Compliance Documentation Drafting for Fintech Companies in Lithuania

What it covers: The master policy document covering the company's full anti-money laundering framework — governance, risk appetite, roles and responsibilities, and the high-level description of all compliance controls.

• Company's regulatory obligations under Lithuanian AML law and applicable EU Directives
• ML/TF risk appetite statement — the company's defined tolerance for money laundering and terrorist financing risk
• Governance structure — the board's, senior management's, and MLRO's respective roles and responsibilities
• Overview of all AML controls — CDD, EDD, transaction monitoring, sanctions screening, STR filing, and record retention
• Staff responsibilities — what is expected from every employee in relation to AML compliance
• Consequences of non-compliance — internal disciplinary consequences and regulatory reporting obligations
• Annual review mechanism — how and when the programme is reviewed and updated
• Reference to all supporting procedure documents — the AML programme is the top-level document; procedures sit below it

What it covers: Defines which customers the company will accept, which it will decline, and which require elevated scrutiny before acceptance — the company's codified risk appetite at the customer level.

• Acceptable customer categories — the types of clients the company serves and the basis for their acceptance
• Prohibited customer categories — explicitly prohibited client types (e.g., customers from sanctioned jurisdictions, shell companies with no identifiable UBO)
• High-risk customer categories — clients who require EDD before acceptance, including PEPs, high-risk jurisdiction nationals, and complex ownership structures
• Senior management approval requirements — customer categories that cannot be accepted without explicit senior approval
• Geographic restrictions — countries and jurisdictions from which the company will not accept clients
• Business activity restrictions — types of business activity that the company will not serve
• Customer re-evaluation triggers — events that require an existing customer's acceptance status to be reassessed

What it covers: Step-by-step operational procedures for identifying and verifying individual and corporate clients — the document analysts follow when onboarding each client type.

• Individual (natural person) onboarding procedure — identity verification, address verification, PEP screening, sanctions check, risk scoring
• Corporate (legal entity) onboarding procedure — corporate document collection, UBO identification, control structure mapping, beneficial ownership verification
• Document collection checklists — specific documents required for each client type and jurisdiction
• Risk scoring worksheet — the step-by-step calculation of the client's ML/TF risk score based on defined criteria
• Decision matrix — what to do with the risk score: accept, escalate to EDD, refer to MLRO, or decline
• Record-keeping requirements — where to store onboarding documents, in what format, for how long
• Re-KYC trigger list — events that require an existing client to go through the onboarding procedure again

What it covers: Procedures for conducting enhanced scrutiny on high-risk clients — PEPs, clients from high-risk jurisdictions, and complex ownership structures — beyond the standard CDD workflow.

• PEP identification and screening procedure — how to identify PEPs, which databases to use, and how to document the result
• PEP EDD requirements — the specific additional information required for a PEP client (source of wealth, source of funds, purpose of relationship)
• High-risk jurisdiction procedure — additional checks required for clients from FATF-listed or EU high-risk countries
• Complex ownership structure procedure — how to trace beneficial ownership through multi-layer corporate structures
• Senior management approval workflow — the documented process for obtaining approval before accepting an EDD client
• EDD monitoring requirements — more frequent transaction monitoring thresholds and periodic review intervals for EDD clients
• EDD file documentation standard — what a complete EDD client file must contain for examination purposes

What it covers: Operational procedures for the transaction monitoring function — from alert generation through investigation to MLRO escalation or closure.

• Alert triage procedure — how to categorise incoming alerts by urgency and risk level
• Alert investigation workflow — step-by-step investigation process including client context review, transaction analysis, and pattern assessment
• Typology reference guide — documented ML/TF typologies relevant to the company's business model, used to contextualise alerts
• Escalation criteria — objective criteria for when an alert must be escalated to the MLRO rather than closed by the analyst
• Alert closure documentation standard — what must be recorded when an alert is closed without escalation
• MLRO referral memo template — the format in which analysts document and communicate escalated alerts to the MLRO
• Quality control procedure — how the compliance officer reviews closed alerts for procedural compliance
• Model review trigger — events that require the transaction monitoring model thresholds or typologies to be reviewed

What it covers: Step-by-step procedures for screening clients and transactions against applicable sanctions lists — and for handling the hits that the screening system generates.

