A financial technology company serving clients in Lisbon, Warsaw and Berlin can secure its licence and oversight solely from Vilnius.

One central bank in a nation of under three million residents oversees a substantial portion of the EU fintech payments sector.

That bank is now quietly reducing its involvement in the role.

Following the United Kingdom exit from the EU, which removed London's financial passporting privileges, Lithuania filled the gap by developing one of the bloc's largest clusters of electronic money and payment institutions.

By late 2024 it had authorised 119 such entities, processing 152 billion euros that year. The sector shows imbalance, with ten companies managing roughly two thirds of the volume alongside numerous smaller operators. A single supervisor handles all of them.

This arrangement is often presented as a success. It qualifies as one.

It also represents regulatory arbitrage in EU terms, where one national authority provides market access across the entire bloc.

The mechanism relies on home state control. A company licensed in one member state can offer services throughout the others without further approval, while the issuing regulator must monitor it regardless of customer locations.

Consequently, customers, complaints and political consequences affect host countries from Portugal to Poland, while the supervisory load remains in Vilnius.

The key factor is the structure above that supervisor.

Banks fall under European Central Bank oversight via the Single Supervisory Mechanism, adding an EU level above national authorities.

Electronic money and payment institutions lack any higher oversight than the home regulator, and client funds receive only safeguarding in separate accounts verified solely by that home authority.

Revolut illustrates the model on a smaller scale. It established its European operations in Vilnius and later integrated its payments unit into a licensed bank in 2022 after outgrowing the e money framework, gaining deposit protection. Larger entities that could impact the system advanced to stronger safeguards, while many smaller ones remained below.

Lithuania did not create this system. It applied it more aggressively than others through rapid English language licensing, a regulatory sandbox and euro payment rail access, targeting firms seeking the most affordable entry to the single market.

Supporters correctly note that passporting was intentional to reduce duplicate licensing expenses in cross border finance, with host states retaining emergency powers.

That holds true yet misses the core issue. A regulator approving a firm active across many locations becomes responsible for risks it cannot monitor directly.

The cautionary example of Wirecard

Wirecard serves as the cautionary case. Germany's payments leader failed in 2020 with 1.9 billion euros unaccounted for, occurring in the EU's biggest economy under a system that focused on journalists raising concerns rather than the firm itself during critical periods.

A passported collapse proves even more damaging since effects hit nations that neither granted nor could revoke the licence.

This context highlights the Vilnius figures. The Bank of Lithuania has stopped expanding its fintech numbers and begun contracting them, cancelling nine licences in 2024 while granting three, continuing a decline since the 2022 peak.

Interpreted positively this reflects careful oversight. More directly it signals that a regulator revoking more licences than it issues annually acknowledges its supervised population exceeds credible capacity.

Brussels has also recognised the issue. In November 2025 EU lawmakers reached provisional agreement on PSD3 and a new Payment Services Regulation to integrate e money firms into a stricter harmonised framework. In December the EU Commission suggested centralising crypto firm supervision under ESMA.

Both target this exact concern. Neither resolves it promptly. The payments measures are not yet enacted and would still keep authorisation and prudential oversight at national level. The crypto proposal remains preliminary. No current plans address firms already passported on lighter licences over the past decade.

This situation does not stem from Lithuanian shortcomings.

Its central bank has acted more openly and revoked licences faster than larger authorities with lighter inspection records.

The issue is structural and originates in Brussels. An offshore centre fundamentally involves assuming risks belonging to others.

By this measure the EU did not eliminate offshore finance but relocated it onshore, assigning it to any ambitious smaller state seeking the activity and labelling it a single market.

The ongoing reforms represent an acknowledgment. They leave unresolved who bears responsibility for risks already present, since rules effective in 2028 cannot retroactively address them.