance challenges, and developing solutions that support growth while meeting the highest regulatory standards.

Languages: English, Lithuanian, Russian

Inga.karulaityte@ecovis.lt

Profile →

LinkedIn →

Loreta Andziulytė

Partner, Attorney-at-law, Corporate, M&A, Technology & Data Protection, Employment, CIPP/E

Learn more →

Loreta Andziulytė is a highly experienced adviser on employment, FinTech, corporate and M&A matters, technology, data protection and regulatory issues. She advises businesses and international counsel on complex, cross-border matters throughout the business lifecycle — from market entry, establishment and investment to transactions, workforce management, restructuring and ongoing operations.

Her practice combines strong commercial and regulatory insight with a practical understanding of the challenges faced by technology-driven financial services and other regulated businesses. Loreta regularly supports clients on employment strategy and disputes, corporate governance, transactions, technology arrangements, data protection and compliance matters.

Loreta is recognised in Chambers Europe for Employment and is also rated by FinTech Legal for her work in the FinTech sector.

Languages: English, Lithuanian, Russian

Loreta.andziulyte@ecovis.lt

Profile →

LinkedIn →

From Copenhagen to the Baltics

Legal expertise across Lithuania, Latvia and Estonia.

ECOVIS ProventusLaw supports international businesses and law firms with cross-border matters throughout the Baltic region.

Explore our CEE resources

Doing Business in Central and Eastern Europe

Our CEE Guide provides practical information for businesses and advisers considering investment, expansion and business operations across Central and Eastern Europe.

Explore the CEE Guide →

RegRally Insights

Regulatory developments that matter to businesses

Our RegRally Insights provide practical updates on regulatory developments affecting businesses, including: Payments · Crypto & Investments · AML/CTF · Sanctions · Data & ICT · Consumer Protection · Employment

Explore RegRally Insights →

Will you be in Copenhagen?

If you are attending the IBA Annual Conference 2026 and would like to discuss a matter involving Lithuania, Latvia or Estonia, we would be pleased to meet.

Whether you are looking for local counsel, a Baltic referral partner or simply want to exchange views on opportunities in the region, get in touch.

Inga Karulaitytė

Inga.karulaityte@ecovis.lt

LinkedIn →

Loreta Andziulytė

Loreta.andziulyte@ecovis.lt

LinkedIn →

The post IBA Annual Conference 2026 in Copenhagen, 4–9 October appeared first on ECOVIS ProventusLaw.

The European Commission’s Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (20 July 2026), and the accompanying Code of Practice on Transparency of AI-generated Content – what they mean in practice, and when AI-generated content must be marked and labeled.

Summary

• Four duties, two owners. Providers must design interactive systems to disclose themselves (Article 50(1)) and embed an invisible, machine-readable mark in synthetic output (Article 50(2)); deployers must notify people exposed to emotion-recognition and biometric categorization systems (Article 50(3)) and add a visible label on deep fakes and on public-interest text (Article 50(4)). The duties are cumulative, none discharges another, and the same organization frequently owes several.
• Not every AI output has to be marked. Standard editing and minor alterations, AI translation, formatting, source code, single words and captions, machine-to-machine data, and genuine closed-loop internal B2B material all fall outside the scope of duty. That is where most of the practical relief lies.
• AI-generated or manipulated public-interest text deserves particular attention. AI-touched investor and sustainability reports on a company website need a visible label unless genuine human review and editorial responsibility are both documented – and that exception collapses the moment AI edits the text after editorial sign-off.
• Article 50 does not stop at the EU border. A provider or deployer established outside the EU owes the same duties where the output of its system is foreseeably used in the Union – so a third-country group entity generating content targeted at EU audiences is in scope.
• A label is not a license. Marking and labeling answer the question “is this AI?”, not “is this allowed?”. A properly labeled deep fake can still be unlawful on other grounds, and a 50(3) notice does not legitimize a deployment prohibited under Article 5 or unlawful under data protection law.
• One deadline has passed, one is coming – and the fines are real. Chatbot and voice-assistant disclosure under Article 50(1) has been required since 2 August 2026, with no grandfathering; providers of generative systems already on the market have until 2 December 2026 to bring Article 50(2) marking into conformity. Non-compliance amounts to EUR 15 000 000 or 3% of the total worldwide annual turnover, whichever is higher, with RRT supervising in Lithuania.

