title: Malta Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/malta/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Malta MT schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 60 sourced findings · 137 sources in the cumulative register 14 Modules baseline.modules[] 60 Findings modules[].findings[] 16 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) ** Law made at European Economic Area level** that applies in Malta is covered once, on the [European Economic Area](https://payments.gi/jurisdictions/european-economic-area/) page. This page covers Malta’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal Malta's electronic-money institution prudential framework and its crypto-asset licensing architecture both completed consolidation moves this cycle. The MFSA's Financial Institutions Rulebook Chapter 3, FIR/03, has been confirmed revised, with the 2011 and 2019 versions now listed under the regulator's own index as superseded, meaning a current revision of FIR/03 is the operative EMI prudential rule. Alongside that, the EU-wide MiCA transitional period for pre-existing crypto firms expired on 1 July 2026, and Malta's Virtual Financial Assets Act, Chapter 590, was formally repealed two days later on 3 July 2026, leaving MiCA and Chapter 647 as the sole legal basis for crypto-asset services in Malta. The combined effect reinforces a commercial model already visible in Malta's licensed population: institutions holding both an EMI authorisation and a MiCA CASP licence from a single Maltese base. #### Other Developments **EMI capital requirements remain substantively unchanged.** The minimum initial capital for an electronic money institution in Malta is EUR 350,000, with ongoing own funds required at the greater of EUR 350,000 or 2% of average outstanding e-money under Method D; this threshold carries through from the superseded 2019 FIR/03 text, and no change to the substance of the capital requirement was identified alongside the rulebook's formal revision. **Two firms illustrate the EMI-plus-CASP commercial pattern.** Fast Shift Limited, part of the Badalyan Brothers Group, was granted MFSA EMI authorisation, opening an EEA-passporting gateway from Malta. Separately, BVNK secured an MFSA CASP licence in addition to its existing Malta EMI authorisation, enabling it to offer digital-asset services across all EEA member states from its Malta base where it was already authorised as an e-money institution. Neither disclosed deal value; both are licensing grants rather than priced transactions. #### Cross-Monitor Connections The VFA Act repeal and the MiCA transitional cliff-edge are the same underlying regulatory facts tracked by the crypto monitor from a licensing-classification perspective; here they are read through the EMI-and-CASP market-access lens. The FIR/03 revision and the Fast Shift and BVNK licensing grants also connect to financial-integrity's coverage of Malta's PMLFTR-obliged-entity landscape, since both EMIs and CASPs are obliged entities under the same AML framework now undergoing its own settlement-regime and AMLA-RTS developments. #### Outlook With the MiCA transitional cliff-edge now passed and the VFA Act repealed, the near-term question for Malta's payments and crypto-licensing landscape is whether further EMI-licensed firms follow the Fast Shift and BVNK pattern of adding a CASP licence, or vice versa, to build combined EEA-wide digital-asset and e-money propositions from a Maltese base. A still-pending EBA binding technical standard under MiCA Article 45(7)(b), setting final reserve-asset liquidity requirements for significant e-money tokens, remains in consultation as of the EBA's September 2026 response and is not expected before 2027. _4 earlier updates not shown here._ ###### Standing brief · as of 6 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Malta's electronic-money and payment-institution regime continues to rest on the Financial Institutions Act and its implementing FIR rules, under which the Malta Financial Services Authority sets EMI initial capital EUR350,000; PI initial capital EUR125,000 for firms seeking Maltese authorisation and onward EEA passporting. That standing capital architecture is now set against a firm European timetable. Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the successor PSD3/Payment Services Regulation package means the current PI and EMI licensing tracks are due to converge, with the reform expected operational late 2027. The agreement merges PI/EMI into a unified authorisation, repeals EMD2, and current planning points to ~24-month grandfathering expected for MT-licensed institutions, giving Malta-licensed firms a multi-year runway before reauthorisation is required under the unified regime. For a jurisdiction whose payments sector has built its market-access model around EMI and PI licensing under Malta's EU-harmonised framework, the grandfathering window is the operative planning variable over the coming two years, and it is the single development this cycle with clear forward-looking materiality for Malta's licensee population. #### Other Developments Beneath this headline reform trajectory, Malta's conduct-side rules for e-money issuers remain unchanged this cycle. Under the FIR/03 safeguarding regime, EMIs must safeguard client e-money funds directly with EU credit institutions — the rule permits no intermediary between licensee and safeguarding bank — and the same regime requires mandatory reconciliations plus annual safeguarding audit as ongoing conduct obligations. Layered on top of this conduct regime, DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, layering ICT incident-reporting and third-party risk-testing obligations atop the MFSA conduct regime — a standing operational-resilience requirement rather than a new development this cycle, but one that continues to shape supervisory expectations for MT payment firms. The safeguarding and licensing findings above pertain specifically to Malta's non-bank payment-institution and e-money-institution population; bank-provided payment services in Malta operate under separate prudential capital and deposit-protection arrangements rather than the FIR/03 direct-safeguarding mechanism, a distinction that runs through this cycle's W1a and W1b findings and that the PSD3/PSR reform track (which applies to both bank and non-bank licensees) will need to reconcile at EU level. Separately, market-guide commentary continues to put MFSA licensing timelines at Roughly 3-9 months depending on file completeness for new EMI/PI applications; this figure derives from a single low-tier legal-services source rather than regulator-published guidance and should be read as indicative rather than confirmed. No MT-specific stablecoin, scheme-compliance, corridor, merchant-acquiring, consumer-protection, AML/CFT, correspondent-banking, or commercial-intelligence development surfaced in this cycle's research pass, and the coverage-gap register flags that no Tier-1 MFSA or EU Official Journal primary citation has yet been retrieved for the capital-requirement and PSD3 findings above, which currently rest on Tier 3/4 market-commentary sources rather than regulator-published text. #### Cross-Monitor Connections No cross-monitor signal was flagged for Malta this cycle, and the research pass returned no findings for the AML/CFT and commercial-intelligence modules that most commonly generate cross-monitor linkages, leaving both as open watch items rather than active signals this cycle. The one connective thread worth noting is structural rather than event-driven: the PSD3/PSR unification track is a supranational reform that will eventually reshape the EU-wide EMI/PI population Malta sits within, and its progress over the next several cycles is the variable most likely to generate a genuine cross-jurisdiction signal for other EU-domiciled EMI/PI hubs tracked elsewhere in this monitor. #### Outlook Looking ahead, the operative horizon marker is regulatory rather than domestic. PSD3 and the Payment Services Regulation merge the current PI and EMI regimes into a unified payment-institution authorisation and repeal EMD2, with roughly 24-month grandfathering expected for existing MFSA-licensed institutions; the reform is tracked against an expected date of 2027-Q4 with a half_year uncertainty band. Malta's EMI/PI capital-requirement and safeguarding regime remains stable and EU-harmonised; the material forward development for MT-licensed institutions is the PSD3/PSR unification timeline rather than any domestic MT-specific change this cycle, and the near-term monitoring priority for Malta is tracking formal adoption milestones and any MFSA transposition guidance as the grandfathering clock starts running. Malta's jurisdiction-level trajectory remains assessed as stable across the primary domains this cycle covers — licensing, conduct/safeguarding, and operational resilience — with no change in regulatory direction expected before the PSD3/PSR transposition process advances further. Absent a primary MFSA or EU Official Journal citation, confidence in the capital-requirement and reform-timeline findings remains Assessed rather than Confirmed, and closing that sourcing gap is the standing research priority for the next cycle. trust tier: ai_unverified ###### Latest update · 18 October 2026 #### Regulatory Status Malta's payments and crypto-asset regulatory landscape consolidated this cycle. The MFSA's