Why VASP Lithuania registration breaks down: where the process fails
Refusal of VASP registration in Lithuania is almost never linked to a single mistake — it is an accumulated discrepancy between what the applicant wrote in the dossier and what the examiner sees.
VASP registration is not filing a form, but proving that the business is structured exactly as described.
The first point of failure is the business model description. The application states exchange of digital assets, while in fact there is fiat intake, custodial storage of client funds, and settlements through counterparties in third jurisdictions.
The regulator's requirements are checked against actual flows: as soon as the fund movement scheme is broader than declared, the dossier falls apart.
The second is a weak dossier. AML/CFT policies are taken from a template, identification procedures are not tied to specific products, risk assessment does not take into account client and counterparty jurisdictions.
Sections of the dossier contradict each other: the escalation procedure for suspicious transactions is described differently in two documents.
The third is the gap between procedures and practice. Crypto compliance is assessed not by text, but by traces of execution: client review logs, decision protocols of the responsible officer, training records. If the team does not know its own regulations, this is noticeable in the very first conversation.
The fourth is opacity of the structure: sources of owners' funds are not confirmed, real presence in the country is not proven, roles in management are blurred. We analyze how each of these points is closed before submission, not after refusal.
What well-built compliance gives: timelines, banks, checks
Compliance is not a folder of documents assembled by the time of submission, but a working contour that is visible to the examiner as a whole: where funds come from, who the ultimate owners are, how operations are structured and who is responsible for control.
When the description matches actual processes, the approval cycle is reduced to one round of clarifications instead of several iterations of correspondence.
This is what registration timelines rest on: each inconsistency returns the application for revision and restarts the countdown.
Our approach is to reconcile the version seen by the Financial Crime Investigation Service with the real operating model.
To do this, we fix roles and areas of responsibility, write out client identification and transaction monitoring procedures, and prepare the procedure for storing and providing information upon request.
The regulator's review then follows a pre-known scenario instead of turning into a retrospective search for documents.
A partner bank for crypto operations looks at the same thing, only stricter and faster.
Sustainable servicing is provided not by an agreement with a manager, but by predictable reporting: a clear source of client funds, established limits and a pre-described handling of non-standard operations.
This is a reduction in refusals in direct form — applications do not go to a second round, and an account does not have to be opened again elsewhere.
Downtime is the most expensive part of the process: while review is ongoing, operations remain limited.
Readiness of policies, accounting data and reporting shortens this window, and the absence of repeat requests after registration shows that procedures are not lying in a folder, but are executed in the team's daily work.
VASP options in Lithuania: license, operating model, restrictions
The operating model of a VASP in Lithuania is determined not only by the fact of registration, but by who bears responsibility for procedures before the regulator.
Hence three practical options: own registration as an intermediary, working through a licensed partner, and internal procedures without separate status. The choice is dictated by the set of services — fiat intake, exchange, transfer, or storage of client funds and keys.
Activity restrictions are tied to the list of services declared during registration: going beyond it means expanding the status or obtaining a new one.
Outsourcing compliance does not transfer responsibility — the contractor performs checks and monitoring, but reporting, internal control and decisions on suspicious operations remain with the company.
| Option | When suitable | Restrictions |
|---|---|---|
| Own registration as an intermediary | Fiat intake, storage of client funds, working with your own base under your own brand | Local presence and responsible officer, regular reporting, internal control, regulator checks |
| Working through a licensed partner | Fast start, demand testing, no resource for your own compliance department | Partner's procedures and decisions, dependence on its policy, limited access to client data |
| Internal procedures without separate registration | Software development and supply, analytics, services without storage of client funds | Cannot provide exchange, transfer and storage, narrow service range, risk of reclassification as volumes grow |
In practice, the scheme is more often hybrid: operations affecting client funds go through own status or a partner, while the rest is covered by internal regulations.
Before choosing, we analyze the flow of funds, the composition of personal data and the points where fiat appears — that is exactly where the boundary between development and regulated activity runs.