Since 2 August 2026, a new layer of Regulation (EU) 2024/1689 (the “AI Act”) applies to almost every business that lets customers talk to a chatbot, generates images or text with artificial intelligence (AI), or edits media with AI tools.

Article 50 of the AI Act imposes a set of transparency obligations: people must be told when they are dealing with AI, and AI-generated or manipulated content must be marked and, in defined cases, visibly labeled. On 20 July 2026, the European Commission (the “Commission”) adopted detailed Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (the “Guidelines”), complemented by the Code of Practice on Transparency of AI-generated Content (the “Code of Practice”).

The Guidelines are non-binding – only the Court of Justice can give an authoritative interpretation of the AI Act – but they are the clearest practical map of what is in scope, what is out of scope, and who has to do what.

This article walks through the four obligations, with the emphasis on the question clients actually ask: what has to be marked or labeled as AI, and by whom? It pays particular attention to the financial market and its participants – banks, payment and electronic money institutions, investment firms, crypto-asset service providers, insurers and listed issuers – for whom AI-touched investor communications, corporate and sustainability reports, client-facing chatbots, marketing content and biometric onboarding tools sit squarely inside Article 50, on top of the disclosure and conduct duties they already owe under financial services regulation.

The four obligations at a glance

Article 50 contains four distinct transparency duties, each attaching to a different type of AI system or output, and each falling on either the provider (the entity that develops the system and places it on the market under its own name) or the deployer (the entity that uses the system under its own authority, unless the use is purely personal and non-professional). The distinction matters because the same organization can be both at once – for example, a firm that builds an in-house generative tool and then uses it to produce deep fakes wears both hats. The deployer side reaches wider than most clients assume: businesses, public-sector bodies, media outlets, advertising and marketing agencies, and any other legal or natural person using AI content in a professional or economic activity – including influencers monetizing social media. Purely personal, non-professional use is outside Article 50 altogether.

• Article 50(1) – interactive AI. The provider must design the system so that a person is informed that they are interacting with an AI. Think chatbots, voice assistants, and AI agents.
• Article 50(2) – marking of synthetic content. The provider must ensure that AI-generated or manipulated audio, images, videos, or text are marked in a machine-readable format and detectable as artificial.
• Article 50(3) – emotion recognition and biometric categorization. The deployer must inform people exposed to such a system that it is operating.
• Article 50(4) – deepfakes and certain text. The deployer must clearly and visibly label deepfakes and AI-generated or manipulated text published to inform the public on matters of public interest.

A single system can trigger several of these at once. An image generator embedded in a chatbot engages 50(1) and 50(2) for the provider; if the deployer uses it to create a deep fake, 50(4) applies on top. The obligations are cumulative, not alternative.

Article 50 does not stop at the EU border. A provider or deployer established outside the EU is caught where the output of its AI system is used in the Union – so a third-country group entity generating content that is disseminated to, or targeted at, EU audiences owes the same duties as an EU actor. The trigger is foreseeable use of the output in the Union: a deployer who directs or authorizes EU distribution, including by posting deep fakes on the open internet, is in scope, whereas purely incidental or unforeseeable downstream use that reaches the Union through channels outside the actor’s control is not.

Two kinds of “marking” – and why the difference matters

The word “marking” serves two very different functions in Article 50, and conflating them is the most common source of confusion. It is worth pinning down the distinction before going further.

Machine-readable marking (Article 50(2)) is invisible plumbing. It is a technical signal – a watermark, metadata, a cryptographic provenance tag, a fingerprint – embedded in the content so that software can later identify it as AI-generated. It is the provider’s job, and it applies to essentially all synthetic audio, image, video and text output of the system.

Visible labeling (Article 50(4)) is a disclosure a person can see or hear – a caption, a banner, a spoken statement – telling the audience that a deep fake or a public-interest text is artificial. It is the deployer’s job, and it applies to a much narrower set of content.

