Outsourcing Services for Fintech Companies in Lithuania

AT A GLANCE

Outsourcing key functions — CFO, compliance officer, MLRO, legal counsel, and DPO — allows a fintech company to access qualified professionals at a fraction of the cost of full-time employment while satisfying Bank of Lithuania requirements.
The Bank of Lithuania permits outsourcing of regulated functions, provided the arrangements are properly documented and the licensed entity retains full accountability for compliance.
We provide six outsourced functions for fintech companies: CFO, compliance officer, MLRO, legal counsel, data protection officer, and regulatory reporting support.
All outsourced functions come with the documentation required by the Bank of Lithuania — written outsourcing agreements, notification where required, and audit-ready records.
Outsourcing is available as a standalone service or as part of a combined setup covering all functions a new licensed entity needs from launch.

Outsourcing services for fintech means engaging qualified professionals to perform specific functions — CFO, compliance officer, MLRO, legal counsel, or data protection officer — on a retainer basis rather than as full-time employees. The Bank of Lithuania permits licensed entities to outsource these functions, subject to proper documentation and oversight requirements. Outsourcing gives early-stage and mid-size fintech companies access to senior expertise from the first day of operations, at a cost structure that scales with the business rather than requiring upfront headcount investment. We provide all six outsourced functions under one engagement, with a single point of contact and a team that understands the full regulatory picture of each client.

Why Fintech Companies Outsource Key Functions

A Bank of Lithuania-licensed fintech entity is required to have qualified people performing specific functions — compliance, MLRO, risk management, financial oversight — from day one of operations. For most early-stage and mid-size fintech companies, hiring senior full-time professionals in all of these roles simultaneously is neither practical nor cost-efficient at launch stage.

Outsourcing provides a structured alternative: the function is performed by a qualified professional on a defined retainer, the licensed entity retains full accountability and oversight, and the cost scales with the actual scope of work rather than being fixed at a full-time salary plus employer contributions. As the company grows and transaction volumes increase, the outsourced retainer can be scaled up or transitioned to a full-time hire when that makes more operational sense.

The cost comparison

A senior compliance officer in Vilnius may receive a gross monthly salary of approximately EUR 3,000–4,500, depending on qualifications, experience and regulatory responsibilities. In 2026, the standard employer-side contribution rate for an indefinite-term employment contract generally starts at 1.77%, subject to the applicable occupational risk category and other statutory conditions. At this rate, the estimated total monthly employer cost would be approximately EUR 3,053–4,580, or EUR 36,637–54,956 annually. Additional employment-related expenses may arise depending on the employment arrangements. An outsourced compliance officer covering the same regulatory function on a retainer costs a fraction of this, scales with the actual workload, and can be supplemented by full-time hiring when the volume justifies it.

When outsourcing is the right structure

Pre-licence stage — when the company needs qualified functions for the application but revenue has not yet begun
Post-licence launch — when functions are needed from day one but transaction volumes do not yet justify full headcount
Growth stage — when the company needs to scale specific functions faster than it can hire and onboard in-house
Multi-jurisdiction operations — when a function covers multiple entities and full-time duplication across entities is inefficient
Interim coverage — when a function holder leaves and a qualified replacement is needed while recruitment takes place

Outsourcing vs. staffing through us

We provide both outsourcing (where our team members perform the function) and recruitment (where we find and place a permanent employee). For functions that require deep, ongoing involvement in day-to-day operations — such as a full compliance officer managing a growing team — a permanent hire is eventually the right structure. For functions that require senior oversight without daily operational involvement — CFO advisory, MLRO sign-off, DPO management — outsourcing remains appropriate indefinitely. We advise on which model fits each function as the company evolves.

Outsourcing and the Bank of Lithuania: What Is Permitted

The Bank of Lithuania’s framework for outsourcing by licensed entities is based on the EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02). Understanding what is and is not permitted — and how to structure an outsourcing arrangement to satisfy the regulator — is essential before entering into any outsourcing arrangement for a regulated function.

