RegRally Insights: Payment Services Regulation, October 2026

For many payment and electronic money institutions, access to the Single Euro Payments Area (SEPA) through CENTROlink changes in January. The European Banking Authority’s new guidelines also extend third-party risk requirements well beyond IT.

In Latvia, our client Velvian SIA obtained a payment institution license, with ECOVIS ProventusLaw supporting selected parts of the licensing process.

EBA publishes final Guidelines on the management of third-party risk

Date: September 18, 2026 | Source: European Banking Authority
Link

The European Banking Authority (EBA) published its final Guidelines on the management of third-party risk, which replace the 2019 outsourcing guidelines with a framework covering both information and communication technology (ICT) and non-ICT third-party arrangements and aligned with the Digital Operational Resilience Act (DORA). The Guidelines apply to credit institutions, payment institutions and electronic money institutions, investment firms other than small and non-interconnected ones, issuers of asset-referenced tokens under the Markets in Crypto-Assets Regulation (MiCA) and certain mortgage creditors.

The Guidelines focus on third-party arrangements supporting critical or important functions, and cover the full lifecycle: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. For less material arrangements, the Guidelines reduce operational and supervisory burden, and proportionality is built in. The Guidelines incorporate Basel Committee principles and feedback from the public consultation.

A two-year transitional period applies to allow institutions to update existing arrangements and registers.

What we recommend

• Map existing outsourcing and third-party registers to the new scope, identifying non-ICT arrangements supporting critical or important functions (for example agent networks, card-program management, customer support and cash handling) that were previously outside the DORA register of information.
• Update the outsourcing policy, contract templates and exit plans to reflect the lifecycle requirements, and plan the remediation of legacy contracts within the transitional period.
• Align the third-party risk framework with the DORA register of information so that ICT arrangements are not recorded twice under inconsistent criteria.

---

Bank of Lithuania amends CENTROlink rules: participants to register ABIC holders

Date: September 24, 2026 | Source: Bank of Lithuania
Link | CENTROlink audit for participants with ABIC holders

The Bank of Lithuania launched a market consultation on amended CENTROlink operating rules, presented to participants on September 30, 2026. The amended rules take effect on November 1, 2026.

The addressable Business Identifier Code (ABIC) model operated by the Bank of Lithuania is being discontinued. Existing ABIC agreements end on December 30, 2026 and may, by way of exception, be extended until June 30, 2027. A deregistration fee of EUR 350 per scheme applies. Spanish electronic money institutions (EMIs) and payment institutions (PIs) gain direct participation from November 1, 2026.

A new model in which CENTROlink participants register ABIC holders opens for applications on November 1, 2026, with go-live from January 1, 2027. A direct participant may register an ABIC holder that cannot participate directly, via a group route (matching ultimate beneficial owner (UBO); EMIs and PIs from SEPA countries outside the European Economic Area (EEA), and EEA EMIs and PIs with restricted licenses) or a non-group route (non-EEA SEPA country with high Financial Action Task Force (FATF) ratings and a Bank of Lithuania cooperation agreement, currently the UK only). The participant needs audited anti-money laundering and counter-terrorist financing (AML/CTF), fraud and sanctions controls and, for non-group ABICs, 12 months of participation and 100,000 payments in the past year; it remains accountable for the ABIC holder (audits every two years, fees, fines, blocking or termination). ABIC holders get SEPA Credit Transfer (SCT) and SEPA Instant Credit Transfer (SCT Inst) only.

Other changes:

• From January 1, 2027 the SEPA Direct Debit (SDD) fee moves from EUR 0.04 to volume tiers of EUR 0.025 to 0.0035, and the fee for a fourth and subsequent BIC falls from EUR 7,000 to EUR 1,000.
• From November 1, 2026 the invoice deadline becomes the 15th working day of the following month, with a late-payment penalty of EUR 200 per month instead of a one-off EUR 100.
• Exceptions to collateral-breach penalties are defined.
• The US Office of Foreign Assets Control (OFAC) sanctions lists criterion applies universally, without the US-jurisdiction qualifier.

