In Latvia, our client Velvian SIA obtained a payment institution license, with ECOVIS ProventusLaw supporting selected parts of the licensing process.

EBA publishes final Guidelines on the management of third-party risk

Date: September 18, 2026 | Source: European Banking Authority
Link

The European Banking Authority (EBA) published its final Guidelines on the management of third-party risk, which replace the 2019 outsourcing guidelines with a framework covering both information and communication technology (ICT) and non-ICT third-party arrangements and aligned with the Digital Operational Resilience Act (DORA). The Guidelines apply to credit institutions, payment institutions and electronic money institutions, investment firms other than small and non-interconnected ones, issuers of asset-referenced tokens under the Markets in Crypto-Assets Regulation (MiCA) and certain mortgage creditors.

The Guidelines focus on third-party arrangements supporting critical or important functions, and cover the full lifecycle: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. For less material arrangements, the Guidelines reduce operational and supervisory burden, and proportionality is built in. The Guidelines incorporate Basel Committee principles and feedback from the public consultation.

A two-year transitional period applies to allow institutions to update existing arrangements and registers.

What we recommend

• Map existing outsourcing and third-party registers to the new scope, identifying non-ICT arrangements supporting critical or important functions (for example agent networks, card-program management, customer support and cash handling) that were previously outside the DORA register of information.
• Update the outsourcing policy, contract templates and exit plans to reflect the lifecycle requirements, and plan the remediation of legacy contracts within the transitional period.
• Align the third-party risk framework with the DORA register of information so that ICT arrangements are not recorded twice under inconsistent criteria.

Bank of Lithuania amends CENTROlink rules: participants to register ABIC holders

Date: September 24, 2026 | Source: Bank of Lithuania
Link | CENTROlink audit for participants with ABIC holders

The Bank of Lithuania launched a market consultation on amended CENTROlink operating rules, presented to participants on September 30, 2026. The amended rules take effect on November 1, 2026.

The Bank of Lithuania will no longer register addressable Business Identifier Code (ABIC) holders itself. Existing ABIC agreements end on December 30, 2026 and may, by way of exception, be extended until June 30, 2027. A deregistration fee of EUR 350 per scheme applies. Spanish electronic money institutions (EMIs) and payment institutions (PIs) gain direct participation from November 1, 2026.

A new model in which CENTROlink participants register ABIC holders opens for applications on November 1, 2026, with go-live from January 1, 2027. A direct participant may register an ABIC holder that cannot participate directly, via a group route (matching ultimate beneficial owner (UBO); EMIs and PIs from SEPA countries outside the European Economic Area (EEA), and EEA EMIs and PIs with restricted licenses) or a non-group route (non-EEA SEPA country with high Financial Action Task Force (FATF) ratings and a Bank of Lithuania cooperation agreement, currently the UK only). The participant needs audited anti-money laundering and counter-terrorist financing (AML/CTF), fraud and sanctions controls and, for non-group ABICs, 12 months of participation and 100,000 payments in the past year; it remains accountable for the ABIC holder (audits every two years, fees, fines, blocking or termination). ABIC holders get SEPA Credit Transfer (SCT) and SEPA Instant Credit Transfer (SCT Inst) only.

Other changes:

• From January 1, 2027 the SEPA Direct Debit (SDD) fee moves from EUR 0.04 to volume tiers of EUR 0.025 to 0.0035, and the fee for a fourth and subsequent BIC falls from EUR 7,000 to EUR 1,000.
• From November 1, 2026 the invoice deadline becomes the 15th working day of the following month, with a late-payment penalty of EUR 200 per month instead of a one-off EUR 100.
• Exceptions to collateral-breach penalties are defined.
• The US Office of Foreign Assets Control (OFAC) sanctions lists criterion applies universally, without the US-jurisdiction qualifier.

What we recommend

• Direct participants that plan to register ABIC holders should check that each candidate meets the conditions above and obtain an independent CENTROlink audit report on their AML/CTF, fraud prevention and sanctions controls.
• All participants should review their SDD fees for clients in light of the lower CENTROlink fees from 2027, align CENTROlink invoice payments with the new deadline, keep the balances in their CENTROlink collateral accounts within the set limits, and make sure their sanctions screening includes the US OFAC lists.
• Existing ABIC holders should plan the migration route now: direct participation if eligible or registration as an ABIC holder by a CENTROlink participant.

Bank of Lithuania warns an e-money institution over late annual financial statements

Date: September 18, 2026 | Source: Bank of Lithuania
Link

The Financial Market Supervision Committee of the Bank of Lithuania published its decisions of September 18, 2026, covering five matters:

• The Committee found that the electronic money institution UAB “Pervesk” had failed, within the statutory deadlines, to approve its 2025 annual financial statements, to adopt a profit (loss) allocation decision and to submit the audited statements, the allocation decision and the audit report. Having assessed all relevant circumstances, the Bank of Lithuania imposed a warning and ordered the documents to be submitted by October 9, 2026, failing which a periodic penalty payment will accrue for each day of delay.
• The Committee did not object to the indirect acquisition by CB Victoria Lux S.à r.l. of a qualifying holding of more than 20 percent but less than 30 percent of the share capital and voting rights of the payment institution Ebury Partners Lithuania UAB.
• On the application of the electronic money institution UAB B4B PAYMENTS EUROPE, the Committee entered its agent Tide Platform S.A. in the Public List of Electronic Money Institutions.
• The Committee granted UAB FMĮ Perpetus Wealth a category C financial brokerage firm license covering investment advice, portfolio management without custody, placing without a firm commitment and related advisory and research services.
• The Committee authorized the registration of amendments to the articles of association of RATO bankas, UAB increasing its share capital from EUR 6.1 million to EUR 8.1 million, and approved Marijana Romanova as board member and person responsible for risk management.

What we recommend

• Payment and e-money institutions should verify that the general meeting approving the annual financial statements and the allocation of profit is held within the statutory period and that the audited statements and audit report are filed with the Bank of Lithuania without delay; the audit engagement should be scheduled to allow this.
• Institutions appointing agents or distributors in other Member States should confirm that the agent is entered in the public list before it starts providing services in the institution’s name.
• Acquirers of indirect qualifying holdings in Lithuanian payment institutions should note that no-objection decisions are published with the identity of the acquirer and the size of the holding.

Bank of Latvia grants a payment institution license to Velvian SIA

Date: September 17, 2026 | Source: Bank of Latvia
Link

The Supervision Committee of the Bank of Latvia issued a payment institution license to Velvian SIA. The license permits the company to provide payment acceptance (acquiring) services, enabling merchants, platforms and business customers to accept card payments.

This is the seventh payment institution license issued by the Bank of Latvia in 2026, bringing the number of licensed payment institutions in Latvia to eleven. The Bank of Latvia again encouraged applicants to use its pre-licensing consultation service and licensing guides, noting that cooperation at the pre-licensing stage helps applicants prepare high-quality applications.

Velvian SIA is a client of ECOVIS ProventusLaw, and we supported the company on selected parts of its licensing process. Congratulations to the Velvian team.

What we recommend

• Prospective applicants in Latvia can significantly reduce licensing costs by combining our advice with the Bank of Latvia’s free pre-licensing consultations, particularly to align the business plan, safeguarding method and ICT and outsourcing arrangements with supervisory expectations before filing.
• Licensed institutions considering Latvia as a second Baltic hub should note the growing pace of authorizations in 2026 as an indicator of processing capacity and supervisory appetite for acquiring and merchant-services models.

Offline card payments now available at ten retail chains in Latvia

Date: September 10, 2026 | Source: Bank of Latvia
Link

The Bank of Latvia announced that offline card payments are now available at ten retail chains in Latvia, allowing consumers to buy essential goods when internet or mobile communications are down. The participating merchants are the grocers Rimi, Maxima and Lidl, the fuel retailers VIADA, ASTARTE NAFTA, Virši and Neste, and the pharmacy chains Euroaptieka, Mēness aptieka and BENU.

The solution works only during a communications outage and only for physical cards inserted into the terminal with PIN entry; contactless and mobile-wallet payments are not supported. Purchases are capped at EUR 200 per card and the merchant terminal must have electricity. Cards issued by Swedbank AS, AS SEB banka, AS Citadele banka and the Latvian branch of Luminor Bank AS are eligible.

The Bank of Latvia links the measure to the continuity of critical financial services required under the National Security Law: together with cash access through ATMs, offline card acceptance is meant to keep essential payments available to residents during a crisis.

What we recommend

• Card issuers and acquirers active in Latvia that are not yet part of the scheme should assess whether the Bank of Latvia or the card schemes will expect them to support offline authorization, and map the technical and risk requirements (offline limits, PIN verification, later settlement and chargeback treatment).
• Payment and e-money institutions issuing cards to Latvian residents should reflect in their business continuity plans that their cards will not work offline unless they join the arrangement, and consider whether to inform customers accordingly.
• Merchant-acquiring clients should confirm terminal configuration and electricity back-up for outlets classed as essential, since offline acceptance depends on both.

Bank of Lithuania does not object to EQT group’s indirect qualifying holding in Vinted Pay

Date: September 2, 2026 | Source: Bank of Lithuania
Link

The Financial Market Supervision Committee of the Bank of Lithuania published its decisions of September 2, 2026. The decisions cover three matters:

• The Committee did not object to the indirect acquisition by the Luxembourg companies EG1 SPV S.à r.l. and EQT Growth Vogue JV S.à r.l., acting in concert with other EQT group entities, of a qualifying holding of more than 10 percent but less than 20 percent of the share capital and voting rights of the electronic money institution Vinted Pay, UAB.
• The Committee approved the mandatory tender offer circular submitted by a natural person for the remaining 6,279,499 ordinary registered shares of AB “Novaturas”, at a price of EUR 0.877 per share.
• The Committee entered UAB Apdrausta in the list of insurance brokerage undertakings.

What we recommend

• Payment and e-money institutions planning capital raises from private-equity or venture investors should map the fund structure to identify every entity that will indirectly cross the 10, 20, 30 or 50 percent thresholds, and file the notification before the transaction closes.
• Ensure the shareholder register is updated after completion of the acquisition.

Bank of Lithuania names AI-enabled cyber threats among the main systemic risks for the financial sector

Date: September 11, 2026 | Source: Bank of Lithuania
Link

The Bank of Lithuania warned that next-generation artificial intelligence models pose a fundamental challenge to cyber security in the financial sector and classified AI-enabled cyber threats as one of the principal systemic risks in the sector. According to the Bank, modern AI systems can autonomously identify critical vulnerabilities, chain together separate weaknesses and execute attacks without direct human involvement, which fundamentally changes the nature of cyber threats. Renata Bagdonienė, Director of the Prudential Supervision Department, said the Bank would give these threats increased supervisory attention.

The Bank drew attention to the joint statement of the EBA, the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) on frontier AI models, which urges financial institutions to strengthen ICT risk management across prevention, threat detection and recovery. The statement stresses that no single solution fits all financial institutions.

The Bank of Lithuania discussed AI-related threats in detail at its consultative workshop on DORA implementation on September 17, 2026.

What we recommend

• Payment and e-money institutions and crypto-asset service providers (CASPs) should add AI-enabled attacks (automated vulnerability discovery, AI-generated phishing and deepfake social engineering against staff and customers) as a distinct threat category in the ICT risk assessment and the threat-led scenarios used for DORA testing.
• Review detection and response capabilities against faster, autonomous attack chains: shorter patching windows for critical vulnerabilities, anomaly-based monitoring and tested business-continuity procedures for a rapid multi-vector incident.
• Record the joint statement of the European Supervisory Authorities (ESAs) and the Bank of Lithuania’s position in the ICT risk management framework review, since the supervisor has said it will give AI-driven cyber risk increased supervisory attention.

Our view

ABIC holders and the participants that may register them have the least time. Existing ABIC agreements end on December 30, 2026 unless the Bank of Lithuania grants an extension, and a participant must have its AML/CTF, fraud prevention and sanctions controls independently audited before it can register anyone. A payment institution that reaches SEPA through an ABIC should already know whether it will connect directly or find a participant to register it.

The EBA third-party risk guidelines reach beyond ICT. Agent networks, card program management, customer support and cash handling may now need the same due diligence, contract terms and exit plans as ICT providers. The transition period is long, but renegotiating legacy contracts takes time, so start with the arrangements that support critical or important functions.

Routine obligations are also under supervisory review. The Bank of Lithuania issued a warning over late annual financial statements and publishes the names of acquirers and agents in its decisions. Schedule the audit and the general meeting early enough to meet the filing deadline, and make sure agents appear in the public list before they act in the institution’s name.

October showed that the Bank of Lithuania’s warning about AI-enabled cyber threats was well founded. Two critical PHP vulnerabilities, discovered with the help of AI tools, led many organizations to take their services offline until patches were available.

How ECOVIS ProventusLaw can help

We advise payment and electronic money institutions on licensing and on the obligations that follow it, including:

• Licensing: preparation of the application, business plan, safeguarding, ICT and outsourcing arrangements and representation during the payment institution licensing procedure.
• Baltic market entry: setting up a regulated payment business, including Latvia as a second Baltic hub.
• Qualifying holdings: shareholder suitability, qualifying holdings and changes of control, including indirect acquisitions through fund structures.
• SEPA access: advice on a direct SEPA connection via CENTROlink or access through a CENTROlink participant, including registration of ABIC holders by participants.
• CENTROlink audits: independent audits of CENTROlink participants with ABIC holders, covering AML/CTF, fraud prevention and sanctions measures, for submission to the Bank of Lithuania.
• Third-party risk and DORA: review of outsourcing policies, contracts, exit plans and the register of information against the EBA guidelines and DORA.
• Agents and passporting: agent and distributor networks, entry in the public list and cross-border expansion through passporting.
• Ongoing compliance: regulatory reporting, internal audit setup and remediation of supervisory findings after licensing.

Contact our fintech regulatory team to discuss CENTROlink access, licensing or any of the changes above.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has one of the most experienced legal teams in the Baltics advising payment and electronic money institutions. We help from the license application through to inspection findings, supervisory warnings and remediation. Our work includes licensing, responses to central bank inspection findings, AML/CTF remediation programs, outsourcing restructuring under DORA and regulatory due diligence for acquisitions of regulated institutions. We advise local and international clients on matters in Lithuania, Latvia, Estonia and other EU jurisdictions. Examples of our recent work are on our pages for payment institutions and electronic money institutions.

Our Banking, Finance and FinTech department has separate teams for regulatory advice, compliance support, and AML/CTF and compliance audits. They work together with our Data Protection department, which covers GDPR compliance and DORA, including ICT governance and risk management, incident reporting, ICT third-party risk and outsourcing, and digital operational resilience testing.

This gives clients a one-stop shop with specialists in each area and a single point of contact who coordinates their work across Lithuania, Latvia and Estonia.

The firm is ranked by IFLR1000, The Legal 500 and Chambers and Partners for banking and finance and fintech work.

The post RegRally Insights: Payment Services Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

Join ECOVIS ProventusLaw’s growing FinTech practice in Latvia.

ECOVIS ProventusLaw is looking for an experienced lawyer to join our team in Riga and contribute to the continued development of our legal and regulatory practice in Latvia and across the Baltic region.