What the Bank of Lithuania permits

Outsourcing of the compliance officer function — provided the arrangement is documented and the licensed entity retains oversight
Outsourcing of the MLRO function — subject to the conditions on MLRO independence and access to information
Outsourcing of financial management and CFO advisory functions
Outsourcing of legal counsel and regulatory advisory functions
Outsourcing of the Data Protection Officer function — explicitly contemplated under GDPR
Outsourcing of regulatory reporting and Bank of Lithuania submission preparation

What must always remain with the licensed entity

Ultimate accountability for compliance — the licensed entity cannot outsource its regulatory responsibility
Strategic decision-making and risk appetite — the board and senior management retain full ownership of strategy
Internal oversight of outsourced functions — the licensed entity must monitor and review outsourced providers
Key management functions where the Bank of Lithuania requires in-house performance — varies by licence type and entity size

Documentation requirements

Every outsourcing arrangement for a regulated function must be covered by a written outsourcing agreement that satisfies EBA guidelines. The agreement must specify: the scope of services, the service level expectations, the provider’s qualifications, the licensed entity’s right to audit and inspect, data protection obligations, business continuity arrangements, and termination provisions. Outsourcing notification requirements depend on the institution’s authorisation, the nature of the outsourced function and the applicable regulatory framework. Critical or important outsourcing arrangements may trigger prior notification obligations under relevant Lithuanian legislation and supervisory requirements. For ICT services supporting critical or important functions, Article 28(3) of Regulation (EU) 2022/2554 (DORA) requires financial entities within its scope to inform the competent authority in a timely manner about planned contractual arrangements. Non-ICT outsourcing is subject to the relevant sector-specific requirements and applicable EBA guidelines. A universal prior notification obligation should not be assumed for every outsourced function.

Concentration risk

The Bank of Lithuania monitors concentration risk in outsourcing — where a licensed entity outsources multiple critical functions to the same provider. While this is permitted, it requires active management: the entity must demonstrate that it is not excessively dependent on any single provider and has continuity plans if the provider relationship ends. Where we provide multiple outsourced functions to a single client, we document the oversight framework and contingency arrangements as part of the engagement.

Our Outsourced Functions for Fintech Companies

We provide six outsourced functions — covering the financial, compliance, legal, and governance needs of a licensed Lithuanian fintech entity. Each function is delivered on a defined monthly retainer with a clear scope of work, a named responsible professional, and the documentation the Bank of Lithuania requires.

Outsourced CFO — Financial oversight and management reporting

The outsourced CFO provides senior financial oversight for the licensed entity — monthly management reporting, regulatory capital monitoring, investor reporting, and financial planning. For pre-revenue and early-stage fintech companies, the outsourced CFO function fills the gap between the accounting team (which processes transactions) and the board (which needs strategic financial information). For licensed entities, the CFO function also ensures that regulatory capital obligations are monitored and reported correctly.

Role scope: Monthly financial oversight, management reporting, regulatory capital monitoring, investor liaison, budget and cash flow planning.

Monthly management accounts — P&L, balance sheet, cash flow, and regulatory capital position
Regulatory capital monitoring — monthly calculation of own funds and minimum capital requirement
Budget preparation and variance analysis — quarterly and annual budget vs. actual reporting
Investor reporting — management packs for shareholders, board, and external investors
Cash flow planning — 13-week rolling cash flow forecast and treasury management guidance
Audit support — liaison with external auditors and preparation of audit schedules
Financial policy review — reviewing and updating financial policies as the business grows
Board financial presentations — preparing and presenting financial data at board meetings

Outsourced Compliance Officer — Ongoing compliance programme management

The outsourced compliance officer manages the licensed entity's ongoing compliance programme — keeping the AML/KYC framework current, monitoring regulatory developments, conducting compliance testing, and preparing for Bank of Lithuania supervisory interactions. For smaller licensed entities, combining compliance officer and AML reporting responsibilities may be permissible where the arrangement satisfies the applicable regulatory requirements. The institution must assess the individual's qualifications, availability, independence, workload and potential conflicts of interest. Combining these responsibilities must not undermine the effectiveness of AML/CFT controls, compliance monitoring or the institution's governance arrangements. The appointment and outsourcing structure must comply with the regulatory framework applicable to the specific licence. All work is performed by a named compliance professional with direct Bank of Lithuania-regulated entity experience.

Role scope: Compliance programme management, regulatory monitoring, compliance testing, staff training coordination, and Bank of Lithuania liaison.