Stages of setting up crypto compliance: from audit to handover
Procedures assembled "as regulator questions arise" quickly diverge from real operations: they are rewritten, and the application stands still.
We start from the fact — first we describe the business model in terms of fund flows, then we build procedures for it, and only then submit the dossier. The order of stages is strict: each subsequent one relies on the result of the previous one.
- Compliance audit. We analyze the structure, client types, settlement currencies, current checks and their coverage. The output is a map of inconsistencies: what blocks submission and what is closed afterward.
- Fund flow scheme. We trace the movement of funds and crypto assets from entry to exit: payment gateways, custodial and non-custodial wallets, counterparties, fees. We mark points where the link between payer and recipient is lost.
- Setting up procedures. For this scheme, we write risk levels, client and beneficiary identification, transaction monitoring, sanctions screening, the procedure for freezing funds and reporting suspicious operations.
- Embedding into systems. We tie rules to accounting and transaction systems: logging, data storage, roles and access, export of reporting forms.
- Dossier submission. We assemble the package — policies, model description, questionnaires, documents on owners and officers — and conduct correspondence with the regulator until a decision.
- Testing in practice. We run scenarios on real operations: how monitoring rules trigger, how long review takes, where the procedure diverges from the actual process.
- Documentation handover. We hand over regulations, a process map, templates and a trained team; after that we support edits for changing requirements.
Documents and regulations that remain in your hands
The compliance document package is not an appendix to a license, but a working contour: employees are trained by it, checks are built around it, and records that the regulator will request are formed from it.
We hand over documents in editable source files — you edit procedures yourself without coming back to us for every step.
What remains in your hands after setting up for VASP in Lithuania:
- Internal policies: anti-money laundering, client due diligence, sanctions control, risk management, conflict of interest.
- Business model description: who your clients are, where funds come from, what operations you conduct and on what terms.
- Client review procedures: verification levels, document set, enhanced due diligence thresholds, dossier review deadlines.
- Reporting regulation: report composition, submission deadlines, who prepares and signs, what confirms sending.
- Client data storage rules: terms, locations, access segregation, deletion procedure after expiry.
- Compliance documentation: decision logs, dossiers, training and non-standard operation review protocols.
- Responsibility matrix: who runs each process and how to act upon a regulator request or review.
Each document references a specific procedure and record form — the examiner sees the link "rule → action → confirmation", not a set of unrelated files.
Case: how a crypto service passed a partner bank's review
Entry point: frozen operations
A crypto service with a VASP license in Lithuania had been serviced by a partner bank for more than a year, until the bank initiated a repeat review and blocked outgoing payments.
Internally everything relied on manual labor: screening of incoming addresses was kept in spreadsheets, decision rationales were stored in correspondence, and the document package for each request was assembled anew.
Reviewing one request took 6-8 hours, quarterly reporting took three days, and no stage could be reproduced without the author of the spreadsheet.
What was changed
Address and client screening was moved to Chainalysis, with automatic risk scoring attached and an escalation threshold for manual review. A single decision log appeared: for each transaction, the source of funds, risk assessment, and who closed it under which rule are stored.
The bank response regulation was assembled into a template — composition of attachments, deadlines, responsible person — so that the package is formed from the log rather than from scratch.
Metrics before and after: the share of requests closed manually fell from 100% to 15%, response time to a bank request — from 6-8 hours to 40 minutes, reporting preparation was reduced from three days to four hours.
Lifting the block took a week: the bank received a full trail on disputed transactions instead of an explanatory note. In the next period, refusals on incoming payments stopped, and the repeat review passed without additional requests.
How does intermediary registration differ from an exchanger license?
These are two different legal regimes, not successive steps of one license. The difference is determined not by the name of the service, but by whose asset and whose risk passes through your infrastructure.
Intermediary registration covers transaction support: consultations, platform selection, bringing parties together, document preparation. The asset does not land on your balance sheet or under your key control, and the price is formed on the side of the licensed platform.