What we recommend

• Direct participants that plan to register ABIC holders should check that each candidate meets the conditions above and obtain an independent CENTROlink audit report on their AML/CTF, fraud prevention and sanctions controls.
• All participants should review their SDD fees for clients in light of the lower CENTROlink fees from 2027, align CENTROlink invoice payments with the new deadline, keep the balances in their CENTROlink collateral accounts within the set limits, and make sure their sanctions screening includes the US OFAC lists.
• Existing ABIC holders should plan the migration route now: direct participation if eligible or registration as an ABIC holder by a CENTROlink participant.

---

Bank of Lithuania warns an e-money institution over late annual financial statements

Date: September 18, 2026 | Source: Bank of Lithuania
Link

The Financial Market Supervision Committee of the Bank of Lithuania published its decisions of September 18, 2026, covering five matters:

• The Committee found that the electronic money institution UAB “Pervesk” had failed, within the statutory deadlines, to approve its 2025 annual financial statements, to adopt a profit (loss) allocation decision and to submit the audited statements, the allocation decision and the audit report. Having assessed all relevant circumstances, the Bank of Lithuania imposed a warning and ordered the documents to be submitted by October 9, 2026, failing which a periodic penalty payment will accrue for each day of delay.
• The Committee did not object to the indirect acquisition by CB Victoria Lux S.à r.l. of a qualifying holding of more than 20 percent but less than 30 percent of the share capital and voting rights of the payment institution Ebury Partners Lithuania UAB.
• On the application of the electronic money institution UAB B4B PAYMENTS EUROPE, the Committee entered its agent Tide Platform S.A. in the Public List of Electronic Money Institutions.
• The Committee granted UAB FMĮ Perpetus Wealth a category C financial brokerage firm license covering investment advice, portfolio management without custody, placing without a firm commitment and related advisory and research services.
• The Committee authorized the registration of amendments to the articles of association of RATO bankas, UAB increasing its share capital from EUR 6.1 million to EUR 8.1 million, and approved Marijana Romanova as board member and person responsible for risk management.

What we recommend

• Payment and e-money institutions should verify that the general meeting approving the annual financial statements and the allocation of profit is held within the statutory period and that the audited statements and audit report are filed with the Bank of Lithuania without delay; the audit engagement should be scheduled to allow this.
• Institutions appointing agents or distributors in other Member States should confirm that the agent is entered in the public list before it starts providing services in the institution’s name.
• Acquirers of indirect qualifying holdings in Lithuanian payment institutions should note that no-objection decisions are published with the identity of the acquirer and the size of the holding.

---

Bank of Latvia grants a payment institution license to Velvian SIA

Date: September 17, 2026 | Source: Bank of Latvia
Link

The Supervision Committee of the Bank of Latvia issued a payment institution license to Velvian SIA. The license permits the company to provide payment acceptance (acquiring) services, enabling merchants, platforms and business customers to accept card payments.

This is the seventh payment institution license issued by the Bank of Latvia in 2026, bringing the number of licensed payment institutions in Latvia to eleven. The Bank of Latvia again encouraged applicants to use its pre-licensing consultation service and licensing guides, noting that cooperation at the pre-licensing stage helps applicants prepare high-quality applications.

Velvian SIA is a client of ECOVIS ProventusLaw, and we supported the company on selected parts of its licensing process. Congratulations to the Velvian team.

What we recommend

• Prospective applicants in Latvia can significantly reduce licensing costs by combining our advice with the Bank of Latvia’s free pre-licensing consultations, particularly to align the business plan, safeguarding method and ICT and outsourcing arrangements with supervisory expectations before filing.
• Licensed institutions considering Latvia as a second Baltic hub should note the growing pace of authorizations in 2026 as an indicator of processing capacity and supervisory appetite for acquiring and merchant-services models.

