Legal Services for Fintech Companies in Lithuania

Corporate Governance and Structure
The corporate governance structure of a fintech company is subject to Bank of Lithuania scrutiny from the moment the licence application is submitted. The regulator assesses whether the management structure is appropriate for the size and complexity of the business, whether decision-making authority is clearly defined, whether there are adequate internal controls, and whether the board and senior management have the qualifications and experience to manage a regulated entity. We structure the governance framework to satisfy these expectations from the outset.

• Articles of association — drafted to include governance provisions aligned with Bank of Lithuania requirements
• Shareholder agreements — defining ownership rights, reserved matters, and investor protections in a regulatory context
• Board and management committee charters — defining decision-making authority, quorum, and reporting lines
• Director and officer service agreements — including fit-and-proper declarations and regulatory reporting obligations
• Delegation of authority frameworks — mapping which decisions require board approval, management approval, or can be delegated
• Corporate governance policy — the overarching document the Bank of Lithuania reviews to assess governance adequacy
• Conflict of interest policy — required for licensed entities; identifying, disclosing, and managing conflicts

Regulatory Legal Support
Navigating the Bank of Lithuania as a licensed entity requires legal support that goes beyond compliance advisory. The legal dimension of the regulatory relationship — licence condition interpretation, regulatory change analysis, notification obligations, and supervisory correspondence — requires lawyers who understand both the regulatory framework and the practical way the Bank of Lithuania operates. We provide legal support across the full regulatory lifecycle of a licensed entity.

• Licence condition legal review — interpreting and mapping each licence condition to an operational obligation
• Material change notifications — drafting and submitting notifications to the Bank of Lithuania for changes requiring prior approval
• Regulatory correspondence — drafting responses to Bank of Lithuania queries, information requests, and supervisory findings
• Passporting notifications — preparing and submitting EU passporting notifications for cross-border service provision
• Outsourcing agreements — drafting and reviewing outsourcing arrangements to satisfy EBA outsourcing guidelines
• Regulatory change legal analysis — assessing the impact of new EU and Lithuanian regulation on existing operations
• Enforcement response — legal support when the Bank of Lithuania initiates formal enforcement or supervisory action

Commercial Contracts and User Agreements
Every commercial relationship a fintech company enters — with clients, partners, payment processors, technology providers, and data vendors — must be governed by a written agreement that satisfies both Lithuanian commercial law and the applicable regulatory framework. For licensed entities, client-facing documents must meet specific mandatory disclosure requirements. We prepare and maintain the full commercial contract suite for fintech companies, ensuring every document is enforceable under Lithuanian law and compliant with the applicable regulation.

• Terms of service — mandatory PSD2 pre-contractual disclosures, payment service framework contracts, user rights
• E-money terms — EMD2-compliant e-money issuance, redemption rights, and fee disclosure
• MiCA client agreements — crypto-asset service disclosures, risk warnings, and complaint procedures required under MiCA
• API and technology partner agreements — governing data access, uptime obligations, and liability allocation
• Acquiring and processing agreements — for companies operating payment acquiring infrastructure
• Agent and distributor agreements — for fintech companies distributing through third-party agents
• White label and licensing agreements — where the company licenses its platform or technology to third parties
• Non-disclosure agreements — tailored to fintech M&A discussions, partnership negotiations, and technology sharing

Data Protection and GDPR
Fintech companies process large volumes of personal data — payment data, identity verification data, transaction history, and behavioural data — that carry significant GDPR obligations. For MiCA-authorised companies, additional data handling requirements apply under the crypto regulation. For companies subject to DORA (Digital Operational Resilience Act), ICT risk management and incident reporting obligations overlap with data protection requirements. We prepare and maintain the full GDPR documentation framework for fintech companies, coordinated with their regulatory obligations.

• Privacy policy — GDPR-compliant, specific to fintech data processing activities
• Data processing agreements (DPAs) — for relationships with third-party processors including KYC providers, cloud services, and analytics platforms
• Records of processing activities (ROPA) — the internal data map required under GDPR Article 30
• Data breach notification procedures — aligned with both GDPR (72-hour notification) and Bank of Lithuania incident reporting requirements
• Data subject rights procedures — handling access, erasure, portability, and objection requests
• Data retention and deletion policy — aligned with both GDPR principles and AML 5-year retention obligations
• Cookie policy and consent management — for fintech companies with web and app interfaces
• Data protection impact assessments (DPIAs) — for high-risk processing activities including biometric KYC

Employment Law for Regulated Roles
Fintech companies operating under a Bank of Lithuania licence must staff specific regulated roles — compliance officer, MLRO, risk manager, and in some cases an internal auditor. These roles have legal obligations that must be reflected in the employment documentation: independence, direct reporting lines, access to information, and protection from interference. Employment contracts for regulated roles that do not include these provisions create governance gaps that the Bank of Lithuania will identify during examination. We draft employment documentation for regulated and standard roles alike.

• Employment contracts for regulated roles — compliance officer, MLRO, risk manager, DPO, internal auditor
• Independence provisions — ensuring regulated function holders have documented authority and protection from undue influence
• Reporting line documentation — defining the direct reporting structure to senior management and the board
• Non-compete and confidentiality clauses — enforceable under Lithuanian Labour Code; with statutory compensation provisions
• IP assignment clauses — ensuring technology developed by employees belongs to the company
• Contractor agreements for specialist roles — including fit-and-proper declarations for key function contractors
• Director service agreements — governing the director’s relationship with the licensed entity
• Redundancy and termination procedures — compliant with the Lithuanian Labour Code for sensitive regulated roles

Investment, M&A, and Corporate Transactions
Fintech companies that raise investment, acquire other businesses, or are themselves the subject of M&A activity face a specific regulatory dimension that standard M&A legal advisors frequently underestimate: any change in qualifying ownership of a licensed entity requires prior approval from the Bank of Lithuania. This regulatory approval process runs in parallel with the commercial transaction and must be carefully coordinated. We manage the legal dimension of fintech M&A and investment transactions, combining corporate transaction experience with the regulatory knowledge required for the Bank of Lithuania approval process.

• Investment round documentation — term sheets, subscription agreements, SHA, convertible instruments
• Qualifying holding notifications — mandatory Bank of Lithuania prior approval for acquisitions above 10%, 20%, 33%, 50% thresholds
• Due diligence support — legal data room preparation; responding to investor legal queries on licence status and conditions
• Shareholder change documentation — legal documents and regulatory filings for ownership changes below notification thresholds
• Acquisition of licensed entities — legal and regulatory assessment of target licence status; SPA drafting
• Change of control conditions — legal management of Bank of Lithuania conditions attached to M&A approvals
• Group restructuring — legal analysis of restructuring impact on existing licences and notification obligations