Ongoing AML/KYC compliance programme management — maintaining policies, procedures, and controls
Quarterly compliance review — assessing programme effectiveness and identifying gaps
Annual AML risk assessment update — refreshing the business-wide ML/TF risk assessment
Regulatory change monitoring — tracking EU and Lithuanian regulatory developments affecting the licence
Compliance testing — periodic testing of CDD files, transaction monitoring, and staff knowledge
Staff AML training coordination — annual training delivery and records maintenance
Board compliance reporting — quarterly compliance report to senior management and the board
Bank of Lithuania examination preparation — pre-examination review and document organisation

Outsourced MLRO — Suspicious activity management and FNTT reporting

An AML reporting officer or other designated person responsible for suspicious transaction reporting must perform their duties in accordance with the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing and the institution's applicable governance requirements. The individual must have sufficient authority, access to relevant information, professional competence and availability to ensure compliance with statutory reporting obligations. Outsourcing the function is permissible only where the applicable regulatory requirements are satisfied, and the licensed institution retains ultimate responsibility for AML/CFT compliance. Availability during ordinary business hours alone may be insufficient where urgent suspicious transactions require immediate assessment and reporting. We provide a named, qualified MLRO on a documented outsourcing arrangement that satisfies Bank of Lithuania requirements.

Role scope: SAR assessment, STR filing with FNTT, FNTT liaison, and MLRO reporting to the board.

Internal SAR assessment — reviewing all suspicious activity reports escalated by staff
STR filing with the FNTT — within the statutory timeframe when suspicion is confirmed
FNTT liaison — responding to FNTT information requests, enquiries, and freeze orders
Declination decisions — documented rationale for SARs assessed and not filed
MLRO monthly report — summary of SAR volume, STR filings, and AML risk observations to the compliance officer and board
Regulatory correspondence — drafting MLRO-related responses to Bank of Lithuania queries
MLRO annual review — review of the STR filing record and effectiveness of the internal reporting process
Availability for urgent suspicious transaction assessments and reporting — the designated AML reporting officer must be accessible within timeframes that enable the institution to comply with statutory transaction suspension and reporting obligations. Under Article 16 of the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing, suspicious transactions must generally be suspended and reported to the Financial Crime Investigation Service (FNTT) without delay, no later than three working hours after suspension, subject to the applicable statutory exceptions. Internal service-level arrangements must not delay mandatory reporting.

MLRO and compliance officer — combined or separate

For smaller licensed entities, the MLRO and compliance officer roles may be held by the same person. We offer a combined outsourced compliance officer and MLRO retainer at a single monthly fee — providing both functions under one engagement with a single named professional. As the entity grows and SAR volumes increase, we advise on whether separating the roles is operationally warranted.

Outsourced Legal Counsel — Ongoing legal advisory and regulatory legal support

The outsourced legal counsel provides ongoing legal advisory to the licensed entity — reviewing and updating commercial contracts, advising on licence condition compliance, analysing the impact of regulatory changes, and drafting regulatory correspondence. For fintech companies that do not need a full-time in-house lawyer but have a continuous flow of legal questions and document needs, an outsourced legal counsel retainer provides senior legal coverage at a predictable monthly cost.

Role scope: Ongoing legal advisory, contract review, licence condition monitoring, regulatory change analysis, and regulatory correspondence drafting.

Contract review and negotiation support — reviewing incoming contracts from partners, clients, and technology providers
Licence condition monitoring — tracking ongoing obligations and flagging compliance risks as they arise
Regulatory change analysis — assessing the practical legal impact of new EU and Lithuanian regulation
Employment law advisory — guidance on HR matters, terminations, and employment documentation updates
Regulatory correspondence drafting — Bank of Lithuania letters, notifications, and responses
Corporate governance maintenance — board resolutions, shareholder decisions, and register updates
Ad hoc legal queries — written responses to one-off legal questions within 24 business hours
Monthly legal briefing — summary of regulatory developments relevant to the client's licence and operations

Outsourced Data Protection Officer (DPO) — GDPR compliance management

Under Article 37 of the GDPR, appointment of a Data Protection Officer (DPO) is mandatory where the controller's or processor's core activities involve regular and systematic monitoring of individuals on a large scale, large-scale processing of special categories of personal data or criminal conviction data, or where another applicable statutory requirement applies. Operating a fintech, payment or crypto-asset platform does not automatically make DPO appointment mandatory. The requirement must be assessed according to the nature, scale and purposes of personal data processing. Where a DPO is appointed, the individual must perform the functions established by Articles 38 and 39 of the GDPR, including compliance monitoring, advisory support and cooperation with the competent data protection supervisory authority. GDPR explicitly permits and in some cases encourages the use of an external DPO. We provide a qualified outsourced DPO on a documented engagement.