---

Offline card payments now available at ten retail chains in Latvia

Date: September 10, 2026 | Source: Bank of Latvia
Link

The Bank of Latvia announced that offline card payments are now available at ten retail chains in Latvia, allowing consumers to buy essential goods when internet or mobile communications are down. The participating merchants are the grocers Rimi, Maxima and Lidl, the fuel retailers VIADA, ASTARTE NAFTA, Virši and Neste, and the pharmacy chains Euroaptieka, Mēness aptieka and BENU.

The solution works only during a communications outage and only for physical cards inserted into the terminal with PIN entry; contactless and mobile-wallet payments are not supported. Purchases are capped at EUR 200 per card and the merchant terminal must have electricity. Cards issued by Swedbank AS, AS SEB banka, AS Citadele banka and the Latvian branch of Luminor Bank AS are eligible.

The Bank of Latvia links the measure to the continuity of critical financial services required under the National Security Law: together with cash access through ATMs, offline card acceptance is meant to keep essential payments available to residents during a crisis.

What we recommend

• Card issuers and acquirers active in Latvia that are not yet part of the scheme should assess whether the Bank of Latvia or the card schemes will expect them to support offline authorization, and map the technical and risk requirements (offline limits, PIN verification, later settlement and chargeback treatment).
• Payment and e-money institutions issuing cards to Latvian residents should reflect in their business continuity plans that their cards will not work offline unless they join the arrangement, and consider whether to inform customers accordingly.
• Merchant-acquiring clients should confirm terminal configuration and electricity back-up for outlets classed as essential, since offline acceptance depends on both.

---

Bank of Lithuania does not object to EQT group’s indirect qualifying holding in Vinted Pay

Date: September 2, 2026 | Source: Bank of Lithuania
Link

The Financial Market Supervision Committee of the Bank of Lithuania published its decisions of September 2, 2026. The decisions cover three matters:

• The Committee did not object to the indirect acquisition by the Luxembourg companies EG1 SPV S.à r.l. and EQT Growth Vogue JV S.à r.l., acting in concert with other EQT group entities, of a qualifying holding of more than 10 percent but less than 20 percent of the share capital and voting rights of the electronic money institution Vinted Pay, UAB.
• The Committee approved the mandatory tender offer circular submitted by a natural person for the remaining 6,279,499 ordinary registered shares of AB “Novaturas”, at a price of EUR 0.877 per share.
• The Committee entered UAB Apdrausta in the list of insurance brokerage undertakings.

What we recommend

• Payment and e-money institutions planning capital raises from private-equity or venture investors should map the fund structure to identify every entity that will indirectly cross the 10, 20, 30 or 50 percent thresholds, and file the notification before the transaction closes.
• Ensure the shareholder register is updated after completion of the acquisition.

---

Bank of Lithuania names AI-enabled cyber threats among the main systemic risks for the financial sector

Date: September 11, 2026 | Source: Bank of Lithuania
Link

The Bank of Lithuania warned that next-generation artificial intelligence models pose a fundamental challenge to cyber security in the financial sector and classified AI-enabled cyber threats as one of the principal systemic risks in the sector. According to the Bank, modern AI systems can autonomously identify critical vulnerabilities, chain together separate weaknesses and execute attacks without direct human involvement, which fundamentally changes the nature of cyber threats. Renata Bagdonienė, Director of the Prudential Supervision Department, said the Bank would give these threats increased supervisory attention.

The Bank drew attention to the joint statement of the EBA, the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) on frontier AI models, which urges financial institutions to strengthen ICT risk management across prevention, threat detection and recovery. The statement stresses that no single solution fits all financial institutions.

The Bank of Lithuania discussed AI-related threats in detail at its consultative workshop on DORA implementation on September 17, 2026.

