RegRally Insights: Payment Services Regulation, September 2026

In August, the Bank of Lithuania restricted an electronic money institution over capital and shareholder-lending failures before any final decision, opened a consultation on how fines are calculated and when a breach counts as minor, and a draft law would let newly established financial institutions open their capital accumulation account at a payment or e-money institution instead of a bank.

At EU level, the new Anti-Money Laundering Authority (AMLA) is reaching payment institutions (PIs) and electronic money institutions (EMIs) directly, through the eligibility data collection that will decide who faces direct supervision and a survey on Central Contact Points. The September edition of RegRally covers what this means for PIs, EMIs and fintech groups in the Baltics and across the EU.

This month at a glance

• Lithuania enforcement: following an inspection, the Bank of Lithuania ordered EMI Verified Payments to restore capital adequacy by 1 October 2026 and, pending a separate decision, prohibited it from taking on new clients, encumbering assets and lending. The same bulletin licensed crowdfunding provider Finance EU (brand Florrid), Lithuania’s 16th, placing the country fifth in the EU.
• Lithuania sanctions methodology: draft amendments to the fine-calculation procedure and the minor-breach criteria are on public consultation, going directly to the amount of supervisory fines and the threshold for escalation. The industry association filed a joint position in August.
• Lithuania draft law: amendments to the Law on Financial Institutions would extend the shareholder-meeting deadline for approving annual accounts from 3 to 5 months and allow initial share capital to be deposited in an accumulation account at a licensed EMI or PI, not only a credit institution.
• AMLA direct supervision: the European Banking Authority (EBA) published the draft reporting framework for the 2027 eligibility data collection that will determine selection for AMLA direct supervision. PIs and EMIs are within the reporting population, with 31 December 2026 as the reference date.
• Passporting: AMLA surveyed payment service providers and EMIs operating through agents and distributors on Central Contact Points until 15 September 2026, feeding technical standards that will determine when a host state may require a CCP.

Bank of Lithuania restricts EMI Verified Payments and licenses crowdfunding provider Finance EU

Date: 5 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Financial Market Supervision Committee decisions bulletin of 5 August contained two decisions: supervisory instructions to an electronic money institution and a new crowdfunding license.

Following an inspection of Verified Payments, UAB, the Bank of Lithuania found the institution had failed to comply with the own funds (capital adequacy) requirement for a significant part of the inspected period, and that the breach remains unremedied. The institution had systematically granted significant loans to its shareholder for personal needs without applying effective credit risk management, and the inspection identified circumstances casting reasonable doubt on the sole shareholder’s financial capacity to ensure sound and financially sustainable management.

Without waiting for a final decision, and to protect clients’ interests immediately, the Bank of Lithuania ordered the institution to restore capital adequacy by 1 October 2026, to prepare and implement a plan acceptable to the supervisor for resolving shareholder-related issues, to report capital adequacy and financial data more frequently, and to notify the Bank of Lithuania in advance of any planned capital-increase actions and not carry them out until it raises no objection. Pending a separate decision, the institution is prohibited from establishing business relationships with new clients, providing them payment services or issuing electronic money, encumbering its financial assets, securing other persons’ obligations and lending its own funds.

In the same bulletin, a crowdfunding service provider license was granted to UAB “Finance EU”, which under the brand Florrid intends to offer investment in crowdfunding projects secured by real estate. The Bank of Lithuania noted that 16 companies now hold such licenses in Lithuania, placing the country fifth in the European Union by that measure.

Why it matters for payment institutions and EMIs

The case shows how much can happen before any final decision. Supervisory doubt about the shareholder alone, combined with an unremedied capital breach, was enough for a new-client ban, asset restrictions and a lending prohibition, all as interim measures.

It also puts related-party lending squarely on the supervisory map. Loans to a shareholder for personal needs, without credit risk management, read as a capital problem and a governance problem at once.

Recommended actions

EMIs and payment institutions should:

• be able to evidence continuous compliance with the own funds requirement between reporting dates, not only at period end
• treat related-party (shareholder) lending as a high-risk area governed by credit-risk policy, arm’s-length terms and documented approval, since it was central to this case
• ensure the financial capacity and suitability of shareholders can be substantiated, since supervisory doubt on this point alone can trigger a new-client ban and asset restrictions as interim measures
• monitor the institution’s communications and consider concentration risk (clients holding balances with a restricted EMI)
• note the increasingly competitive Lithuanian licensed population (prospective crowdfunding applicants)

---

Bank of Lithuania consults on how fines are calculated and when breaches count as minor

Date: August 2026 | Source: Lietuvos bankas (draft Board resolutions, public consultation)

What happened?

The Bank of Lithuania placed on public consultation draft amendments to two enforcement instruments: the Procedure for the Calculation of Fines and the Procedure for Determining When a Breach of a Legal Act Is Considered Minor.

Together these determine how the supervisor sets the amount of a fine and when it may treat a breach as minor and refrain from imposing an enforcement measure. The amendments therefore go directly to the quantum of supervisory sanctions and the threshold for escalation. The consultation attracted sector comments, including a joint position submitted by the industry association in August 2026.

Why it matters for payment institutions and EMIs

This is the math behind every future enforcement case. How a fine is calculated, and where the minor-breach line sits, changes both the realistic exposure of any finding and the calculus around self-reporting.

