Lithuania Crypto Licence Check: Verify a CASP in 2026

Whether you are a compliance team onboarding a crypto merchant, a bank sizing up a counterparty, or a founder proving your own authorisation, a “Lithuania crypto licence” is only worth what the regulator’s register says it is. In 2026 that has a sharp edge, because the credential most firms still wave around — an old Lithuanian VASP registration — is not the licence that carries weight across the EU.

In our practice we run a Lithuania crypto license register check before every partner introduction and banking application (we also mirror the EU-wide register weekly at EU MiCA CASP data), and it has two halves that must both pass: the Bank of Lithuania’s national register on lb.lt, and the ESMA MiCA register of authorised CASPs. This guide shows how to run that search the way we do, what a valid CASP entry actually shows, how to tell a genuine MiCA authorisation from a lapsed VASP registration that expires on 1 July 2026, and the red flags that separate a real EU licence from a certificate that verifies against nothing.

Why the check has two halves in 2026

Before MiCA, “licensed in Lithuania” meant a national VASP registration — an anti-money-laundering registration recorded with the Register of Legal Entities and supervised via the Financial Crime Investigation Service (FCIS). It was quick to obtain, never an EU licence, and did not let a firm passport a single service across a border. Thousands of companies collected one, and many still print “crypto licence, Lithuania” on their websites.

That world is closing. Under the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), the national VASP regime is being replaced by a single EU credential: the Crypto-Asset Service Provider (CASP) authorisation, issued in Lithuania by the Bank of Lithuania (Lietuvos bankas). A CASP licence is a real financial-services authorisation — genuine local substance, qualified management, an MLRO, minimum capital of €50,000 to €150,000 by service class, and a DORA-compliant ICT framework — and it passports across all 27 EU states on a notification basis under MiCA Article 65. The transitional window for previously registered VASPs to convert (or fall away) closes on 1 July 2026 under MiCA Article 143(3).

That transition drives almost all of the confusion. During the wind-down a firm can still hold a live-looking VASP registration while having no CASP authorisation at all — so you can no longer treat a Lithuanian crypto credential as a single yes/no badge. Our VASP-to-CASP transition guide covers the deadline in full; for verification, only a live CASP entry counts.

Step one — the Bank of Lithuania register (lb.lt)

The Bank of Lithuania publishes its supervised entities in a public Financial Market Participants register, with a dedicated list of authorised crypto-asset service providers. Reach it by typing the regulator’s own address — never through a link embedded in a certificate, and be wary of search results echoing the regulator’s name on a slightly-off domain.

Search by the exact legal entity that will contract with you — the Lithuanian UAB, ideally with its registration code — not the consumer brand in the logo. A genuine record returns that company as an authorised CASP, with an authorisation date and active status. A brand that cannot be tied to a named, authorised entity is a reason to stop before any commercial question.

Then read the services the entry lists. A CASP is authorised for specific crypto-asset services, and the record tells you which: reception and transmission of orders, execution, placing, advice, portfolio management, transfer services, exchange of crypto for funds or other crypto, custody and administration, or operating a trading platform. This field is decisive — a firm authorised only for reception/transmission and advice is not licensed to run an exchange or custody wallets.

Step two — the ESMA MiCA register

The Bank of Lithuania authorises and lists a CASP nationally, but MiCA is an EU regime, so there is a second, EU-wide source of truth: the ESMA register of authorised CASPs, which aggregates every national regulator’s entries into one place. It confirms two things the national list alone will not always spell out.

First, it corroborates the authorisation — the same Lithuanian entity should appear on ESMA as an authorised CASP, independently confirming the licence is real rather than a certificate a lookalike site invented. Second, and more useful, ESMA shows the host member states a CASP has passported into. Because a Lithuanian CASP serves other EU markets by notification under Article 65, this is where you check whether the firm may lawfully serve the country you (or your users) sit in. A licence genuine in Lithuania but never passported into, say, Germany is not authorisation to serve German customers.

If a firm appears on the Bank of Lithuania list but not on ESMA, or vice versa, that mismatch is itself a finding — treat the “MiCA licence” claim as unproven until both line up. The point of MiCA was to make cross-border crypto authorisation checkable in exactly this way; use both registers, not one. Our explainer on how VASP, CASP and MiCA fit together is worth a read if the terminology still feels slippery.

What good looks like: the verification table

Knowing what each field tells you is what turns a glance into a real check. Use the table below as the verification you — or a diligent bank — should run before onboarding.

The service-classes field is the one to lean on. A firm can hold a perfectly real CASP authorisation and still operate beyond it — advertising custody or an exchange when it is only authorised for reception, transmission and advice. That gap is a compliance problem you inherit the moment you onboard them, and it is invisible unless you read the field. A review of the Lithuania CASP licence classes tells you whether the firm’s real business fits its authorisation.

Valid CASP vs. lapsed VASP: reading the credential

The single most misread signal on a Lithuanian crypto site is the word “licence” itself, so it is worth being precise.

• A CASP authorisation is the current, valid credential — granted by the Bank of Lithuania under MiCA, held by a named Lithuanian company, findable on lb.lt with defined service classes, and mirrored on the ESMA register with its passported states. This is what “licensed in Lithuania” should mean in 2026.
• A VASP registration is the legacy national AML registration. It was never an EU licence, it does not passport, and it expires as a route on 1 July 2026. A firm quoting a VASP number in 2026 is quoting a credential that is winding down, not a MiCA licence.
• A certificate with no matching register entry is the weakest of all. A convincing PDF that verifies against no independent regulator record is exactly what a bad actor produces. If it is not on lb.lt and ESMA, it does not exist for verification.

None of this means every firm mid-transition is illegitimate — many genuine businesses are converting their old registration into a CASP authorisation right now, and our flagship Lithuania crypto licence guide explains that process. It means the credential quoted at you is a starting point, not a conclusion. The test never changes: does the exact legal entity appear, active, as an authorised CASP on the Bank of Lithuania register, with matching services and a passport covering your market on ESMA?

Red flags, and verifying your own licence

Most problem cases give themselves away before you finish the register search, if you know the tells. In our experience these recur:

• “Verify here” links baked into the certificate. Legitimate verification never depends on a link the seller controls — the single most common vector for a fake.
• A firm relying on an old VASP number. A company marketing itself on a national VASP registration, with no CASP entry on lb.lt, is trading on a credential that lapses on 1 July 2026.
• Service claims broader than the authorisation. A site advertising an exchange or custody while the register lists only reception, transmission and advice is operating outside its licence.
• A company name that does not match the register. The authorised entity, not just the brand, must be the party you contract with and the party your money touches.
• No ESMA passport for your market. A genuine Lithuanian CASP that has not notified your country cannot lawfully serve customers there — a valid licence is not blanket EU access.

If you are the firm being checked, treat verification as continuous. Pull your own Bank of Lithuania record before every major onboarding — a new bank, an EMI or PI partner, an institutional counterparty — and send them the register entry rather than a PDF. Keep the authorised entity name matched to the company your partners contract with, your service classes aligned to what you actually do, and passport notifications filed before you market into a new member state. A clean, current CASP entry that ESMA corroborates is the foundation everything else is built on.

If you want that foundation laid correctly the first time, or a free check on a Lithuania crypto licence you have been offered or already hold, book a free consultation and we will run it against both the Bank of Lithuania and ESMA registers with you.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.