Role scope: GDPR programme management, SDPI liaison, data subject rights handling, and data protection advisory.

GDPR compliance programme oversight — monitoring the ongoing effectiveness of the privacy framework
Data subject rights management — coordinating responses to access, erasure, portability, and objection requests within GDPR timeframes
Data breach assessment and notification — assessing breach severity and managing SDPI and data subject notifications
DPIA oversight — reviewing Data Protection Impact Assessments for new processing activities
Vendor DPA review — assessing data processing agreements with new third-party service providers
State Data Protection Inspectorate liaison — responding to SDPI enquiries and inspections
Annual GDPR review — reviewing the privacy programme against current regulatory expectations
Staff data protection training — annual privacy awareness training delivery and records

Regulatory Reporting Support — Bank of Lithuania periodic submissions

Licensed Lithuanian fintech entities must submit periodic regulatory reports to the Bank of Lithuania — covering prudential data, payment volumes, client fund positions, and operational matters. These submissions must reconcile with the accounting records and be prepared to a format and standard that the regulator can directly use for supervisory analysis. Errors or delays in regulatory reporting are a supervisory finding. We prepare periodic Bank of Lithuania submissions for licensed entities, coordinating with the accounting team to ensure consistency between the management accounts and the regulatory returns.

Role scope: Periodic Bank of Lithuania submission preparation, data reconciliation, and supervisory correspondence.

Prudential regulatory reporting — preparation of own funds calculations, payment transaction statistics, outstanding electronic money information and other regulatory returns required for the specific institution. Reporting frequency, content and deadlines depend on the type of authorisation, applicable Lithuanian regulatory requirements and the nature of the institution's activities. Quarterly reporting is not a universal requirement for every prudential return submitted by EMIs and PIs.
Annual regulatory financial data — Bank of Lithuania annual data submissions reconciled with the statutory accounts
AML/CFT regulatory reporting — preparation of statistical reports, supervisory information and other AML/CFT submissions required by the competent Lithuanian authorities. The applicable reporting obligations, recipients, frequency and deadlines depend on the institution's regulatory classification and the specific reporting framework. An annual AML statistical report submitted to FNTT should not be presented as a universal obligation applicable to every Lithuanian fintech institution.
Ad hoc regulatory submissions — responding to Bank of Lithuania requests for additional data or clarification
Supervisory correspondence support — drafting responses to Bank of Lithuania information requests
Reconciliation with management accounts — ensuring all regulatory submissions are consistent with the accounting records
Submission calendar management — tracking all regulatory reporting deadlines and ensuring timely filing

Outsourced vs. In-House: A Direct Comparison

The right structure for each function depends on the company’s stage, transaction volume, and operational complexity. The comparison below reflects the practical difference between outsourcing and in-house hiring for the key functions at a Lithuanian licensed fintech entity.

Factor	In-House Hire	Outsourced Function
Monthly cost (compliance officer example)	Approximately EUR 3,053–4,580 total employer cost (EUR 3,000–4,500 gross salary plus a standard employer contribution rate starting at 1.77% for an indefinite-term employment contract in 2026, subject to applicable conditions)	Fixed monthly retainer determined by the agreed scope of services.
Available from	After recruitment (4–8 weeks) + Bank of Lithuania fit-and-proper (4–8 weeks)	From contract signature — typically within 1–2 weeks
Regulatory suitability assessment	Prior approval, notification or suitability assessment may be required for specific positions, depending on the institution’s licence and the responsibilities of the individual	Outsourced function holders must satisfy the applicable competence, independence and suitability requirements. Previous regulatory experience or professional qualifications do not automatically eliminate institution-specific assessments, notification obligations or supervisory review.
Depth of expertise	Single person — expertise limited to that individual’s background	Backed by a team — specialist knowledge across AML, legal, and regulatory
Scale flexibility	Fixed cost regardless of transaction volume or complexity	Retainer adjusts as scope changes; scales up or down with the business
Regulatory documentation	Employment contract; no outsourcing agreement required	Written outsourcing agreement required; we prepare and maintain this
Continuity risk	High dependency on individual — illness or resignation creates gap	Team-backed — continuity maintained if individual is unavailable
Transition to in-house	N/A — already in-house	We support the transition when the time comes — handover of all documentation and processes