We advise local and international clients on financial services regulation, FinTech, payments, AML/CTF, sanctions, data protection, technology, corporate governance and cross-border matters. Our firm has particular strength in highly regulated sectors and is recognised by leading international legal directories, including Chambers and Partners, The Legal 500 and IFLR1000.

The successful candidate will work on complex, cross-border mandates involving financial institutions, payment and electronic money institutions, FinTech companies, crypto-asset service providers and technology businesses.

FinTech Lawyer

Location: Riga, Latvia (hybrid)
Salary: EUR 3,500–4,500 gross per month, depending on experience and qualifications

Key responsibilities

• Advising clients on Latvian and EU financial services regulation, including payment services, electronic money, banking, investment services and crypto-assets.
• Supporting licensing, authorisation and regulatory approval processes before Latvijas Banka and other competent authorities.
• Advising on the regulatory implications of new products, services, distribution models and market-entry projects.
• Preparing and reviewing regulatory submissions, legal opinions, internal policies, procedures, customer documentation and governance documents.
• Advising on AML/CTF, sanctions, operational resilience, outsourcing, consumer protection and data protection requirements.
• Monitoring Latvian and EU regulatory developments and assessing their impact on clients’ business models.
• Drafting, reviewing and negotiating commercial, technology, outsourcing, partnership and service agreements.
• Supporting regulatory inspections, information requests, remediation projects and internal investigations.
• Working closely with ECOVIS ProventusLaw colleagues in Lithuania and Estonia on coordinated Baltic and cross-border assignments.
• Developing long-term client relationships and contributing to the growth of the firm’s Latvian FinTech practice.

Candidate profile

We expect that you:

• hold a university degree in law and are qualified to practise law in Latvia, or have relevant Latvian legal practice experience;
• have at least 3–5 years of relevant legal experience, preferably in a law firm, financial institution, FinTech company or regulatory authority;
• have practical knowledge of Latvian and EU financial services regulation;
• understand the regulatory frameworks applicable to payments, electronic money, AML/CTF, data protection and digital financial services;
• have experience in regulatory, licensing, commercial contract or corporate governance matters;
• are able to analyse complex regulatory requirements and provide clear, commercially focused legal advice;
• have excellent written and spoken Latvian and English language skills;
• are proactive, detail-oriented and comfortable working independently;
• can manage several assignments and deadlines in an international environment.

Experience in one or more of the following areas would be an advantage:

• MiCA and crypto-asset services;
• DORA and ICT-related regulatory requirements;
• financial services licensing or regulatory inspections;
• investment services or banking regulation;
• sanctions compliance;
• interaction with Latvijas Banka or other supervisory authorities.

What we offer

• An opportunity to help develop a growing FinTech and financial regulatory practice in Latvia.
• Complex and professionally demanding work for Latvian and international financial-sector clients.
• Cross-border assignments involving Lithuania, Latvia, Estonia and other EU jurisdictions.
• Direct cooperation with experienced partners and recognised FinTech and regulatory specialists.
• Access to the international ECOVIS network operating across more than 90 countries.
• A professional environment encouraging independence, initiative and continuous development.
• Flexible working arrangements: a hybrid working model combining remote and on-site work.
• Competitive remuneration: EUR 3,500–4,500 gross per month, depending on experience and qualifications.

How to apply

Please send your CV and a short motivation letter to ecovisproventuslaw@ecovis.lv, indicating “FinTech Lawyer – Riga” in the subject line.

Applications will be reviewed confidentially. We reserve the right to contact only candidates selected for the next stage of the recruitment process.

The post We’re Hiring in Riga appeared first on ECOVIS ProventusLaw.

At a glance

• Stable taxes, targeted support. The draft 2027 budget keeps corporate and personal income tax at 22%, lowers the overall tax burden to 35.2% of gross domestic product (GDP) and earmarks more than EUR 270m for business growth, research and development (R&D) and exports.
• More flexible company law is on its way. A Commercial Code reform now before Parliament would simplify share transfers and corporate meetings and introduce a new private foundation for holding assets.
• Lower red tape for employers. Parliament cut occupational health and safety paperwork, and unemployment insurance rates are frozen until 2030.
• Four compliance requirements began to apply. Online withdrawal button (September 1), stricter green-claims rules (September 27), Data Act design duty (September 12) and Cyber Resilience Act reporting (September 11).

2027 budget: stable taxes and targeted support

Status: Draft | Date: approved by the Government on September 28, 2026; submitted to Parliament on September 29, 2026 (bill 1037 SE) | Source: Government of Estonia
Link

Under the Government’s draft 2027 budget, retained company profits remain tax-free (credit institutions pay an 18% advance income tax), while distributed profits and personal income would still be taxed at 22%. The tax burden would fall to 35.2% of GDP, from 35.5% in 2026. The deficit would fall to 4% of GDP despite defense spending above 5% of GDP.

Planned 2027 spending relevant to businesses:

• Research and innovation – EUR 135m. Support for company R&D, applied research, innovation cooperation and the adoption of new technologies, including artificial intelligence (AI). Relevant for companies developing products or technology in Estonia.
• Exports, investment, industry and tourism – nearly EUR 116m. Includes export promotion and continued state support for large investment projects. Relevant for exporters and investors planning large production or industrial projects.
• State equity investments – EUR 25m + EUR 12.6m. EUR 25m a year in 2027–2030 for investments in strategically important companies, and EUR 12.6m for the state-backed SmartCap venture capital fund. Relevant for growth companies raising capital.
• Defense – EUR 2.2bn (over 5% of GDP). Includes EUR 632m for defense capabilities (such as air and missile defense, long-range strike and ammunition), of which EUR 100m is for drones. Relevant for defense and dual-use suppliers.
• Energy – EUR 12m + EUR 2.5m. EUR 12m over two years to encourage municipalities to host onshore wind farms, and EUR 2.5m to prepare for nuclear energy. Relevant for wind and nuclear energy developers.
• Digital – EUR 21m + over EUR 30m. EUR 21m for cybersecurity and over EUR 30m for AI adoption, including testing environments and computing capacity. Relevant for cybersecurity and AI providers.
• Rail Baltica – EUR 445m. The main line is now targeted for completion in the EU’s 2028–2034 budget period, together with Latvia and Lithuania. Relevant for construction and engineering contractors.

Two things to keep in mind. First, the budget is a draft until Parliament adopts it, and a budget line is not a grant: each support measure has its own eligibility rules, timetable and caps. Second, the slower Rail Baltica timetable may affect logistics, real estate and development projects that assumed earlier completion of the main line.

On September 29, the Research and Development Council approved the principles for selecting Estonia’s priority growth sectors. It highlighted AI and computing capacity as technologies relevant across sectors. The specific sectors are due to be identified in spring 2027, giving an early indication of where future support is likely to concentrate.

Our view

The 2027 draft budget creates opportunities to take part in state-funded projects and invest in Estonia, especially in R&D, AI, cybersecurity and defense technology. Each support measure has its own conditions, so check them before starting a project.

Additional sources: ERR News · Ministry of Economic Affairs: EUR 270m for business growth · Research and Development Council: priority sectors

Commercial Code reform: simpler share deals and a new private foundation

Status: Bill | Date: approved by the Government on September 3, 2026; bill 1008 SE initiated on September 14, 2026; amendment deadline October 15, 2026 | Source: Riigikogu
Link

The most significant company-law reform in years has passed its first reading. Its aim is to give owners more contractual freedom and reduce administrative burden, changes that will directly affect how investors acquire, hold and govern Estonian companies.

The main proposed changes:

• Share transfers in a private limited company (OÜ). Shareholders will be able to agree themselves when ownership passes, instead of it depending on the commercial register entry. This makes it easier to bring in new investors.
• Shareholder list. The company’s management board will keep the list of shareholders, and the register entry will only reflect it (planned from February 1, 2028). To check who owns a company, you will need to look at the company’s own records, not only the public register.
• Simpler corporate rules on quorum, capital contributions, supervisory board meetings and notice of general meetings, making decisions faster.
• Broader shareholder information rights, including about subsidiaries, which strengthens the position of minority shareholders.
• New private foundation for holding and managing assets; founders may give up their founder rights. A new option for holding family wealth and passing it on to the next generation.
• More automation in the commercial register, including company-name checks, making company formation quicker.

Some changes are planned to take effect on April 1, 2027, and the shareholder-list rules on February 1, 2028. Most other changes would take effect under the general procedure. The text may still change in Parliament.

Our view

If you are looking for a way to hold family assets or pass them on to the next generation, the new private foundation may become an option once the law is adopted. The reform would also make Estonian companies easier to run: simpler corporate formalities, more flexible share transfers and more automation in the commercial register would make company formation even quicker.

Additional sources: Government agenda, September 3, 2026

Lighter employer obligations and stable payroll costs

Status: Adopted (occupational health and safety amendments); decided (unemployment insurance rates) | Date: Occupational Health and Safety Act amendments adopted on September 30, 2026; unemployment insurance rates decided on September 17, 2026 | Source: Government of Estonia
Link

Parliament adopted an occupational health and safety reform that the Government estimates will save businesses up to EUR 22.6m a year, mostly benefiting micro and small companies:

• Companies with fewer than 10 employees no longer need to file a risk assessment in the Labour Inspectorate portal or commission a full health-situation analysis every three years.
• Single-person companies are largely exempt, and no separate safety instruction is needed for every task or where the manufacturer’s manual already covers safety.
• Health checks for new employees may be completed within six months instead of four; employers get a clearer basis for intoxication testing.

The Labour Inspectorate will also use register and contracting-chain data to detect undeclared work. Separately, unemployment insurance rates stay at 0.8% (employer) and 1.6% (employee) for 2027–2030.

Additional sources: Riigikogu, September 30, 2026 · Government agenda, September 17, 2026

Online withdrawal must work as a complete process

Status: In force | Date: September 1, 2026 (Law of Obligations Act and Consumer Protection Act amendments) | Source: Consumer Protection and Technical Regulatory Authority (TTJA)
Link

Online traders must offer a clearly visible electronic withdrawal function for consumer contracts concluded online. The 14-day withdrawal right itself is not new and its statutory exceptions still apply. What changes is how easily consumers can exercise it.

The consumer must be able to:

• 1. Find a clearly labeled button, e.g., “Taganen lepingust” (“I withdraw from the contract”), available throughout the withdrawal period.
• 2. Fill in their name, the order or contract and an email address for confirmation.
• 3. Confirm through a separate button, e.g., “Kinnitan taganemise” (“I confirm the withdrawal”).
• 4. Receive confirmation immediately by email or another durable medium, showing what was submitted and when.

Each withdrawal request must be linked to the correct order and passed to customer service and the refund process. Refunds remain due within 14 days of the withdrawal notice. The same amending act also implements EU rules on distance financial services contracts, including limits on manipulative interface design and the consumer’s right to request contact with a person rather than only a chatbot.

Our view

The withdrawal button already applies in Estonia (from September 1, 2026) and Lithuania (from June 19, 2026), while Latvia is still preparing its rules. Because the requirement comes from an EU directive, businesses selling online across the Baltics can use one withdrawal process for all three markets. Test the full customer journey on mobile and desktop, including guest checkout. Agree with your platform provider who fixes failures and keeps the records. When acquiring an e-commerce business, check how the withdrawal process works in practice as well as reviewing the terms of sale. Specify in the transaction documents who will pay to correct any failures.

Additional sources: TTJA guidance for online traders · Riigikogu: bill 796 SE

Green claims: say less, prove more

Status: In force | Date: September 27, 2026 (Consumer Protection Act amendments implementing Directive (EU) 2024/825) | Source: Consumer Protection and Technical Regulatory Authority (TTJA)
Link

Generic claims such as “green” or “eco-friendly” are now permitted only with recognized excellent environmental performance relevant to the claim. A benefit that concerns one part of a product cannot be presented as a feature of the whole product or business.

• Sustainability labels must be based on a qualifying certification scheme or set by a public authority.
• “Climate-neutral” style claims based on emissions offsetting are prohibited. Buying carbon credits does not make such product claims lawful.
• Durability, repairability and software-update statements must not mislead.

Retailers and online sellers are covered too, including product texts supplied by others, with no general grace period for materials already in circulation.

Our view

Review the environmental claims on your packaging, website and advertising against the requirements above. Remove claims that do not meet those requirements. Do not use “climate-neutral” product claims based on emissions offsetting. Use specific statements backed by evidence and keep that evidence on file. If you sell other brands’ products, check the environmental claims in the product descriptions you receive, as you are responsible for them too.

Additional sources: Directive (EU) 2024/825

Data Act: users of new connected devices must be able to access their data

Status: In force | Date: products placed on the market after September 12, 2026 (Regulation (EU) 2023/2854, Articles 3 and 50) | Source: EUR-Lex
Link

Connected devices and their related services placed on the market after September 12, 2026 must be designed to give users access to the data they generate, including relevant metadata. Access must be easy, secure, free of charge and in a reusable format, with direct access where technically possible. Examples of connected devices include industrial machines, vehicles and smart home appliances. The Data Act’s other access and sharing rights have applied since September 2025. The design obligation is an additional requirement.

In practice, a company using, for example, an industrial machine can get the data the machine generates and use it itself or share it with another service provider, instead of depending on the manufacturer. Personal data and trade secrets remain protected, the data cannot be used to develop a competing product, and smaller companies may be exempt.

Our view

If you make connected devices, check that new models give users access to their data from the start and that your business model does not depend on keeping that data to yourself. If you buy such equipment, ask the supplier before signing how you will get the data and in what format.

Additional sources: Commission explainer

Cyber Resilience Act: 24-hour reporting for digital products

Status: In force | Date: September 11, 2026 (Regulation (EU) 2024/2847, Article 14) | Source: European Commission
Link

The Cyber Resilience Act (CRA) is an EU regulation on the cybersecurity of products with software or an internet connection, from smart devices to standalone software. Their manufacturers must now report actively exploited vulnerabilities and severe incidents affecting product security. The duty also covers products already on the market, but only cases meeting the legal criteria, not every suspected flaw.

Reports are filed through the Single Reporting Platform of the EU Agency for Cybersecurity (ENISA). The CRA’s main product requirements apply only from December 11, 2027, so September marks the start of reporting, not of every CRA obligation.

Our view

If you make software or connected devices sold in the EU, decide in advance who determines whether an incident must be reported. Make sure someone can make that decision outside working hours. Test whether your team can meet the 24-hour deadline. Ask your suppliers to inform you promptly about security issues in the components they provide.

Additional sources: Regulation (EU) 2024/2847

What we recommend

• If you are looking for an EU base for your business, consider an Estonian private limited company (OÜ): it can be set up and managed online, and profits are taxed only when distributed, at 22%.
• If you invest in R&D, AI, cybersecurity, defense technology or tourism, note that the 2027 draft budget plans additional state support in these areas, and check which measures apply before you start the project.
• If you plan to hold family assets or pass a business on to the next generation, consider the new Estonian private foundation once the Commercial Code reform is adopted.
• If you sell online to consumers, make sure customers can withdraw from a purchase with the online withdrawal button and that each request reaches your refund process.
• If you make software or connected devices, check which CRA reporting duties and Data Act design requirements apply to your products. Test whether your team can submit a required CRA early warning within 24 hours.
• If you market consumer products, remove environmental claims you cannot prove.
• If you employ staff in Estonia, update your occupational health and safety documents once the simplified rules take effect.