Financial Institutions Rulebook Chapter 3, FIR/03, is confirmed revised, with prior 2011 and 2019 versions now superseded; EMI capital requirements remain substantively unchanged at a EUR 350,000 minimum with ongoing own funds at the greater of EUR 350,000 or 2% of average outstanding e-money. On crypto, the EU-wide MiCA transitional period expired 1 July 2026 and Malta's Virtual Financial Assets Act was formally repealed 3 July 2026, leaving MiCA/Chapter 647 as the sole crypto-asset services basis. Commercially, Fast Shift Limited was granted MFSA EMI authorisation and BVNK secured an MFSA CASP licence alongside its existing EMI authorisation, both illustrating a combined EMI-plus-CASP licensing pattern. #### Outlook Watch for further combined EMI-plus-CASP licensing activity and for the EBA's pending binding RTS on reserve-asset liquidity for significant e-money tokens under MiCA Article 45(7)(b), not expected before 2027. _2 earlier updates not shown here._ ###### Standing brief · as of 6 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Malta's payments regulatory position this cycle is defined by two elements: a stable, EU-harmonised standing regime for e-money and payment-institution licensing and safeguarding, and a supranational reform track that will reshape that regime's structure over the coming two years. On the standing side, Malta regulates EMIs and PIs under the Financial Institutions Act and FIR rules, supervised by the MFSA, with the licensing regime built around EMI initial capital EUR350,000; PI initial capital EUR125,000 and EEA passporting rights. FIR/03 requires that EMIs must safeguard client e-money funds directly with EU credit institutions (no intermediaries permitted), reinforced by mandatory reconciliations plus annual safeguarding audit. Malta-licensed EMIs and PIs have separately operated under a resilience regime in which DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, adding an ICT operational-resilience compliance layer to the existing conduct regime. On the reform side, Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the PSD3/Payment Services Regulation package sets Malta's licensing regime on a consolidation path: the reform merges PI/EMI into a unified authorisation, repeals EMD2, expected operational late 2027, with ~24-month grandfathering expected for MT-licensed institutions. This is the single most consequential forward-looking development for Malta's payments sector identified this cycle, and it applies to Malta by virtue of Malta's EU membership rather than through any domestic Maltese legislative action. No material development surfaced this cycle across Malta's stablecoin/digital-money, scheme-and-network-compliance, payment-corridor, industry-structure, litigation, merchant-acquiring, product-innovation, consumer-protection, AML/CFT, correspondent-banking, or commercial-intelligence modules; Malta's risk position across those modules is carried as stable by absence of new signal rather than by an affirmative stability finding. #### Outlook Malta's jurisdiction-level trajectory is assessed as stable, with the PSD3/PSR unification timeline as the defining medium-term variable: MFSA-licensed institutions have a multi-year window, running through the reform's expected 2027-Q4 in-force date and an anticipated roughly two-year grandfathering period, to prepare for reauthorisation under the unified PI/EMI regime. The standing research priority for Malta is closing the Tier-1 sourcing gap — no MFSA or EU Official Journal primary citation has yet been retrieved to confirm the capital-requirement, safeguarding, or reform-timeline findings carried in this cycle's baseline — and monitoring for any Malta-specific instant-payments, merchant-acquiring, AML/CFT, correspondent-banking, or commercial-intelligence development in subsequent cycles, none of which surfaced this cycle. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access moved Confirmed confirmed 2026-06-27 Malta regulates EMIs and Payment Institutions under the Financial Institutions Act and implementing FIR rules, supervised by the MFSA, within the EU PSD2/EMD2 harmonised regime enabling EEA passporting. PSD3/PSR reached provisional political agreement 27 November 2025, expected in force late 2027 with ~24-month grandfathering for existing MFSA-licensed institutions. Movement — CHANGED FIR/03 EMI prudential rule confirmed revised; 2011/2019 versions superseded._MFSA's own index confirms a current rule now governs EMI prudential requirements._ Standing sub-brief · as of 6 August 2026 517 words · last cycle 2026-10-18 #### Licensing, Authorisation & Market Access Malta's payment-institution and e-money licensing architecture remains anchored in the Financial Institutions Act and its implementing FIR rules, administered by the Malta Financial Services Authority (MFSA) within the EU's harmonised PSD2/EMD2 framework. The regime's defining feature for market entrants is its capital-requirement structure: EMI initial capital EUR350,000; PI initial capital EUR125,000, a differential that continues to shape which licence class prospective entrants pursue depending on the scale and type of payment activity they intend to conduct. Firms holding either authorisation gain access to EEA-wide passporting, allowing a single Maltese licence to underpin cross-border payment-service or e-money issuance activity across the bloc — a structural advantage that has made Malta a recurring jurisdiction of choice for non-bank payment and e-money firms seeking a single EU entry point. This standing architecture is now moving toward consolidation. Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the PSD3/Payment Services Regulation package confirmed that the current, separately authorised PI and EMI tracks are being folded into a single unified payment-institution authorisation, with the reform package expected operational late 2027. Under the agreed approach, the reform merges PI/EMI into a unified authorisation, repeals EMD2, and — of direct relevance to Malta's existing licensee population — current planning anticipates ~24-month grandfathering expected for MT-licensed institutions. That grandfathering period is the critical operational variable for MFSA-licensed EMIs and PIs: it sets the outer boundary by which existing licences must be reauthorised or restructured under the unified regime, rather than requiring an immediate transition. Alongside the reform trajectory, market-guide sources continue to describe MFSA processing timelines in indicative terms only. One low-tier source puts new-application processing at Roughly 3-9 months depending on file completeness, a range that is plausible on its face but has not been corroborated against MFSA-published guidance and should be treated as a market estimate rather than a regulator-confirmed benchmark. The findings above pertain specifically to Malta's non-bank payment-institution and e-money-institution population; the PSD3/PSR consolidation applies to both bank and non-bank payment-services licensees at EU level, but its Malta-specific operational consequence — the roughly two-year grandfathering clock — is most acute for the non-bank PI/EMI licensees this module tracks. The overarching gap this cycle is sourcing quality rather than substantive volatility: every W1a finding above rests on Tier 3 or Tier 4 market-commentary sources, and no Tier-1 MFSA rulebook or EU Official Journal citation has yet been retrieved to anchor the capital-requirement or PSD3-timeline claims directly against primary text. #### Outlook The near-term trajectory for W1a is one of managed continuity rather than domestic change: Malta's EMI/PI regime is expected to hold its current shape through the PSD3/PSR transposition window, with the reform's expected in-force date of 2027-Q4 carrying a half_year uncertainty band around it. The practical monitoring task for the coming cycles is tracking formal EU adoption of the PSD3/PSR package, any MFSA consultation or transposition guidance signalling how the roughly two-year grandfathering period will be operationalised for Malta's existing licensee base, and closing the Tier-1 sourcing gap so that the capital-requirement and reform-timeline findings can be upgraded from Assessed to Confirmed status. Periodic update · new data 2026-10-18 #### Licensing, Authorisation & Market Access Malta's electronic-money institution prudential rule has been confirmed revised this cycle. The Malta Financial Services Authority's own index of its Financial Institutions Rulebook now lists the 2011 and 2019 versions of Chapter 3, FIR/03, under superseded rulebooks, which confirms that a current, revised FIR/03 is the operative prudential rule for EMIs licensed in Malta. The current text of the revised FIR/03 was not independently re-fetched this cycle, so the specific content of what changed between the superseded 2019 text and the current revision has not been independently verified beyond the fact of supersession itself. What is confirmed to carry through unchanged in substance is the headline capital requirement: a minimum initial capital of EUR 350,000 for an EMI, with ongoing own funds required at the greater of EUR 350,000 or 2% of average outstanding e-money under Method D. This threshold derives from the superseded 2019 FIR/03 text and has not been shown to have moved under the current revision. Malta's EMI licensing route continues to see new authorisation