Lithuania: Tax administration-VMI introduces new self-service and access rules for tax information systems

Lithuania’s Tax inspectorate -VMI is moving access and user-right administration for its electronic tax services to the new VMI Self-Service environment. The changes introduce mandatory two-factor authentication, self-generated login credentials and new access procedures, including specific changes for foreign companies.

The Lithuanian State Tax Inspectorate (VMI) has introduced new rules governing the use of its VMI Self-Service system (VMI Savitarna) as part of the broader digital transformation of Lithuania’s tax administration.

The VMI announced the new Self-Service Rules on 2 October 2026. The system forms part of the new Taxpayer Register and Tax Administration Information System (MAP) and is intended to become the authorized electronic-services environment through which taxpayers and their representatives manage access to VMI services.

The change is connected with Lithuania's “New Generation Lithuania” recovery and resilience plan and the project “VMI digital transformation: creation of innovative electronic services and tax administration platform.” According to VMI, rules concerning system use, user administration and access rights that were previously regulated through the Mano VMI and Electronic Declaration System (EDS) rules are being reorganized around the new VMI Self-Service environment. 

Importantly, the attached VMI information letter of 1 October 2026, No. R-2665, provides considerably more practical information than the short tax news announcement. It confirms that the granting and management of login credentials for VMI information systems is being transferred to VMI Self-Service.    

What is changing?

The amended access rules are based on Order No. VA-83, in its new version introduced by Order No. VA-59 of 8 September 2026. They regulate how individuals obtain and use credentials for VMI information systems. 

The accompanying VMI letter explains nine important practical changes:

• Users can generate their own login credentials. Previously, a user generally had to contact VMI by mail or telephone, visit a territorial VMI office or make a request through Mano VMI. Under the new system, users can generate a login name and choose a password through VMI Self-Service.    
• Two-factor authentication becomes mandatory when users log in with VMI-issued credentials. The second authentication factor can be delivered by email or through a TOTP authentication application. This is intended to provide additional protection against unauthorized access. 
• Google and Facebook accounts can also be used for login, although this method cannot be used for a person's first access to the system. It must first be activated through VMI Self-Service after authentication through Lithuania's Electronic Government Gateway. Two-factor authentication also applies to this login method. 
• Unused VMI login credentials will be removed after two years. If credentials have not been used for two years, the relevant login method can be deactivated and new credentials must subsequently be obtained.    
• VMI may block a login method where there is a security risk, for example if credentials have been lost or information suggesting unauthorized access has been received from third parties.    
• The previous Annex 1 is abolished, because credentials will now be generated automatically and sent electronically rather than handled under the former process.    
• The application procedure requires less personal information. The revised form no longer requires information such as country, telephone number, date of birth or residential address.     
• Some previous authentication options are being discontinued. VMI states that direct authentication arrangements involving certain authentication providers, including banks, are being terminated, while direct electronic-signature login is also removed as a separate option. Access through the Electronic Government Gateway (Elektroniniai valdžios vartai) remains available.    
• There is also an important procedural change for foreign legal entities. Previously, if a foreign company registering through form FR0227 included the email address of its manager or authorized management representative, VMI credentials could be issued automatically to that person. Following the change, foreign-company representatives will have to obtain access through the standard procedure.     

The standard procedure allows an individual to generate credentials through VMI Self-Service where another login method is already available. Otherwise, the person can contact VMI by telephone or submit an application by email with a qualified electronic signature, by post with the necessary identity documentation, or personally at a VMI office. 

What does this actually mean?

This is primarily an administrative, access-management and cybersecurity change, rather than a new fiscalization requirement.

The announcement does not introduce a new POS requirement, receipt requirement, cash-register function, transaction-reporting rule or new fiscal data format. Its immediate impact is on the way businesses, employees, representatives and other authorized persons gain access to Lithuanian tax administration systems.

For companies already interacting electronically with VMI, the most visible changes will therefore concern login methods, authentication, account administration and user authorization.

The change is nevertheless relevant for international companies. Groups operating in Lithuania often rely on local finance teams, external accountants or foreign representatives to access Lithuanian tax systems. The new procedure for foreign legal entities means that companies should no longer assume that registration through FR0227 automatically provides the foreign manager with VMI access credentials.

In our view, this update should be seen as part of Lithuania's broader move toward a more centralized and secure digital tax-administration environment rather than as a new tax or fiscalization obligation.

For retailers and POS providers, there appears to be no direct software-development impact at this stage. However, the change is relevant from an operational and compliance perspective because employees or service providers who work with VMI systems may need to change how they authenticate and manage their access.

The foreign-company change is particularly worth highlighting. International retailers should check which individuals currently access Lithuanian VMI systems and whether those users will continue to have valid access under the new procedure.

Implementation impact and what businesses should do: 

Businesses should review who currently has access to Lithuanian VMI systems and ensure that the relevant employees, accountants and representatives understand the new VMI Self-Service login procedure. In particular, companies should prepare for mandatory two-factor authentication and check whether old login credentials or authentication methods are still being used.

Foreign companies should also review how access is provided to their directors and authorized representatives. Registration through FR0227 will no longer automatically result in access credentials being issued to the foreign entity's manager, meaning that a separate standard access procedure may be necessary.

For retailers and POS solution providers, no immediate POS or fiscalization system modification is indicated by these documents. The practical action is primarily to update internal tax-system access procedures, user administration and security processes rather than transaction or cash-register functionality.

Primary official sources: VMI's 2 October 2026 tax news announcement on the VMI Self-Service Rules VMI and the amended VA-83 Rules, version under Order No. VA-59 of 8 September 2026: Source

Nikolina Basić, Senior Legal Consultant at Fiscal Solutions

Linkedin profile