The Guidelines are explicit that these do not substitute for one another. A deployer cannot discharge the 50(4) labeling duty by pointing to the provider’s machine-readable mark, because that mark is not perceptible to the ordinary viewer without special tools. Conversely, a visible label does not relieve the provider of the duty to provide a machine-readable marking under 50(2).

What must be marked under Article 50(2)

This is the obligation with the widest reach, and the one clients most often ask about. It applies where all of the following are true: the system is an AI system; it generates or manipulates synthetic content; the content is audio, image, video or text (an exhaustive list, but one that includes multimodal, 3-D, and virtual and augmented reality (VR/AR) output); and none of the exceptions applies.

Crucially, content does not have to be wholly AI-generated to count. Content mixed with human-created material still qualifies as synthetic if the AI-generated or manipulated part falls within one of the four modalities. “Generation” means creating new material (an AI-drawn image, a synthesized song); “manipulation” means altering existing content beyond standard editing (a face swap, a voice clone).

Marking is only half of it. Article 50(2) imposes two cumulative duties: the provider must mark the output in a machine-readable format and ensure a means of detection is available to the people exposed to it, one that returns a human-readable result indicating whether the content is AI-generated or manipulated. A mark that no one can read back is not compliance. Where the provider relies on another actor for detection, it remains responsible for ensuring that the solution works and that the result is clearly shown at first exposure.

In scope – must be marked

• AI-generated summaries of text, or paraphrasing/rewriting that changes style, structure or meaning.
• Removal, replacement or insertion of objects or persons in images and videos that change the substance; face replacement or substantial facial modification.
• Synthesis of a specific person’s voice, or a realistic video of events that did not occur; altering a person’s body shape or skin color.
• Composite images or clips that modify the depiction of persons, objects, events or facts.
• AI agent output that is perceptible to a person as audio, image, video or text.

Out of scope – no marking required

The Guidelines carve out a long list of things that do not have to be marked, which is just as useful to know:

• Standard editing and minor alterations – grammar and spell-checking, minor stylistic polishing, AI-generated translations, formatting and format conversion, noise reduction, minor cropping or color correction, red-eye removal, background blurring, video stabilization, and converting black-and-white to color.
• Non-substantial changes – anything that does not significantly alter the input data or its meaning, style or intent.
• Source code – code in any programming, scripting, markup, query or configuration language (including SDKs, SQL, YAML, JSON, APIs), and integral comments.
• Very short outputs – single words, image captions, alt-text, UI labels, icon-scale graphics.
• Machine-to-machine output processed automatically and never perceived by a person; internal analytical extraction and structuring of data; mere reproduction, ranking or arrangement of existing content (playlists, recommender systems).
• Closed-loop and industrial output – strictly technical, business-to-business (B2B) output, perceived only by a limited pre-defined set of professionals inside the organization, not shared externally, with appropriate safeguards. Real-time ephemeral content (e.g. in games or VR) consumed immediately and not stored may also be exempt where marking is not technically feasible, and an in-experience notice is provided.
• Law enforcement use authorized by law to detect, prevent, investigate or prosecute criminal offences.

The technical solution must be effective, interoperable, robust and reliable, as far as technically feasible and in line with the state of the art. Providers may rely on an adequate Code of Practice to demonstrate compliance; those who do not adhere to one must provide equivalent alternative measures and should expect closer scrutiny and more information requests.

What must be labeled under Article 50(4)

This obligation sits on deployers and concerns visible, perceivable disclosure. It has two limbs.

Deepfakes

A “deepfake” is AI-generated or manipulated image, audio or video content that (i) appreciably resembles (ii) an existing (iii) person, object, place, entity or event, and (iv) would falsely appear to a person to be authentic or truthful. “Existing” is read broadly: something that exists, plausibly could exist, or could have plausibly existed. Content that defies physics or biology – a dragon, an elephant driving a car – is not a deepfake, because it cannot mislead.