• Screening lists reference — the specific sanctions lists screened (EU, UN, OFAC, and FNTT domestic list) with update frequency
• Onboarding screening procedure — how and when to screen new clients before account activation
• Ongoing screening procedure — how to handle automated rescreening when sanctions lists are updated
• Transaction screening procedure — real-time or batch screening of payment counterparties
• Hit review procedure — the documented process for assessing whether a screening hit is a true match or a false positive
• False positive documentation standard — what must be recorded when a hit is confirmed as a false positive
• True match escalation procedure — immediate steps when a true sanctions match is confirmed; account freeze and FNTT notification
• Sanctions training note — brief reference guide for staff on what sanctions compliance means and what to do when a name appears suspicious

What it covers: The procedures governing how staff report suspicious activity internally to the MLRO — and how the MLRO assesses those reports and decides whether to file an STR with the FNTT.

• Internal SAR reporting procedure — how employees report suspicions to the MLRO (form, channel, timeframe)
• Internal SAR form template — the standardised form employees complete when reporting a suspicion
• MLRO assessment procedure — how the MLRO evaluates an internal SAR and reaches a filing decision
• MLRO decision documentation standard — what the MLRO must record regardless of whether an STR is filed
• STR filing procedure — how to prepare and submit an STR to the FNTT through the AML system
• Tipping-off prohibition — instructions to all staff on why the suspicion must not be disclosed to the subject
• FNTT enquiry response procedure — how to handle and respond to FNTT information requests
• MLRO monthly reporting template — the format in which the MLRO reports to the compliance officer and board

What it covers: Defines what compliance records must be retained, for how long, in what format, and how they must be made available to the regulator — aligned with both AML minimum retention requirements and GDPR.

• AML record retention schedule — minimum 5-year retention for CDD documents, transaction records, and STR filings
• GDPR retention alignment — reconciling AML retention obligations with GDPR data minimisation and storage limitation principles
• Record format requirements — what constitutes an adequate record for examination purposes (completeness, legibility, authenticity)
• Storage and access controls — who can access compliance records, under what conditions
• Regulator access procedure — how to respond to Bank of Lithuania or FNTT requests for records, within the required timeframe
• Record destruction procedure — how and when records are destroyed after the retention period expires
• Retention register — the master document listing all compliance record categories with their retention periods

What it covers: For licensed entities subject to the Digital Operational Resilience Act (DORA) — applicable to all Lithuanian EMIs, PIs, MiCA-authorised companies, and investment firms from January 2025 — an ICT risk management framework and related procedures are mandatory.

• ICT risk management policy — governance of ICT risk, roles and responsibilities, and risk appetite for operational disruption
• ICT asset register — inventory of all ICT systems and assets critical to the licensed activities
• ICT risk assessment procedure — how to identify, assess, and score ICT risks across the technology infrastructure
• ICT incident classification procedure — how to classify ICT incidents by severity and determine whether Bank of Lithuania reporting is required
• Major ICT incident reporting procedure — the documented process for notifying the Bank of Lithuania of major ICT incidents
• ICT third-party risk management procedure — how to assess and monitor critical ICT service providers
• Business continuity and disaster recovery plan — documented response to ICT disruption affecting regulated activities
• Digital operational resilience testing programme — the schedule and methodology for testing resilience annually

What it covers: Required for all licensed entities that outsource any function — defines governance of outsourcing arrangements, the register of outsourced functions, and how third-party performance is monitored.

• Outsourcing governance framework — the board's role in approving outsourcing arrangements and the criteria for classifying outsourcing as critical or important
• Outsourcing register — a live record of all outsourced functions, providers, and contract terms
• Due diligence procedure for outsourcing providers — how to assess a new provider before entering an outsourcing arrangement
• Outsourcing agreement minimum terms — the contractual provisions required by EBA guidelines for every outsourcing agreement
• Provider monitoring procedure — ongoing monitoring of outsourced provider performance and compliance
• Concentration risk assessment — procedure for assessing and managing concentration risk across the outsourcing portfolio
• Exit planning procedure — how to plan for and manage the exit from an outsourcing arrangement
• Bank of Lithuania notification procedure — how to notify the regulator for critical or important outsourcing

What it covers: A structured template for the annual review of the compliance programme — covering all AML/KYC controls, transaction monitoring effectiveness, STR filing record, and training completion.

• Review scope and methodology — what the annual review covers and how it is conducted
• AML policy review section — assessment of whether the policy remains current and fit for purpose
• CDD file quality assessment — results of the file sampling exercise conducted as part of the review
• Transaction monitoring effectiveness section — alert volumes, closure rates, escalation rates, and model performance
• STR filing record section — number of SARs received, STRs filed, and trends versus prior year
• Training completion section — confirmation of annual AML training completion across all relevant staff
• Risk assessment refresh section — whether the business-wide risk assessment requires updating
• Remediation tracker — outstanding actions from the prior year's review and their completion status
• Board presentation summary — a one-page executive summary of review findings for the board