Key dates ahead

• November 20: EU application date of the new Consumer Credit Directive, including “buy now, pay later”; the Estonian bill (947 SE) is still in Parliament.
• November–December: parliamentary readings of the 2027 budget.
• December 11, 2027: full application of the Cyber Resilience Act; use the coming year to close product-security gaps.

How ProventusLaw can help

ProventusLaw helps international businesses set up in Estonia, comply with new rules and complete deals. We advise on setting up companies, holding and investment structures, and buying and selling businesses. We also advise on state support and its conditions, foreign investment screening, commercial contracts, construction, tax, remote gambling licensing and technology regulation. ProventusLaw operates across Lithuania, Latvia and Estonia and is part of the ECOVIS International network present in more than 90 countries, so clients working in several countries have one point of contact.

Want to know what these changes mean for your business? Get in touch with our team.

The post RegRally Insights: Legal and Investment Update in Estonia, October 2026 appeared first on ECOVIS ProventusLaw.

CJEU: unrestricted public access to shareholder data is disproportionate

Date: September 3, 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders, and that the Latvian rule requiring online publication of shareholder names, identification numbers, addresses, email addresses and shareholdings, downloadable in bulk and without restriction, is disproportionate under the GDPR and the Charter.

The Court accepted that business transparency, the prevention of money laundering and terrorist financing and the implementation of sanctions are legitimate objectives but found that unrestricted public access exposes data subjects to significant risks of misuse and that less intrusive means exist, such as access on demonstration of a legitimate interest. The judgment follows the line of case law on public beneficial-ownership registers.

What we recommend

If your organization obtains shareholder data from a public register, monitor changes to access rules and document the legal basis and purpose for obtaining and using the data. Collect only the necessary fields and restrict further disclosure.

Advocate General: Belgian rules on electronic communications data retention fail the necessity test

Date: September 3, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Szpunar delivered his Opinion in Case C-661/24 Académie Fiscale and Others, on five actions before the Belgian Constitutional Court against the 2022 Belgian law on the collection and retention of identification data and metadata in electronic communications. He stated that retention of traffic and location data interferes with the rights to privacy and data protection and is permissible only where provided by law, strictly necessary and proportionate.

The Advocate General proposed that general retention may be compatible with Directive 2002/58/EC where technical safeguards ensure a genuinely watertight separation of the categories of data so that they cannot be combined during the retention period, but concluded that the Belgian law fails the test because it retains excessively broad data without such separation, leaves essential retention choices to providers and lacks clarity and safeguards.

What we recommend

This is an Advocate General’s Opinion and is not binding on the Court. Electronic communications providers and organizations operating messaging or similar services should monitor the case until the Court delivers its final judgment before making structural changes solely in reliance on the Opinion.

In the meantime, review the categories and retention periods of traffic and location data, applicable legal requirements and existing access controls. Identify whether technical segregation of retained data categories may be required if the Court follows the Opinion.

Italian DPA fines IQVIA EUR 7 million over health data that were not anonymous

Date: September 23, 2026 | Source: Garante per la protezione dei dati personali (Italian Data Protection Authority)
Link

The Garante fined IQVIA Solutions Italy S.r.l. EUR 7 million for unlawfully processing health data relating to approximately one million patients of 800 general practitioners in a database used for research and analytics. The authority found that the data were not anonymous: persistent patient codes and detailed clinical information enabled individuals to be singled out, linked over time and potentially re-identified.

The Garante treated IQVIA as a controller from the point of collection and found deficiencies in the legal basis, patient information, retention periods, data protection impact assessment and security measures. IQVIA must bring the processing into compliance within 120 days if it intends to continue the activity; alternatively, the doctors must anonymize the data independently in accordance with the safeguards specified by the authority.

What we recommend

Do not treat coded or pseudonymized datasets as anonymous without a documented assessment showing that individuals cannot reasonably be singled out, linked over time or re-identified using available additional information.

Before collecting, receiving or reusing personal data, document the parties’ controller or processor roles. Verify:

• the legal basis;
• transparency information;
• purpose limitation and data minimization;
• the retention period;
• the need for a data protection impact assessment (DPIA);
• appropriate security measures.

CNIL fines EXTIA EUR 300,000 over unhandled erasure requests

Date: September 9, 2026 | Source: CNIL (French Data Protection Authority)
Link

The CNIL fined the IT and engineering consultancy EXTIA EUR 300,000 for failing to respect the right to erasure and the information obligations under Articles 12 and 17 GDPR. The audit, carried out in April 2025 following complaints and as part of the EDPB Coordinated Enforcement Framework action on the right to erasure, found that of 265 erasure requests received in 2024, mostly from job candidates and former employees, more than three quarters had not been handled or had been handled inadequately.

Twelve requests were not processed at all, 166 people were not informed of the outcome of their request and 27 were informed late, beyond the one-month deadline. The fine reflects the number of people concerned and the fact that the company has already been reminded of its obligations twice.

What we recommend

Review the process for handling erasure requests from all data subjects: intake, identity verification, responsible persons, searches across relevant systems, applicable retention exceptions and deletion from active and backup systems.

Respond to every request within one month, including where it is refused, partly granted or the data have already been deleted. Retain evidence of the assessment, action taken and response.

Cyber Resilience Act reporting obligations now apply

Applies from: September 11, 2026 | Source: Cyber Resilience Act (Regulation (EU) 2024/2847)
Link

From September 11, 2026, the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) apply: manufacturers of products with digital elements placed on the EU market, including software such as operating systems and mobile applications, must report actively exploited vulnerabilities and severe incidents affecting the security of their products. An early warning is due within 24 hours of becoming aware, a notification within 72 hours and a final report after resolution.

Reports are submitted once through the CRA Single Reporting Platform, operated by ENISA and launched on September 11, 2026. The platform forwards them to the competent CSIRTs. For manufacturers with their main establishment in Lithuania, the coordinating CSIRT is NKSC. Prior registration on the platform is not required and can be completed when the first early warning is submitted. The obligation also covers products already on the market, but exploitation known before September 11, 2026, need not be reported. The main CRA product requirements apply from December 11, 2027, and open-source software stewards become subject to reporting on the same date.

What we recommend

If your organization develops or supplies software, apps, connected products or components, assess whether it is a manufacturer under the CRA and identify the products and legal entities within scope.

For in-scope products, establish a reporting procedure covering internal escalation, assessment, approval and submission within the applicable 24-hour, 72-hour and final-report deadlines. Coordinate with any DORA, NIS2 and GDPR notification duties that apply.

Ensure supplier and development contracts require timely vulnerability and incident information needed to meet CRA reporting deadlines.

Advocate General: marketing consent must identify the company sending the message

Date: September 17, 2026 | Source: Court of Justice of the EU (Advocate General)
Link

Advocate General Spielmann delivered his Opinion in Case C-317/25 Groupe Canal+, arising from a CNIL fine of EUR 600,000 for electronic direct marketing to about 3.9 million people whose contact data had been obtained from two internet service providers. The subscribers had consented to marketing by the providers’ “partners” without being told which companies those partners were.

The Advocate General considered that valid consent requires the data subject to know the identity of the controller that will use the data; where the partners are not identified at the time of collection, the data subject cannot expect to be contacted by any particular company, so fresh consent must be obtained before the marketing takes place, at the latest at the time of the first communication. An opt-out offered after the campaign has started cannot cure the defect.

What we recommend

If contact details obtained from a partner, data broker or lead generator are used for electronic marketing, verify that the consent specifically identified the organization sending the message. If not, obtain valid consent before the first communication.

Keep evidence of consent and ensure that partner arrangements require notification of withdrawals and objections and the suppression of contacts that may no longer be used.

European Commission proposes the EU KIDS Act on children’s access to social media

Date: September 17, 2026 | Source: European Commission
Link

The European Commission adopted the proposal for an EU KIDS Act, a regulation restricting access by children to social media platforms. The proposal prohibits platforms from giving access to children under 13 and sets an EU-wide minimum age of 15 for opening an account independently, while placing the burden on platforms to demonstrate that their services are age-appropriate and safe by design.

The proposal builds on the Digital Services Act and is intended to give parents more control over children’s online experience. Age-verification methods, enforcement timelines and penalties will be settled in the legislative process.

What we recommend

Providers of social, community, video-sharing, gaming, AI chatbot or similar services used by minors should assess whether they fall within the proposed scope and review age gates, parental controls, default settings and child-safety measures.

Where age assurance is used, collect only the personal data necessary to confirm age and reflect the processing in privacy information, the DPIA where required and supplier arrangements.

Irish DPC fines Google EUR 403 million over location data

Date: September 21, 2026 | Source: Data Protection Commission (Ireland)
Link

The Irish Data Protection Commission announced its final decision in the inquiry it had initiated into Google Ireland Limited’s processing of location data in the “Web & App Activity”, “Location History” and “Location Accuracy” features between May 25, 2018, and February 4, 2020, imposing administrative fines totaling EUR 403 million and ordering Google to bring its processing into compliance within six months.

The DPC found infringements of the lawfulness and fairness principles for Web & App Activity and Location History, of accountability for Location Accuracy, of transparency for all three features and of storage limitation through excessive retention of location data. The inquiry was opened in February 2020 following complaints by consumer organizations including BEUC, and the decision was adopted after cooperation with the concerned supervisory authorities under the one-stop-shop mechanism.

What we recommend

If location data are used, document the legal basis, necessity and retention period for each purpose or feature.

Explain at the point of activation what location data are collected, for which purposes, how account and device settings interact and how long the data are retained.

ENISA Threat Landscape 2026: ransomware and supply-chain risks remain at the top

Date: September 22, 2026 | Source: ENISA
Link

ENISA published the Threat Landscape 2026, covering incidents from January 1 to December 31, 2025. Ransomware remains the most disruptive threat, combining encryption, data theft and extortion. Social engineering, in particular phishing supported by phishing kits and the ClickFix technique, remains the main route to initial compromise. Exploitation of known or zero-day vulnerabilities accounted for 60 percent of unauthorized-access incidents. More than 48,000 new vulnerabilities were disclosed in 2025, a 22 percent annual increase.

Public administration was the most targeted sector (32 percent of incidents, largely ideology-driven DDoS), followed by business services (8 percent), transport (8 percent), manufacturing (7 percent) and finance and banking (6 percent). Seventy-three percent of targeted organizations fall within the NIS2 definitions of essential or important entities. The report highlights supply-chain and third-party dependencies as the source of the largest incidents and notes that online investment fraud alone cost about EUR 4 billion in the EEA in 2024.

What we recommend

Use the ENISA report as an external input to the organization’s ICT and cybersecurity risk assessment. Prioritize ransomware, supply-chain and third-party compromise, and exploitation of internet-facing vulnerabilities.

Update phishing training for ClickFix-style techniques, test incident procedures and review patching and supplier-remediation deadlines.

VDAI publishes a summary of 2025 court decisions on its complaints

Date: September 30, 2026 | Source: VDAI (State Data Protection Inspectorate, Lithuania)
Link

VDAI published a summary of the significant court decisions of 2025 in administrative cases arising from complaints handled by the Inspectorate, covering rulings of the Supreme Administrative Court of Lithuania (LVAT) and the Regional Administrative Court. The summary addresses the Inspectorate’s discretion in choosing corrective measures, the lawfulness of video surveillance, the processing of personal data to comply with a legal obligation or to collect service fees, and other recurring questions.

The summary is published in the “Court decisions (based on VDAI complaints)” section of the VDAI website and is the most direct indication of how Lithuanian courts test VDAI decisions and fines on appeal.

What we recommend

If your organization carries out video surveillance, debt collection, service-fee recovery or processing based on a legal obligation, compare its practices and documentation with the court summary and update them where the courts’ reasoning differs.

When responding to a VDAI investigation or considering an appeal, assess the evidence supporting the legal basis, necessity and safeguards and the proportionality factors relevant to the corrective measure.

EDPB consults on draft guidelines on administrative fines

Date: September 21, 2026 | Source: EDPB
Link

At its September plenary, the EDPB adopted draft guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR for public consultation. The consultation is open until November 13, 2026. The draft fining guidelines are intended to replace the former WP29 guidelines on administrative fines and complement the 2023 guidelines on the calculation of fines.

Under the draft guidelines, data protection authorities should follow a five-step method:

1. Determine whether the infringement may result in a fine under the GDPR or national law.
2. Determine whether the party under investigation may be fined for the provision breached.
3. Establish whether the infringement was intentional or negligent.
4. Assess aggravating and mitigating factors, with a reprimand generally available for minor infringements and a strong presumption of a fine for non-minor infringements.
5. Determine whether a fine would be effective, proportionate and dissuasive.

The draft also describes other corrective measures and provides 14 practical examples.

For companies, the draft’s approach to negligence is particularly relevant: actual awareness of a GDPR infringement is not necessarily required where the organization could not have been unaware of the risk and, acting with due care, should have identified it. Previous infringements may be treated as aggravating factors, including infringements of a different nature. Repeated minor failures may indicate a systemic compliance problem and support the imposition of a fine. Prompt and voluntary remediation, including timely notification, compensation of affected persons where appropriate, and additional technical or organizational measures, may materially reduce the likelihood or severity of corrective action.

What we recommend

Use the draft guidelines to review how GDPR risks and remedial actions are documented. A company may be considered negligent where it should have identified the risk even if it did not actually recognize the infringement.

Keep records of previous infringements and recurring control failures. After an incident, document prompt notification where required, remediation and measures taken to prevent recurrence, as these factors may affect the supervisory authority’s response.

EDPB adopts final guidelines on the interplay between the DSA and the GDPR

Date: September 17, 2026 | Source: EDPB
Link

The EDPB adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR following public consultation. The guidelines are addressed to providers of intermediary services, including online platforms, very large online platforms (VLOPs) and very large online search engines (VLOSEs), that must comply with both the DSA and the GDPR.

The guidelines clarify that the DSA advertising-transparency requirements supplement the GDPR information obligations. The DSA prohibits advertising based on profiling using special categories of personal data under Article 9 GDPR, even where the processing might otherwise have a legal basis and an Article 9 derogation under the GDPR.

They also address transparency of recommender systems, content moderation, account suspension and the protection of minors. Age-assurance measures should be proportionate and should not require more personal data than necessary.

What we recommend

If automated content removal or account suspension is used, assess whether Article 22 GDPR applies and provides human review and an effective challenge process where required.

Platforms displaying user advertisements should assess their controller or joint-controller role and prevent advertising or profiling based on special-category data.

Review recommender systems and age-assurance measures for transparency, data minimization and safeguards for minors.

Our view

Before reusing data from partners, public registers or external providers, review the legal basis, the information given to individuals and any limits on further use. According to the Advocate General, consent to marketing must name the organization that sends the message, so contacts obtained from partners may need fresh consent. The Court has yet to rule.