Minor or cosmetic AI manipulation of existing content does not make it a deepfake in the first place, where the change has too little effect on how a viewer perceives the content’s authenticity or truthfulness – for example, editing out a background passer-by, adjusting lighting or color, noise reduction, re-scaling or file compression. This is a threshold question, not an exemption: such content is simply not a deep fake, so no labelling duty arises. Whether a given edit stays on this side of the line is context-dependent: the Guidelines contrast these cosmetic operations with substantial AI editing of journalistic images, where the expectation of authenticity is high enough that a similar change may affect perceived authenticity and cross into deep fake territory.

The fourth criterion is assessed objectively and in context; the deployer’s intention to deceive is not required. Where the foreseeable audience does not expect the content to be authentic – for instance, standard special effects in a movie – the content may not “falsely appear” authentic and so falls outside the definition. But fully AI-generated actors, digital replicas of real or deceased actors, de-aging, or non-authentic depictions in documentaries generally will be deepfakes.

Deepfakes must be clearly and distinctly labeled. A lighter regime applies to content that is evidently artistic, creative, satirical, fictional or analogous: the disclosure need only be made in a manner that does not hamper enjoyment of the work, but disclosure is still required, and the “evidently” threshold is read strictly. Two limits keep this regime narrow. Where content mixes an informative and a creative character, the informative character prevails labeling, and full labeling applies; and the lighter regime is, in any event, subject to appropriate safeguards for third-party rights, so it is no justification for disregarding data-protection or intellectual-property obligations.

Public-interest text

AI-generated or manipulated text published to inform the public on matters of public interest must also be labeled. “Published” means accessible to an indeterminate, fairly large group; “public interest” covers politics, public administration, justice, fundamental rights, public health and safety, the environment, consumer safety, and economic, financial, scientific or cultural developments meriting public debate.

There is an important exception: text that has undergone genuine human review or editorial control and for which a natural or legal person holds editorial responsibility need not be labeled. Both conditions are cumulative. A superficial spell-check, an automated review, or a mere editorial policy will not do – the review must engage with the substance, and fact-checking is the minimum. If AI makes any substantive change after editorial sign-off, the exception falls away.

For a regulated financial entity, note the concrete examples the Guidelines give as in scope: AI-manipulated corporate reports containing investor information on a listed company’s website, and AI-generated sustainability reports – both of which need labeling unless the human-review/editorial-responsibility exception is satisfied. Conversely, an AI-manipulated advice text prepared by a consultant for a single client on regulatory compliance is not “published” and falls outside 50(4).

How to label in practice

Article 50 does not dictate wording. The Code of Practice does the practical work: the AI Office has published three EU icons – AI involved, fully AI-generated, and human content modified by AI – free to use, and testing showed that an icon on its own is not enough. The icon plus a few plain words are what people actually understand. “AI” is the only abbreviation to use.

What that looks like in practice. An icon and “Image created with AI” in the caption of a social media post – not in the small print. A spoken line in the first seconds of a podcast produced with a synthetic voice. A badge at the top of an AI-drafted news summary, not in the website footer. A mark that stays in the corner of the screen while an AI presenter is speaking. Give the icon alt text so a screen reader conveys it, leave a temporary label up long enough to be read, and use the same icon and the same words everywhere.

A label is not a license. The Guidelines are emphatic that complying with Article 50 does not make the content or its use lawful. A properly labeled deep fake can still be unlawful on other grounds – child sexual abuse material, non-consensual intimate imagery, trademark or copyright infringement, misleading advertising – and a 50(3) notice does not legitimize an emotion-recognition deployment that is prohibited under Article 5 or unlawful under data protection law.

Marking and labeling answer the question “is this AI?”, not “is this allowed?” The two assessments are separate.

The other two obligations, briefly

When must a chatbot tell users that they are interacting with AI?

Providers of systems that interact directly with people – chatbots, voice assistants, AI companions, AI agents – must design them so the person is told they are dealing with AI, at the latest at the first interaction. The disclosure must be clear and in context: a first-turn message, a spoken statement, a persistent badge. Burying it in terms and conditions, or relying on a vague reference to an “assistant” or “this system uses LLMs”, is not enough.