grants: Fast Shift Limited, part of the Badalyan Brothers Group, was granted MFSA EMI authorisation, opening an EEA-passporting gateway from its Malta base. This is a market-access event for a nonbank payment institution specifically, illustrating that Malta's EMI authorisation route remains an active entry pathway into the EEA payments market for new entrants. #### Outlook The item to watch is whether the current revised FIR/03 text, once independently reviewed, reveals any substantive prudential change beyond the capital-requirement continuity already confirmed, and whether further EMI authorisation grants follow the Fast Shift pattern in coming cycles. **3 earlier distinct update(s)** Periodic update · new data 2026-10-06 #### Licensing, Authorisation & Market Access Malta's licensing and authorisation framework for payment institutions and electronic money institutions tightened this cycle through provisions in the MFSA's Financial Institutions Rulebook Chapter 3 (FIR/03), version 6.00 of November 2025, that extend supervisory control over structural and operational changes at licence holders. The Rulebook requires a licence holder implementing a material change to its business or organisational structure to obtain the MFSA's written consent in advance, submitting a transition plan for any proposed board change and an updated business plan, and to do so at least one month before the change is intended to take effect, regardless of whether the change itself would separately require authorisation. This places a standing notify-and-wait obligation on licence holders contemplating structural change, rather than a case-by-case discretionary filing. The same Rulebook also extends MFSA oversight into outsourcing and distribution arrangements. Where a licence holder intends to outsource a critical or important operational function relating to the provision of payment services or electronic money services, it is required to submit an FI Outsourcing Notification Form to the MFSA, and separately, the Rulebook's provisions on agent and distributor appointment require MFSA consent before a licence holder decides to use an agent or distributor. Both requirements function as gateway controls on how a Maltese-licensed payment or e-money business can structure its operational footprint and distribution network, reinforcing the MFSA's visibility into material changes before they take effect rather than relying solely on retrospective supervisory review. Taken together, these provisions describe a licensing regime in which authorisation is not a one-time event but a continuing relationship requiring advance notice and, in the case of material structural change, affirmative written consent. The 60-calendar-day advance notice period applicable to outsourcing and safeguarding-arrangement changes, and the one-month advance consent requirement for material business or organisational change, both function as structural brakes on the pace at which a Maltese licence holder can reorganise without first clearing the change with its supervisor. #### Outlook Firms holding or seeking a Maltese payment institution or electronic money institution licence should build the one-month advance consent requirement for material structural change, and the 60-calendar-day advance notice requirement for outsourcing and distributor changes, into their change-management planning as binding lead times rather than best-practice guidelines. Any board transition or significant change to business model should be planned with the MFSA consent process as a gating step, supported by the required transition plan and updated business plan, rather than treated as a notification formality to be completed after the fact. Open findings on Financial Institutions Act (Cap. 376) article 8C(2) outsourcing-liability provisions and the precise approval mechanics for distributor appointment under article 8A were not supported by a verbatim quote this cycle and remain pending further verification rather than confirmed findings. Periodic update · new data 2026-10-04 #### Licensing, Authorisation & Market Access Gate Technology Ltd obtained a Payment Institution licence under PSD2 from the Malta Financial Services Authority, enabling EU-passported payment execution services, credit transfers and direct debits. This licence complements a MiCA CASP permit the entity had already obtained in October 2025, meaning Gate Technology now holds both a PSD2-based payment authorisation and a crypto-asset-service authorisation from the same Maltese regulator. The development was reported via a press-release wire rather than confirmed against the Authority's own public register this cycle, and the finding is accordingly held at probable rather than confirmed confidence pending that corroboration. The practical significance of this licensing combination lies in what it signals about Malta's positioning in the payments-crypto intersection: entities are able to assemble a PSD2 payment-execution capability and a MiCA crypto-asset-service capability under a single Maltese regulatory relationship, rather than needing to establish separate licensed entities in different jurisdictions for each function. This is consistent with Malta's established dual positioning as both a payments licensing centre and a crypto-asset licensing centre within the EU's single market, allowing a passported payment capability to sit alongside a passported crypto-asset-service capability from one base. #### Outlook No Tier-1 Malta Financial Services Authority register source was reached this cycle to independently confirm Gate Technology's PI licence grant or its current capital position; confirming the licence against the Authority's own public register, and establishing the current capital requirements applicable to Malta PI/EMI licensees generally, would sharpen the market-access picture for this corridor in a future cycle. Periodic update · new data 2026-09-05 #### Licensing, Authorisation & Market Access The Malta Financial Services Authority is the single gatekeeper for payment institution and electronic money institution licensing, regulating both categories under the Financial Institutions Act (Chapter 376), which transposes PSD2. Minimum initial capital for an EMI is EUR 350,000, while PI capital requirements range from EUR 20,000 to EUR 125,000 depending on the licensed service class. This is a standing baseline position, assessed at probable confidence, reflecting the settled structure of Malta's non-bank payments licensing regime. The forward-looking development this cycle is the anticipated PSD3/Payment Services Regulation reform, which is expected to merge Malta's separate PI and EMI licence categories into a single unified status, described as a payment institution authorised to issue e-money, with an anticipated timeline around late 2027 and grandfathering protection for existing licensees. This is an assessed, Tier 3-sourced forward-looking finding requiring regulatory-horizon tracking rather than a confirmed rule change, but it is the most consequential structural item in Malta's licensing landscape this cycle, since it would collapse a distinction that has structured market entry since PSD2 transposition. A discrete, non-structural licensing event this cycle further illustrates the regime's dynamism: a MiCA-regulated Malta entity received an MFSA Limited Financial Institutions licence on 27 February 2026, authorising payment services exclusively in relation to electronic money tokens. This licence addresses the overlap between MiCA and PSD2 scopes directly, and is a high-confidence, Tier 2-sourced commercial development distinct from the structural licence-category question above; it should be read as a dated entry illustrating active MFSA management of the MiCA/PSD2 perimeter rather than as a standing-brief development in its own right. #### Outlook The PSD3/PSR merger timeline, anchored around late 2027, is the primary item to watch for Malta's PI/EMI licensing landscape; any firmer legislative timeline or draft text would materially sharpen this reading. A direct MFSA primary-source citation for the FIR/01 and FIR/03 rulebooks remains an open coverage gap from this cycle. **Sources and findings (5)** 1. T1 [https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/) retrieved 2026-06-27 2. T1 [https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/) retrieved 2026-06-27 3. T3 [https://www.tetraconsultants.com/jurisdictions/register-company-in-malta/malta-emi-license/](https://www.tetraconsultants.com/jurisdictions/register-company-in-malta/malta-emi-license/) retrieved 2026-06-27 4. T3 [https://www.mondaq.com/fin-tech/867616/fintech-guide-2019](https://www.mondaq.com/fin-tech/867616/fintech-guide-2019) retrieved 2026-06-27 5. T3 [https://gvzh.mt/services/practice-areas/banking-finance/credit-financial-institutions-banks/emi-malta-electronic-money-institutions/](https://gvzh.mt/services/practice-areas/banking-finance/credit-financial-institutions-banks/emi-malta-electronic-money-institutions/) retrieved 2026-06-27 ### W1b Conduct, Safeguarding & Promotions Probable confirmed 2026-06-27 Malta EMIs must safeguard client e-money funds directly with EU credit institutions (FIR/03 bars intermediaries), with mandatory reconciliations and an annual safeguarding audit. DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025. Horizon · 2026-Q3 (±quarter) PSD3 / Payment Services Regulation (PSR) Official