In finance, “permission hierarchy” means two connected things. The first is the regulatory ladder: which institution is licensed to do what, from banks down to payment institutions. The second is the internal ladder inside a company: who may view, prepare, approve and release a payment. This guide covers both, with Lithuania as the reference market, and shows how the two meet when your business opens an account.
DemivoltBuild Clear Roles Into Business BankingDemivolt provides business accounts with role-based user management, helping companies align payment access with their internal governance.Visit DemivoltTL;DR
- Lithuanian financial services are tiered by license: banks sit at the top, electronic money institutions (EMIs) and payment institutions (PIs) below, each with different capital and scope.
- Only credit institutions accept deposits. EMIs and PIs must safeguard client funds in separate accounts, so those funds are insulated from other creditors.
- A licensed institution stays fully accountable for agents, distributors and white-label partners. Outsourcing does not outsource responsibility.
- Inside your company, a permission hierarchy means role-based access, approval limits and separate people for preparing and releasing payments.
- Choosing a regulated provider with role management and transparent fees lets you mirror your own governance in the account.
Table of Contents
- The regulatory ladder: who is allowed to do what
- Safeguarding: why the license tier matters to your money
- Accountability does not travel down the chain
- Operational resilience is part of the permission
- The internal ladder: permission hierarchy inside your company
- What to check when choosing a business account
- Our perspective: governance should be built into the account
- Costs of moving money across the hierarchy
- Set up your structure with Demivolt
- FAQ
- Sources
The regulatory ladder: who is allowed to do what
The Bank of Lithuania’s payments overview describes a tiered system based on institutional license. The higher the tier, the heavier the capital and governance requirements, and the wider the permitted activity.
| Tier | Initial capital requirement | What it means in practice |
|---|---|---|
| Bank | 5,000,000 € | Highest capital and governance requirements; can accept deposits |
| Specialized bank | 1,000,000 € | Credit institution with a narrower scope; can accept deposits |
| Electronic money institution (EMI) | 350,000 € | Issues electronic money, for unrestricted activities |
| Payment institution (PI) | 20,000 to 125,000 € | Tiered by the scope of payment services provided |
The same page states that evaluation of applications typically takes up to three months for PIs and EMIs, and up to six months for banks. That difference alone shows how the regulator treats each tier.
Banks and specialized banks
Credit institutions are the top of the hierarchy. They hold the deposit-taking permission and carry the strictest requirements. Other institutions often rely on them: under PSD2, a payment institution may keep safeguarded client money in a separate account at a credit institution.
Electronic money institutions
An EMI issues electronic money and offers payment services connected to it. The 350,000 € initial capital figure reflects a broader permission than that of most payment institutions. EMIs do not take deposits in the banking sense, and what they hold for clients is protected through safeguarding rules rather than a deposit model.
Payment institutions
The Bank of Lithuania describes a payment institution as a licensed market participant providing payment services such as money transfers and payment transactions. Its capital requirement depends on which of the listed services it offers: 20,000 € at the lower end, 125,000 € at the upper end.
Crypto-asset providers and the payment layer
The ladder is also moving at its edges. The Bank of Lithuania announced that transfers involving electronic money tokens made on behalf of clients count as a payment service under PSD2. Crypto-asset service providers therefore had to obtain a payment institution license, or hand those services to a licensed entity, by 1 March 2026. That transition date has now passed, so any business using such a provider should check which licensed entity actually executes its payments.
Safeguarding: why the license tier matters to your money
For a company, the practical question is what happens to its funds if the provider fails. Under PSD2 (Directive (EU) 2015/2366), payment institutions must safeguard client funds received for payment transactions. The funds must be:
- kept in a separate account at a credit institution or central bank, or invested in secure, liquid, low-risk assets; or
- covered by an equivalent insurance policy or guarantee.
They must not be mixed with the institution’s own money, and they are insulated from the claims of its other creditors in an insolvency. When you compare providers, ask three questions: which license does it hold, where are client funds held, and is that segregation documented?
Accountability does not travel down the chain
Many fintech products are built through agents, e-money distributors and white-label arrangements. The regulatory hierarchy applies to these too, and often in ways partners do not expect.
The Bank of Lithuania warned in 2023 that a licensed institution carries the full legal and reputational consequences of its agents’ and distributors’ activities. Signing a contract is not enough. The institution must exercise active, documented oversight of AML/CTF and sanctions controls. The same publication says that the line between a white-label service provider and an agent is often blurred: if a third party holds or controls client funds, it must be registered as an agent or distributor, not treated as a plain service provider.
The regulator’s best-practice and recommendations document adds that outsourcing operational functions does not outsource regulatory accountability, and that institutions need independent oversight and exit strategies for critical functions.
If you are an advisor, agency or platform thinking about referring clients or building on someone else’s license, this is the hierarchy that matters most. Decide early whether you are a referrer, an agent or a distributor, and have the regulated institution confirm it in writing.
Operational resilience is part of the permission
A license is also a duty to keep systems running. The ESAs’ 2025 report on major ICT-related incidents, prepared under DORA, counts 3,383 major incidents reported by EU financial entities in 2025. The ESAs stress that this figure is not a sign of structural failure. Resilience is judged by how quickly incidents are identified, managed and contained. Credit and payment sectors, being highly digital, account for most reports, and roughly one-third of the incidents had cross-border impact through shared ICT providers.
For your business, that means asking your provider how incidents are handled, and having your own escalation route. Many companies also set up an internal reporting channel so staff can raise control concerns safely, for example with a cloud-based whistleblowing platform built for EU-compliant internal reporting.
Authentication is the other control. According to EBA analysis, card payments authenticated with Strong Customer Authentication had markedly lower fraud rates in the first half of 2024, and payments acquired outside the EU, where SCA is not legally mandated, showed fraud rates up to 10 times higher.
