Lithuania AML Obligations for Accountants and Auditors: Law VIII-275 Guide

Lithuania's anti-money laundering rules sit in the Law on the Prevention of Money Laundering and Terrorist Financing, No VIII-275 of 19 June 1997. This guide uses the official English consolidated text published on the Seimas legal register, which is marked as last amended on 15 April 2021 (No XIV-249). It is written for accountants, auditors and finance students who want to see how a Baltic regime compares with the UK and Ireland. For the general principles behind customer checks, our guide to KYC and customer due diligence in accountancy practices is a good starting point.

Please read the "What we could not confirm" section at the end. The law has probably been amended since the version we read, so treat this post as a map of the structure rather than a current compliance checklist.

Who is covered

According to Article 2(10) of the consolidated text, the obliged entities include auditors, accounting and tax advisory undertakings and self-employed persons providing those services, notaries and advocates, trust or company service providers, gaming and lottery companies, estate agents, virtual currency exchange and custodian wallet operators, and free zone operators.

Who supervises

Article 4 allocates supervision by sector. In the text we read, the Lithuanian Chamber of Auditors supervises auditors. Entities not covered by the other listed supervisors fall under the Financial Crime Investigation Service (FCIS), which is also the financial intelligence unit. Our reading is that accounting and tax advisory firms fall into that last group, but the text does not say so in terms, so please confirm with the FCIS before relying on it.

When customer due diligence is required

Article 9 requires due diligence before a business relationship is established and for one-off or linked operations of EUR 15,000 or more. It also sets lower thresholds for other sectors, such as EUR 3,000 for cash currency exchange and EUR 10,000 for traders paid in cash for property. Linked operations are aggregated per day. The article also requires the entity to decide whether to forward a report when it cannot meet its due diligence requirements. High-risk relationships need approval from a senior manager (Article 14(3)). The practical steps for doing this well are covered in the KYC guide linked above.

Beneficial owners

Article 2(14) treats a natural person holding more than 25% of the shares or voting rights, or 25% plus one share, as an indication of direct ownership. Indirect ownership is assessed through controlled undertakings. If no owner can be identified, or doubt remains, the senior managing official is treated as the beneficial owner. For trusts the settlor, trustee, protector, beneficiaries and any other controlling person are covered. Article 12(7) says the beneficial owner must be identified before the customer identification process ends. See our guide to ultimate beneficial ownership for the wider concept.

Reporting suspicions to the FCIS

Article 16 sets short deadlines. Where an entity suspects that assets are criminal proceeds or that terrorism is being supported, it must report "not later than within one working day from the emergence of such knowledge or suspicions" (Article 16(1)). Where a suspicious operation is under way, the entity must suspend it and report within three working hours of the suspension, or of identifying the operation if it is not suspended (Article 16(2)). If a customer intends to attempt a suspicious operation, the entity must notify the FCIS immediately (Article 16(3)). Good-faith reporters are protected from legal proceedings and disciplinary sanctions, and institutions are not liable to customers for contract breaches caused by performing these duties (Article 16(13)).

The FCIS also has powers to act. It can order an operation suspended for up to ten working days (Article 7(5)), and an entity must report on the measures it took within seven working days of receiving FCIS instructions (Article 7(4)).

Tipping off

Article 23(3) prohibits institutions, employees and other obliged entities from telling the customer or others that information was sent to the FCIS or another supervisory authority. Notaries, advocates and judicial officers are exempt when they are dissuading clients from illegal activity. Disclosure between entities is allowed only to prevent money laundering or terrorist financing.

Record keeping

Article 19 sets out several periods. Register data, including suspicious-transaction registers, must be kept for eight years from the end of the relationship. Copies of customer identity documents and account or agreement documents are kept for eight years, and transaction and operation documents for eight years from execution. Business correspondence is kept for five years from the end of the relationship, and records of investigations under Article 17 for five years. A competent authority can extend the period by up to two years on a reasoned instruction.

Internal controls and training

Entities must designate a senior employee, or a board member where the board leads, to organise the measures and liaise with the FCIS, and notify the FCIS in writing within seven working days (Article 22(1)). Relevant employees must receive special ongoing training to recognise suspicious activity, although the text we read gives no training frequency (Article 22(2)). Entities must answer FCIS enquiries within 14 working days (Article 22(6)). Our guide to suspicious activity reports and tipping off compares the UK approach.

Our suggestions for a Lithuanian firm

These are our own suggestions, not requirements of the law. Build the one-working-day reporting deadline into your escalation procedure, so that a staff member knows who to tell the same day. Keep a single retention schedule that uses the eight-year period for core records and the five-year period for correspondence. Record who your designated senior employee is and when the FCIS was notified. If you want structured study, see our CPD courses.

Frequently asked questions

How quickly must a suspicion be reported?

According to Article 16(1) of the consolidated text, within one working day from the emergence of the knowledge or suspicion. For a suspicious operation in progress, the text says to suspend it and report within three working hours.

How long are records kept?

Article 19 sets eight years for most customer and transaction records and five years for business correspondence, with a possible extension of up to two years.

Are auditors and accountants supervised by the same body?

In the text we read, auditors are supervised by the Chamber of Auditors. Which body supervises accounting firms is our reading only, so check with the FCIS.

What we could not confirm

We read an official English consolidated text that was last amended on 15 April 2021, and we did not check later amendments or the current Lithuanian-language text. We did not find penalty amounts, so we state none. We did not confirm the exact supervisor for accounting and tax advisory firms, the detailed internal control requirements, or any guidance published by the FCIS or the professional bodies. Always check the current law and FCIS guidance before acting. This post is general information, not legal advice.