RegRally Insights: Payment Services Regulation, November 2026

Addressable business identifier code (ABIC) holders of the Bank of Lithuania must secure continued CENTROlink access by December 31, 2026, unless the Bank grants an extension. From January 1, 2027, a participant can register them only after submitting an independent CENTROlink audit report, so the audit has to come first.

November’s RegRally Insights also covers cheaper CENTROlink direct debits, supervision fees for 2027, a corporate exemption from strong customer authentication, clearer rules on when the Bank of Lithuania imposes fines, and, in Latvia, payment licenses for two crypto firms and payment accounts for minors.

Bank of Lithuania adopts new CENTROlink rules: participants may register ABIC holders from January 1, 2027

Date: October 22, 2026 | Source: Bank of Lithuania
Link (Resolution No 2026/03-121) | Link (Resolution No 2026/03-122)

The Bank of Lithuania (LB) Board has restated the CENTROlink operating rules in full (Resolution No 2026/03-121) and the rules for concluding ABIC holder contracts with LB (Resolution No 2026/03-122). Both resolutions have been in force since November 1, 2026. Since that date, the Bank of Lithuania has stopped signing new ABIC holder contracts.

Key changes include:

• The Bank of Lithuania’s own ABIC holders may operate in CENTROlink only until December 31, 2026. The Bank of Lithuania may allow an ABIC holder to continue until June 30, 2027 where there are important objective reasons.
• From January 1, 2027, a participant may register ABIC holders only if it has operated in CENTROlink for at least 12 months, executed at least 100,000 payment orders in the last 12 months, has adequate measures for anti-money laundering and counter-terrorist financing (AML/CTF), fraud prevention and sanctions for such relationships, and submits an independent audit report assessing those measures. Neither threshold applies where the prospective ABIC holder belongs to the participant’s group and their ultimate beneficial ownership structures match.
• An ABIC holder may be a credit institution, payment institution or electronic money institution (EMI) from a Single Euro Payments Area (SEPA) country outside the European Economic Area (EEA) in the participant’s group with the same beneficial owners, or an EEA small payment institution or EMI. Participants may register ABIC holders in the SEPA Credit Transfer and SEPA Instant Credit Transfer schemes.
• A credit institution, payment institution or EMI licensed in a SEPA country outside the EEA may also qualify. The country must have adequate technical compliance and effectiveness ratings in its latest Financial Action Task Force assessment and must be on neither its high-risk list nor its list of jurisdictions under increased monitoring. The Bank of Lithuania must also have a supervisory information-sharing agreement with the relevant authority.
• The application includes legal opinions and license documents. For an ABIC holder that is a payment institution or EMI, it must also specify the maximum collateral amount, provide a detailed calculation and identify the safeguarding accounts. The participant’s head must confirm in writing that no sanctions apply to the ABIC holder, its managers or its beneficial owners. Beneficial owners who jointly or individually hold a qualifying share of its capital and/or voting rights must not be Russian or Belarusian residents or citizens unless they have a right of residence in the EU or EEA. The confirmation must also state that the ABIC holder’s group includes no other companies established in Russia or Belarus. The Bank of Lithuania decides within 20 working days of a complete application.
• Participants must ensure that their ABIC holders meet the conditions at all times and submit the independent audit report on request and at least every two years. The Bank of Lithuania may deregister an ABIC holder without notice, for example for sanctions or license restrictions.
• From January 1, 2027, SEPA direct debit fees become tiered (from EUR 0.025 down to EUR 0.0035 per order, instead of a flat EUR 0.040), and connecting a fourth or further business identifier code (BIC) of the same participant costs EUR 1,000 instead of EUR 7,000.

Why does it matter for payment and electronic money institutions?

The independent audit is a condition for registration, not a follow-up step, so a participant that wants to host ABIC holders from January 2027 needs the audit report with its application. The Bank of Lithuania’s current ABIC holders have until December 31, 2026 to arrange continued access, unless the Bank grants an extension. The eligibility conditions exclude many payment service providers that are neither small institutions nor in the participant’s group.

Recommended actions

Payment and electronic money institutions should:

• if they are LB ABIC holders, choose a new access route before December 31, 2026 and consider whether to ask LB for an extension to June 30, 2027;
• if they plan to host ABIC holders, check the 12-month and 100,000-order thresholds;
• commission the independent CENTROlink audit of their AML/CTF, fraud and sanctions measures now, as the report is required before registering ABIC holders;
• update onboarding and monitoring procedures for ABIC holders, including the sanctions and Russia or Belarus ownership checks the participant must confirm;
• review the direct debit pricing that applies from January 1, 2027.