The EXTIA case resulted in a EUR 300,000 fine after more than three quarters of erasure requests were left unhandled or handled inadequately. The EDPB’s draft fining guidelines explain how overlooked risks and repeated failures may affect enforcement. An organization that should have identified a risk may be negligent even if it never noticed the infringement. Repeated minor failures can point to a systemic problem. Prompt, documented remediation can reduce the likelihood or severity of corrective action. Start with processes that generate repeated complaints or leave requests unresolved. Test a sample of requests from receipt to final response and record who is responsible for fixing each gap.

Test CRA reporting procedures before a reportable vulnerability or incident occurs. Legal, security and product teams should know who assesses the vulnerability or incident, obtains information from suppliers and submits the required reports. Proposals such as the EU KIDS Act and Advocate General opinions are worth tracking now, but implementation decisions should reflect their legal status.

How ECOVIS ProventusLaw can help

For the issues covered in this edition, we can assist with:

• Data subject rights: We prepare or review your procedures for handling erasure and access requests, from receipt to final response.
• Anonymization and data sharing: Based on your process documentation, we assess whether data can be treated as anonymous under the GDPR and define controller and processor roles. We also prepare data-sharing agreements and data protection impact assessments (DPIAs).
• Cyber Resilience Act readiness: We assess whether the CRA applies to your products. We also prepare reporting procedures for the 24-hour, 72-hour and final-report deadlines, coordinated with NIS2, DORA and GDPR reporting duties, where applicable.
• GDPR audits and remediation: We run gap analyses and prepare remediation plans and records that show what was fixed and when.
• VDAI investigations and appeals: We represent clients in VDAI investigations and in challenging the Inspectorate’s decisions before the Lithuanian administrative courts.

Contact our team to discuss a specific process, planned use of data or regulatory finding.

Why ECOVIS ProventusLaw

Our technology team advises on data protection and DORA requirements, including ICT risk management, incident reporting, ICT third-party risk and digital operational resilience testing. This is our advantage: one team covers both data protection and operational resilience, so your procedures and reports stay consistent.

The firm is ranked by IFLR1000 for M&A, Financial services regulatory, and Banking and finance. The Legal 500 ranks the firm for TMT, Tax, Real estate and construction, Fintech, Employment, Dispute resolution, and Banking, finance and capital markets. The firm is also ranked by Chambers and Partners in its FinTech and Europe guides.

Data protection and ICT are a core part of our fintech practice. Credit institutions, payment and e-money institutions and other fintech companies deal with GDPR and DORA every day. Read more in our insight on data protection in fintech companies. We also work with telecommunications, defense technology and logistics businesses.

Our advice is practical. We prepare procedures your teams can use, documents that match how your systems work, and evidence you can show a supervisory authority.

ECOVIS ProventusLaw operates across Lithuania, Latvia and Estonia and is part of the ECOVIS International network, present in more than 90 countries worldwide. This allows us to support clients on cross-border processing and multi-jurisdictional matters.

The post RegRally Insights: Personal Data Protection & ICT Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

This edition of RegRally covers employment law developments for employers, HR and payroll teams in Lithuania and across the EU, including the State Labour Inspectorate’s warnings on wage deductions and occupational safety, the draft rules on platform work and a GDPR fine for leaving erasure requests from job candidates and former employees unanswered.

Reminder: All employers must have a compliant pay structure by 31 December 2026

Deadline: December 31, 2026 | Source: Labour Code, Article 140(3)
Link | Our overview of the Pay Transparency Directive implementation in Lithuania

31 December 2026 is the deadline for employers to approve, or review and, where necessary, amend the pay structure (darbo apmokėjimo sistema, DAS) under Article 140 of the Labour Code and Article 23(4) of Law No XV-969. By that date, all employers, irrespective of their size, sector or nature of activities, must have objective and gender-neutral pay systems ensuring employees’ right to fair remuneration.

The pay structure will be mandatory for all employers and must be made available to all employees. Before approving or amending it, the employer must complete the information and consultation procedures required under the Labour Code.

The pay structure must group positions according to objective and gender-neutral criteria and set out the forms of pay, salary amounts or ranges, rules for additional remuneration, allowances and bonuses, and the criteria and procedure for salary indexation and increases. Employers with fewer than 50 employees are exempt from the obligation to set salary increase criteria and procedure.

Positions involving the same work or work of equal value must be assigned to the same position group, and equal pay must be ensured for men and women performing the same or equal-value work.

Why it matters

There is no small company exception. The obligation applies to all employers, irrespective of size, sector or nature of activities.

The grouping decisions made now will be carried forward. The same position categories will be used for pay transparency reporting from 2027, so inconsistencies in the grouping will carry into the reported data.

What we recommend for employers

Employers should:

• complete the preparation or review of their pay structure by 31 December 2026 and ensure that all positions are grouped using objective and gender-neutral criteria in line with Article 140(3) of the Labour Code
• map all existing roles against the pay structure and assign each employee to the appropriate position group
• check whether information and consultation procedures are required before approval or amendment
• align the internal categories with the categories that will later be used for pay transparency reporting

Breaches of occupational safety rules can move employers to a higher accident insurance tariff group

Date: September 3, 2026 | Source: Valstybinė darbo inspekcija (State Labour Inspectorate, VDI)
Link

VDI reminded employers that companies which fail to comply with occupational safety and health requirements may be assigned to a higher accident insurance contribution tariff group. Reassignment follows a serious or fatal accident at work caused by non-compliance, or a suspension of operations by inspectors during an inspection, for example where risks of falls from height, chemical exposure, falling objects, equipment faults or soil collapse are found without documented prevention measures.

Between 1 November 2025 and 27 August 2026 VDI issued 77 reclassification notices; the companies concerned will pay the higher social insurance contributions from 1 January 2027. Construction accounted for about half of the notices and manufacturing for a quarter, with the remainder in retail, agriculture, transport and utilities.

What we recommend for employers

Employers should run the VDI inspection checklists for their activity against current workplace risks and close any documented gaps before an inspection or incident triggers reclassification.

Finance teams should note that a reclassification notice issued in 2026 affects contributions from 1 January 2027 and budget accordingly.

Reminder: New rules on business trip daily allowances from 1 October 2026

Applies from: October 1, 2026 | Source: Government Resolution No 518 of 1 July 2026 (TAR)
Link | Our view on the new per diem rules

From 1 October 2026, new rules for paying business trip daily allowances (per diems) apply, adopted by Government Resolution No 518 of 1 July 2026. The State Labour Inspectorate has urged employers to review their business trip procedures, pay systems and other related internal documents ahead of the change. The new rules change when per diems can be reduced, add information guarantees for employees and introduce a new calculation method for certain trips.

For business trips shorter than 7 calendar days, where there is no collective agreement, per diems can no longer be reduced unilaterally by the employer through an internal policy.

For business trips lasting 7 calendar days or longer, reduced per diem rates may be established in an internal normative act, but may not be lower than 65% of the maximum rates established by the Government.

Reduced per diem rates may also be established in a collective agreement but may not be lower than 50% of the maximum rates.

An employee must know in advance what reduced per diem rate will apply to the business trip.

If the first or the last day of a trip lasts less than four hours, 20% of the applicable per diem rate is paid for that day.

No per diems are paid for a one-day business trip within Lithuania. For trips abroad, the Labour Code duty to pay per diem remains.

Why it matters

The changes concern every employer whose employees travel on business. The Inspectorate stresses that the review should cover not only internal documents but also how trips are organized in practice, how employees are informed and how per diems are calculated. HR, payroll and accounting processes need to be able to record trip duration, inform employees on time and calculate the amounts due correctly.

What we recommend for employers

Employers should:

• review the business trip procedure, the pay system and other related internal documents against the new rules
• identify whether reduced per diem rates are currently provided for and ensure that they comply with the new 7-day, 65% and 50% rules
• check that HR, payroll and accounting processes can record trip duration, inform employees on time and calculate the per diems due
• make sure employees know in advance when and at what rate reduced per diems will apply
• where a works council or trade union operates in the company, assess and, where applicable, carry out the information and consultation procedures set out in the Labour Code before setting per diem amounts or their payment rules in a local normative act

European Commission proposes Fair Labour Mobility package with digital A1 certificates

Date: September 15, 2026 | Source: European Commission
Link

The European Commission adopted a Fair Labour Mobility package of one communication and five legislative proposals. The package includes a European Social Security Pass (ESSPASS) for fully online issue of social security documents, including the portable document A1 for posted workers, through the EU Digital Identity Wallet; a Skills Portability Act with standardised digital qualification formats and faster recognition procedures; and a strengthened mandate for the European Labour Authority, with risk-assessment tools, inspection liaison officers, coverage of third-country nationals and illegal employment, and simplified mediation.

Digitalisation would be phased in after adoption by the Parliament and the Council, with the portable document A1 within one year and the European Health Insurance Card within three years; the qualification and ELA changes are planned for 2028 to 2030.

What we recommend for employers posting staff across borders

Employers that post staff across borders should follow the ESSPASS proposal, since digital A1 certificates will change how postings are documented and verified during inspections.

Groups employing third-country nationals in several Member States should note the proposed extension of the European Labour Authority’s remit to such workers and to concerted cross-border inspections.

State Labour Inspectorate: employers may not make deductions from wages at their own discretion

Date: September 21, 2026 | Source: Valstybinė darbo inspekcija (State Labour Inspectorate, VDI)
Link

VDI warned that an employer may not make deductions from an employee’s wages at its own discretion. Under the Labour Code, deductions are permitted only in the cases provided by law: recovery of unspent advances paid for work purposes, correction of arithmetical overpayments, compensation for damage caused through the employee’s fault subject to the statutory conditions, and, in limited cases, recovery of pay for annual leave taken in excess of entitlement.

For damage claims the employer must establish individual fault; it may not presume that all employees on shift are responsible for missing stock. Liability is generally capped at three average monthly wages (six for gross negligence), with full compensation only in cases such as intentional damage or crime. The written claim must be made within one month of discovery, a single deduction may not exceed one month’s wages, larger amounts require the Labour Disputes Commission, and “savings” schemes or advance acknowledgements of future damage are prohibited. Statutory limits of 10 to 50 percent of pay apply to deductions.

What we recommend for employers

Employers should remove any clauses in employment contracts, material liability agreements or internal rules that provide for automatic or collective deductions, and route damage claims through the statutory procedure.

Payroll should apply the one-month cap on single deductions and the statutory percentage limits and keep written records of the employee’s consent or the Labour Disputes Commission decision where required.

Reminder: Second Labour Code Amendment

In force from: November 1, 2026 | Source: Law No. XV-1058 amending the Labour Code
Link | Our view on the Second Labour Code Amendment

Significant amendments to the Labour Code were adopted and will enter into force on 1 November 2026.

Key changes include:

• Late payment penalties for employment-related payments are increased. Default interest will be linked to the consumer price index and multiplied by five, creating stronger incentives for employers to pay wages and other employment-related amounts on time.
• Clearer final settlement rules apply upon termination. Amounts up to one average monthly wage must generally be paid on the employee’s last working day or, if otherwise agreed, within up to 10 working days. Larger amounts may be deferred, but for no longer than three months after termination.
• Employees retain full remuneration for working hours reduced before public holidays. Where remuneration depends on work output or performance standards, employees must receive average remuneration for the shortened hours.
• A new ground for termination applies where an employee no longer meets the statutory good-reputation requirements applicable to their position.
• Highly remunerated employees earning at least twice the national average wage may agree to greater contractual flexibility, including deviations from a wider range of Labour Code provisions and certain aspects of employment termination. Their probationary period may be extended to six months instead of the general three-month limit.

What we recommend for employers

Employers should familiarise themselves with the upcoming amendments and assess whether the new flexibility introduced by the Labour Code could be beneficial in their organisation.

In particular, employers may wish to consider opportunities relating to:

• the engagement of highly remunerated employees
• termination processes
• internal investigation procedures
• settlement arrangements upon termination of employment

The Government approved draft amendments on platform work; parliamentary approval is still required

Date: September 30, 2026 | Source: Ministry of Social Security and Labour (SADM, Lithuania) — draft legislation
Link

On 30 September 2026, the Government approved draft amendments to the Labour Code and related laws prepared by the Ministry of Social Security and Labour to transpose the EU Platform Work Directive. This is a step in the legislative process: the proposals are not yet in force and must still be considered and adopted by the Seimas.

The draft seeks to improve the determination of employment status for people working through digital labour platforms. The assessment would be based on the actual circumstances of the work rather than solely on the wording of the contract, including indicators of subordination and the worker’s freedom to choose whether and when to work, provide similar services to third parties and negotiate or reject service terms without adverse consequences.

The proposals would also regulate algorithmic management. Platforms would face restrictions on collecting sensitive, private or work-unrelated data and would have to provide clear information about automated monitoring and decision-making systems, their criteria, the data used and their effects. Platform workers would have rights to explanations, human review and challenges to automated decisions. Final decisions affecting workers’ rights, such as dismissal or account blocking, would have to be taken by a person.

The draft also provides for regular checks against discrimination, data portability, and information and consultation before automated monitoring or decision-making systems are introduced or changed.

What we recommend for platform operators and companies using platform workers

Platform operators and companies using platform workers should monitor the proposal as it proceeds through the Seimas and assess its potential impact, without treating the draft requirements as already applicable.

As a preparatory step, companies may review contractor classification, identify algorithmic monitoring and decision-making tools, map the data used by those systems and assess whether human review and challenge procedures would be available if the amendments are adopted.

CNIL fines EXTIA EUR 300,000 over unhandled erasure requests from candidates and former employees

Date: September 9, 2026 | Source: CNIL (French Data Protection Authority)
Link

The CNIL fined the IT and engineering consultancy EXTIA EUR 300,000 for failing to respect the right to erasure and the information obligations under Articles 12 and 17 GDPR. The audit was carried out in April 2025 following complaints and as part of the EDPB Coordinated Enforcement Framework action on the right to erasure.

It was found that of 265 erasure requests received in 2024, mostly from job candidates and former employees, more than three quarters had not been handled or had been handled inadequately.

Twelve requests were not processed at all, 166 people were not informed of the outcome of their request and 27 were informed late, beyond the one-month deadline.

The fine reflects the number of people concerned and the fact that the company has already been reminded of its obligations twice.

What we recommend for employers

Review the process for handling erasure requests from all data subjects: intake, identity verification, responsible persons, searches across relevant systems, applicable retention exceptions and deletion from active and backup systems.

Respond to every request within one month, including where it is refused, partly granted or the data have already been deleted, and retain evidence of the assessment, action taken and response.

How ECOVIS ProventusLaw can help employers

ECOVIS ProventusLaw advises employers in Lithuania, Latvia and Estonia on employment, labor and migration law: employment contracts and internal rules, pay systems, terminations and restructuring, labor disputes, employment of foreigners and employment due diligence in transactions. We work with employers of every size and sector, from manufacturers, transport and logistics groups and defense industry investors to IT businesses, fintechs and start-ups.

Our employment lawyers can help you:

• prepare or review the pay structure (DAS) and group positions on objective and gender-neutral criteria
• review employment contracts, local normative acts and internal rules against the Labour Code amendments and the new per diem rules
• carry out a labor law due diligence of contracts, material liability agreements, wage deduction practices and business trip procedures
• handle dismissals, employee transfers, settlement arrangements, collective redundancies and consultation with employee representatives
• assess whether people working under civil-law contracts or through platforms are contractors or, in fact, employees
• handle candidate and employee data, retention periods and data subject requests, including erasure

Contact us if your pay structure or employment documents need review.

