FAQ

General Notes

The compliance report must be signed with a qualified electronic signature by the Head of the Institution (a cover letter is not required).

If, in response to any question, the Institution refers to more than one policy or procedure, then the approval date (or date of the most recent update) must be provided for each referenced document.

When answering the questions, the Institution should indicate specific policies or procedures (including their titles and approval dates). Generalised responses such as “Policy X and procedures” are not acceptable unless all procedures are listed and their approval dates are provided.

If the Institution selects “No” as an answer to any question, a clear and unambiguous explanation or justification must be provided in the column entitled “Institution’s justification for selecting “No””.

Questions on the Safeguarding of Client Funds

• “1.5. Does the Institution have an agreement (or a draft agreement) with a credit institution for a segregated account to hold client funds?”

If the Institution selects “Yes”, it must indicate all credit institutions with which such agreements have been concluded, along with the dates on which each of the agreements were signed. If the Institution has not yet signed any such agreements, it should provide information about the draft agreement and the date on which it was approved. If the draft is part of another policy or procedure, the Institution should clearly state this and provide the name and approval date of that document. It is important to note that copies of agreements or draft agreements do not need to be submitted.

• “Requirements when client funds are safeguarded by insurance, a guarantee, or a surety” (questions 1.6–1.10)

If the Institution does not safeguard client funds using insurance, a guarantee, or a surety, this must be clearly stated in response to question 1.6. In such a case, it will be assumed that questions 1.7 through 1.10, which request further detail on this safeguarding method, are not applicable to the Institution.

• “1.11. Are the documents, information, and procedures describing the safeguarding of client funds up to date and appropriate according to the nature of the Institution’s activities?”

When answering this question, the Institution is not required to list supporting documentation, as it is assumed that all relevant documents describing the arrangements for the safeguarding of client funds have already been identified in answers to questions 1.1–1.10. By answering “Yes”, the Institution confirms that the previously referenced documents, information, and procedures are up to date and appropriately reflect the nature of its business activities.

• “1.12. Does the Institution confirm that it complies with Article 17 of the Republic of Lithuania Law on Payment Institutions and/or Article 25 of the Law on Electronic Money and Electronic Money Institutions?”

Since this question requires confirmation only, it is assumed that all relevant documents and information relating to the safeguarding of client funds have already been addressed in questions 1.1–1.11. Therefore, there is no need to list any documents again in this response.

• “1.13. Does the Institution confirm that internal documents establishing measures for the safeguarding of client funds comply with the requirements set out in the Description of Institutional Management System Requirements?”

As this question also requires only confirmation, it is assumed that all relevant documents and required information concerning the safeguarding of client funds have already been provided in responses to questions 1.1–1.10, and do not need to be repeated here.

Questions on Governance Arrangements and Internal Control Mechanisms

• “2.1. Does the Institution have documents establishing governance arrangements and internal control mechanisms for the provision of payment services and/or the issuance of electronic money?”

When responding to this question, the Institution should list all key policies (or procedures, if no higher-level document regulates the area) that define its governance arrangements and internal control mechanisms. These may include, but are not limited to: risk management policy; compliance policy; anti-money laundering, counter-terrorist financing, and fraud prevention policy; international sanctions implementation policy; conflict of interest prevention policy; and internal audit policy. It is important to note that only the core internal rules governing a specific area of governance or internal control should be listed (typically at the policy level), and it is not necessary to include procedures implementing those policies.

• “2.2. Are the governance arrangements and internal control procedures proportionate, appropriate, reliable, and sufficient?”

The Institution is not required to refer to specific documents (such as policies, descriptions, or procedures) that demonstrate compliance with this requirement, since it is assumed that all key documents have already been listed in response to question 2.1. By answering “Yes”, the Institution confirms that the documents mentioned in response to question 2.1 adequately define governance arrangements and internal control procedures that are proportionate, appropriate, reliable, and sufficient.

• “2.6. Has the Institution appointed a person or persons responsible for internal control functions, including periodic, ongoing, and compliance monitoring, and does it hold their identification data and up-to-date CV(s)?”

In response to this question, the Institution should provide the names and surnames of the appointed persons along with their areas of responsibility (e.g. AML/CTF officer, compliance officer, risk management officer). No further personal details or documents are required.

