CASP Licence in Lithuania: The 2026 Guide

If you want a full EU crypto licence and you want it quickly, the phrase you keep hitting is “CASP in Lithuania”. It is not marketing shorthand — it is a specific authorisation, issued by a specific regulator, under a specific EU law. This guide sets out exactly what a Lithuanian CASP licence is, which services fall into which capital class, and how the EU passport actually works so you can plan the application around the parts that matter.

In our practice, the operators who get this right treat the CASP as what it is — a real financial-services licence with substance, capital and a technology-resilience programme — not the light-touch registration Lithuania was known for before 2025. The ones who struggle are the ones who budgeted for the old VASP world. Below is the version we scope from.

What a CASP authorisation actually is

CASP stands for Crypto-Asset Service Provider. It is the single licence created by MiCA — the EU’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 — for any business that provides crypto-asset services to third parties. Before MiCA, each EU country ran its own registration, and Lithuania’s was a national VASP (Virtual Asset Service Provider) registration that became famous for being fast and light. MiCA swept that away and put one harmonised authorisation in its place.

The Bank of Lithuania (Lietuvos bankas) is the competent authority that issues and supervises CASPs in Lithuania. That matters: a CASP is not a company registration or an AML notice, it is a supervised financial-services licence in the same family as an e-money or investment-firm authorisation. You apply to a central bank, you are assessed on fit-and-proper management and capital, and you report to that regulator for the life of the licence. For the wider picture of how these terms fit together, our explainer on VASP, CASP and MiCA unpacks the vocabulary in full.

The three service classes and their capital

MiCA does not charge one flat capital figure. It bundles the ten regulated crypto services into three capital classes, and your minimum own-funds requirement is fixed by the highest-class service you provide. Because these thresholds live in the regulation itself, they are the same in Lithuania as in every other EU state — you do not shop between EU countries for cheaper capital.

The dividing lines are worth reading carefully. The moment you hold client assets — custody, wallets, safeguarding — or run an exchange desk, you are in Class 2 at €125,000. The moment you operate the matching venue itself — a trading platform with an order book — you are in Class 3 at €150,000. A pure advisory or order-routing model that never touches client crypto can sit in Class 1 at €50,000. Most exchange businesses that people casually call “a crypto exchange” are Class 2 or Class 3 once you map what they really do; our crypto exchange licence guide walks through that classification for Lithuania specifically, and our CASP capital requirements piece breaks the tiers down further.

How EU-27 passporting works

This is the reason to license in the EU at all. Under MiCA Article 65, an authorised CASP that wants to provide services in other member states does not re-apply anywhere. It notifies the Bank of Lithuania of the host states and services it intends to offer; the Bank of Lithuania forwards that notification to the competent authorities in those states; and after a short notice period the firm can operate there. One authorisation, up to 27 markets, on a notification basis.

In practice that turns a single Lithuanian CASP into a passport for the entire European single market — the largest regulated crypto market in the world. You still respect each host country’s local marketing and consumer rules, and you still geo-block jurisdictions you are not authorised in, but you are not filing 27 licence applications or funding 27 lots of capital. That single-licence economics is the whole case for the EU route, and it is what our Lithuania crypto licence pillar covers end to end.

Why Lithuania is the EU’s default CASP gateway

If the capital and the passport are identical EU-wide, what makes Lithuania the most-used entry point? Two things: speed and ecosystem.

On speed, the Bank of Lithuania built genuine capacity for crypto and fintech authorisations well before MiCA and has kept one of the shorter CASP review queues in the EU — realistically three to six months on a complete file, against the longer waits at several larger regulators. On ecosystem, Lithuania already hosts one of Europe’s deepest benches of e-money institutions, payment firms and crypto companies, which means crypto-aware banking and EMI/PI partners, specialist compliance talent and auditors who have done this before are all on the ground. Add a competitive 15% corporate tax rate (with a 5% reduced band for qualifying small firms) and modest state fees — the Bank of Lithuania application fee starts from around €2,300 — and the total picture beats most alternatives on time-to-market rather than on any single line item.

The practical trade-off is substance. A Lithuanian CASP applicant is a Lithuanian company — typically a UAB (uždaroji akcinė bendrovė) — with a real registered office, genuine local operating presence, fit-and-proper management the regulator can assess, and a resident-anchored AML function. This is not an offshore shell with a nameplate; the Bank of Lithuania tests for real substance, and thin structures get sent back. If you are weighing this against the neighbouring Baltic option, our Estonia vs Lithuania comparison sets the two side by side.

DORA, AML and the compliance backbone

A CASP is a supervised licence, so the obligations run past day one. Two frameworks sit underneath every Lithuanian CASP.

AML/CFT. You need a dedicated money-laundering reporting officer (MLRO), customer due-diligence, transaction monitoring and suspicious-activity reporting aligned to the EU’s 5th and 6th AML directives, plus the Travel Rule — originator and beneficiary data attached to crypto transfers under the EU Transfer of Funds Regulation. This is the operational heart of the licence and the part regulators scrutinise hardest.

DORA. The Digital Operational Resilience Act — Regulation (EU) 2022/2554 — has applied to CASPs since 17 January 2025. It requires an ICT risk-management framework, incident classification and reporting, resilience testing, and oversight of your third-party technology providers. A CASP file submitted without a credible DORA programme is incomplete, and this is one of the most common reasons applications stall. On top of both sit MiCA’s own conduct rules: client-asset safeguarding and segregation, conflict-of-interest management, disclosures and complaints handling.

From the old VASP registration to CASP

For years, Lithuania’s draw was a fast national VASP registration with light requirements. MiCA ended that model. The national VASP regime is being retired, and the transitional window for previously registered VASPs closes by 1 July 2026 under MiCA Article 143(3). After that, CASP authorisation is the only route, and firms that leaned on the old registration must be fully MiCA-authorised to keep operating.

For anyone still holding a legacy registration, the sequence is straightforward but time-sensitive: scope your service classes and capital now, stand up the substance and the DORA and AML programmes, and file for CASP well ahead of the cliff rather than at it. Our VASP-to-CASP transition guide maps that migration step by step. New entrants skip the legacy stage entirely and apply for CASP directly — which, given the transition deadline, is usually the cleaner path anyway.

The upside for the extra rigour is real. A Bank of Lithuania CASP carries weight with banks, PSPs, auditors and institutional counterparties in a way an offshore registration never did, and it opens the whole EU by notification. It costs more in substance and capital than the old world, but it buys a durable, passportable EU credential — and for a serious crypto business that is precisely the point.

If you are deciding between service classes, weighing Lithuania against another EU or offshore home, or timing a VASP migration before the July 2026 deadline, we will map it to where your users and your capital actually sit and quote the real number. Book a free consultation and we will scope your CASP file end to end.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.