Outsourcing Services Pricing

All ongoing outsourced function retainers are quoted on request — the monthly fee depends on the scope of work, transaction volumes, and the complexity of the licensed entity’s operations. One-off engagements and setup fees for defined deliverables are priced at fixed rates. There are no hourly charges within an agreed retainer scope.

Service	Price
Outsourced CFO — monthly retainer Based on company size, transaction volume, and reporting requirements	On request
Outsourced Compliance Officer — monthly retainer Based on licence type, client base size, and compliance programme scope	On request
Outsourced MLRO — monthly retainer Based on expected SAR/STR volume and company risk profile	On request
Combined Compliance Officer + MLRO — monthly retainer Single named professional covering both functions — typically most efficient for smaller entities	On request
Outsourced Legal Counsel — monthly retainer Based on expected contract volume and regulatory advisory requirements	On request
Outsourced DPO — monthly retainer Based on processing volume, number of data subjects, and SDPI interaction frequency	On request
Regulatory Reporting Support — monthly retainer Based on licence type and number of periodic submissions required	On request
Outsourcing agreement preparation (per function) Written outsourcing agreement satisfying EBA guidelines; Bank of Lithuania notification where required	€800
Bank of Lithuania outsourcing notification For critical/important outsourcing arrangements requiring prior notification	€400
Initial compliance programme health check (new outsourcing clients) Assessment of existing programme before we take over the outsourced function	€1,600
Transition-in documentation package Full handover document pack when transitioning from a previous provider or in-house function	€1,000
Transition-out documentation package (to in-house hire) Full handover to an incoming in-house function holder when the company is ready to hire permanently	€1,000
One-off MLRO consultation (complex SAR or regulatory query) Per session — for specific matters outside a standing retainer	€600
One-off regulatory advisory session (CFO / legal) Per session — for specific financial or legal questions outside a retainer	€750

How retainer pricing works

Monthly retainer fees are quoted individually based on a brief scoping call — typically 30–45 minutes. We ask about the licence type, client volumes, current compliance status, and the expected scope of work for each function. From this, we provide a fixed monthly rate. The rate is reviewed quarterly and adjusted where the scope has materially changed. There is no minimum contract period — we work month-to-month, though most clients engage on a rolling 6–12 month basis given the regulatory continuity requirements.

Combined outsourcing package

Companies that need multiple outsourced functions simultaneously — for example, compliance officer, MLRO, and legal counsel at launch — benefit from a combined package at a discounted total monthly rate. Contact us to discuss a combined package for the specific functions you need. We work with companies at pre-licence stage, building the outsourced team in advance of the licence application, and with newly licensed entities that need the functions operational from day one.

Frequently Asked Questions

The Bank of Lithuania supervises outsourcing arrangements in accordance with the regulatory framework applicable to each institution. Depending on the nature of the function and relevant legislation, outsourcing may be subject to notification, supervisory assessment or other regulatory conditions. The Bank of Lithuania may require corrective measures or exercise other statutory supervisory powers where an outsourcing arrangement creates unacceptable risks or fails to comply with regulatory requirements. Outsourcing arrangements involving ICT services must also comply with DORA where applicable. The absence of a universal formal approval procedure does not prevent the supervisory authority from requiring changes to an arrangement or taking measures against non-compliance. We structure all outsourcing arrangements to satisfy EBA guidelines and Bank of Lithuania expectations, including the preparation of the outsourcing agreement and notification where required.