---

Bank of Lithuania sets 2027 supervision fees

Date: October 29, 2026 | Source: Bank of Lithuania
Link (Board decisions) | Link (supervision fee rates)

The Bank of Lithuania has set the maximum supervision fee rates for 2027. For fintech businesses, the main rates are:

• Electronic money institutions, including branches established in Lithuania: 0.65% of annual income from issuing electronic money and/or providing payment services.
• Payment institutions, including branches established in Lithuania of payment institutions licensed in the EEA: 0.65% of annual income from payment services.
• Crypto-asset service providers (CASPs) and issuers of asset-referenced tokens: 0.7% of annual income, with a minimum fee of EUR 3,000. Persons offering to the public or seeking admission to trading of other crypto-assets, except e-money tokens: EUR 3,000.
• Consumer credit providers and other credit providers that are not credit institutions: 0.0125% of the average annual outstanding amount of credit granted.

Why does it matter for payment and electronic money institutions?

The fee for EMIs, payment institutions and CASPs remains a percentage of income, which keeps it predictable.

Recommended actions

Supervised firms should:

• budget for the 2027 supervision fee based on the income or credit portfolio used as the fee base;
• make sure that this fee base can be separated from other revenue.

---

Latvijas Banka issues payment institution licenses to Neverless SIA and Noah LV SIA

Date: October 1, 2026 | Source: Latvijas Banka
Link (Neverless SIA) | Link (Noah LV SIA)

Latvijas Banka has granted payment institution licenses to two companies that also provide crypto-asset services. With these decisions, 13 companies hold payment institution licenses in Latvia.

• Neverless SIA may execute credit transfers and standing orders. The company already holds a Latvijas Banka license for crypto-asset services, obtained in May 2026.
• Noah LV SIA may execute payment transactions, credit transfers and standing orders. On the same day, it received a CASP license covering custody and administration of crypto-assets, exchange of crypto-assets for funds, execution of client orders and transfer services. Noah LV applied for the two licenses in separate procedures.

Why does it matter for payment and electronic money institutions?

Both decisions concern crypto businesses that also provide payment services. Under Article 70(4) of the Markets in Crypto-Assets Regulation (MiCA), a CASP may provide payment services related to its crypto-asset services only if it, or a third party it uses, is authorized to provide them under Directive (EU) 2015/2366.

Latvia aims to compete for such businesses in line with its government-approved Fintech Strategy and its commitment to increase the number of fintech companies by one third, create new jobs in the sector, attract investment, and establish Latvia as a competitive European fintech hub. Non-bank payment service providers can take part in SEPA payments directly through Latvijas Banka’s Electronic Clearing System (EKS), and Latvijas Banka’s Instant Verification Service checks payee names in real time for providers across Europe. Retained and reinvested profits are subject to 0% corporate income tax, and the Latvian, Lithuanian and Estonian Financial Intelligence Units share AML intelligence, which helps manage regional risk.

Lithuania’s payment infrastructure remains stronger, however. CENTROlink has more than 100 participants and gives payment and electronic money institutions licensed in the EEA direct access to SEPA.

Recommended actions

Crypto and payment businesses considering Latvia should:

• plan the CASP and payment institution applications in parallel if they intend to offer both services from launch;
• use Latvijas Banka’s licensing guides and pre-licensing consultations before filing.

---

Bank of Lithuania allows TransferGo Lithuania to apply the corporate exemption from strong customer authentication

Date: October 16, 2026 | Source: Bank of Lithuania
Link

The Bank of Lithuania has allowed the electronic money institution UAB TransferGo Lithuania not to apply strong customer authentication (SCA) to legal persons that initiate electronic payment transactions through dedicated payment processes. The decision applies the exemption for secure corporate payment processes and protocols in Article 17 of Commission Delegated Regulation (EU) 2018/389. The Bank of Lithuania found that the institution’s processes for initiating electronic payment transactions ensure a level of security no lower than that set by the Law on Payments.

Why does it matter for payment and electronic money institutions?

The exemption is not automatic. A payment service provider must apply to LB and show that its corporate payment processes ensure a level of security no lower than the law requires.

Recommended actions

Payment and electronic money institutions serving corporate clients should:

• check whether their dedicated payment processes, available only to payers who are not consumers, could qualify for the exemption;
• prepare evidence of the security of those processes before applying to LB.

---

Bank of Lithuania clarifies how it sets fines and treats minor breaches

Date: October 14, 2026 | Source: Bank of Lithuania
Link

The Bank of Lithuania Board has amended two resolutions on enforcement measures to answer questions that arose in practice.

• Fines. The revised procedure explains in more detail how the Bank of Lithuania assesses the seriousness and duration of a breach and assigns it to a category. Breaches range from not serious to very serious. The procedure also clarifies how the Bank weighs mitigating and aggravating circumstances, when it may reduce or increase a fine, and how it calculates fines for individuals.
• Minor breaches. The amended procedure for recognizing a breach as minor describes its features in more detail and provides that no enforcement measure is applied for a minor breach.

Institutions facing supervisory proceedings should assess their case against the new criteria on seriousness, duration, mitigating circumstances and minor breaches.

