A system allowing financial technology firms to operate across the European Union with a single license from a small member state is facing critical scrutiny, as Lithuania, a key hub for such operations, begins to scale back its supervisory role.
The central bank of Lithuania, a country with fewer than three million people, has become the sole supervisor for a significant portion of the EU’s fintech payments industry. This arrangement enables firms serving customers in major European cities like Lisbon, Warsaw, and Berlin to be licensed and supervised entirely from Vilnius.
Lithuania stepped into this role following the United Kingdom’s departure from the EU, which took London’s financial passporting rights with it. By the end of 2024, Lithuania had licensed 119 electronic money and payment institutions, which collectively moved €152 billion that year. The market, however, is highly concentrated, with just 10 firms handling approximately two-thirds of this financial flow, leaving a long tail of smaller players under the same single supervisor.
While often hailed as a success story, this model is also recognized in EU terminology as “regulatory arbitrage.” It relies on a rule known as “home-state control,” where a firm authorized in one member state can “passport” its services into all other member states without needing additional authorization. The responsibility for policing these firms, regardless of where their customers are located, falls solely on the regulator that issued the initial license.
This structure means that while the supervisory burden remains with the Lithuanian central bank, any customer complaints or political fallout from these firms land in the host states, from Portugal to Poland. Unlike banks, which are overseen by the European Central Bank through its Single Supervisory Mechanism, electronic money and payment institutions have no equivalent EU-level oversight above their home authority. Furthermore, their customers’ money lacks a deposit guarantee, relying instead on safeguarding in segregated accounts that only the home regulator checks.
The case of Revolut illustrates this dynamic: the firm established its European base in Vilnius. When its payments arm outgrew the e-money regime, it transitioned into a licensed bank in 2022, thereby moving into the supervised tier with a deposit guarantee. This left hundreds of smaller firms below without the same level of safety.
Lithuania did not invent this system but applied it more ambitiously than others, offering a fast-track licensing process in English, a regulatory sandbox, and direct access to euro payment rails. This approach was marketed to firms seeking the most cost-effective and credible entry into the single market. Proponents argue that passporting was a deliberate move to cut duplicate-licensing costs for cross-border finance and that host states retain emergency powers. However, critics contend that a regulator approving firms with operations across the continent becomes accountable for risks it cannot closely monitor.
The collapse of Germany’s payments champion Wirecard in 2020, with €1.9 billion missing, serves as a stark warning. This occurred in the EU’s largest economy under a supervisory system that pursued journalists raising alarms rather than the company itself. A passported failure, where damage affects countries that neither issued nor could withdraw the license, is considered even more problematic.
The data from Vilnius is revealing: the Lithuanian central bank has consistently canceled more licenses than it has granted, year after year. This trend suggests an implicit admission that the volume of firms it took on during the boom period has become larger than it can credibly oversee.
Brussels has now acknowledged this issue. In November 2025, EU lawmakers provisionally agreed on PSD3 and a new Payment Services Regulation, designed to integrate e-money firms into a more stringent, harmonized regime. Additionally, in December, the EU Commission proposed transferring the supervision of all crypto firms to ESMA, a central EU body.
While these measures aim to address the structural problem, they are not immediate solutions. The payments package is not yet law, and even when enacted, it will still leave authorization and prudential supervision at the national level, which is the core of the current concern. The crypto plan remains a proposal. Crucially, none of the proposed changes will unwind the numerous firms already operating across the bloc under a decade of light-touch, passported licenses.
This situation is not a failure on Lithuania’s part; its central bank has demonstrated greater candor and a quicker response in revoking licenses compared to some larger supervisors. Instead, the problem is structural and lies with Brussels. The EU, by enabling this system, effectively moved what amounts to “offshore finance” onshore, entrusting it to any ambitious small state willing to take on the business, and rebranding it as a single market. The ongoing reforms are an admission of this flaw, but they leave unanswered the critical question of who bears the risk already embedded within the system, as a rulebook arriving in 2028 cannot retroactively address it.
True, and beside the point. A regulator that approves a firm whose business is everywhere becomes answerable for risks it cannot see up close.