Why ECOVIS ProventusLaw

• Ranked employment practice. ECOVIS ProventusLaw is consistently ranked in Chambers and Partners’ Europe guide (Employment) and The Legal 500 among the leading law firms in the employment and labor law sector in Lithuania.
• More than 20 years of experience. Employment law has been one of the firm’s key practice areas for more than 20 years.
• Local lawyers in Lithuania, Latvia and Estonia. Our employment lawyers advise under each country’s own labor law. Employers with staff in several Baltic countries work with one contact.
• Support from market entry. We advise companies setting up in Lithuania, Latvia and Estonia on their employee strategy, employment documents and migration, including work permits, residence permits and national D visas.
• Full range of employment services. We advise on employment contracts and dismissals, internal policies and employee handbooks, share options, secondment of employees, employment of foreigners, labor taxation, unfair competition by employees and dispute resolution.

The post RegRally Insights: Employment & Migration Law Updates, October 2026 appeared first on ECOVIS ProventusLaw.

The EU’s Anti-Money Laundering Authority (AMLA) has made crypto a strategic priority. Crypto-asset service providers (CASPs) and payment institutions working with crypto businesses should expect EU supervisors to align their expectations, including how crypto flows are monitored. Staffing is under scrutiny too: an understaffed anti-money laundering (AML) team can become a regulatory finding. Estonia’s action against Wallester shows why staffing and independent oversight belong in an AML audit, alongside customer checks and transaction monitoring.

This edition of RegRally covers September’s anti-money laundering and counter-terrorist financing (AML/CTF) developments for financial institutions and crypto businesses in the Baltics and across the EU.

At a glance

• AMLA: crypto-assets are now a strategic priority. AMLA presented its Crypto Action Plan for 2026 and beyond and called for stronger blockchain analytics at EU level.
• United Kingdom: firms closed the accounts of 238,396 suspected money mules in 2025. The Financial Conduct Authority (FCA) wants mule activity stopped earlier.
• Estonia: Finantsinspektsioon ordered Wallester AS to remedy governance, safeguarding and AML/CTF deficiencies, including by ensuring sufficient AML/CTF staff, by 31 December 2026.
• CASPs: the Commission set the criteria under which host Member States may require a central contact point from CASPs operating through establishments other than branches.
• Latvia / EU case law: in Jautiva, the Court of Justice ruled that the General Data Protection Regulation (GDPR) precludes national rules making the personal data of all shareholders of public limited companies, including minority shareholders, public without conditions such as a legitimate interest, even where the rules serve AML/CTF and sanctions purposes.
• FATF: the Financial Action Task Force (FATF) reports that underground banking and hawala are increasingly associated with “money laundering as a service”, with a growing shift toward digital wallets and stablecoins.
• Gaming and gambling: the FATF published new risk indicators and found that in many jurisdictions illegal gambling markets rival or even exceed legal markets.

AMLA makes crypto a strategic priority

Date: 15 September 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

At the Global Conference on Criminal Finances and Cryptoassets in Luxembourg, AMLA Executive Board member Simonas Krepšta said that crypto-assets have become a strategic priority for the Authority. He presented AMLA’s Crypto Action Plan for 2026 and beyond, which focuses on four areas:

• improving EU-wide understanding of crypto-related risks;
• advancing supervisory consistency and effectiveness;
• strengthening analytical resources;
• deepening cooperation with relevant EU stakeholders.

AMLA is analyzing money laundering and terrorist financing risks in the crypto sector, and a report is expected to follow. Mr Krepšta highlighted the importance of strengthening blockchain-analytics capabilities, noting that the current fragmented approach across Member States requires an EU-level response.

He also noted that the Markets in Crypto-Assets Regulation (MiCA) and the AML package provide a stronger framework, but important risks remain. Effective implementation and supervisory convergence will be decisive.

Why it matters

Supervisory expectations for crypto businesses are likely to converge across the EU, including the use of blockchain analytics in supervision. As AMLA strengthens blockchain analytics, CASPs should expect closer scrutiny of their own analytics and wallet screening.

What we recommend for CASPs and payment institutions serving crypto businesses

• Expect supervisors across the EU to align their expectations under AMLA, including on the use of blockchain analytics in supervision. Make sure your analytics tools and wallet-screening coverage would withstand a supervisory review.
• Track the forthcoming AMLA crypto risk report. Plan to reflect its findings in the business-wide risk assessment and in the sectoral risk factors used in customer risk scoring.

FCA urges earlier action against money mule accounts

Date: 23 September 2026 | Source: FCA (UK)
Link

The FCA published the results of a survey of 35 retail banks, building societies, challenger banks, payment institutions and e-money institutions on how they handle money mule accounts. Firms closed the accounts of 238,396 suspected money mules in 2025, up from 233,269 in 2024 and 184,935 in 2023.

Closures were highest among customers aged 26 to 39, and customers aged 25 and under also made up a significant share. The sharpest increase was among customers aged 40 to 49.

The FCA found that criminals move fraudulent funds through several accounts and typically cash out between the second and fifth account. Some accounts had been used repeatedly for mule activity and had also been used for fraud, which points to established criminal infrastructure. The National Crime Agency estimates that more than GBP 100 billion is laundered annually through the UK or UK corporate structures.

According to the FCA, firms need to act on mule activity as early as possible. The FCA is also working with industry on an action plan, including better ways for firms and law enforcement to share intelligence on suspected mule activity. Card payments were the most common cash-out method, used for many low-value transactions or for higher-value payments to local businesses and retailers.

Why it matters

The survey covered payment and e-money institutions, not only banks. Closing a mule account is often too late, because by then the money has usually moved on through other accounts. The FCA says firms need to act as early as possible. In practice, this points to controls at onboarding and soon after an account is opened, before the funds are cashed out.

What we recommend for payment and e-money institutions

• Review account-opening controls and monitoring of new personal accounts. Set alert rules for funds moving rapidly in and out within days of onboarding and for accounts receiving funds from multiple unrelated payers.
• Have a documented process for restricting, closing and reporting mule accounts, and for sharing information with the financial intelligence unit (FIU) and, where the legal basis exists, with other payment service providers.
• Use the FCA age-profile findings to calibrate risk scoring for younger customers, without blanket restrictions that would breach access-to-account obligations.

Estonian supervisor orders Wallester to remedy governance and AML/CTF deficiencies

Date: 16 September 2026 | Source: Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)
Link

Finantsinspektsioon issued a precept (ettekirjutus) to the Estonian payment institution Wallester AS following an on-site inspection. The inspection assessed general and risk governance, the internal audit and compliance functions, capital management, reporting accuracy, the prevention of money laundering and terrorist financing, and the application of financial sanctions.

Wallester must remedy the deficiencies identified, including by:

• ensuring the separation of the three lines of defense at all levels;
• adopting and implementing the necessary internal rules;
• applying the statutory measures for safeguarding client assets;
• ensuring sufficient human resources for AML/CTF compliance.

The deficiencies must be remedied by 31 December 2026.

Why it matters

The precept requires internal rules, sufficient AML/CTF staff and separate lines of defense. Payment institutions’ AML reviews should examine procedures, who carries out controls, who can challenge business decisions and whether internal audit checks this independently.

What we recommend for payment and e-money institutions

• Assess AML/CTF staffing against transaction volumes and client numbers, and document the assessment. The supervisor explicitly identified AML/CTF staffing as an issue in this case.
• Confirm that the AML/CTF and sanctions functions sit in the second line and are independent from operational teams, with internal audit as a distinct third line. Make sure the organizational chart and job descriptions reflect this.
• Payment and e-money institutions with Estonian operations should be prepared for on-site inspections that combine governance, safeguarding, reporting and AML/CTF topics in a single review.

Commission extends AML central contact point standards to CASPs

Date: 8 September 2026 | Source: European Commission
Link

The European Commission adopted a Delegated Regulation (C(2026) 6179) amending Commission Delegated Regulation (EU) 2018/1108. As a result, the regulatory technical standards on the criteria for appointing central contact points, and the rules on their functions, will apply to crypto-asset service providers in addition to electronic money issuers and payment service providers.

A Member State may require a CASP to appoint a central contact point if the CASP has establishments on its territory in a form other than a branch and its head office is in another Member State. This is possible where any of the following applies:

• the CASP has 10 or more such establishments in that Member State;
• the cumulative value of the services and activities carried out by its establishments in that Member State is expected to exceed EUR 3 million per financial year, or exceeded that amount in the previous financial year;
• the information needed to assess these criteria is not provided to the host supervisor on request and in a timely manner.

Host Member States may also require a central contact point where this is commensurate with the money laundering or terrorist financing risk of those establishments and, in exceptional cases, where there are reasonable grounds to believe that this risk is high.

The central contact point must, among other things:

• facilitate the implementation of AML/CTF policies and procedures;
• oversee compliance;
• inform the head office of breaches;
• represent the CASP before the host authorities.

The act is subject to scrutiny by the European Parliament and the Council. It will enter into force on the twentieth day following its publication in the Official Journal.

Why it matters

A MiCA authorization lets a CASP offer services in other Member States, but AML/CTF supervisors in those countries can still oversee its local establishments. If a CASP works there through agents or other establishments that are not branches, the host state may require a central contact point: a local person or function responsible for AML/CTF compliance there.

What we recommend for cross-border CASPs

• CASPs passporting into Lithuania, Latvia or other Member States through agents or other non-branch establishments should compare the value of services provided through those establishments in each country with the EUR 3 million threshold. Prepare for a host-state request to appoint a central contact point.
• Draft the governance arrangements for a central contact point in advance, including the reporting line to the group AML officer and the mandate to act before host authorities and FIUs.
• Monitor publication in the Official Journal and the entry-into-force date. Check for any national implementing decisions by Lietuvos bankas or Latvijas Banka.

CJEU limits public access to shareholder data in Latvian case

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders.

The Court examined the Latvian rule requiring shareholder names, identification numbers, addresses, email addresses (where the shareholder asked the company to use them) and shareholding details to be published online, without restriction and downloadable in bulk. It accepted that the rule pursued legitimate objectives: business transparency, the prevention of money laundering and terrorist financing, and the implementation of sanctions. However, it found that unrestricted public access was disproportionate under the GDPR and the Charter, since less intrusive means exist, such as access conditional on a demonstrated legitimate interest.

The judgment builds on the 2022 ruling on public access to beneficial ownership registers. It confirms that AML/CTF and sanctions objectives do not justify unlimited public disclosure of the personal data of shareholders.

Why it matters

Firms that use public registers for customer due diligence may need to change how they get shareholder information. Limited public access does not remove the duty to identify and verify owners, so firms should be ready to meet access conditions or ask customers directly.

What we recommend for obliged entities

• Where customer due diligence relies on national shareholder or beneficial ownership registers, document the legal basis of access. In Latvia, obliged entities already have a statutory right under the AML law to obtain register data on members and beneficial owners. Elsewhere, be prepared for national registers to require a legitimate interest for access, and make sure the firm can demonstrate its legitimate interest as an obliged entity.
• Review internal data-protection notices covering the collection and retention of shareholder and beneficial ownership data, and confirm that the proportionality reasoning is recorded.
• For clients that are Latvian public limited liability companies, anticipate changes to the publicly available shareholder data. Adjust the customer due diligence (CDD) procedure to use direct requests to the client where register data becomes restricted.

FATF: underground banking and hawala increasingly associated with “money laundering as a service”

Date: 3 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on professional money launderers operating through underground banking, hawala and other similar service providers (HOSSPs). More than 80 percent of reporting jurisdictions identified these systems among the principal professional money laundering channels or techniques. Individual cases involved more than EUR 500 million laundered within a few months.

The report describes a shift toward commercially operated “money laundering as a service” networks that offer low commissions and rapid cross-border value transfer. Nearly 70 percent of respondents identified the integration of new technologies, including a growing shift toward “digital hawala”:

• operators coordinate through encrypted messaging apps;
• customers initiate transfers through digital wallets and fintech applications;
• operators settle balances between themselves in virtual assets, including stablecoins.

The proceeds handled now extend beyond drug trafficking to fraud, cyber-enabled crime, terrorist financing and illegal gaming.

The FATF notes growing involvement by lawyers, accountants, notaries, corporate agents, real estate agents and casino operators. These schemes are also becoming integrated with formal banking, fintech platforms and virtual asset services. It recommends combining targeted prevention and enforcement with proportionate financial inclusion measures, supported by legal clarity, better detection and public-private cooperation.

Why it matters

Digital hawala uses the same products many fintechs offer: customers send money through wallets and apps, and operators settle with each other in stablecoins. Each payment can look ordinary on its own, so the risk only shows when firms look at how incoming and outgoing flows and counterparties connect.

What we recommend for payment, e-money and crypto businesses

• Add the report’s typologies to the business-wide risk assessment. Pay particular attention to money remittance, multi-currency wallet, crypto on- and off-ramp and merchant acquiring products that can be used to net-settle informal value transfers.
• Review transaction-monitoring scenarios for patterns consistent with informal value transfer: offsetting flows between unrelated parties in different corridors, third-party settlement of trade invoices, and frequent stablecoin settlement between the same counterparties.
• Refresh staff training with the report’s red flags, and confirm that suspicious transaction reporting procedures cover professional intermediaries acting for clients.

FATF publishes risk indicators for gaming and gambling

Date: 9 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on money laundering and terrorist financing risks in gaming and gambling, together with a new set of risk indicators. The report finds that risks are rising with the expansion of online platforms and fast cross-border payments. In many jurisdictions, illegal gambling markets rival or even exceed the size of legal markets.

The indicators cover:

• multiple accounts and payment methods opened under different identities;
• discrepancies between customer and payment data;
• links to cyber fraud, organized crime or corruption;
• unusual or coordinated betting patterns suggesting match manipulation;
• smurfing and movement of funds without genuine gambling;
• complex ownership structures obscuring beneficial owners.

The FATF notes that payment methods such as cash, e-wallets, mobile money and virtual assets are vulnerable to a range of money laundering risks. Platforms depend on interconnected digital services that may fall outside the scope of regulation.

The FATF urges governments to strengthen oversight, crack down on illegal and offshore operators, and deepen international and public-private cooperation.

Why it matters

The risks extend to payment institutions, e-money institutions and CASPs processing gambling-related funds. A merchant’s stated business activity may not reveal where its customers are located, whether it has the required licenses or whether payments relate to genuine play.

What we recommend for payment and e-money institutions and CASPs serving gambling merchants

• Payment institutions, e-money institutions and CASPs that serve gambling operators or process gaming-related payments should incorporate the FATF indicators into merchant onboarding, ongoing monitoring and merchant-activity reviews.
• Verify that gambling merchants hold the license required in each jurisdiction where players are located, and that the firm’s own license and card-scheme rules permit the activity.
• Treat pass-through of gaming proceeds without genuine play, and repeated deposits and withdrawals across multiple payment instruments, as scenarios requiring alert rules in the monitoring system.

