Lithuania’s Fintech Retreat Exposes a Fault Line in EU Regulation

Lithuania’s rise as a fintech powerhouse was built on a bold interpretation of EU passporting rules, which allow firms licensed in one member state to operate freely across the continent. By offering fast-track licensing and direct access to euro payment rails, the Bank of Lithuania attracted hundreds of electronic money and payment institutions. By the end of 2024, the country was overseeing 119 entities handling €152bn in flows. Yet, this model created a lopsided reality: while the regulator in Vilnius bears the supervisory burden, the political and financial fallout of any failure falls on host states from Portugal to Poland.

The system lacks the safety nets afforded to traditional banks. Unlike lenders overseen by the European Central Bank, these payment firms answer only to their home authority, and customer funds lack deposit guarantees. The cautionary tale of Wirecard, which collapsed in 2020 with €1.9bn missing, proves that even Europe’s largest economies struggle to police these entities. When a passported firm fails, the damage transcends borders, leaving the nations where customers reside powerless to intervene.

Signs of a retreat are now clear. The Bank of Lithuania revoked nine licenses in 2024 while issuing only three, marking a steady contraction from the sector’s 2022 peak. This shift serves as an implicit admission that the population of firms taken on during the boom exceeds the regulator's capacity to oversee them credibly. While Brussels has proposed tighter rules under PSD3 and plans to shift crypto supervision to the European Securities and Markets Authority (ESMA), these measures arrive years too late for the thousands of firms already operating under light-touch licenses. The EU aimed to create a single market, but in doing so, it effectively moved offshore risk onshore, leaving the bloc to face the consequences of a decade-long regulatory experiment.