An exchanger license is needed when you yourself exchange crypto assets for fiat or for other crypto assets, set the rate yourself and store client keys.
The regulator Lietuvos bankas maintains such a regime through the register of virtual asset service providers: it is required to confirm sources of capital, appoint local management, and describe client identification and transaction monitoring procedures.
The practical boundary is tested by three questions: does the asset pass through your balance sheet, do you form the price, do you have direct settlement with the client.
Two "yes" answers mean an exchanger regime, and work under intermediary registration turns into unregistered activity with service suspension and an order.
Therefore, the choice of activity form is an architectural decision, not a formality: payment routing, the key storage model and the scope of mandatory control depend on it.
We analyze the flow of operations and select a regime that is legal at the start and does not require changing the license when scaling.
Common technical doubts before submitting documents
Before submitting to the Lithuanian register, almost every team goes through the same circle of questions: can clients from other jurisdictions be serviced, what to do if a bank refuses, how a change of owners is formalized, and whether it makes sense to apply again after refusal.
None of these points is closed "in words" — each requires a document that the regulator will accept without follow-up requests.
Below are short answers on four scenarios that most often slow down a VASP application. This is not legal advice, but an engineering view of what procedures and artifacts have to be prepared.
Can you work with clients from other countries?
Geography itself is not a prohibition — the restriction lies in procedures. Enhanced identification of non-residents, sanctions screening and confirmation of source of funds are needed, and for high-risk jurisdictions — a separate regulation with rationale for the decision.
Internal rules must describe by what signs a client falls under enhanced control and who makes the decision.
The bank refused to open an account — should the application be submitted later?
An account is not a condition for registration, but without a working settlement route the activity cannot be launched.
The reason for refusal can almost always be read in the dossier: opaque ownership structure, blurred business model description or absence of transaction monitoring rules.
We rebuild the package — the client fund flow scheme, product description, review procedure — and go to the bank again with it.
How does a change of owners or company structure work?
The process is notification-based, but a change of control entails a repeat business reputation check, updated questionnaires and adjustment of internal rules.
If this is launched simultaneously with the closing of the reporting period, the regulator may suspend activity until inconsistencies are eliminated. We plan the change in advance and synchronize it with the reporting calendar.
Does it make sense to submit documents again after refusal?
Refusal does not block re-submission — it is important not to send the same package. We analyze the wording of the comments, compare it with internal rules, the monitoring system and the procedure description, and close each point documentarily.
The second application is assembled as a corrected version with a list of changes, not as a new one from scratch.
Let's discuss your task: what to prepare for the conversation
VASP license assessment in Lithuania depends on how accurately the operating model is described: the supervisory authority looks not at the name of the service, but at how assets move and who bears responsibility at each step.
The more input you provide in the first conversation, the fewer clarification rounds there are and the more concrete the assessment and plan become. With a full set of data, we usually return with timelines and the scope of work within a few business days.
What is worth preparing for the conversation:
- Operating model: asset storage with you or with the client, exchange, transfers, payment acceptance — this determines the list of mandatory procedures and the volume of internal regulations.
- Target markets and client geography: service countries set requirements for identification, reporting and work with high-risk jurisdictions.
- Current procedures: how client review, transaction monitoring, suspicious transaction escalation, and who is appointed responsible for internal control are currently arranged.
- History of communication with the bank or payment provider: refusals, document requests, suspensions — this shows the counterparties' real requirements, not only formal ones.
- Legal structure and accounts: where accounts are opened, who is on the management and ownership team, whether there are affiliated companies.
- Scaling plans: new directions, products, volumes — they determine whether to build perimeter expansion in immediately or in stages.
- Who on your side owns the process: one contact person with access to documents speeds up data collection more than anything else.
Describe the task in free form — operating model, markets, current state of procedures. We will return with an assessment, a stage plan and document preparation timelines, without general wording.