Journal publication and entry into force_in_force_pending · T3_ Standing sub-brief · as of 6 August 2026 399 words · last cycle 2026-10-06 #### Conduct, Safeguarding & Financial Promotions Malta's conduct-of-business regime for e-money issuers centres this cycle on the FIR/03 safeguarding rules, which impose a direct, disintermediated model for protecting client funds. Under FIR/03, EMIs must safeguard client e-money funds directly with EU credit institutions, with the rule text explicit that no intermediary arrangement sits between the licensed e-money institution and the credit institution holding safeguarded funds. This directness requirement narrows the range of custody structures available to Malta-licensed EMIs relative to jurisdictions that permit layered or delegated safeguarding arrangements, and it places the onus for counterparty selection and ongoing monitoring of the safeguarding credit institution squarely on the licensed EMI itself. The safeguarding obligation is reinforced by ongoing verification requirements: the regime requires mandatory reconciliations plus annual safeguarding audit as standing conduct obligations, meaning Malta-licensed EMIs must demonstrate, on a recurring basis, that safeguarded-fund balances match outstanding e-money liabilities, with an independent annual audit providing an additional layer of assurance to the MFSA. Together, the direct-safeguarding mandate and the reconciliation/audit cycle form the operational backbone of Malta's e-money conduct regime, and both elements are treated this cycle as standing, unchanged features of the framework rather than new developments — the underlying source is a single Tier 4 market commentary rather than MFSA rule text, so the finding is carried at Low confidence pending stronger sourcing. No new financial-promotions or conduct-rule development specific to Malta surfaced this cycle beyond the safeguarding baseline described above; the bank-versus-non-bank distinction that structures much of the wider W1a/W1b analysis is particularly salient here, since the FIR/03 direct-safeguarding requirement applies specifically to the non-bank PI/EMI population rather than to bank-provided payment services, which safeguard client funds under separate prudential capital and deposit-protection arrangements rather than the FIR/03 mechanism. #### Outlook Malta's safeguarding regime is not currently flagged for near-term domestic change, but it sits inside the same PSD3/PSR consolidation horizon tracked under W1a: as PI and EMI authorisations merge into a single regime ahead of the reform's 2027-Q4 expected in-force date, safeguarding obligations for the unified authorisation category will need to be reconciled with Malta's existing FIR/03 direct-safeguarding model, and any divergence between the current national approach and the harmonised PSR safeguarding standard is a watch item for the next several cycles. Strengthening the sourcing base for this module — moving beyond the current single Tier 4 citation to MFSA rulebook text — remains the standing research priority. Periodic update · new data 2026-10-06 #### Conduct, Safeguarding & Financial Promotions **Sources and findings (4)** 1. T3 [https://www.mamotcv.com/insights/payments-insights-1/](https://www.mamotcv.com/insights/payments-insights-1/) retrieved 2026-06-27 2. T3 [https://www.mamotcv.com/insights/payments-insights-1/](https://www.mamotcv.com/insights/payments-insights-1/) retrieved 2026-06-27 3. T3 [https://www.lexology.com/library/detail.aspx?g=dc2b8924-1452-4d33-a93b-7e4cff411b05](https://www.lexology.com/library/detail.aspx?g=dc2b8924-1452-4d33-a93b-7e4cff411b05) retrieved 2026-06-27 4. T1 [https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/) retrieved 2026-06-27 ### W2 Stablecoins & Digital Money moved Confirmed confirmed 2026-06-27 Malta's domestic cryptoasset framework is now exclusively MiCA (Cap. 647); the VFA Act (Cap. 590) was repealed 3 July 2026. Movement — CHANGED VFA Act repealed 3 July 2026; MiCA transitional period ended 1 July 2026 EU-wide._Major transitional cliff-edge for Malta's crypto/stablecoin regime._ Standing sub-brief · as of 27 June 2026 275 words · last cycle 2026-10-18 #### Stablecoins & Digital Money Malta has a live, in-force stablecoin and digital-money regime. The Markets in Crypto-Assets Act (Cap. 647) implements MiCA (Regulation (EU) 2023/1114) in Malta, with transposition facilitated through Act XIV of 2024 integrating Titles III and IV on asset-referenced tokens and e-money tokens, and the MFSA amending Chapter 3 of the VFA Rulebook. Title III/IV became effective on 30 June 2024 and the full CASP regime applied from 30 December 2024. This implementation makes Malta a live EU stablecoin and CASP authorisation venue, attracting EMT issuers and crypto-asset service providers. The regime is operative rather than theoretical. The MFSA supervises Maltese stablecoin issuer StablR (EURR) as an EMT issuer under MiCA. EMT issuance is restricted to licensed EMIs or credit institutions, and MiCA Article 36 requires EMT issuers to hold at least 30% of reserves in credit-institution deposits (60% for significant EMTs), with redemption at par on demand. StablR demonstrates that Malta hosts operative MiCA-compliant EMT issuance, a competitive differentiator versus slower-implementing Member States. The link between this module and the licensing framework is direct: because EMT issuance requires an EMI or credit-institution licence, the non-bank EMI cohort authorised under Cap. 376 is the natural pool of EMT issuers, while reserve-composition rules tie issuers back into the bank-deposit system. #### Outlook The stablecoin module trajectory is escalating, driven by continued CASP authorisation activity. The February 2026 BVNK CASP licence (tracked in W13 as a commercial event) and the live StablR EURR issuance evidence a maturing venue. Going forward, the intersection with the pending PSD3/PSR EMI-into-PI collapse warrants watching, since EMT issuance is anchored to the EMI/credit-institution licensing categories that the package will restructure. Periodic update · new data 2026-10-18 #### Stablecoins & Digital Money Two dated structural events closed out Malta's transition to the MiCA crypto-asset regime this cycle. First, the EU-wide MiCA transitional period for pre-existing crypto firms expired on 1 July 2026: ESMA's own statement confirms that any entity still serving EU clients without a MiCA licence after that date is in breach and must wind down its activities. Second, Malta's Virtual Financial Assets Act, Chapter 590, was formally repealed with effect from 3 July 2026 under Act XXXVI of 2024, two days after the EU-wide cliff-edge, leaving MiCA and Chapter 647 as the sole legal basis for crypto-asset services in Malta. Together these two dated events mark the completion of Malta's move from a dual VFA/MiCA transitional posture to a single MiCA-only regime. This consolidation is already shaping commercial structuring in Malta: BVNK secured an MFSA CASP licence under MiCA in addition to its existing Malta EMI authorisation, which by its own account will allow it to offer digital-asset services across all EEA member states from its Malta base where it is already authorised as an e-money institution. This combined EMI-plus-CASP structure is a direct commercial consequence of Malta's now-settled single-track crypto licensing regime. Separately, a still-open item on the EU stablecoin rulebook is the binding regulatory technical standard under MiCA Article 45(7)(b), which will set final reserve-asset liquidity composition requirements for significant e-money tokens. As of the European Banking Authority's consultation response dated 24 September 2026, this RTS has not been adopted, and the EBA's own response references but does not propose changing the existing 30% and 60% deposit-floor figures. #### Outlook The binding RTS on reserve-asset liquidity for significant EMTs under MiCA Article 45(7)(b) remains in consultation as of September 2026 and is not expected to be adopted before 2027; its eventual terms will be the next material development for any significant e-money token issuer operating from Malta. **1 earlier distinct update(s)** Periodic update · new data 2026-10-12 #### Stablecoins & Digital Money Malta's digital-asset regulatory perimeter completed a significant structural simplification this cycle. The Virtual Financial Assets Act, Malta's domestic crypto-licensing framework that had operated alongside MiCA during the transitional period, was repealed on 3 July 2026 following the end of the maximum eighteen-month MiCA grandfathering period available to Member States. This leaves MiCA, and its domestic implementing legislation, as the sole framework governing crypto-asset service providers operating from Malta, removing what had been a dual-track licensing landscape. Separately, the MFSA's MiCA Rulebook sets a binding outsourcing-notification obligation for CASPs: a MiCA Outsourcing Notification Form must be filed via the LH Portal at least sixty calendar days before a critical or important outsourcing arrangement is entered into. This is explicitly a notification requirement rather than a prior-approval gate, meaning a CASP does not need to wait for MFSA sign-off before proceeding with the arrangement, but must give the regulator sixty days' advance visibility into it. This distinction matters operationally: a CASP planning a critical outsourcing