Yes — and for smaller licensed entities, this is the most common structure. Lithuanian AML law and Bank of Lithuania guidance permit the compliance officer and MLRO roles to be held by the same individual, provided that individual has the qualifications and time to perform both functions adequately and that there is no structural conflict of interest between the roles. As the entity grows and the volume of SARs and compliance work increases, separating the roles becomes more appropriate. We provide the combined function initially and advise when separation is warranted.

Whether a specific outsourcing arrangement requires prior notification depends on whether it constitutes ‘critical or important’ outsourcing under EBA guidelines. Outsourcing the compliance officer function at a licensed entity is typically considered critical or important — meaning prior notification to the Bank of Lithuania is required before the arrangement takes effect. We prepare the notification and submit it on behalf of the licensed entity. The Bank of Lithuania does not have a formal approval process for outsourcing notifications — it acknowledges receipt and can raise concerns, but the arrangement can proceed unless the regulator objects.

Transitioning from an outsourced function to an in-house hire is a natural progression that we actively support. When a company decides to bring a function in-house, we manage the transition: preparing a comprehensive handover documentation package, briefing the incoming hire on the regulatory history and current status of the function, and ensuring continuity during the handover period. We charge a fixed transition-out fee of EUR 1,000 for this service, in accordance with the published Outsourcing Services Pricing table. The transition typically takes 4–6 weeks from the point the incoming hire is confirmed.

A Data Protection Officer is mandatory under GDPR where an organisation’s core activities consist of large-scale processing of personal data — which includes most fintech companies operating payment or crypto platforms. Where a DPO is mandatory, GDPR explicitly permits the role to be performed by an external service provider rather than an employee. The DPO must be accessible to data subjects and the supervisory authority (SDPI), must have expert knowledge of data protection law, and must be provided with the resources necessary to perform their tasks. An outsourced DPO satisfies all of these requirements, provided the engagement is correctly structured.

Yes — and using outsourced functions during the application process is often the most efficient approach. The Bank of Lithuania’s licence application requires demonstrably qualified key function holders to be in place at the point of application. Appointing experienced external compliance and AML/CFT specialists during the licensing application process may support the preparation of governance arrangements and regulatory documentation. However, previous experience with Bank of Lithuania-regulated institutions does not constitute a transferable regulatory approval or automatically exempt an individual from suitability assessments relevant to a new institution. The applicant must demonstrate that all designated function holders meet the applicable competence, independence, availability and governance requirements. Any required supervisory assessment or notification must be completed in accordance with the rules applicable to the proposed licence.

When we take over an outsourced function from a previous provider or from an in-house function holder who has left, we conduct a structured transition-in exercise. This includes: reviewing all existing compliance documentation for completeness and quality; assessing the current status of the function against Bank of Lithuania expectations; identifying and prioritising any gaps; briefing ourselves on the company’s client base, risk profile, and regulatory history; and confirming the scope of the ongoing retainer. The transition-in documentation package (EUR 1,000) covers the review of existing compliance documentation, preparation of a written assessment, identification of outstanding issues and development of a structured transition plan, in accordance with the published Outsourcing Services Pricing table. It is separate from the first month’s retainer fee.

Ready to discuss outsourcing for your fintech company?

Contact us to book a scoping call. We will assess which functions are most appropriate to outsource at your current stage, confirm whether prior Bank of Lithuania notification is required, and provide fixed monthly retainer quotes for each function within 24 hours. No minimum commitment — we quote on a function-by-function basis.

Was this page helpful? Rate it

Be the first to rate this page

Company in Lithuania UAB partners

Company in Lithuania UAB collaborates with a network of trusted partners across legal, financial, accounting, and business consulting sectors. Our strategic partnerships enable us to provide clients with end-to-end solutions for company registration, tax advisory, banking setup, and beyond — all under one roof, right here in Lithuania.

Strongest in Lithuania

Company in Lithuania UAB has been recognised as one of Lithuania’s most trusted business services firms. Based on the independent economic data of 2025, we have been awarded the Strongest in Lithuania designation for four consecutive years — a testament to our financial stability, professional credibility, and the trust that our clients place in us.

We contribute to a transparent, well-functioning business environment in the Lithuanian Republic — and we bring that same standard of integrity to every client engagement.

Ready to start your business in Lithuania?Contact our team today for a personalized consultation. We are here to make the process simple, fast and hassle-free.Contact us

Popular services

Cases