---

Latvia: payment service providers may open payment accounts for minors of any age, and minors aged 16 and over may manage their own accounts

Date: October 1, 2026 | Source: Law of September 17, 2026 amending the Payment Services and Electronic Money Law (Latvia)
Link

On September 17, 2026, the Saeima adopted amendments to the Latvian Payment Services and Electronic Money Law. They were published on October 1, 2026 and entered into force on October 15, 2026, except the changes linked to the transfer of consumer protection supervision to Latvijas Banka, which apply from January 1, 2027.

Key changes include:

• Accounts for minors. Under the new Article 79.1, a payment service provider may, according to its own policy, open a payment account or issue a payment instrument in a minor’s name regardless of age, with age-appropriate limits. Credit institutions may also pay interest and offer deposits.
• Under 16. One parent or other legal representative opens, manages and closes the account.
• From 16. The minor may enter into the account agreement and use funds that form part of his or her free property. The legal representative may receive information on the balance and transactions but may not give payment orders.
• From January 1, 2027. Latvijas Banka publishes the comparison of fees for payment account services and handles consumer complaints instead of the Consumer Rights Protection Centre.

Why does it matter for payment and electronic money institutions?

The amendments give Latvian providers a clear legal basis for children’s accounts and cards. Customer due diligence still applies, including identification of the legal representative.

Recommended actions

Payment service providers active in Latvia should:

• decide whether to offer accounts or instruments to minors and set age-appropriate limits in a written policy;
• prepare consumer complaint handling and fee reporting for Latvijas Banka from January 1, 2027.

---

Our view

The CENTROlink deadlines are the most urgent this month. The Bank of Lithuania’s ABIC holders need a new access route by December 31, 2026, and participants that want to register ABIC holders from January 1, 2027 need an independent audit report first. Hosting ABIC holders also brings ongoing duties: the participant confirms sanctions and ownership checks, monitors collateral and repeats the audit at least every two years.

The Bank of Lithuania’s other decisions make supervision more predictable. Supervision fees for EMIs, payment institutions and CASPs remain tied to income. The TransferGo decision shows that the Bank of Lithuania grants the corporate SCA exemption where dedicated processes are shown to be secure. The new rules on fines set out how the Bank assesses seriousness, duration and mitigating circumstances, and confirm that no enforcement measure is applied for a minor breach. Institutions that know these criteria can prepare in advance and avoid surprises.

In Latvia, the Neverless and Noah LV decisions show that crypto businesses can add payment services through a separate payment institution license. The amendments on minors’ accounts leave age limits and conditions to each provider, so providers should set them in a policy before launch.

---

How ECOVIS ProventusLaw can help payment and electronic money institutions

We advise payment and electronic money institutions from licensing to inspection findings and remediation.

• CENTROlink audit: independent audit of the AML/CTF, fraud prevention and sanctions measures required before registering ABIC holders.
• CENTROlink access: assessing eligibility under the new rules and preparing applications, legal opinions and supporting documents.
• ABIC holder onboarding: drafting due diligence procedures and contracts for participant-ABIC holder relationships.
• Licensing: payment and electronic money institution licensing in Lithuania, Latvia and Estonia.
• Inspections and remediation: responses to central bank inspection findings and AML/CTF remediation programs.
• Digital Operational Resilience Act (DORA) and outsourcing: outsourcing restructuring and information and communication technology (ICT) third-party risk under DORA.
• Product compliance in Latvia: advising on payment accounts and instruments for minors and updating terms for Latvijas Banka supervision from 2027.

Contact our fintech regulatory team to plan your CENTROlink route before January 1, 2027.

---

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has one of the most experienced legal teams in the Baltics advising payment and electronic money institutions. We help from the license application through to inspection findings, supervisory warnings and remediation, and now with the move to the new CENTROlink ABIC holder model. Our work includes licensing, responses to central bank inspection findings, AML/CTF remediation programs, outsourcing restructuring under DORA and regulatory due diligence for acquisitions of regulated institutions. We advise local and international clients on matters in Lithuania, Latvia, Estonia and other EU jurisdictions. Examples of our recent work are on our pages for payment institutions and electronic money institutions.

We have completed more than 40 licensing processes end to end in the Baltics, including for international payment businesses such as Nium and Contis Group.

Our Banking and Finance & FinTech department has separate teams for regulatory advice, compliance support, and AML/CTF and compliance audits. They work together with our Data Protection department, which covers General Data Protection Regulation (GDPR) compliance and DORA, including ICT governance and risk management, incident reporting, ICT third-party risk and outsourcing, and digital operational resilience testing. For CENTROlink participants, this means the audit required before registering ABIC holders is carried out by a team separate from the one that advises them.

This gives clients a one-stop shop with specialists in each area and a single point of contact who coordinates the teams’ work across Lithuania, Latvia and Estonia.

Through the ECOVIS International network, present in more than 90 countries, we can coordinate legal, tax and accounting support for clients operating across jurisdictions.

The firm is ranked by IFLR1000, The Legal 500 and Chambers and Partners for banking and finance and fintech work.