Our view

AMLA’s crypto priorities give CASPs and payment institutions serving crypto businesses a reason to review how they use blockchain analytics and wallet screening. We recommend testing coverage against the networks, assets and counterparties the business actually handles, and documenting how findings feed into customer risk assessments and investigations. Cross-border CASPs should also assess whether their local operations could fall within the central contact point framework.

The FCA and FATF findings provide specific patterns to test in transaction monitoring, including money mule activity, informal value transfers and gambling-related flows. The Wallester case also highlights staffing, independent compliance oversight and follow-up when gaps are found. Alerts are only useful if there are staff to investigate them.

The Latvian ruling may limit what firms can find in public registers, but it does not change their duty to identify and verify ownership.

How ECOVIS ProventusLaw can help with AML/CTF compliance

ECOVIS ProventusLaw advises payment and e-money institutions, CASPs, banks and other obliged entities on AML/CTF compliance, from risk assessments and policies to independent audits and remediation after a supervisory inspection. The aim is compliance that holds up under audit and inspection, so that our clients avoid fines, business restrictions and the suspension or withdrawal of their license.

For the issues covered in this edition, we can help with:

• Independent AML/CTF and sanctions audit – testing whether know-your-customer (KYC), transaction monitoring, screening and suspicious transaction reporting work in practice. Members of our audit team have carried out more than 50 internal and external AML and sanctions audits.
• Review of AML systems and tools – configuration of transaction monitoring, KYC software, and politically exposed person (PEP) and sanctions screening, including scenarios and thresholds. Where artificial intelligence (AI) or algorithmic tools support AML decisions, the review covers their role in customer risk scoring and monitoring, human oversight and retained evidence.
• Post-inspection remediation – remediation plans after findings by the Bank of Lithuania or another supervisor, and independent reviews of whether corrective measures have been implemented and work.
• Compliance support and governance – the three lines of defense, resourcing of the compliance function, internal controls and ongoing compliance support that turns audit findings into assigned actions and follows them through to completion.
• Money laundering and terrorist financing (ML/TF) risk assessments – business-wide and customer risk assessments that reflect new typologies such as digital hawala, money mules and gaming-related flows.
• AML policies, procedures and training – KYC, CDD and enhanced due diligence (EDD) procedures adapted to your business model, escalation procedures and internal investigations, and ML/TF training for staff and management.
• AMLA readiness and cross-border requirements – preparation for the EU AML package and AMLA supervision, and host-state requirements such as central contact points.
• AML/CTF for licensing and crypto businesses – the AML/CTF parts of license applications for payment, e-money and crypto businesses, and CASP-specific AML requirements, including Travel Rule controls, blockchain analytics and wallet screening.

If you are planning an audit or need to resolve known gaps, contact us and we will help you plan the work before the regulator asks.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics and has advised financial institutions for many years.

Our Banking, Finance & FinTech department has separate regulatory, compliance and audit teams. This gives clients access to legal advice, operational compliance support and independent testing, with roles defined for each engagement.

We adapt AML processes to each client’s business model, so that compliance does not hold up customer onboarding or day-to-day operations. We also work to supervisory timelines: we can carry out an audit quickly and support clients during an inspection or when they respond to the regulator’s findings and inspection reports.

The department is led by Inga Karulaitytė. Members of our teams hold the Certified Anti-Money Laundering Specialist (CAMS) and Certified Information Privacy Professional/Europe (CIPP/E) certifications and the International Compliance Association (ICA) International Advanced Certificate in Anti-Money Laundering, and our auditors are members of the Association of Internal Auditors. Before the actual audit, clients can check their readiness with RegRally, our AI-assisted AML compliance platform. They complete an expert-vetted AML questionnaire, upload documents and receive findings and recommendations within a couple of hours.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions. We have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.

The post RegRally Insights: AML/CTF Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

For fintechs, payment institutions and crypto businesses, each of these changes affects screening, onboarding and freezing decisions. This edition of RegRally covers the sanctions developments of September 2026 for financial institutions and fintech companies in the Baltics and across the EU.

At a glance

• Lithuania: in the Inter Rao Lietuva case, the Court of Justice of the EU ruled that control by a listed person must be shown by objective and sufficiently solid evidence. Informal control can count, but the nature of Russia’s political regime alone is not enough.
• EU listings: more than 3,000 Russia-related individual listings were extended until 22 September 2029. New listings followed over the deportation of Ukrainian children, the barring of Yabloko and hybrid threats.
• Crypto: OFAC designated the Xinbi Guarantee marketplace, its messaging and wallet developers, and associated wallet addresses.
• EU General Court: the Abramovich listing was upheld, confirming both “businessperson” criteria.
• United States: OFAC designated a Sinaloa Cartel laundering network and Iranian procurement agents, amended the Lukoil general license, ended the Ethiopia program and consolidated its penalty rules.

Court of Justice sets the evidence standard for control in Inter Rao Lietuva

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

The Court of Justice of the EU delivered its judgment in Case C-147/25 Inter Rao Lietuva, a reference from the Supreme Administrative Court of Lithuania. The company, an electricity importer and supplier, had its funds frozen in 2022 after the Lithuanian Financial Crime Investigation Service (FNTT) added it to a national list of persons linked to sanctioned persons. From May 2022, the listing was based on links to the President of Russia, who is subject to EU restrictive measures under Council Regulation (EU) No 269/2014. This rested mainly on the company being indirectly owned by the Russian company Inter RAO, whose main shareholders are undertakings indirectly owned by Russia.

The Court held that:

• Such a freeze implements the EU measures and is not a separate national sanction. It may apply to a company not named in the EU annexes if its funds belong to, or are owned, held or controlled by, a listed person. A mere “link” with a listed person is not enough: the authority must show that the funds belong to, or are owned, held or controlled by, that person. This applies even if the company can challenge the measure only after it has been listed. The grounds must, however, be communicated as soon as possible afterwards.
• The national court must make sure that the competent authority has established control objectively and on a sufficiently solid basis. Its review may be limited to the statement of reasons, the accuracy of the facts, any manifest error of assessment, compliance with procedural rules and misuse of powers, and it does not have to assess whether the measure is necessary in view of a threat to national security.
• Informal control can be taken into account, but only on objective and sufficiently solid evidence about the specific company. The autocratic nature of Russia’s political regime does not, in itself, prove that the President of Russia controls a company.

Why it matters

The ruling sets the standard of evidence for treating a company as controlled by a listed person. Informal control can count, while general assumptions about the Russian state do not. The case now returns to the Supreme Administrative Court of Lithuania, which will decide it in line with the ruling.

What we recommend for businesses

• Review your ownership-and-control screening methodology so that every “control” conclusion under Regulation 269/2014 is backed by concrete indicia, such as shareholder agreements, board appointment rights, funding flows or management overlap, rather than general assumptions about state influence.
• Where a client or counterparty has been treated as controlled by a listed person solely because of indirect Russian state ownership, reassess the file against the evidentiary standard set by the Court and record the outcome.
• Document the grounds for any internal decision to freeze funds or reject a client on control grounds, so that the decision can be explained to the competent authority.

EU extends Russia-related individual listings until 2029

Date: 22 September 2026 | Source: Council of the European Union
Link

The Council of the EU prolonged the individual restrictive measures under the regime concerning actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine for a further 36 months, until 22 September 2029. The measures apply to more than 3,000 individuals and entities and comprise asset freezes, travel bans and a prohibition on making funds or economic resources available.

Following its review, the Council decided not to renew the listings of three individuals and one entity, and removed three deceased persons from the list. Previously, the listings were renewed every six months.

Why it matters

The listings no longer need to be renewed every six months, but the Council can still add or remove names at any time, as the 28 September listings over the deportation of Ukrainian children show. The names that were not renewed are no longer on the list, so screening lists and any related freezes need to reflect them.

What we recommend for businesses

• Note the new expiry date of 22 September 2029 in the sanctions calendar and remove any internal contingency planning built around the six-month renewal risk.
• Update screening lists for the delisted persons and review any funds or economic resources frozen solely on the basis of those listings. Release them only after confirming that the persons are not listed under another EU regime or owned or controlled by another EU-listed person, and that no UK or U.S. restrictions apply to your business.
• Keep ownership-and-control checks against this list in the sanctions risk assessment for the full period of the listings.

OFAC sanctions the Xinbi Guarantee crypto marketplace and its wallet developer

Date: 9 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC designated Xinbi Guarantee, a Chinese-language online marketplace operating from Myanmar, Thailand and Laos, as a significant transnational criminal organization under Executive Order 13581, as amended by Executive Order 13863. It also designated SafeW Technology Co., Ltd. (Singapore), the developer of an encrypted messaging application, and Anwen Technology Co., Ltd. (Cambodia), the developer of the XinbiPay/NewPay crypto-asset wallet.

According to the U.S. Treasury, the marketplace has processed the equivalent of over USD 24 billion in digital assets and fiat currency since 2022, providing escrow services and connecting scam center operators in Southeast Asia, whose victims include Americans, with merchants offering money laundering, technology and other services. The Xinbi Guarantee SDN entry includes numerous associated crypto-asset wallet addresses. On the same day, the Department of Justice seized infrastructure and digital-asset wallets used by the marketplace. OFAC also amended ten existing FAQs and published two new licensing FAQs (1269 and 1270).

Why it matters

Because the designations include wallet addresses, exposure can be traced on-chain as well as by name. Under the OFAC 50 percent rule, entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by blocked persons are blocked too, even if they are not named.

What we recommend for crypto businesses and payment institutions

• Load the newly designated entities and the listed wallet addresses into sanctions and blockchain-analytics screening tools, and rescreen the transaction history of crypto-asset and payment clients for exposure.
• Reassess the risk rating of clients operating guarantee-type marketplaces, escrow services or wallet applications in Southeast Asia, and of clients with transaction flows to counterparties in Burma (Myanmar), Cambodia, Laos and Thailand.
• Remind the monitoring team that the OFAC 50 percent rule applies to entities owned 50 percent or more, individually or in the aggregate, by the designated organizations, and that U.S. dollar transactions and counterparties with a U.S. nexus must be screened against the updated SDN List.

EU sanctions 27 persons over the deportation of Ukrainian children

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU imposed restrictive measures on 10 individuals and 17 entities responsible for the unlawful deportation and forced transfer of Ukrainian children to Russia and within occupied territories, and for their forced assimilation. The listings were adopted under the Ukraine territorial-integrity regime by Council Decision (CFSP) 2026/2185 and Council Implementing Regulation (EU) 2026/2184.

Those listed include Rustam Minnikhanov, President of the Republic of Tatarstan, education and sports officials in the occupied territories, heads of children’s camps and schools, the Moscow City Tourism Committee, Russian companies active in children’s recreation and tourism, and the Songdowon International Children’s Camp in North Korea. Listed persons are subject to an asset freeze and, for natural persons, a travel ban. No funds or economic resources may be made available to them.

Why it matters

Besides officials, the listings include a public tourism body, children’s camps and sports centers, and companies in children’s recreation and tourism, so exposure is not limited to state officials.

What we recommend for businesses

• Update sanctions screening lists with the new designations and rescreen the client base, paying particular attention to travel, tourism, education and youth-camp businesses with Russian or occupied-territory links.
• Confirm that the screening tool ingests the consolidated EU list on the day of publication in the Official Journal.

General Court upholds the Abramovich listing

Date: 9 September 2026 | Source: General Court of the EU
Link

The General Court dismissed the action in Case T-358/25 Abramovich v Council, upholding the Council acts that extended the restrictive measures against Roman Abramovich until 15 March 2026 and dismissing his damages claim. The listing relies on the criteria covering leading businesspersons operating in Russia and businesspersons involved in economic sectors that provide a substantial source of revenue to the Russian Government.

The applicant argued that the listing had in practice been decided by Council working parties and that his designation reflected public notoriety rather than objective criteria. The Court rejected both arguments. It found that the Council retained full decision-making power and that his position as the principal shareholder in Evraz and his shareholding in Norilsk Nickel provided an objective basis for the listing. The Court also held that the criteria are sufficiently clear and proportionate, and that the travel ban is lawful even though he is also a Portuguese, and therefore EU, citizen, given the periodic review of listings and the available derogations.

Why it matters

The judgment confirms that significant holdings in key Russian companies can support a listing under these criteria, and that the criteria themselves are sufficiently precise and proportionate.

What we recommend for businesses

• Treat these criteria as judicially confirmed listing grounds, subject to any appeal to the Court of Justice, when assessing exposure to Russia-linked ultimate beneficial owners, including through significant holdings in revenue-generating sectors.
• Keep beneficial ownership information up to date for clients with Russian-linked shareholders so that new listings under this criterion can be identified and acted on the same day.
• Brief compliance and onboarding teams that a listing continues to apply while a court challenge is pending, so a pending challenge is not a reason to release funds.

EU lists ten individuals over the barring of Yabloko

Date: 28 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed ten individuals under the framework of restrictive measures in view of the situation in Russia, which targets serious human rights violations and the repression of civil society and the democratic opposition. The listings respond to the barring of the Yabloko party from the September 2026 State Duma elections and to the prosecution of its leaders.

Those listed include three judges of the Supreme Court of the Russian Federation, an official of the Prosecutor General’s Office, the judge and prosecutor involved in sentencing Lev Shlosberg, and judges involved in proceedings against Maxim Kruglov and Nikolai Rybakov. The regime now covers 108 individuals and 7 entities, all subject to an asset freeze and a prohibition on making funds or economic resources available.

Why it matters

This round targets judges and prosecutors, including three Supreme Court judges. The regime has its own legal basis, Regulation (EU) 2024/1485, and its own list.

What we recommend for businesses

• Add the ten designations to screening lists and confirm that the Russia human rights regime (Regulation (EU) 2024/1485) is included in the list sources used by your screening provider.

OFAC designates a Sinaloa Cartel laundering network and Iranian procurement agents

Date: 29 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC added 23 individuals and 30 entities to the SDN List in a coordinated action under its counter-narcotics, counter-terrorism, Iran-related and non-proliferation authorities, and updated six existing entries.

The largest group of designations targets the “Los Mayos” faction of the Sinaloa Cartel and its leader Ismael Zambada Sicairos. It also covers a network of businesses in northern Mexico, mainly in Baja California, used to launder proceeds, and politicians who protected the cartel. Among them are currency exchange houses (Galerias Centro Cambiario, MIA Centro Cambiario), real estate developers, hospitality venues and logistics operators. OFAC also designated five individuals and five entities linked to Kavoshcom Asia R&D Group and Iran’s Ministry of Defense and Armed Forces Logistics for military procurement conducted through intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.

Why it matters

The action names currency exchange houses and other cash-intensive businesses used for laundering, giving monitoring teams a current typology. All the new entries carry a secondary sanctions warning: non-U.S. financial institutions that knowingly conduct or facilitate significant transactions for these persons risk losing or facing restrictions on U.S. correspondent accounts.

What we recommend for payment and financial institutions

• Load the new designations into screening tools and rescreen counterparties in the currency exchange, real estate and hospitality sectors in northern Mexico, as well as trading intermediaries in China, Hong Kong, Saudi Arabia, Pakistan and Türkiye.
• Treat the exchange houses and cash-intensive businesses named in the action as an updated typology for cartel laundering when reviewing transaction-monitoring scenarios for USD and MXN flows.