Recommended actions

Supervised entities should:

• review the draft methodology now and model its effect on realistic fine exposure, rather than waiting for the final resolutions
• reassess internal breach-classification and self-reporting practice against the revised minor-breach criteria
• consider responding to the consultation, individually or through an association, while the calculation methodology is still open

---

Draft law would ease incorporation and reporting deadlines for financial institutions

Date: 3 August 2026 | Source: Ministry of Finance / Government of the Republic of Lithuania
Link

What happened?

A draft law amending Articles 27 and 43 of the Law on Financial Institutions (No. IX-1068) was registered on 3 August 2026 (project No. 26-10473), prepared by the Ministry of Finance and submitted to the Seimas by the Government. Consultation with institutions and the public ran from 3 to 17 August 2026.

If adopted, two changes follow. The deadline for the general meeting of shareholders to approve annual financial statements and decide on profit distribution would be extended from 3 to 5 months after the financial year end, aligning it with the Law on Companies. And newly established financial institutions would be able to deposit initial share capital into an accumulation account held not only with a credit institution but also with an electronic money institution or payment institution licensed in Lithuania, again aligning with the Law on Companies and adding flexibility on incorporation.

Why it matters for payment institutions and EMIs

The accumulation-account change removes a practical bottleneck: today, setting up a financial institution depends on a bank agreeing to open the capital account. If the amendment passes, licensed EMIs and PIs can be on the other side of that service.

Recommended actions

Financial institutions should:

• note the prospective 5-month approval deadline when planning the 2026 annual accounts and profit-distribution timetable
• track adoption when advising on or setting up new financial institutions, since the accumulation-account change removes the practical dependence on a bank at incorporation
• assess the commercial opportunity in offering accumulation accounts if the amendment passes (licensed EMIs and PIs)

---

AMLA’s 2027 eligibility data collection includes PIs and EMIs

Date: 4 August 2026 | Source: EBA (European Banking Authority)
Link

What happened?

The EBA published, as part of release 4.4 of its reporting framework, a public working draft of the data model and taxonomy that will support the 2027 eligibility data collection underpinning AMLA’s first selection of institutions for direct supervision. Credit and financial institutions fall within the population that must report, including payment institutions and electronic money institutions.

For PIs and EMIs this introduces a concrete reporting exercise. Data gathered in early 2027 will confirm whether provisionally eligible entities still meet the criteria as of 31 December 2026, with the prospect of EU-level direct supervision from 2028. The consultation on the draft closed on 24 August 2026.

Why it matters for payment institutions and EMIs

For PI and EMI reporting teams this is a data exercise with templates, a taxonomy and a fixed reference date. The data reported in early 2027 will reflect the position as of the 31 December 2026 reference date.

Recommended actions

PI and EMI compliance and reporting teams should:

• scope the reporting obligation and prepare the underlying data against the draft templates
• monitor the final eligibility criteria and thresholds
• assess governance readiness for potential AMLA direct supervision

---

AMLA’s Central Contact Point survey goes to the heart of the passported PI and EMI model

Date: 6 August 2026 | Source: AMLA (Authority for Anti-Money Laundering and Countering the Financing of Terrorism)
Link

What happened?

AMLA launched a survey on Central Contact Points (CCPs) directed at payment service providers and electronic money institutions that operate in host Member States through agents and distributors, drawing on Article 45(9) of the Anti-Money Laundering Directive (AMLD) and Delegated Regulation (EU) 2018/1108.

The initiative feeds regulatory technical standards (RTS) under Article 41(2) of the AMLD, determining when a host authority may require a CCP and what its functions are. That is a core operating-model question for passported PI and EMI activity, since a CCP obligation affects local representation, governance and AML/CFT accountability in each host market.

The survey closed on 15 September 2026. Crypto-asset service providers are outside its scope.

Why it matters for payment institutions and EMIs

For an institution passporting through agents and distributors, CCP rules decide how much local substance each host market demands. The future RTS will standardize that answer across the EU, and the survey is where the practical input went in.

Recommended actions

PIs and EMIs with agent or distributor networks should:

• map host-state CCP requirements against current agent and distributor arrangements
• factor potential CCP obligations into passporting strategy, local-representation and governance arrangements
• track the resulting Article 41(2) RTS, which may standardize CCP requirements across the EU

---

Key takeaways for payment institutions and EMIs

Verified Payments is the case to read closely. Own funds compliance is continuous, shareholder lending is a supervisory topic, and doubt about the shareholder alone can trigger a new-client ban and asset restrictions long before any final decision.

The domestic rulebook is moving too. The fine-calculation methodology and the minor-breach threshold are open for consultation, and the draft law on accumulation accounts would turn EMIs and PIs from bank-dependent applicants into providers of the incorporation service themselves. Both are worth engaging with while they are still drafts.

And AMLA now reaches PIs and EMIs directly. The eligibility reporting exercise fixes positions against 31 December 2026, and the Central Contact Point survey, closed on 15 September, will feed the standards on how much local substance passported models need in each host market.

---

How ECOVIS ProventusLaw can help payment institutions and EMIs

Our payments team supports PIs, EMIs and fintech groups across the Baltics with fintech and financial institution licensing in the EU, including:

• PI and EMI license applications and authorization strategy
• own funds, safeguarding and prudential compliance questions
• responding to inspections, supervisory instructions and enforcement
• shareholder suitability, qualifying holdings and changes of control
• passporting, agent and distributor networks, and Central Contact Point questions
• AML/CTF frameworks and AMLA readiness
• wind-down planning and regulatory reporting
• consultations and dialogue with financial supervisors

If a supervisory instruction, a capital question or an AMLA reporting obligation has landed on your desk, we can help you respond with a plan the regulator will accept.