AML audit in Lithuania the focus of the regulator and banks

Nikita Veremeev

10.01.2026 | 6 min read

Updated: 10.01.2026

As the CEO and founder of COREDO, I see entrepreneurs from Europe, Asia and the CIS facing the challenges of international expansion every day: from registering companies in new jurisdictions to obtaining financial licenses and ensuring strict AML compliance. Our experience since 2016, covering the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, confirms: success is built on a deep understanding of local regulations, such as 6AMLD and AMLR, and the implementation of practical solutions. In this article I will outline the key steps based on real cases from the COREDO team, so that you get a clear guide to minimizing risks and accelerating processes.

I’ll add an important caveat from COREDO’s practice: “negative outcome” during bank onboarding or licensing is almost never related to a single document. It is always a combination of factors: ownership structure + source of funds + client risk profile + quality of monitoring + manageability of compliance. Therefore, below I will analyze not the “theory of AML”, but a set of concrete artifacts that are actually checked: (1) EU banks when opening an account/correspondent account, (2) regulators during licensing, (3) auditors during an AML audit/inspection. And most importantly: I’ll show how to compile these artifacts so they work as an evidentiary basis, not as a “folder for the sake of a folder”.

Choosing a Jurisdiction: Taxes and Compliance

In reality a bank judges a jurisdiction not by the “tax rate” but by implementation risk and how controllable it is. Common rejection triggers I regularly see:

• multi-layered ownership chain without clear business logic (especially if there are offshore “layers”);
• “investor/founder” with an opaque source of wealth (high income without a provable accumulation history);
• mismatch between the geography of the funds and the geography of the business (for example, a company in the EU while the money “lives” in Asia/Middle East without explanation);
• nominal substance (there is an address but no management function and no verifiable operational reality);
• lack of a clear model: who the client is, how you make money, what the risks are and who controls them.

The COREDO team recently assisted a fintech startup from Asia with registration in Lithuania: we integrated online verification with the government platform, ensuring AML audit compliance in Lithuania and opening an account in a local bank within 3 weeks.

The Bank of Lithuania AML in 2025 strengthened priorities: mandatory transaction monitoring and PEP monitoring for all new entities. The solution developed at COREDO included preliminary due diligence for international transfers, minimizing predicate offences risks and ensuring smooth onboarding.

Mini-document package that speeds up banking onboarding in the EU (what they actually ask for)

1. Ownership pack: organizational structure (diagram), UBO register, corporate documents for each “tier” of ownership.
2. Source of Funds / Source of Wealth pack: origin of capital (contracts/dividends/sale of assets), tax returns/audit (if any), statements, accumulation logic.
3. Business model pack: products, target markets, client types, payment geography, calculation of expected turnover, list of key counterparties (top-10), money flow diagram.
4. Compliance pack: AML policy, Risk Assessment (methodology + result), sanctions/PEP screening, EDD procedure, SAR workflow, training.
5. Operations pack: substance (office/people/functions), contracts with providers (KYC/screening/monitoring), description of IT environment and access.

Obtaining Financial Licenses

Obtaining licenses for crypto, banking services, forex or payments is not a formality but a demonstration of resilience. In Lithuania the Bank of Lithuania AML requires a business plan with SAR reporting and a risk-based approach before issuance.

Practically speaking: for the regulator and the bank the “business plan” is not a pitch but a test of how well risks are managed. At COREDO we compile it in the format:

• Product scope: which services you provide and which you do not provide (especially important for crypto/payments).
• Customer risk: who your customer is (individual/legal entity), which segments are high-risk, what restrictions (for example, bans on certain jurisdictions / certain industries).
• Transaction risk: what types of transactions, what limits, what triggers enhanced checks.
• Control design: sanctions/PEP screening, EDD procedures, transaction monitoring, case management, SAR/STR reporting.
• Governance: who is the MLRO, who they report to, how the “three lines of defence” works, how often the Risk Assessment is reviewed.
• Outsourcing & vendor risk: which functions are with providers, what SLAs, how you control the quality of data and models.

Our experience at COREDO with a fintech client showed: integration of AI-driven AML scoring increased approvals from 60% to 95%, speeding up the process by 40%. We conducted compliance stress-testing by simulating peak transactions, which convinced the regulator of readiness for 6AMLD implementation.

Realistic timeline for AML implementation

• First 30 days: Risk Assessment, basic policies (CDD/EDD/sanctions), appointment of MLRO, start of screening, initial client and country risk matrix.
• 60 days: setup of transaction monitoring (scenarios, thresholds, alerts), implementation of case management, staff training, first test SAR/STR reports “for internal use”.
• 90 days: tuning false positives/false negatives, regular reports to the board of directors, internal audit plan, vendor quality control, an “audit trail” of decisions.