What we recommend

• Payment and e-money institutions and crypto-asset service providers (CASPs) should add AI-enabled attacks (automated vulnerability discovery, AI-generated phishing and deepfake social engineering against staff and customers) as a distinct threat category in the ICT risk assessment and the threat-led scenarios used for DORA testing.
• Review detection and response capabilities against faster, autonomous attack chains: shorter patching windows for critical vulnerabilities, anomaly-based monitoring and tested business-continuity procedures for a rapid multi-vector incident.
• Record the joint statement of the European Supervisory Authorities (ESAs) and the Bank of Lithuania’s position in the ICT risk management framework review, since the supervisor has said it will give AI-driven cyber risk increased supervisory attention.

---

Our view

ABIC holders and the participants that may register them have the least time. Existing ABIC agreements end on December 30, 2026 unless the Bank of Lithuania grants an extension, and a participant must have its AML/CTF, fraud prevention and sanctions controls independently audited before it can register anyone. A payment institution that reaches SEPA through an ABIC should already know whether it will connect directly or find a participant to register it.

The EBA third-party risk guidelines reach beyond ICT. Agent networks, card program management, customer support and cash handling may now need the same due diligence, contract terms and exit plans as ICT providers. The transition period is long, but renegotiating legacy contracts takes time, so start with the arrangements that support critical or important functions.

Routine obligations are also under supervisory review. The Bank of Lithuania issued a warning over late annual financial statements and publishes the names of acquirers and agents in its decisions. Schedule the audit and the general meeting early enough to meet the filing deadline, and make sure agents appear in the public list before they act in the institution’s name.

October showed that the Bank of Lithuania’s warning about AI-enabled cyber threats was well founded. Two critical PHP vulnerabilities, discovered with the help of AI tools, led many organizations to take their services offline until patches were available.

---

How ECOVIS ProventusLaw can help

We advise payment and electronic money institutions on licensing and on the obligations that follow it, including:

• Licensing: preparation of the application, business plan, safeguarding, ICT and outsourcing arrangements and representation during the payment institution licensing procedure.
• Baltic market entry: setting up a regulated payment business, including Latvia as a second Baltic hub.
• Qualifying holdings: shareholder suitability, qualifying holdings and changes of control, including indirect acquisitions through fund structures.
• SEPA access: advice on a direct SEPA connection via CENTROlink or access through a CENTROlink participant, including registration of ABIC holders by participants.
• CENTROlink audits: independent audits of CENTROlink participants with ABIC holders, covering AML/CTF, fraud prevention and sanctions measures, for submission to the Bank of Lithuania.
• Third-party risk and DORA: review of outsourcing policies, contracts, exit plans and the register of information against the EBA guidelines and DORA.
• Agents and passporting: agent and distributor networks, entry in the public list and cross-border expansion through passporting.
• Ongoing compliance: regulatory reporting, internal audit setup and remediation of supervisory findings after licensing.

Contact our fintech regulatory team to discuss CENTROlink access, licensing or any of the changes above.

---

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw has one of the most experienced legal teams in the Baltics advising payment and electronic money institutions. We help from the license application through to inspection findings, supervisory warnings and remediation. Our work includes licensing, responses to central bank inspection findings, AML/CTF remediation programs, outsourcing restructuring under DORA and regulatory due diligence for acquisitions of regulated institutions. We advise local and international clients on matters in Lithuania, Latvia, Estonia and other EU jurisdictions. Examples of our recent work are on our pages for payment institutions and electronic money institutions.

Our Banking, Finance and FinTech department has separate teams for regulatory advice, compliance support, and AML/CTF and compliance audits. They work together with our Data Protection department, which covers GDPR compliance and DORA, including ICT governance and risk management, incident reporting, ICT third-party risk and outsourcing, and digital operational resilience testing.

This gives clients a one-stop shop with specialists in each area and a single point of contact who coordinates their work across Lithuania, Latvia and Estonia.

The firm is ranked by IFLR1000, The Legal 500 and Chambers and Partners for banking and finance and fintech work.