There is an obviousness exception – no disclosure is needed where it would be obvious to a reasonably well-informed, observant and circumspect person that they are dealing with AI. But the Guidelines read this narrowly: general awareness that chatbots exist does not mean people recognize them in a given interaction, and the exception is unavailable where vulnerable groups (children, the elderly, the less digitally literate) may be exposed. A professional-only internal helpdesk assistant may qualify; a public-facing helpdesk chatbot generally will not.

AI agents carry an extra layer. An agent must disclose not only its artificial nature but also the person on whose behalf it acts, reflecting the need for transparency regarding both its origin and delegated authority. Where the provider cannot know in advance whether an agent will meet a natural person, it must be designed to disclose itself in every situation where interaction with a person is reasonably likely, including in multi-agent chains where another agent is the one facing the person. Agents should also re-disclose to the person instructing them at key steps such as authorization, reporting and validation, and at every new interaction.

Emotion recognition and biometric categorization – Article 50(3)

Deployers of these systems must inform the people exposed to them that the system is operating – for example, a notice at the entrance to a space where facial images are captured to infer age, or a pop-up before a game that reads the player’s emotions. This applies whether the system runs in real time or after the fact, and to any biometric categorization system (unless outright prohibited under Article 5).

Timing, accessibility and penalties

Whatever the obligation, Article 50(5) requires the information to be given clearly and distinguishably, at the latest at the first interaction or exposure, and in an accessible format. “First exposure” means the start of a video featuring a deepfake, the start of a public-interest text, or the moment a person scrolling through social media encounters the content. Where children are foreseeably in the audience, the disclosure must be child-friendly and age-appropriate.

Non-compliance is not trivial. Fines can reach EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher (EU institutions face up to EUR 750 000; small and medium-sized enterprises (SMEs) and start-ups face the lower of the two figures). Enforcement sits with national market surveillance authorities, the AI Office for systems based on general-purpose AI (GPAI) models, and the European Data Protection Supervisor (EDPS) for EU institutions.

In Lithuania, the Communications Regulatory Authority (RRT) has already issued public guidance of its own on when AI-generated content must be marked and when it need not be – an early signal that the national supervisor intends to engage with these obligations actively rather than wait for complaints.

On timing of application: Article 50 has applied since 2 August 2026 to all in-scope systems on the market on that date, regardless of when they were placed. A targeted grandfathering rule under the AI Omnibus gives providers of existing generative systems until 2 December 2026 to bring the 50(2) marking into conformity – but the 50(1) interaction disclosure had to be in place by 2 August 2026. Content generated before 2 August 2026 need not be marked or labeled retroactively, but pre-existing text published on or after that date does need labeling.

What should businesses pay attention to?

Four practical points to act on:

• Separate the two “markings”. Providers owe invisible, machine-readable markings on synthetic output (50(2)); deployers owe visible labels on deepfakes and public-interest text (50(4)). One does not cover the other.
• Get the label right – and know what needs none. The EU icon, plus a short, plain-language line (“AI” is the only abbreviation to use), placed where the content is consumed, with alt text and an audio disclaimer when there is nothing to see. Standard editing, translation, formatting, source code, short labels and genuine internal B2B output fall outside the marking duty entirely – that is where much of the practical relief lies.
• Watch the text limb closely. AI-touched investor and sustainability reports on a company website count as text published on matters of public interest, so they are squarely in scope unless the human-review and editorial-responsibility exception is properly documented – and that exception collapses if AI edits the text after sign-off.
• Consider the Code of Practice. Adhering to the adequate Code of Practice is the most predictable way to demonstrate compliance with the 50(2) and 50(4) content obligations; non-signatories should run a gap analysis against it and keep evidence of equivalent measures.

Businesses introducing AI systems should assess Article 50 alongside their wider AI governance, data protection and intellectual property obligations. ECOVIS ProventusLaw can assist with this assessment and the implementation of appropriate compliance measures.

This article reflects ECOVIS ProventusLaw’s interpretation of the Commission’s non-binding Guidelines and Code of Practice and is provided for general information purposes only. It does not constitute legal advice; specific advice should be obtained before acting on any part of it.

The post AI made it? Say so. What the Commission’s new AI Act transparency Guidelines require appeared first on ECOVIS ProventusLaw.