AML consulting: audit and monitoring

AML compliance Lithuania: a priority for everyone entering EU markets. AML audit Lithuania includes CDD, EDD and checks against FATF recommendations. The COREDO team conducts it in two stages: diagnosis (predicate offence risks) and optimization (automation). In a project for a bank we implemented transaction monitoring Lithuania with AI, providing performance metrics: coverage 99%, response time <1 min.

Which monitoring metrics banks and auditors really “love”

• Alert-to-case ratio: how many alerts turn into cases (if almost all alerts are “off” — the system is noisy).
• Case cycle time: average time to close a case and share of overdue cases.
• SAR/STR quality: share of returns/clarifications from the FIU (if such signals exist) or internal QA scoring of quality.
• False positives for key scenarios and causes (threshold/data/rule/client behavior).

At COREDO we almost always start by tuning the “top-3 noisiest scenarios” — this quickly reduces the team’s load and improves investigation quality without loss of control.

To prepare for an AML audit/inspection, it’s important to understand the mechanics of the review. The auditor almost always follows the logic:

• Design — do you have policies/procedures, and do they correspond to the risks.
• Implementation — do staff actually perform the procedures (and are there traces of this in systems).
• Effectiveness — do controls deliver results (metrics, tests, cases, adjustments).

KYC Lithuania is evolving toward eKYC standards with eIDAS identification: onboarding conversion increases by 50% without loss of security. Our approach: real-time PEP screening plus SAR reporting Lithuania according to Bank of Lithuania templates. For fintechs we minimized risks by integrating AI into Lithuanian banks’ AML systems, which increased efficiency by 35% and reduced fines from AMLA.

6AMLD Lithuania focuses on criminal liability of directors: COREDO recommends an AML officer on the board. In a crypto-business case we performed a stress test of AML compliance, identifying vulnerabilities in CFT, and adjusted policies to ensure protection against predicate offences in international transfers.

Critical moment of 2026: MLRO/AML Officer is not a “signature person”. Banks and regulators look at the independence of the function: who the MLRO reports to, can they stop a client/transaction, is there direct access to senior management, how conflicts of interest are recorded. We usually implement a simple but strong arrangement:

• The MLRO has the right to freeze/hold transactions until the investigation is completed;
• decisions are recorded in the case-management system with an audit trail;
• monthly MLRO report to management/board: risks, trends, incidents, scenario adjustments.

Support: from registration to scaling

COREDO offers a full cycle: registration, licensing, AML-compliant EU banks, account opening and reporting. In the EU banks require proof of business reputation and a business plan — we prepare them with ESG criteria. For Asia we add cryptographic security protocols.

To be as concrete as possible, here is a typical set of deliverables that we provide to the client in turnkey projects:

• Risk Assessment (methodology + final risk matrix for clients/products/countries/channels);
• AML/CFT Policies & Procedures (CDD/EDD/sanctions/PEP/monitoring/SAR);
• Onboarding playbook for the bank (structure, funds, business logic, answers to standard questions);
• Monitoring setup (scenarios + thresholds + escalation rules + investigation templates);
• Training pack (slides/tests/training log);
• Evidence pack for the audit (case examples, logs, QA reports, decision records);
• Remediation plan for 30/60/90 days if the audit/bank found gaps.

The AML regulator in Lithuania in 2025 emphasizes automated transaction monitoring — we integrate it with existing systems to ensure seamless scaling.

Typical reasons for bank refusals or compliance delays

1. Weak source of wealth: funds exist, but there is no provenance story. Solution: compile a narrative + documents + transaction sequence.
2. Insufficient substance: “a shell office”. Solution: demonstrate management function, contracts, roles, processes.
3. Unaddressed high risk: no EDD logic for PEP/sanctions/high-risk countries. Solution: EDD matrix + limits + controls on review frequency.
4. Monitoring “in a vacuum”: rules exist, but no cases/metrics/QA. Solution: evidence pack + performance indicators.
5. Too broad business model: “we do everything”. Solution: narrow the scope at the start and expand after gaining the bank’s trust.

Strategic ideas for growth

• Conduct sanctions due diligence on founders before submission; reduces rejections by 80%.
• Invest in AI for unusual patterns detection: ROI 200–300% per year.
• Prepare for AMLA focus: quarterly stress tests.
• For eKYC and digital onboarding use EU standards: preserves conversion during growth.

Questions clients commonly ask before entering the EU/Lithuania