OFAC amends the Lukoil general license and ends the Ethiopia program

Date: 18 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link

OFAC issued amended Russia-related General License 131J, which authorizes negotiations and contingent contracts for the sale of Lukoil International GmbH and the maintenance or wind-down of the operations of LIG entities. General License 131J is valid until 12:01 a.m. EDT on 22 October 2026. OFAC also announced the expiry of the national emergency concerning Ethiopia and removed the persons designated under that program, mainly Eritrean entities and officials, from the SDN List.

Why it matters

The license applies under U.S. sanctions only and does not change obligations under EU sanctions.

What we recommend for financial institutions

• Where you service counterparties connected to the Lukoil asset sale, check that the transactions fall within the scope and validity period of General License 131J and document your reliance on it.
• Update screening lists for the Ethiopia-related delistings, after confirming that no other listing ground applies.

EU lists former RT France head under the hybrid threats regime

Date: 24 September 2026 | Source: Council of the European Union
Link

The Council of the EU listed Xenia Fedorova, former President and Director of Information of RT France, under the hybrid threats regime (restrictive measures in view of Russia’s destabilizing activities) for continuing foreign information manipulation through French media after RT broadcasting was suspended in the EU. The regime now covers 81 individuals and 20 entities.

Why it matters

The hybrid threats regime is separate from the Russia territorial-integrity regime, with its own legal basis, Regulation (EU) 2024/2642, and its own list.

What we recommend for businesses

• Add the new listing to screening tools and check that the hybrid threats regime is included in the list sources used by your screening provider.

OFAC consolidates its penalty rules in new Sanctions Penalties Regulations

Date: 24 September 2026 | Source: OFAC (U.S. Department of the Treasury)
Link | 30 September rule

OFAC moved the penalty provisions for programs based on IEEPA and the UNPA, previously repeated across individual program regulations, into a single new part, the Sanctions Penalties Regulations (31 CFR Part 505). The first rule made no substantive changes to the penalties. A second rule of 30 September removed the old program-specific provisions and reorganized several program regulations. OFAC also removed a Syria-specific general license that is no longer needed after Syria was removed from the U.S. list of State Sponsors of Terrorism.

Why it matters

Since 30 September, sanctions policies that cite the old program-specific provisions may point to sections that have been removed or moved.

What we recommend for businesses with U.S. exposure

• Check references to OFAC penalty and procedural provisions in the sanctions policy against the reorganized regulations, including the new 31 CFR Part 505.

Our view

For the Baltics, Inter Rao Lietuva is the development of the month. It began as a Lithuanian freezing decision and now sets the evidence standard for control findings by national authorities across the EU. Informal control can count, while general assumptions about the Russian state cannot. Firms should check that their own control conclusions rest on evidence of this kind rather than on assumptions.

Most of the other September changes come down to keeping screening lists and procedures up to date. But screening alone does not make a sanctions program. It also takes a documented risk assessment, enhanced due diligence where the counterparty risk calls for it and someone who follows regulatory change as it happens. With enforcement paying more attention to circumvention, internal controls have to keep pace with how the rules are actually applied.

How ECOVIS ProventusLaw can help with sanctions compliance

ECOVIS ProventusLaw advises fintechs, payment institutions, crypto businesses and other financial institutions on EU sanctions compliance, sanctions screening, ownership and control analysis, Russia and Belarus sanctions, circumvention risks, crypto-asset sanctions compliance, trade restrictions and regulatory investigations.

We can help with:

• Sanctions compliance assessments – reviewing sanctions programs and risk assessments against current EU, U.S. and national requirements.
• Sanctions screening and risk reviews – list sources, screening configuration and ownership-and-control methodology.
• Internal policies and procedures – sanctions policies, freezing and escalation procedures, and internal controls.
• Supply chain and counterparty risk analysis – due diligence on counterparties, intermediaries and beneficial owners.
• Regulatory investigations and enforcement matters – asset freezes, supervisory inquiries and enforcement proceedings.
• Sanctions-related business structuring and compliance advice – transactions, restructurings and exits with sanctions exposure.
• Financial services licensing – license applications for fintech, payment, crypto and investment businesses, including the sanctions and AML/CFT controls supervisors review.
• Independent AML/CFT and sanctions audit – testing whether controls work in practice.

Contact us to discuss your sanctions controls, a licensing project or a transaction requiring legal review.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has advised financial institutions for many years and is one of the most experienced financial regulatory law firms in the Baltics.

Our advantage is having a dedicated regulatory team and a separate compliance team within the Banking and Finance and FinTech departments. The two teams work together to provide coordinated legal and operational support across licensing, AML/CFT, sanctions, internal controls and regulatory risk management.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions.

We were among the first legal advisors to crypto businesses in the Baltics and have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.

The post RegRally Insights: Sanctions Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

This edition is for crypto-asset service providers (CASPs), investment firms and fund managers in the Baltics and across the EU.

At a glance

• EU AML/CFT: the European Commission adopted Delegated Regulation C(2026) 6179, extending the anti-money laundering and countering the financing of terrorism (AML/CFT) central contact point standards to CASPs. A host Member State may require a contact point where, among other criteria, the value of services provided by a CASP’s local establishments exceeds EUR 3 million per financial year, or where the money laundering and terrorist financing (ML/TF) risk justifies it.
• MiCA review: the European Banking Authority (EBA) identified four priorities: multi-issuer stablecoin schemes with third-country issuers, the scope and classification of crypto-assets, crypto-asset lending, and reporting. 39 electronic money tokens (EMTs) had been issued as of 1 September 2026.
• Latvia: Latvijas Banka licensed SIA IBC INVEST as an investment firm. This was the third license in 2026, making it the 13th licensed investment firm in Latvia. It also registered SIA “Finterra” as an alternative investment fund manager (AIFM), bringing the total to 31 registered and three licensed managers.
• United Kingdom: the Financial Conduct Authority (FCA) published final perimeter guidance and opened its authorization gateway. The regime takes effect on 25 October 2027, and existing firms that apply by 28 February 2027 can continue operating while their application is assessed.
• ESMA: the European Securities and Markets Authority (ESMA) set a new Union Strategic Supervisory Priority (USSP) on digital innovation, covering artificial intelligence (AI) and tokenization, which applies from 2027. ESMA’s 2027 priorities also cover MiCA convergence, Digital Operational Resilience Act (DORA) oversight, the Retail Investment Strategy and T+1 settlement.

European Commission extends central contact point requirements to CASPs

Date: 8 September 2026 | Source: European Commission
Link

The European Commission adopted a Delegated Regulation (C(2026) 6179) that extends the regulatory technical standards on central contact points in Commission Delegated Regulation (EU) 2018/1108 to CASPs. Until now, these standards applied only to electronic money issuers and payment service providers operating in a host Member State through establishments other than branches.

A host Member State may require a CASP headquartered in another Member State to appoint a central contact point where, among other criteria, the cumulative value of the services and activities of its establishments in the host territory is expected to exceed EUR 3 million per financial year, or exceeded that amount in the previous financial year. It may also do so where this is commensurate with the ML/TF risk. The contact point must:

• facilitate the implementation of the CASP’s AML/CFT policies and procedures in the host state
• oversee compliance and inform the head office of breaches
• represent the CASP before the host supervisor and financial intelligence unit (FIU)

The act follows an EBA consultation and cost-benefit analysis. It enters into force twenty days after publication in the Official Journal, subject to scrutiny by the Parliament and the Council.

Why it matters

A MiCA authorization allows cross-border services within the EU, but local AML/CFT requirements still matter. For CASPs operating through establishments other than branches, a host-state contact point can mean additional local compliance responsibilities. CASPs providing only advice on crypto-assets fall outside the definition used in this act.

What we recommend for cross-border CASPs

• CASPs authorized in Lithuania or Latvia that serve other Member States through agents, physical points or local entities that are not branches should calculate the value of services provided in each country and identify where a host-state request is likely.
• Prepare a central contact point job description and reporting line that can be put in place on request.
• Reflect this possibility in the group AML/CFT policy and in the MiCA passport notifications.

EBA identifies four priorities for the MiCA review

Date: 24 September 2026 | Source: EBA
Link

The EBA published its response to the European Commission’s targeted consultation on the review of MiCA, identifying four priorities:

• Multi-issuer stablecoin schemes. The framework for schemes involving third-country issuers should be strengthened because the EBA assesses their risks as significant to very significant. Separately, the reserve requirements for issuers, notably the minimum amount of reserves held as deposits, should be reviewed.
• Scope and classification. The Commission should clarify the scope and classification of crypto-assets because uncertainty about classification creates avoidable costs and delays in launching products.
• Crypto-asset lending. The EBA encourages regulation of crypto-asset lending, including where CASPs facilitate access to decentralized lending protocols, because of the risks to consumers.
• Reporting. The reporting framework for issuers and service providers should be reviewed to improve supervision and risk monitoring.

The EBA notes that 39 EMTs had been issued as of 1 September 2026.

Why it matters

For stablecoin issuers and distributors, the review may change reserve requirements, while clearer classification rules could reduce uncertainty for firms developing products that sit between MiCA and other EU financial rules. Crypto-asset lending may also come within scope, but the EBA recommendations do not themselves create new obligations.

What we recommend for CASPs, crypto lenders and stablecoin issuers

• CASPs offering or intermediating lending, earn or staking-like yield products, or providing access to decentralized finance (DeFi) lending protocols, should document the legal analysis of these activities under current MiCA and national law. They should also prepare for these products to be brought expressly within scope.
• EMT issuers and CASPs distributing stablecoins issued under multi-issuer schemes with non-EU issuers should assess how changes to reserve requirements and stricter requirements for multi-issuer schemes would affect liquidity and redemption arrangements.
• Track the Commission’s MiCA review report and any legislative proposal, and align product classification memos with the EBA and ESMA positions on scope.

Latvia issues its third investment firm license of 2026 to IBC INVEST

Date: 17 September 2026 | Source: Latvijas Banka
Link

The Supervision Committee of Latvijas Banka issued an investment firm license to SIA IBC INVEST. The license covers reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, and placing of financial instruments without a firm commitment. It also covers two ancillary services: safekeeping of financial instruments and services related to underwriting.

This is the third investment firm license Latvijas Banka has issued in 2026, bringing the number of licensed investment firms in Latvia to 13. Latvijas Banka encouraged applicants to use its licensing guide and pre-licensing consultations.

Why it matters

Latvia’s fintech strategy for 2025–2027 targets a 30% increase in the number of fintech companies in the country, and Latvijas Banka continues to authorize new firms.

What we recommend for investment firms and applicants in Latvia

• Firms considering a Markets in Financial Instruments Directive II (MiFID II) license in Latvia should note the pace of authorizations in 2026 and use the pre-licensing consultation to prepare their application. They should focus on the initial capital for the requested services, safeguarding of client instruments and the conflicts framework for own-account dealing.
• Existing Latvian investment firms should review the competition and confirm that their own permissions cover the services they plan to add.

Latvia registers Finterra as an alternative investment fund manager

Date: 23 September 2026 | Source: Latvijas Banka
Link

The Supervision Committee of Latvijas Banka registered SIA “Finterra” as an AIFM on 22 September 2026. The company may provide alternative investment fund management services and supplementary services as provided in the Law on Alternative Investment Funds and their Managers.

Latvia now has 31 registered and three licensed AIFMs. Latvijas Banka directed applicants to the registration procedure and required documents on its website, where registration applications are submitted electronically.

Why it matters

For sponsors of smaller funds, registration may be an option where the applicable conditions are met. The choice between registration and a full license matters when planning how far the fund will grow and where it will raise capital.

What we recommend for fund managers and sponsors in Latvia

• Sponsors planning sub-threshold fund structures in Latvia should use the registration route where assets under management remain below the Alternative Investment Fund Managers Directive (AIFMD) thresholds. If the strategy anticipates leverage or growth that would take assets under management beyond the thresholds, they should plan for a full license.
• Registered managers should monitor the thresholds and the marketing rules that apply to sub-threshold managers, since registration does not confer a marketing passport.

FCA clarifies the scope of the UK cryptoasset regime

Date: 16 September 2026 | Source: FCA (UK)
Link

The FCA published final perimeter guidance on how the UK cryptoasset regime applies to different business activities: issuing qualifying stablecoins, operating a cryptoasset trading platform, dealing and arranging deals, safeguarding cryptoassets and arranging staking. The guidance clarifies “adding value” activities, staking arrangements and the distinction between asset types.

The FCA confirmed that authorization applications open on 30 September 2026 and that the regime takes effect on 25 October 2027. The Government has laid a final amending statutory instrument with limited exclusions, including for UK qualifying stablecoins and a technical-services exclusion from the arranging activity. The FCA will consult in October 2026 on targeted updates to the guidance. Pre-application meetings and webinars are available to prospective applicants.

Why it matters

The guidance helps firms serving UK customers determine which activities may require FCA authorization. For businesses operating in both the EU and the UK, this affects the scope of their UK application and how they organize compliance across the two regimes.

What we recommend for EU CASPs operating in the UK

• EU CASPs serving UK customers should use the guidance to map each of their services against the UK regulated activities. They should then decide whether to seek UK authorization, restructure the UK offering or withdraw before 25 October 2027.
• Groups with both MiCA and UK authorization plans should align governance, safeguarding and conflicts arrangements so that a single control framework satisfies both regimes. They should also book pre-application meetings early.

ESMA makes digital innovation a supervisory priority for 2027

Date: 23 September 2026 | Source: ESMA
Link

ESMA announced a new USSP on digital innovation, effective from 2027. The priority will focus on how supervised entities use AI and tokenization, with flexibility to cover other emerging technologies. It runs alongside the existing USSP on cyber and operational resilience launched in 2025. ESMA is also concluding the priority on environmental, social and governance (ESG) disclosures, launched in 2023.

ESMA will work with national competent authorities to ensure supervisors have the expertise and capacity to oversee the use of new technologies. Supervised entities, including investment firms, fund managers, trading venues and CASPs, should expect more supervisory attention to the governance, risk management and client-facing use of AI and tokenized instruments.

Why it matters

The priority helps direct national supervisory resources, so firms using AI or tokenization can expect these activities to receive more attention from 2027. This makes the governance and risk controls around their use relevant to supervisory reviews.

What we recommend for firms using AI and tokenization

• List the AI tools used in client onboarding, suitability and appropriateness assessments, trading, surveillance and customer communication. Document the governance, testing and human oversight arrangements for each.
• Firms issuing or servicing tokenized financial instruments should review how they classify the instruments under MiFID II and MiCA, and how custody, settlement and investor disclosure are handled. Lietuvos bankas and Latvijas Banka are expected to align their 2027 supervisory work programs with the USSP.

ESMA outlines its 2027 supervisory priorities

Date: 28 September 2026 | Source: ESMA
Link

ESMA published its 2027 priorities, describing 2027 as the year in which many Savings and Investments Union initiatives move into the delivery phase. ESMA will:

• strengthen supervisory convergence with national competent authorities on CASPs under MiCA
• advance the oversight of critical information and communication technology (ICT) third-party service providers under DORA, together with the other European Supervisory Authorities (ESAs)
• support the implementation of the Retail Investment Strategy and continue its simplification work, including on the retail investor journey

Other priorities include implementing the European Single Access Point, transitioning to T+1 settlement, reviewing the impact of the clearing reforms under the European Market Infrastructure Regulation (EMIR) 3 and deploying AI-based supervisory tools.

