title: LT — Operational Resilience & Critical Infrastructure (W3) | World Payments Monitor canonical: https://payments.gi/jurisdictions/lithuania/w3/ ### W3 Operational Resilience & Critical Infra limited signal Probable re-verified 2026-10-18 · changed 2026-09-28 Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable since 17 January 2025, supervised by the Bank of Lithuania as integrated financial supervisor across banks, insurers, EMIs/PIs and investment firms. Obligations cover ICT risk management, major-incident reporting (4h/72h/1-month), resilience testing, ICT third-party oversight and a Register of Information. Lithuania operates the REGATA system for JSON-format incident reporting. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/lithuania/) Standing sub-brief · as of 27 June 2026 237 words · last cycle 2026-09-28 #### Operational Resilience & Critical Infra The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has been directly applicable since 17 January 2025, and the Bank of Lithuania, acting as an integrated financial supervisor, oversees compliance across banks, insurers, EMIs and PIs, and investment firms. The obligations span ICT risk management, major-incident reporting on the 4-hour, 72-hour and 1-month cadence, resilience testing, ICT third-party oversight, and the maintenance of a Register of Information. Operationally, Lithuania runs the REGATA system for JSON-format incident reporting. Because the Lithuanian fintech sector relies heavily on cross-border cloud and outsourcing arrangements, the DORA Register of Information and the ICT third-party oversight regime are a material operating constraint for both bank and non-bank entities supervised here. The supervisory picture carries one corroborated wrinkle: Lithuania has been noted among Member States receiving formal notice over incomplete transposition of the DORA Directive, a point sourced from a Tier-3 vendor and flagged accordingly. The substance of the directly applicable Regulation, however, is confirmed against the Bank of Lithuania's primary DORA page. #### Outlook The W3 trajectory is established. The framework is in force and supervised, and the analytical interest going forward lies in how the Register of Information and third-party oversight obligations bite on a fintech population whose business models depend on outsourced cloud infrastructure. The incomplete-transposition notice is a watch item that may yet generate corrective supervisory activity, but the core resilience regime is settled for this cycle. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure DORA-aligned incident-reporting expectations, requiring initial notification within four hours and follow-up reporting within seventy-two hours, are now an explicit supervisory expectation for Lithuania-licensed electronic money institutions. This represents the operational-resilience dimension of the broader supervisory tightening evident elsewhere in Lithuania's payments sector this cycle, extending beyond capital-adequacy and licensing enforcement into incident-response timeliness as a distinct compliance expectation for EMIs operating in the jurisdiction. This expectation applies specifically to the bank-and-EMI-regulated population rather than to non-bank payment institutions uniformly, reflecting the bank-PSP versus non-bank-PI/EMI distinction that runs through Lithuania's broader payments-supervision architecture: prudentially significant entities face the more demanding incident-reporting cadence associated with DORA alignment. Whether DORA-aligned incident-reporting expectations are extended explicitly to payment institutions as well as electronic money institutions, and how compliance with the four-hour/seventy-two-hour cadence is supervised in practice, are the items to watch as this expectation becomes embedded in ordinary supervisory practice. **2 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Operational Resilience & Critical Infrastructure CENTROlink, the Bank of Lithuania's payment-infrastructure platform, processed 379.7 million payments in 2025, an increase of 28.9% year over year, with instant payments now accounting for 68% of total volume. The platform's participant community has grown to more than 200 financial institutions drawn from more than 20 countries, with more than 140 active participants as of the most recent update. This scale and growth rate together represent a structural competitive advantage rather than a single-cycle event: CENTROlink gives eligible payment institutions direct access to SEPA and instant-payment rails through the central bank itself, obviating the need for a correspondent-banking relationship with a commercial intermediary bank. The resilience dimension of this infrastructure is inseparable from its growth: a platform now carrying nearly 380 million payments annually, with more than two-thirds processed as instant payments, is infrastructure whose continuous availability has become systemically important to the EMI and PI sector's day-to-day operations. The year-over-year growth rate of 28.9% also indicates the platform is still absorbing incremental participant and volume growth rather than approaching any evident capacity ceiling. Watch for continued growth in CENTROlink's participant count and transaction volume in the next reporting period, and for any operational-resilience disclosures addressing capacity planning given the platform's sustained high growth rate. Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Trade-press reporting this cycle suggests the Bank of Lithuania introduced cyber-resilience stress testing in 2026. This rests on a single Tier-4 source without corroboration to a primary regulatory publication, and is therefore carried as a low-confidence, watch-status development rather than a confirmed operational-resilience measure. No further detail on the scope, frequency, or supervised-entity population subject to any such stress testing was available this cycle. Watch for primary-source corroboration of the cyber-resilience stress-testing claim in a future cycle; until such corroboration is available, this should be treated as an unconfirmed signal rather than a settled feature of Lithuania's operational-resilience supervisory framework. **Sources and findings (3 unique sources · R-3/R-4)** 1. [W3-E1] T1 Derived: Confirmed [in_force https://www.lb.lt/en/digital-operational-resilience-act-dora](https://www.lb.lt/en/digital-operational-resilience-act-dora) re-verified 2026-06-27 DORA is a directly applicable EU regulation requiring financial entities including EMIs and PIs to ensure operational capacity to withstand, respond to and recover from ICT disruptions, with uniform rules on ICT risk management, incident reporting, operational resilience testing and ICT third-party risk monitoring, supplemented by RTS/ITS such as Commission Delegated Regulation (EU) 2025/301. 2. [W3-E2] T3 Derived: Probable [in_force https://vendorica.com/supervisory/national-authorities/bank-of-lithuania/](https://vendorica.com/supervisory/national-authorities/bank-of-lithuania/) re-verified 2026-06-27 As Lithuania's integrated financial supervisor the Bank of Lithuania oversees DORA compliance across the financial sector, operates the major ICT incident reporting framework, and activated the REGATA system for JSON-format ICT incident and cyber-threat reporting; the Seimas passed DORA-related legislation and Lithuania was among 13 Member States receiving formal notice over incomplete DORA Directive transposition. 3. [W3-E3] T3 Derived: Probable [in_force https://www.baltictimes.com/dora_in_the_balticswhat_financial_entities_in_estonialatvia_lithuania_must_know/](https://www.baltictimes.com/dora_in_the_balticswhat_financial_entities_in_estonialatvia_lithuania_must_know/) re-verified 2026-06-27 The Bank of Lithuania has issued detailed guidance on how DORA applies to banks, insurers, EMIs and investment firms; given heavy reliance on cross-border outsourcing and cloud services, Lithuanian firms must establish a Register of Information for ICT contracts and the regulator is preparing to supervise critical ICT third-party providers.