Lithuania built the EU’s biggest home for fintech payments firms. Now its own regulator is retreating, and the fixes from Brussels arrive too late to undo what is already through the gate.
Marta Liduma
A financial-technology firm serving customers in Lisbon, Warsaw and Berlin can be licensed, and supervised, entirely from Vilnius.
One central bank, in a country of fewer than three million people, stands behind a large slice of the EU’s fintech payments industry.
And it is now quietly backing away from the job.
When the United Kingdom left the EU, it took London’s financial passporting rights with it, and Lithuania stepped in, building one of the EU’s largest concentrations of electronic money and payment institutions.
At the end of 2024 it licensed 119 of them, moving €152bn that year. The market is lopsided: 10 firms handle about two-thirds of that flow, above a long tail of small players. One supervisor answers for the lot.
This is usually told as a success story. It is one.
It is also, in the EU’s own language, regulatory arbitrage: a single national regulator underwriting market access for the whole bloc.
The device is a rule called home-state control. A firm authorised in one member state can passport its services into all the others without asking anyone, and the regulator that issues the licence must police it, wherever its customers sit.
So the customers, complaints and political fallout land in host states from Portugal to Poland. The supervisory burden stays in Vilnius.
What matters is what sits above that supervisor.
Banks answer to the European Central Bank through its Single Supervisory Mechanism, a layer of EU oversight above the national regulator.
Electronic money and payment institutions answer to no one above the home authority, and their customers’ money carries no deposit guarantee, only safeguarding in segregated accounts the home regulator alone checks.
Revolut is the pattern in miniature: it built its European base in Vilnius and, when its payments arm outgrew the e-money regime, folded it into a licensed bank in 2022, climbing into the supervised tier with a deposit guarantee. The firm big enough to threaten the system moved up to safety. The hundreds it left below did not.
Lithuania did not invent this. It simply read it more ambitiously than anyone, with a fast-track licencing process in English, a regulatory sandbox and direct access to euro payment rails, marketed to firms hunting the cheapest credible door into the single market.
Its defenders have a fair point: passporting is deliberate, it cut the duplicate-licensing costs that burdened cross-border finance, and host states keep emergency powers.
True, and beside the point. A regulator that approves a firm whose business is everywhere becomes answerable for risks it cannot see up close.
The warning from Wirecard
Wirecard is the warning. When Germany’s payments champion collapsed in 2020 with €1.9bn missing, it happened in the EU’s largest economy, under a supervisory system that spent the crucial months chasing the journalists who raised the alarm, not the company.
A passported failure is worse still, because the damage lands on countries that never issued the licence and could not withdraw it.
Which is what makes the numbers from Vilnius so revealing.
The Bank of Lithuania is no longer growing its fintech population; it is shrinking it, revoking nine licences in 2024 while issuing three, the latest in a steady contraction since the sector peaked in 2022.
Read generously, this is responsible supervision. Read plainly, it is an admission: a regulator that cancels more licences than it grants, year-after-year, is conceding that the population it took on in the boom is larger than it can credibly oversee.
Brussels, too, now concedes the point.
In November 2025 the EU’s lawmakers provisionally agreed PSD3 and a new Payment Services Regulation that fold e-money firms into a tighter, harmonised regime; in December the EU Commission proposed handing supervision of all crypto firms to a central EU body, ESMA.
Both aim at exactly this. Neither fixes it soon. The payments package is not yet law and, when it lands, still leaves authorisation and prudential supervision national, the very thing in question. The crypto plan is still only a proposal. And nothing on the table unwinds the firms already passported across the bloc on a decade of light-touch licences.
None of this is a Lithuanian failure.
Its central bank has been more candid, and quicker to revoke, than bigger supervisors that inspect less.
The problem is structural, and it belongs to Brussels. An offshore centre is not, at bottom, about secrecy. It is about holding risk that belongs to everyone else.
By that test the EU did not abolish offshore finance; it moved it onshore, handed it to whichever ambitious small state wanted the business, and called it a single market.
The reforms now in train are an admission. What they leave unanswered is who carries the risk already inside the gate, because a rulebook that arrives in 2028 cannot reach back to collect it.