Why it matters

For CASPs, closer convergence on MiCA aims to make supervision more consistent across Member States. For investment firms and fund managers, work on the Retail Investment Strategy and T+1 settlement is relevant to how they serve retail investors and organize post-trade operations.

What we recommend for CASPs, investment firms and fund managers

• CASPs authorized in the Baltic states should expect peer reviews, common supervisory actions and Q&A-driven convergence on MiCA topics such as reverse solicitation, custody segregation and conflicts of interest. They should keep their policies aligned with ESMA guidance as it is issued.
• Investment firms and fund managers should plan for Retail Investment Strategy changes to inducements, value-for-money and disclosure rules, and for T+1 operational changes.

FCA opens UK cryptoasset authorization gateway

Date: 30 September 2026 | Source: FCA (UK)
Link

The FCA opened the authorization gateway for cryptoasset firms. Firms that want to carry on regulated cryptoasset activities in the UK from 25 October 2027 can now apply. The FCA stresses that authorization is not automatic: applicants must demonstrate compliance with standards on consumer protection, safeguarding of assets, market integrity and financial resilience.

Existing firms that apply by 28 February 2027 benefit from transitional arrangements. They can continue providing cryptoasset services, including taking on new customers, while their application is assessed, even if a decision is not reached before the regime takes effect. Pre-application meetings and webinars are available.

Why it matters

For existing cryptoasset firms intending to remain in the UK market, applying by 28 February 2027 is important for business continuity: it allows services and new business to continue while the application is assessed. This transitional protection does not guarantee authorization.

What we recommend for CASPs serving UK customers

• CASPs with UK customers that intend to remain in the UK market should aim to apply well before 28 February 2027 to secure transitional protection. They should prepare a UK-specific regulatory business plan, safeguarding arrangements and evidence of financial resilience.
• Firms that will not apply should plan an orderly withdrawal from UK customers before 25 October 2027 and update terms, marketing and geo-restrictions accordingly.

Our view

The UK application deadline is the only deadline in this edition that firms can act on now: applications filed by 28 February 2027 preserve transitional protection. The EU changes come later. The central contact point rules still need publication, the Commission is assessing responses to its MiCA review consultation, which closed on 30 September, and ESMA’s new priority applies from 2027. We expect the ESMA priorities and the central contact point rules to become part of day-to-day supervision in the Baltics in 2027, while any MiCA amendments would follow a separate legislative process.

In Latvia, interest from crypto-asset businesses keeps growing, and we are receiving inquiries about MiCA licensing in Latvia. Latvijas Banka continues to issue MiCA licenses, and we will cover the latest authorizations in next month’s edition.

How ECOVIS ProventusLaw can help crypto and investment businesses

ECOVIS ProventusLaw advises crypto-asset businesses, investment firms and fund managers on EU licensing, regulatory compliance and cross-border operations.

Our services related to the developments covered in this edition include:

• Gap assessments, compliance reviews and remediation – reviewing existing authorizations and operations against current requirements and supervisory priorities, and addressing identified gaps.
• MiCA authorization and CASP regulatory compliance – licensing strategy, regulatory perimeter assessments, EU passporting and ongoing compliance.
• Token classification and MiCA white papers – legal analysis of token offerings, stablecoins, tokenized assets and related regulatory requirements.
• MiFID II investment firm licensing – authorization applications, scope of permitted activities, governance and regulatory documentation.
• Investment fund management and AIFM licensing – fund structures, manager registration and licensing, and regulatory requirements.
• AML/CFT compliance – host-state requirements including central contact points, risk assessments, internal policies, controls and compliance arrangements for financial institutions and crypto businesses.
• Regulatory compliance and risk management – preparation for supervision, governance, DORA and ICT risk management, regulatory reporting and internal controls.

If your plans involve a license application, a question about the regulatory perimeter or a new regulatory proposal, we can help you assess the work required before the regulator asks.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics, with a long track record of advising financial institutions and early participants in the cryptocurrency market.

Our teams operate across Lithuania, Latvia and Estonia, providing clients with a single point of contact for regulatory and compliance matters throughout the Baltic region. Through the ECOVIS International network, present in more than 90 countries, we also support businesses operating across multiple jurisdictions.

As an early legal advisor to crypto businesses in the Baltics, ECOVIS ProventusLaw has developed extensive experience across all stages of crypto and financial services operations. We have advised on more than 40 end-to-end licensing projects, from initial business structuring and regulatory applications to ongoing supervision and compliance.

Our highly qualified and experienced regulatory and compliance teams within the Banking and Finance and FinTech departments work together to provide coordinated legal and operational support, including licensing, AML/CFT, sanctions, internal controls and regulatory risk management.

The post RegRally Insights: Crypto & Investments Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

The B-READY team applies a rigorous screening and selection process to identify private sector experts. Inga Karulaitytė’s selection reflects her expertise in financial services regulation, electronic payments and FinTech in Lithuania and the wider Baltic region. Her team advises payment service providers and FinTech companies entering the Baltic market on these matters.

ECOVIS ProventusLaw warmly congratulates Inga Karulaitytė on the World Bank Group Certificate of Appreciation for her contribution to B-READY 2026.

About Inga Karulaitytė

Inga Karulaitytė is a partner at ECOVIS ProventusLaw and head of the firm’s Banking & Finance and FinTech practices. She has more than 20 years of legal experience and is a member of the Lithuanian Bar. She is also registered to practice law in Latvia and Estonia.

Her practice focuses on FinTech regulation, anti-money laundering and counter-terrorist financing (AML/CTF), payments, compliance and international financial services. She is ranked annually by the international legal directories Chambers and Partners, The Legal 500 and IFLR1000.

About Business Ready (B-READY)

Business Ready (B-READY) is the World Bank Group’s flagship report benchmarking the business environment and investment climate in economies worldwide. B-READY succeeded the World Bank’s Doing Business report. It assesses the regulatory framework, public services and operational efficiency across ten topics. The Financial Services topic covers commercial lending, electronic payments, secured transactions and credit reporting.

Data are collected through expert questionnaires and firm-level surveys. The B-READY 2026 Electronic Payments questionnaire assesses the regulatory framework for payment service providers, including risk management, operational resilience, consumer protection, transparency, interoperability and supervisory oversight.

Once the B-READY 2026 report is published later in 2026, ECOVIS ProventusLaw will share the report’s main findings for Lithuania.

About ECOVIS ProventusLaw

ECOVIS ProventusLaw is a business law firm operating across Lithuania, Latvia and Estonia. The firm advises local and international clients on banking and finance, FinTech, financial services licensing and compliance, as well as corporate law, mergers and acquisitions, data protection, technology, employment law, dispute resolution and tax.

ECOVIS ProventusLaw is part of ECOVIS International, a global network operating in more than 90 countries and providing legal, tax and audit services. The firm and its lawyers are ranked by international legal directories, including Chambers and Partners, The Legal 500 and IFLR1000.

The post ECOVIS ProventusLaw partner Inga Karulaitytė selected as an independent expert for the World Bank Group’s B-READY 2026 study appeared first on ECOVIS ProventusLaw.

The September edition of RegRally covers the data protection and information and communication technology (ICT) developments of August that matter most to businesses processing personal data in Lithuania and across the EU.

This month at a glance

• Automated decisions: the Dutch Data Protection Authority fined Uber nearly EUR 825 million under Article 22 GDPR for deactivating drivers by automated decision-making without meaningful human intervention.
• Retention and erasure: noyb sent SCHUFA a cease-and-desist letter over an alleged shadow database, demanding genuine erasure, complete access responses and transparency, and opened an interest list for a possible class action.
• Video surveillance: Lithuania’s National Cyber Security Centre (NKSC), together with the Second Investigation Department under the Ministry of National Defence (AOTD) and the State Security Department (VSD), published recommendations on the secure use of video surveillance cameras.
• Plain-language GDPR: VDAI published material explaining data protection requirements in accessible language, useful for internal policies, staff training and privacy notices.

Uber’s EUR 825 million GDPR fine for automated decisions

Date: 21 August 2026 | Source: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Link | Link

What happened?

On 21 August 2026, the Dutch Data Protection Authority fined Uber EUR 824,990,000, nearly EUR 825 million, for the fully automated deactivation (blocking) of drivers. It is one of the largest GDPR penalties ever issued.

The decision turns on Article 22 GDPR. Drivers were deactivated by automated decision-making with no meaningful human intervention, and without the safeguards and transparency that provision requires for decisions producing legal effects or similarly significantly affecting data subjects.

Why does it matter for businesses?

The decision is significant for organizations using AI-supported or other algorithmic decision-making tools affecting individuals, including in HR, onboarding, offboarding, fraud prevention, compliance, risk scoring and account termination. It also confirms that regulators will treat the absence of genuine human review as a substantive breach of Article 22 GDPR rather than a mere procedural defect.

Recommended actions

Businesses using automated decision-making should:

• prepare an inventory of the decisions the organization makes about individuals without human involvement, for example blocking an account, terminating a contract or refusing a client on risk grounds
• assess for each whether Article 22 GDPR allows it to be taken on a fully automated basis
• make sure the human review behind an automated decision is genuine and can be evidenced: the reviewer should see the underlying data, have authority to change the outcome and leave a record of the review
• remember that a formal sign-off alone does not meet the Article 22 GDPR standard, as this was the central failing in the Uber decision
• check that privacy notices tell individuals when a decision about them is automated and what logic is involved
• keep a working procedure through which individuals can contest an automated decision and obtain human review, and document the safeguards in writing

SCHUFA and the GDPR: retention, erasure and access requests

Date: 26 August 2026 | Source: noyb (European Center for Digital Rights)
Link

What happened?

On 26 August 2026, noyb sent a cease-and-desist letter to the German credit information agency SCHUFA over an alleged shadow database and opened an interest list for a prospective class action. noyb demands that SCHUFA stop storing data beyond its own published retention periods, provide affected individuals with their historical data in response to access requests under Article 15 GDPR, and ensure transparency about its processing practices.

SCHUFA rejected the demands, so noyb has confirmed it will file for an injunction, and an interest list has been opened for a possible damages class action.

Why does it matter for businesses?

The dispute turns on retention and genuine erasure, and on the completeness of access responses. The allegation is that records which should have been deleted are only hidden from view and still used, including to develop and test scores.

Recommended actions

Businesses holding personal data should:

• map every dataset in which the organization holds personal data, including archives, backups and historical records
• check that the retention period the organization itself publishes is actually applied, and that data is genuinely erased at the end of that period, not merely hidden from everyday view while remaining available for other uses
• make sure responses to access requests under Article 15 GDPR cover all personal data held about the individual, including archived and historical records, not only what appears in the active system
• state in the privacy notice how long each category of data is kept and on what basis
• where historical data is reused for a further purpose, for example to develop or test scoring models, confirm that the further use has its own lawful basis and is disclosed to the individuals concerned

Video surveillance cameras: security recommendations from Lithuanian authorities

Date: 26 August 2026 | Source: National Cyber Security Centre (NKSC)
Link | Link

What happened?

On 26 August 2026, NKSC, AOTD and VSD jointly published recommendations on the secure use of video surveillance cameras, framing the issue as running from privacy to national security. The authorities stress that even a single unprotected camera can serve both as a source of valuable information and as an access point into the whole network of a home, company or organization.

Cameras deployed for security and monitoring are themselves attractive targets. Attackers who gain access can collect sensitive information for criminal purposes or in the interests of foreign states. The authorities point to the Dutch intelligence services’ July 2026 disclosure of systematic Russian digital espionage operations exploiting internet-connected cameras in the West and in Ukraine, where intercepted video feeds were used to identify military vehicle routes, weapons delivery routes and troop positions.

Why does it matter for businesses?

Poorly configured or unpatched devices create both a personal data exposure and a national security exposure. For businesses, camera security raises both GDPR and ICT security issues. The guidance also highlights the growing focus of public authorities on supply-chain security risks associated with connected devices and surveillance technologies.

Recommended actions

The baseline recommendations issued by the authorities are in substance the following:

• change the factory administrator password on every device to a strong and unique password that is not reused across units, and change it periodically
• update camera software and firmware regularly, and do not use devices the manufacturer no longer supports, replacing them with newer equipment from reliable manufacturers
• make sure there are no abandoned or unmonitored cameras still connected to the network
• where there is no genuine need, do not allow the camera to be reached directly from the internet. For remote access use only the manufacturer’s recommended solution or a VPN, and keep surveillance equipment in a separate network segment
• do not install or upgrade to surveillance equipment from untrusted manufacturers, in particular devices produced in China, Russia or Iran
• use features such as partial blurring where the image may otherwise reveal sensitive information, for example GPS location, and limit the camera’s field of view so that it does not capture excessive detail, such as an exact address, or confidential detail, such as computer screens or documents
• monitor whether cameras that do not belong to the organization have appeared on its property or are pointed at it
• include camera systems in the assessment of security of processing under Article 32 GDPR and, where the organization is subject to ICT rules such as the NIS2 Directive or the Digital Operational Resilience Act (DORA), also in its ICT risk management and incident reporting arrangements

VDAI explains data protection in plain language

Date: 28 August 2026 | Source: State Data Protection Inspectorate (VDAI)
Link

What happened?

On 28 August 2026, VDAI published material explaining data protection requirements in plain and accessible language, as part of its ongoing effort to make GDPR obligations comprehensible to controllers and data subjects.

Why does it matter for businesses?

The material shows how the Inspectorate itself explains key GDPR principles, and is useful when reviewing internal policies, staff training materials and privacy notices.

Recommended actions

Businesses processing personal data should:

• review the Inspectorate’s material and circulate it internally to the staff who handle personal data
• use it as a reference when reviewing internal policies, staff training materials and privacy notices

What should businesses take from this month’s developments?

The Uber decision is relevant to any business that uses automated decisions about individuals. If an account can be blocked, a contract terminated or a client refused without a person genuinely reviewing the decision, human review has to be real, evidenced and capable of changing the outcome.

Retention promises have to be kept in practice. The SCHUFA dispute turns on exactly that pattern: data kept beyond published retention periods, hidden from everyday view but still in use, and access responses that stop at the active system.

Camera systems can raise both data protection and ICT security issues. They belong in the Article 32 GDPR assessment of security of processing, and, for organizations under the NIS2 Directive or DORA, in ICT risk management and incident reporting arrangements.

How ECOVIS ProventusLaw can help

ECOVIS ProventusLaw advises businesses on telecommunications, IT and data protection matters, including GDPR compliance, automated decision-making, retention and erasure practices, privacy notices and the ICT requirements applying to connected devices.

For financial institutions, our team also covers data protection in fintech companies. As your legal advisors, we will be happy to assist with all questions related to these developments, including legal advice as well as the revision and preparation of your internal documents.

The post RegRally Insights: Personal Data Protection & ICT Regulation, September 2026 appeared first on ECOVIS ProventusLaw.