Payment Gateway Compliance Advisory for E-Commerce in Lithuania
AT A GLANCE
- Payment processing is the operational heart of an e-commerce business — and the legal and compliance framework around it is significantly more complex than most operators understand before they encounter their first chargeback dispute or PSP account suspension.
- PSP agreements contain liability clauses that shift chargeback and fraud exposure directly onto the merchant — understanding what you are signing before you sign it determines your exposure when things go wrong.
- Strong Customer Authentication (SCA) under PSD2 affects checkout conversion across the EU — implementation choices have a measurable impact on completed purchases.
- PCI DSS compliance is generally required for merchants accepting payment cards through the contractual rules of their acquiring institutions and participating card schemes. The applicable requirements depend on the merchant’s payment processing arrangements and the way cardholder data is handled. Non-compliance may result in additional assessments, financial penalties, restrictions on payment processing or termination of acquiring services. PCI DSS compliance does not automatically protect a merchant from liability following a data breach, and non-compliance does not automatically establish unlimited liability. Financial responsibility depends on the applicable contracts, card scheme rules, relevant legislation and circumstances of the incident.
- We advise e-commerce companies on PSP selection, agreement review, chargeback management, SCA implementation, and PCI-DSS compliance across all major payment processing arrangements.
Payment gateway compliance advisory covers the legal, contractual, and technical compliance obligations that arise from accepting card payments and using payment service providers (PSPs). This includes reviewing PSP agreements before signing to identify liability clauses and reserve requirements; implementing Strong Customer Authentication correctly to balance security with checkout conversion; designing a chargeback management framework to handle disputes within PSP deadlines; assessing PCI-DSS compliance obligations for the specific way card payments are processed; and advising on subscription billing compliance under EU consumer law. We provide each of these as standalone advisory engagements or as a combined payment compliance review for businesses launching or auditing their payment setup.
The Payment Compliance Landscape for E-Commerce
Accepting card payments online is not simply a technical integration — it is entry into a contractual and regulatory framework that determines the merchant’s exposure when payments go wrong. Most e-commerce operators sign PSP agreements without reading them in full, implement SCA without understanding how it affects conversion, and discover their PCI-DSS obligations only when they are non-compliant. Payment compliance is one of the most under-resourced areas of e-commerce legal and operational setup.
The PSP agreement: more than a fee schedule
A payment service provider agreement is a commercial contract — but it is a contract heavily weighted in favour of the PSP. Liability clauses shift chargeback liability to the merchant above defined thresholds. Reserve clauses allow the PSP to withhold a percentage of settlements for rolling periods, sometimes extending to 180 days after the last transaction. Termination clauses can result in immediate account suspension and withholding of funds if the merchant’s chargeback rate exceeds the PSP’s threshold. Understanding these clauses before signing — not after the first major chargeback wave — is the most cost-effective thing an e-commerce business can do in payment compliance.
SCA: the regulatory framework for authentication
Strong Customer Authentication (SCA) is a requirement of the EU Payment Services Directive 2 (PSD2), implemented in Lithuania through the Law on Payments. SCA requires that most card-not-present transactions are authenticated using at least two of three factors: something the payer knows (PIN, password), something the payer has (phone, card), and something the payer is (biometric). In practice, SCA is implemented through 3D Secure 2 (3DS2). Correctly implementing 3DS2 — including using SCA exemptions where appropriate — can reduce authentication friction and improve checkout conversion. Incorrectly implemented SCA increases cart abandonment without improving security.
PCI-DSS: the card industry security standard
PCI-DSS (Payment Card Industry Data Security Standard) applies to any organisation that stores, processes, or transmits cardholder data. For e-commerce merchants, the scope of PCI-DSS depends on how payments are processed: a merchant using a hosted payment page provided entirely by the PSP has a narrower scope than one that customises the payment form or stores card data. PCI DSS compliance is generally required under the applicable card scheme and acquiring institution rules. Non-compliance may result in financial assessments, mandatory remediation measures, additional monitoring, restrictions on card acceptance or termination of payment processing arrangements, even where no data breach has occurred. Following a breach, liability is determined by the applicable contractual provisions, card scheme rules, data protection legislation and the circumstances of the incident. Compliance with PCI DSS does not automatically eliminate liability, while non-compliance does not necessarily make a merchant responsible for every breach-related cost.