• “2.7. If the Institution uses the services of an auditor who is not a statutory auditor as defined in the Republic of Lithuania Law on Audit of Financial Statements, does it have the identification data of that auditor?”

If the answer is “Yes”, the Institution should indicate the auditor’s name and registration code (for a legal person) or full name (for a natural person). No further personal details or documents are required.

• “2.12. Are the documents, information, and procedures relevant and appropriate for the Institution’s operational nature?”

The Institution is not required to indicate documents proving compliance with this requirement, as it is assumed that all key documents describing the governance arrangements and internal control mechanisms have already been listed in previous responses under the section entitled “2. Governance arrangements and internal control mechanisms for the provision of payment services and/or electronic money issuance”. By answering “Yes”, the Institution confirms that the previously mentioned documents are up to date and suitably reflect the Institution’s operations.

• “2.13. Does the Institution confirm that the internal documents establishing governance arrangements and internal control mechanisms comply with the requirements set out in the Description of the Management System and Safeguarding Requirements for Electronic Money Institutions and Payment Institutions?”

Since this question only requires confirmation from the Institution, it is assumed that all key documents describing the governance arrangements and internal control mechanisms have already been listed in the responses to previous questions under the section entitled “2. Requirements for the governance arrangements and internal control mechanisms for the provision of payment services and/or electronic money issuance”.
By answering “Yes” to this question, the Institution confirms that the governance and internal control framework set out in the documents mentioned in previous questions complies with the requirements established in the Description of the Management System Requirements for Institutions.

Questions on the Use of Information and Communication Technology (ICT) Services

• “3.1. Does the Institution have internal documents setting out the procedures for the use of ICT services?”

In response to this question, the Institution should indicate all key policies (or procedures, if no higher-level document exists) governing the use of ICT services. This includes, but is not limited to, information security policy, incident management policy, acceptable use policy, access rights management policy, and similar documents.

• “3.2. Are the ICT usage procedures proportionate, appropriate, reliable, and sufficient?”

When answering this question, the Institution is not required to indicate documents (such as policies, procedural descriptions, or other materials) proving compliance with the requirement, as it is assumed that all key documents describing the procedures for the use of ICT services have already been listed in response to question 3.1.
By answering “Yes” to this question, the Institution confirms that the ICT usage procedures set out in the documents referenced in question 3.1 are proportionate, appropriate, reliable, and sufficient.

• “3.4. Does the Institution confirm that its ICT usage procedures comply with the requirements of Articles 6 and 7 of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011?”

Since this question requires confirmation only, it is assumed that all key documents describing the procedures for the use of ICT services have already been listed in the responses to the previous questions under the section entitled “3. Requirements for the use of Information and Communication Technology (ICT) services”. By answering “Yes” to this question, the Institution confirms that it complies with the requirements set out in Regulation (EU) 2022/2554 of the European Parliament and of the Council.

Questions on the Winding-Up Plan

• “4.2. Is the winding-up plan tailored to the (anticipated) size and operational model of the Institution?”

In response to this question, the Institution is not required to list documents demonstrating compliance with the requirement. By selecting “Yes”, the Institution confirms that the winding-up plan has been prepared with proper consideration of the Institution’s size and operational model.

• “4.3. Does the winding-up plan include risk mitigation measures that the Institution must apply upon the termination of payment services and/or electronic money issuance, ensuring the execution of pending payment transactions and the termination of existing contracts?”

If the mentioned risk mitigation measures are included in the winding-up plan referred to in response to question 4.1, then the Institution should again reference the winding-up plan and its approval date in response to this question. If, for any reason, the mitigation measures are detailed in separate documents, those documents should be listed separately.

• “4.4. Does the Institution confirm that the winding-up plan complies with the requirements set out in the Description of Institutional Management System Requirements regarding the preparation of winding-up plans for payment service provision and/or electronic money issuance?”

Since this question requires confirmation only, it is assumed that all relevant documents governing the winding-up arrangements have already been listed in response to the previous questions under the section entitled “4. Requirements for the winding-up plan for payment service provision and/or electronic money issuance”. By answering “Yes” to this question, the Institution confirms that the winding-up plan has been prepared with due consideration of the Institution’s size and operational model.