The internal ladder: permission hierarchy inside your company
Regulation decides who may hold and move money. Your own governance decides who in your company may instruct that movement. A workable internal hierarchy has four layers.
- View only. Bookkeepers, auditors and advisors who need statements and reports but cannot move funds.
- Prepare. Staff who create payment orders, upload invoices or request cards.
- Approve. A finance manager or CFO who validates the order against a budget or contract.
- Administer. One or two owners who add users, change limits and close accounts.
The rule that holds the structure together is separation of duties: the person who prepares a payment should not be the only person who releases it. Small teams can satisfy this with two people. Larger ones add thresholds, for example a manager approves routine supplier payments while the CFO approves anything above an agreed amount, or any SWIFT payment to a new beneficiary.
A worked example
Take an e-commerce company in Vilnius with a founder, a finance manager, a part-time bookkeeper and an external accountant.
- The accountant gets view-only access to the main account.
- The bookkeeper prepares supplier payments and sees all transactions.
- The finance manager approves payments up to the agreed limit and manages virtual cards for the marketing team.
- The founder is the administrator and approves anything above the limit.
- Separate accounts hold operating cash, VAT and tax reserves, and a marketplace settlement balance, so each team sees only what it needs.
This is not complicated, but it only works if the account supports multiple accounts and roles. Many basic business accounts offer one login with full rights, which forces companies to share credentials. That is the weakest possible hierarchy.
What to check when choosing a business account
- License and scope. Which institution is regulated, and for which services? Is it a bank, an EMI or a PI?
- Safeguarding. Are client funds held in segregated accounts?
- Roles and approvals. Can you separate view, prepare, approve and admin rights?
- Multi-account structure. Can you split balances by purpose, entity or project?
- Cards. Can you issue virtual and physical cards to named users with controls?
- Fee transparency. Are payment fees published per operation?
- Onboarding. Is the risk-based verification process clear and documented?
Our perspective: governance should be built into the account
We see the same pattern with many cross-border SMEs. The company has clear rules on paper, but the bank account does not reflect them: one login, one balance, no approval trail. When something goes wrong, nobody can show who did what.
Our view is that permissions belong in the infrastructure, not only in a policy document. That is why Demivolt is built around dedicated IBAN accounts, multi-account structures and role-based user management, with client funds held in segregated accounts. A founder can keep full control, a finance lead can approve, and an external accountant can see everything without touching anything.
We also think the regulatory side deserves plain language. A business should know which regulated structure sits behind its account, and a partner or reseller should know exactly where referral ends and regulated activity begins. Our reseller and white-label models are set up with that line in mind, and we are glad to walk advisors through it.
— dd
Costs of moving money across the hierarchy
Permissions also touch cost, because approval rules work best when you know what each payment costs. Our published fees are:
| Item | Fee |
|---|---|
| Account opening | 0 |
| Account verification | 0 |
| Dedicated Client Manager | 0 |
| Monthly maintenance | 0 per month |
| Account closure | 0 |
| Internal transfers between Demivolt accounts | 0 |
| SEPA In | €0 |
| SEPA Out | €0.40 per transfer |
| SWIFT In | €25.00 |
| SWIFT Out | €30.00 |
You can estimate outgoing transfer costs with our SEPA fee calculator. Because a SWIFT payment costs far more than a SEPA one, many companies set a rule that international transfers always need a second approver.
Set up your structure with Demivolt
If you are building or reorganizing your company’s finance setup, start with Demivolt business accounts: dedicated IBANs, multiple accounts and role-based users, with no account opening or monthly maintenance fee. For payments we support SEPA and SWIFT, and for team spending we offer virtual and physical Visa cards. Fintechs and platforms that need regulated infrastructure can look at Banking-as-a-Service, and advisors can review our partner, agency and white-label models. To begin, get started on demivolt.com or contact us through the site.
FAQ
Which institution is at the top of the financial hierarchy in Lithuania?
Credit institutions, meaning banks and specialized banks. They face the highest capital requirements (5,000,000 € for banks, 1,000,000 € for specialized banks) and can accept deposits. EMIs and payment institutions operate below them, with narrower permissions.
What is the difference between an EMI and a payment institution?
An EMI issues electronic money and needs 350,000 € in initial capital for unrestricted activities. A payment institution provides payment services only, and its capital requirement ranges from 20,000 to 125,000 € depending on scope. Both must safeguard client funds under PSD2.
Is my money protected if a payment institution fails?
Under PSD2, client funds must be safeguarded: held in a separate account at a credit institution or central bank, invested in secure low-risk assets, or covered by an insurance policy or guarantee. They are insulated from the claims of other creditors. Confirm with your provider exactly which method it uses.
Who is responsible when a licensed institution uses an agent or white-label partner?
The licensed institution. The Bank of Lithuania states that it bears the legal and reputational consequences and must keep documented oversight of AML/CTF and sanctions controls. If you are a partner, ask the institution to confirm in writing whether your role is referral, agency or distribution.
How should a small company structure approval rights?
Separate who prepares from who approves, give accountants view-only access, and keep administrator rights with one or two owners. Add approval thresholds for large or international payments. If your account cannot enforce these roles, consider one that supports role-based user management.
Sources
- Bank of Lithuania: Payments
- Bank of Lithuania: Payment institutions
- Bank of Lithuania: EMT operations will require a payment services license
- Directive (EU) 2015/2366 (PSD2), EUR-Lex
- Bank of Lithuania: responsibility for agents and e-money distributors
- Bank of Lithuania: best practice and recommendations on third parties, agents, distributors and white labelling
- ESAs 2025 report on major ICT-related incidents
- EBA: Innovation, competition and security, Payments Tomorrow
- Ashio: internal reporting channel case study