arrangement, such as moving custody infrastructure or core transaction-processing functions to a third-party provider, needs to build the sixty-day notice period into its project planning, but does not face a licensing-style approval bottleneck on the arrangement itself. Taken together, the VFA repeal and the outsourcing-notification requirement describe a digital-asset regulatory environment in Malta that is now fully harmonised with the EU-wide MiCA framework, with Malta-specific procedural detail, such as the LH Portal filing mechanism, sitting on top of that harmonised base rather than constituting a separate substantive regime. #### Outlook The next formal compliance checkpoint under this framework is the MFSA's annual register-of-information filing window for outsourcing arrangements, which opens between 1 January and 21 March 2027 and applies to all in-scope entities including microenterprises. CASPs operating from Malta should treat that filing window as a recurring annual obligation layered on top of the ad hoc sixty-day notification requirement for any new critical or important outsourcing arrangement entered into during the year. **Sources and findings (4)** 1. T1 [https://www.mfsa.mt/our-work/crypto-assets/](https://www.mfsa.mt/our-work/crypto-assets/) retrieved 2026-06-27 2. T3 [https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/malta](https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/malta) retrieved 2026-06-27 3. T3 [https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers](https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers) retrieved 2026-06-27 4. T3 [https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757](https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757) retrieved 2026-06-27 ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-27 DORA (EU 2022/2554) applicable 17 Jan 2025; MFSA designated national supervisor (TLPT under Legal Notice 166 of 2024, TIBER-MT); annual RoI submission 1 Jan-21 Mar from 2026 reflecting 31 Dec prior-year status. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/malta/) Horizon · 2027-Q1 (±quarter) DORA Register of Information annual submission window (Malta)_in_force · T3_ Horizon · 2027-Q1 (±quarter) DORA Register of Information annual submission window (Malta)_in_force · T3_ Standing sub-brief · as of 6 August 2026 252 words · last cycle 2026-08-21 #### Operational Resilience & Critical Infrastructure Malta's payment and e-money licensees now operate under a second, EU-wide resilience layer alongside their MFSA conduct obligations. DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, meaning the Digital Operational Resilience Act's ICT risk-management framework has been in force for MT payment firms for well over a year at this point. The Act's substantive effect on Malta-licensed EMIs and PIs is that it is layering ICT incident-reporting and third-party risk-testing obligations atop the MFSA conduct regime, adding a distinct compliance track — covering incident classification and reporting timelines, resilience testing, and oversight of critical ICT third-party providers — that sits alongside, rather than replacing, the FIR-based conduct and safeguarding rules tracked under W1b. This cycle surfaced no new Malta-specific DORA development: the finding is a standing-applicability baseline rather than a fresh regulatory action, and it was identified this cycle as a cross-reference from a W1b-sourced document rather than from a dedicated resilience-focused source. That sourcing path is itself informative — it suggests Malta-specific DORA commentary remains thin relative to the conduct and licensing literature, and dedicated resilience-focused sourcing is a module priority going forward. #### Outlook No Malta-specific resilience development is expected imminently beyond continued DORA supervisory embedding; the module's standing position is that DORA obligations are now a fixed feature of the operating environment for MT-licensed payment firms, with the near-term research task being direct sourcing of any MFSA-specific DORA guidance, incident-reporting statistics, or third-party-risk oversight actions that would move this module beyond baseline-applicability status. Periodic update · new data 2026-09-05 #### Operational Resilience & Critical Infrastructure The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied in Malta since 17 January 2025. The Malta Financial Services Authority now expects DORA-aligned ICT risk management, incident reporting, threat-led penetration testing, and a third-party ICT register to be evidenced from day one of any new payment institution or electronic money institution authorisation file, rather than treated as a post-authorisation build-out item. This is a probable, Tier 3-sourced baseline finding describing standing MFSA supervisory practice for Malta's non-bank payments sector. The expectation is not confined to the authorisation stage: existing MFSA-supervised EMIs and PIs must continue to evidence DORA-aligned ICT incident handling and vendor-risk oversight as part of ongoing supervision. This distinguishes an initial-authorisation requirement from a continuing supervisory obligation, and it means operational-resilience compliance is now embedded as a standing cost of doing business in Malta's payments sector rather than a one-time hurdle cleared at licensing and then set aside. Both the day-one and the ongoing dimensions of this expectation are assessed-to-probable confidence findings sourced from secondary regulatory-advisory commentary rather than a directly retrieved MFSA supervisory handbook citation this cycle. #### Outlook Watch for any MFSA-published supervisory guidance or thematic review specifically addressing DORA compliance in the payments sector, which would upgrade this cycle's secondary-sourced findings to primary-source confidence. The day-one and ongoing DORA expectations described here should be read together as a single operational-resilience posture rather than as two separate requirements. **Sources and findings (4)** 1. T1 [https://www.mfsa.mt/news-item/mfsa-outlines-minimum-expectations-on-digital-operational-resilience-preparedness-for-financial-entities/](https://www.mfsa.mt/news-item/mfsa-outlines-minimum-expectations-on-digital-operational-resilience-preparedness-for-financial-entities/) retrieved 2026-06-27 2. T1 [https://www.mfsa.mt/our-work/supervisory-ict-risk-and-cybersecurity/](https://www.mfsa.mt/our-work/supervisory-ict-risk-and-cybersecurity/) retrieved 2026-06-27 3. T1 [https://www.mfsa.mt/wp-content/uploads/2025/03/Regulation-EU-20222554-on-Digital-Operational-Resilience-for-the-Financial-Sector-%E2%80%93-Register-of-Information-Submission-Guidance.pdf](https://www.mfsa.mt/wp-content/uploads/2025/03/Regulation-EU-20222554-on-Digital-Operational-Resilience-for-the-Financial-Sector-%E2%80%93-Register-of-Information-Submission-Guidance.pdf) retrieved 2026-06-27 4. T3 [https://shoulder.mt/mfsa-circular-on-dora-register-of-information-reporting-timelines-for-2026-and-beyond/](https://shoulder.mt/mfsa-circular-on-dora-register-of-information-reporting-timelines-for-2026-and-beyond/) retrieved 2026-06-27 ### W4 Scheme & Network Compliance Confirmed confirmed 2026-06-27 Card-scheme compliance in Malta operates within the EU Interchange Fee Regulation (Regulation (EU) 2015/751), with the Central Bank of Malta as the national authority for IFR. Interchange is capped at 0.2% (debit) and 0.3% (credit) on consumer cards; Visa/Mastercard scheme rulebooks, PCI DSS, and surcharging restrictions (no surcharging on regulated-IFR cards) apply. PSD2 SCA requirements bind issuers/acquirers. Standing sub-brief · as of 27 June 2026 196 words · last cycle 2026-06-27 #### Scheme & Network Compliance The Central Bank of Malta acts as national authority for the Interchange Fee Regulation (EU) 2015/751. The IFR enforces interchange caps of 0.2% of transaction value on consumer debit cards and 0.3% on consumer credit cards, with Member-State discretion to set lower domestic caps. Beyond the caps, the IFR prohibits territorial licensing restrictions, mandates per-category merchant-service-charge disclosure and constrains the Honour-All-Cards rule. The scheme operators directly affected are Visa and Mastercard. This module sits at the interface between the card schemes and the acquiring market. The caps and the unblending obligations are stable and in force, and the analytical weight of W4 is on how scheme rules layer over the EU regulatory floor. Because the IFR is a directly-applicable EU regulation with the CBM as national authority, the framework applies uniformly to bank and non-bank acquirers operating in Malta. #### Outlook The scheme and network compliance module is stable. The interchange caps and unblending obligations are settled features of the operating environment, and no near-term legislative change is signalled for this cycle. Monitoring focus remains on scheme-rule schedule changes flowing through acquirers to merchants, which connect this module to merchant acquiring in W8. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.centralbankmalta.org/ifr](https://www.centralbankmalta.org/ifr) retrieved 2026-06-27 2. T1 [https://eur-lex.europa.eu/EN/legal-content/summary/fees-for-card-based-payments.html](https://eur-lex.europa.eu/EN/legal-content/summary/fees-for-card-based-payments.html) retrieved 2026-06-27 3. T1 [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) retrieved 2026-06-27 4. T2 [https://www.mastercard.com/europe/en/regulatory/european-interchange.html](https://www.mastercard.com/europe/en/regulatory/european-interchange.html) retrieved 2026-06-27 ### W5 Payment Corridor Dynamics Confirmed confirmed 2026-06-27 As a Eurozone member, Malta's principal corridors run through SEPA (SCT, SCT Inst, SDD), settling via TARGET (T2) and TIPS, with SWIFT for non-euro/cross-border. The EU Instant Payments Regulation (in force 9 January 2025) mandates universal instant euro transfers; Maltese banks (e.g., IIG Bank, APS, MeDirect) have rolled out SEPA Instant. Central Bank of Malta is the lead authority for SEPA implementation. Standing sub-brief · as of 27 June 2026 217 words · last cycle 2026-06-27 #### Payment Corridor Dynamics Malta's euro corridors run on real-time rails. SEPA Instant Credit Transfer (SCT Inst) and TARGET Instant Payment Settlement (TIPS) settle euro transfers in under 10 seconds, while SWIFT handles non-euro and cross-border flows over 1-5 business days. The Central Bank of Malta is the lead authority for SEPA implementation. This dual structure defines the corridor map: a deepening real-time euro corridor domestically and into the SEPA zone, alongside slower correspondent-based rails for non-euro flows. The escalating driver is the EU Instant Payments Regulation, in force from 9 January 2025, which mandated universal instant euro transfers and drove Maltese banks including IIG Bank, APS and MeDirect to introduce SEPA incoming instant payments for domestic and cross-border euro transfers. The IPR rollout is observable at the bank level, evidencing the corridor opening in practice rather than merely in regulation. The non-euro corridor picture connects directly to the correspondent-banking constraints analysed in W12, where USD access remains the structural weak point. #### Outlook The payment-corridor module trajectory is escalating as the Instant Payments Regulation continues to deepen real-time euro connectivity. The MT-EU-SEPA corridor is opening, with SCT Inst/TIPS rollout broadening across Maltese banks. The MT-US-USD corridor remains uncertain and is tracked under correspondent banking in W12, where the legacy of constrained USD access continues to shape access direction. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.lightspark.com/knowledge/instant-payments-malta](https://www.lightspark.com/knowledge/instant-payments-malta) retrieved 2026-06-27 2. T3 [https://iigbank-malta.com/page/news-202501b](https://iigbank-malta.com/page/news-202501b) retrieved 2026-06-27 3. T3 [https://www.medirect.com.mt/pay/payments/](https://www.medirect.com.mt/pay/payments/) retrieved 2026-06-27 4. T1 [https://www.centralbankmalta.org/the-sepa](https://www.centralbankmalta.org/the-sepa) retrieved 2026-06-27 ### W6 Industry Structure & Commercial Probable confirmed 2026-06-27 Malta is a disproportionately large EMI/PI domicile for its size, positioned as an EU alternative hub to Dublin/Luxembourg, with ~36 EMIs and ~30 PIs authorised by the MFSA (as of March 2025). Home-grown leaders include Papaya (EMI), SysPay and Truevo Payments (acquirer/PSP). The fintech sector accounted for ~8.2% of GVA and ~14,700 jobs in 2025. Banking is concentrated in BOV and HSBC Malta (latter sold to CrediaBank). Standing sub-brief · as of 27 June 2026 250 words · last cycle 2026-06-27 #### Industry Structure & Commercial Malta's payments market structure is defined by a disproportionately large non-bank institution population. As of March 2025, the MFSA had authorised 36 e-money institutions and 30 payment institutions, with 12 licences issued in 2024, ranking Malta alongside Germany on new authorisations. This snapshot is approximately 15 months old relative to the June 2026 run and may not reflect subsequent authorisations or withdrawals; confidence is held at Assessed pending verification against the MFSA live register. With that caveat, Malta's outsized EMI/PI population for its size positions it as an EU alternative hub to Dublin and Luxembourg. The domestic champion layer is led by home-grown firms: Papaya (an EMI offering IBAN accounts and Mastercard-linked services), SysPay (modular payment services, card processing and anti-fraud) and Truevo Payments (an acquirer and PSP). The sector's economic footprint is material — in 2025 the fintech industry accounted for 8.2% of real gross value added and employed over 14,700 people. This concentration of non-bank PI/EMI activity is the commercial spine of the Maltese payments market and the reason the pending PSD3/PSR EMI-into-PI collapse carries outsized local significance. #### Outlook The industry-structure module is stable but flagged for staleness. The March 2025 institution counts should be refreshed via a direct MFSA Financial Services Register pull on the next cycle to confirm whether the EMI/PI population has grown or contracted. The structural story — a large non-bank cohort against a small, concentrated banking sector being foreign-acquired (see W13) — is the analytical thread to carry forward. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://advapay.eu/emoney-and-payment-institution-licensing/e-money-and-payment-institution-license-in-malta/](https://advapay.eu/emoney-and-payment-institution-licensing/e-money-and-payment-institution-license-in-malta/) retrieved 2026-06-27 2. T3 [https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/) retrieved 2026-06-27 3. T3 [https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta) retrieved 2026-06-27 4. T3 [https://www.legal500.com/guides/chapter/malta-fintech/?export-pdf=](https://www.legal500.com/guides/chapter/malta-fintech/?export-pdf=) retrieved 2026-06-27 ### W7 Legal & Litigation Probable confirmed 2026-06-27 Enforcement in the payments space is led by the MFSA (administrative penalties under the MFSA Act and FIA) and the FIAU (AML/CFT penalties). MFSA published financial-institution regulatory actions in 2025 (Ref 2025-12 €650; Ref 2025-13 €7,050). The FIAU fined a subsidiary of crypto group OKX €2.7m for AML failings — among the largest VASP actions in the jurisdiction. Arbiter decisions (e.g., SE v Trust Payments (Malta)) shape PSP liability allocation. Standing sub-brief · as of 27 June 2026 201 words · last cycle 2026-06-27 #### Legal & Litigation The Maltese enforcement and litigation record for payments is anchored in two strands. On administrative penalties, the MFSA imposed a EUR 7,050 penalty on a financial institution on 13 March 2025 under Article 16(8) of the MFSA Act (Ref 2025-13), with a companion action (Ref 2025-12) imposing EUR 650 the same day. These are dated episodes evidencing active MFSA enforcement against the non-bank PI/EMI cohort. On adjudicated PSP liability, the Office of the Arbiter for Financial Services decided Case ASF 095/2021 (SE v Trust Payments (Malta) Limited), an internet-fraud reimbursement claim in which the PSP disputed eligibility on the basis of the absence of a direct customer relationship. The OAFS is the ADR/ombudsman route under Chapter 555 (Act XVI of 2016) for natural persons and micro-enterprises. The decision shapes how PSP liability is allocated in fraud-reimbursement disputes and connects to the broader consumer-protection allocation model analysed in W10. #### Outlook The legal and litigation module is stable, built on MFSA primary publication anchors and an OAFS decision. The forward watch is whether the OAFS continues to develop its PSP-liability jurisprudence and whether MFSA administrative-penalty activity against payment and e-money institutions accelerates. Both strands feed the consumer-protection picture in W10. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-13/](https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-13/) retrieved 2026-06-27 2. T1 [https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-12/](https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-12/) retrieved 2026-06-27 3. T3 [https://www.vixio.com/insights/pc-malta-unveils-intensified-amlctf-plan-year-ahead](https://www.vixio.com/insights/pc-malta-unveils-intensified-amlctf-plan-year-ahead) retrieved 2026-06-27 4. T1 [https://financialarbiter.org.mt/sites/default/files/oafs/decisions/303/ASF%20095-2021%20-%20SE%20vs%20Trust%20Payments%20(Malta)%20Limited.pdf](https://financialarbiter.org.mt/sites/default/files/oafs/decisions/303/ASF%20095-2021%20-%20SE%20vs%20Trust%20Payments%20(Malta)%20Limited.pdf) retrieved 2026-06-27 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-27 Merchant acquiring in Malta is conducted by FIA-licensed financial institutions and global PSPs, within the EU IFR framework (merchant service charge transparency, unblending on request) and card-scheme rulebooks (chargeback windows, 3DS/SCA, dispute mechanics, PCI DSS). Domestic acquirers include Truevo Payments and historically Credorax/Finaro (now Shift4). Global PSPs (Stripe, Adyen, Worldpay) operate cross-border into Malta. Standing sub-brief · as of 27 June 2026 207 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk Merchant acquiring in Malta operates under the IFR transparency regime. Acquirers must offer individually-specified merchant service charges per card category and brand unless the payee requests blended charges in writing, and must include applicable MSC, interchange and scheme fees in agreements. Scheme rules govern chargeback windows, 3DS/SCA, surcharging and PCI DSS, with scheme fines flowing through acquirers to merchants via indemnification. The unblending obligation is the analytical core of this module, and it links acquiring directly to the scheme-compliance framework in W4. The market has seen structural restructuring at the acquirer level. Malta-based payment processor Credorax (later Finaro) was acquired by Shift4 Payments in 2023; in 2024 the company surrendered its credit-institution licence and shifted to a financial-institution licence. This is a dated episode treated as a short entry for structural context, illustrating the bank-to-non-bank licence migration that recurs across the Maltese acquiring landscape. #### Outlook The merchant-acquiring module is stable but rests partly on tertiary sources, with acquirer chargeback and high-risk-MCC operational data not directly evidenced this cycle. The forward watch is whether scheme-rule schedule changes materially shift acquirer cost structures, and whether further licence migrations occur among Maltese acquirers. Quantitative open-banking and acquiring-ops data is flagged as under-indexed for the next cycle. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) retrieved 2026-06-27 2. T3 [https://www.pxp.io/payments-glossary/card-scheme-rules](https://www.pxp.io/payments-glossary/card-scheme-rules) retrieved 2026-06-27 3. T3 [https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/) retrieved 2026-06-27 4. T3 [https://iclg.com/practice-areas/fintech-laws-and-regulations/malta/](https://iclg.com/practice-areas/fintech-laws-and-regulations/malta/) retrieved 2026-06-27 ### W9 Product Innovation & Market Development limited signal Confirmed confirmed 2026-06-27 Innovation is anchored by the MFSA FinTech Strategy (2019), the FinTech Regulatory Sandbox (Rule 3 of the MFSA Act, launched 2020, revised v2), and a dedicated FinTech Supervision Function and Innovation Office. Open banking exists via PSD2 APIs but adoption remains nascent; PSD3/PSR and FiDA (expected ~2027) will deepen open finance. MFSA is a GFIN member and participates in the EU Supervisory Digital Finance Academy. Instant-payments rollout and EMT issuance are key product developments. Horizon · 2027-H2 (±year) Financial Data Access (FiDA) open-finance framework_proposed · T3_ Standing sub-brief · as of 27 June 2026 215 words · last cycle 2026-10-04 #### Product Innovation & Market Development The MFSA supports innovation through a FinTech Strategy with a FinTech Regulatory Sandbox under Rule 3 of the MFSA Act, launched in July 2020, offering a controlled testing environment under prescribed conditions. The MFSA operates a dedicated FinTech Supervision Function and holds GFIN membership, with open enrolment for regulated and unregulated providers and technology providers meeting four eligibility criteria. This positions Malta as an innovation-facilitative venue at the regulatory level. On open banking, the framework rests on PSD2 APIs but adoption lags despite a digitally-savvy population. The PSD3/PSR package and the Financial Data Access (FiDA) framework, expected by late 2027, promise mandated multi-product data sharing that would expand the data-access surface beyond current open banking. Malta recorded a 43% increase in EMI/payment-services authorisations between 2022 and 2024, indicating market-development momentum even as open-banking uptake remains an under-indexed signal. This thematic regulatory product-access view is distinct from the discrete commercial events tracked in W13. #### Outlook The product-innovation module trajectory is established at the regulatory-facilitation level but constrained by the open-banking adoption gap. The key forward item is FiDA, expected by late 2027, which would mandate multi-product data sharing and deepen open finance. Quantitative open-banking penetration data for Malta is flagged as under-indexed and recommended for direct sourcing on the next cycle. Periodic update · new data 2026-10-04 #### Product Innovation & Market Development Payhound is reported to combine a Malta Financial Services Authority financial-institution licence with a MiCA CASP authorisation, obtained from 24 November 2025, to operate a crypto-deposit cashiering route for iGaming operators. The product design reported is one in which the iGaming operator itself does not take custody of crypto assets; instead, the combined-licence entity handles the crypto-deposit function on the operator's behalf, allowing an iGaming business to accept crypto-denominated deposits without itself becoming a crypto-custody entity subject to the attendant licensing and custody obligations. This reporting originates from vendor commentary rather than a primary Authority source and has not been independently corroborated against the Authority's own licensing record this cycle; it is held at uncertain confidence and should be read as an emerging product pattern in the Malta market rather than a verified structural fact. If accurate, it represents a notable product-innovation use case for a combined PI/EMI-plus-CASP licensing footprint specifically tailored to the iGaming sector's crypto-payment needs, distinct from the general payments-licensing development seen in the Gate Technology case. #### Outlook Independent verification of the Payhound licensing combination against the Malta Financial Services Authority's own register would resolve the confidence gap in this finding. If confirmed, the product model described here would be relevant to any iGaming operator in Malta's gambling licensing ecosystem assessing crypto-deposit payment-rail options without taking on direct crypto-custody licensing exposure itself. **Sources and findings (4)** 1. T1 [https://www.mfsa.mt/our-work/fintech/](https://www.mfsa.mt/our-work/fintech/) retrieved 2026-06-27 2. T1 [https://www.mfsa.mt/fintech/regulatory-sandbox/](https://www.mfsa.mt/fintech/regulatory-sandbox/) retrieved 2026-06-27 3. T3 [https://noda.live/articles/open-banking-in-malta](https://noda.live/articles/open-banking-in-malta) retrieved 2026-06-27 4. T3 [https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/) retrieved 2026-06-27 ### W10 Consumer Protection & APP Fraud Probable confirmed 2026-06-27 No EU-wide mandatory APP-reimbursement regime; OAFS (Cap. 555) ADR route and published PSP/PSU responsibility-allocation model govern scam reimbursement; MFSA launched anti-fraud public-private partnership 8 Apr 2026 (MFSA, Police, OAFS, FIAU, CBM). Standing sub-brief · as of 27 June 2026 238 words · last cycle 2026-06-27 #### Consumer Protection & APP Fraud Malta lacks a UK-style mandatory APP-reimbursement regime, and the de facto allocation framework is set by the Office of the Arbiter for Financial Services. The OAFS published a model allocating responsibility between PSPs and payment-service users in payment-fraud scam cases, setting criteria and weightings to determine the gross negligence required to deny full reimbursement under PSD2. This model defines PSP liability exposure for scam reimbursement in the absence of an EU-wide mandatory APP regime and connects directly to the adjudicated PSP-liability decisions tracked in W7. The live event for this module is the anti-fraud public-private partnership. On 8 April 2026 the MFSA launched a partnership to combat financial fraud, with permanent participants including the MFSA, Malta Police Force, OAFS, FIAU and Central Bank of Malta, prioritising consumer-facing retail payment fraud. The scale is significant: Malta recorded 10,024 fraud incidents over a six-month period with close to EUR 3.76m in losses, mostly from credit transfers — directly relevant given the instant-payments rollout analysed in W5. #### Outlook The consumer-protection module trajectory is escalating, driven by the new anti-fraud partnership and the rising salience of credit-transfer fraud as instant payments expand. The forward watch is how the OAFS allocation model is applied in subsequent scam-reimbursement decisions and whether the public-private partnership produces operational or regulatory output. The intersection between fraud loss concentration in credit transfers and the IPR-driven instant-payments rollout is the analytical thread to track. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://gtg.com.mt/financial-service-providers-and-the-arbiter-for-financial-services-a-dive-into-dispute-resolution/](https://gtg.com.mt/financial-service-providers-and-the-arbiter-for-financial-services-a-dive-into-dispute-resolution/) retrieved 2026-06-27 2. T1 [https://www.financialarbiter.org.mt/content/model-allocation-responsibility-between-payment-service-provider-psp-and-payment-services](https://www.financialarbiter.org.mt/content/model-allocation-responsibility-between-payment-service-provider-psp-and-payment-services) retrieved 2026-06-27 3. T3 [https://www.ccmalta.com/publications/eu-payment-services-law-and-scam-refunds-what-victims-need-to-know-in-2026](https://www.ccmalta.com/publications/eu-payment-services-law-and-scam-refunds-what-victims-need-to-know-in-2026) retrieved 2026-06-27 4. T3 [https://www.crowdfundinsider.com/2026/04/274113-malta-mfsa-advances-financial-sector-resilience-with-new-anti-fraud-alliance-and-insurance-oversight-review/](https://www.crowdfundinsider.com/2026/04/274113-malta-mfsa-advances-financial-sector-resilience-with-new-anti-fraud-alliance-and-insurance-oversight-review/) retrieved 2026-06-27 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/malta/#sec-dom-D7) Probable confirmed 2026-06-27 sentinel: Malta's AML/CFT posture is led by the FIAU under the PMLFTR (transposing EU AML directives), with MFSA financial-crime compliance supervision. Malta was the first EU state grey-listed by FATF (June 2022–June 2023) and has since strengthened the FIAU and enforcement. The FIAU AML/CFT Supervisory Plan 2025–2026 targets crypto beneficial ownership, money remittances and trade-based ML. Carried as Sentinel feed only — no original illicit-finance analysis. Standing sub-brief · as of 27 June 2026 233 words · last cycle 2026-06-27 #### AML/CFT & Financial Crime The intelligence for this module is sourced from the Sentinel feed and carried as provenance only; original illicit-finance analysis is routed to the Financial Intelligence Monitor (FIM) and is not a World Payments conclusion. Per the Sentinel feed, the FIAU's AML/CFT Supervisory Plan 2025-2026 focuses on crypto beneficial-ownership compliance, money remittances at financial institutions, and trade-based money laundering at credit institutions, with terrorist-financing risk examined across these areas. Also per the Sentinel feed, Malta was the first EU member state grey-listed by FATF, from June 2022 to June 2023. To exit, it strengthened the FIAU, tightened oversight and increased enforcement. As a MONEYVAL member, Malta has been re-rated on eight FATF Recommendations (8, 13, 20, 24, 26, 28, 36, 38) and remains in enhanced follow-up. This grey-list history is the backdrop to ongoing correspondent-banking de-risking pressure on Maltese institutions, which is the WPM-relevant cross-reference into W12. The full illicit-finance assessment and any sanctions-evasion or stablecoin-misuse analysis belong to FIM. See the Sentinel feed for the underlying intelligence. #### Outlook The AML/CFT module is carried as a Sentinel-fed provenance layer with a stable trajectory. The WPM-relevant forward signal is the continued de-risking overhang that the grey-list legacy sustains, which feeds correspondent-banking access in W12. Depth on the FIAU enforcement pipeline and post-grey-list MONEYVAL follow-up is routed to FIM; the bank-versus-non-bank AML supervision gap in Malta is not separately quantified this cycle. no periodic updates on record for this sub-brief ** Sources and findings (7)** 1. T3 [https://www.acams.org/en/news/legal-brief-malta-implements-aml-reforms-to-avoid-fatf-gray-list](https://www.acams.org/en/news/legal-brief-malta-implements-aml-reforms-to-avoid-fatf-gray-list) retrieved 2026-06-27 2. T? FIM (sentinel.gi) per-JID baseline profile — Malta — Malta's AML/CFT regime rests on the Prevention of Money Laundering Act and PMLFTR regulations, supervised by FIAU (FIU) and MFSA (financial/VASP licensing). Malta was FATF/MONEYVAL grey-listed June 2021-June 2022; it retains a bespoke citizenship-by-investment programme (ruled unlawful by the CJEU in April 2025), an active crypto-licensing hub, and a large maritime flag registry exposed to sanctions-evasion shipping. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: absent-field-provenance 4. T1 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: OFSI divergence 5. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: regulatory-failure 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: legal-gap 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: political-constraint ### W12 Correspondent Banking, Settlement & Access Probable confirmed 2026-06-27 Settlement access in Malta runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta; significant institutions (BOV, and historically HSBC Malta) are directly ECB-supervised, while LSIs sit under MFSA day-to-day supervision. Malta has faced acute correspondent-banking de-risking pressure — BOV lost its last USD correspondent (ING) in 2019 amid global de-risking and reputational concerns — though USD-clearing and BOV's financials recovered by 2024. Many Malta firms run operations through EMIs (Revolut/Wise) alongside traditional bank accounts. Standing sub-brief · as of 27 June 2026 271 words · last cycle 2026-06-27 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank-versus-non-bank access asymmetry. Bank of Valletta lost its last USD correspondent banking relationship (ING), terminating 14 December 2019, within a global de-risking scale-down that disproportionately hit small jurisdictions like Malta given low volumes against compliance costs. By 2024 the worst of the USD freeze had eased and BOV financials recovered (H1 2024 pre-tax profit EUR 148.2m, up 40.9%), but new-company onboarding remains difficult. The structural consequence is that many Malta firms run operations through EMIs such as Revolut Business or Wise alongside traditional bank accounts — a clear illustration of the non-bank rails substituting for constrained bank correspondent access. Settlement supervision is split along the banking-union architecture. Significant institutions in Malta are directly ECB-supervised via joint supervisory teams, while less significant institutions are supervised by the MFSA as national competent authority under ECB oversight; as of 1 September 2025 the ECB listed two Maltese SIs and 18 LSIs. Settlement access runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta. This means euro settlement access for banks is structurally secure through the Eurosystem, while the constraint sits in non-euro (notably USD) correspondent access — the asymmetry that drives operators toward EMI rails. #### Outlook The correspondent-banking module is stable but flagged as an under-indexed structural overhang. USD-clearing access has eased from its 2019 nadir, yet onboarding difficulty persists and the grey-list legacy (W11) sustains de-risking pressure. The forward watch is whether foreign acquisition of Maltese banks (W13) reconfigures the correspondent footprint, and whether non-bank EMI rails continue absorbing the access gap. The MT-US-USD corridor access direction remains uncertain. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.maltatoday.com.mt/business/business_news/95724/bank_of_valletta_to_lose_us_dollar_transactions_provider_by_december](https://www.maltatoday.com.mt/business/business_news/95724/bank_of_valletta_to_lose_us_dollar_transactions_provider_by_december) retrieved 2026-06-27 2. T3 [https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta) retrieved 2026-06-27 3. T3 [https://jeangalea.com/malta-fatf-grey-list/](https://jeangalea.com/malta-fatf-grey-list/) retrieved 2026-06-27 4. T3 [https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta) retrieved 2026-06-27 ### W13 Commercial Intelligence (M&A, Investment & Product) Probable confirmed 2026-06-27 Trailing-12m commercial activity: BVNK MiCA CASP licence (Feb 2026); HSBC Malta sold to CrediaBank and MDB Group to Banka Creditas; 2025 fintech funding peak >$2bn (Binance-dominated); Gemini EU-HQ relocation 2025. Standing sub-brief · as of 27 June 2026 286 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) This module renders discrete commercial events from the trailing window. On product/licensing, in February 2026 stablecoin payment-infrastructure company BVNK obtained a CASP licence under the MiCA framework issued by the MFSA — a completed event evidencing Malta's MiCA fast-track attracting stablecoin payment-infrastructure firms. On M&A, HSBC sold its Maltese subsidiary to Athens-based CrediaBank, and MDB Group was acquired by Prague-based Banka Creditas; both deal values are not publicly disclosed. These foreign acquisitions reshape the correspondent/settlement-access and banking-concentration landscape among Malta's significant banks and reconfigure the concentrated Maltese banking market and its correspondent footprint — a direct link to the access analysis in W12. On investment, Malta fintech funding peaked in 2025 at over $2bn (the highest in a decade), with Binance the highest-funded Malta fintech at roughly $2.02bn; 35 companies in the sector have received funding to date. The aggregate funding figure is dominated by Binance-related raises and signals Malta's continued attraction of large crypto/fintech players despite its small size. On market development, US-based crypto exchange Gemini relocated its European headquarters to Malta in 2025 as its core EU compliance hub under MiCA, while OKX designated Malta as a regional hub in 2024; values are not publicly disclosed. These hub designations reinforce Malta's role as an EU MiCA compliance base for large international CASPs. #### Outlook The commercial-intelligence module trajectory is escalating, with active bank-level M&A and continued international CASP interest. The forward watch is whether the HSBC Malta and MDB Group acquisitions complete their integration and reshape the correspondent landscape, and whether further large CASPs designate Malta as an EU hub. Deal-value disclosure is under-indexed for the private and cross-border bank transactions; amounts remain undisclosed, limiting precision on individual deals. Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech Two discrete licensing events mark Malta's commercial fintech activity this cycle. Fast Shift Limited, an electronic money institution and part of the Badalyan Brothers Group, was granted EMI authorisation by the Malta Financial Services Authority, opening an EEA-passporting gateway from its Malta base; the event was reported 3 August 2026, and the deal value was not publicly disclosed. Separately, BVNK secured an MFSA CASP licence in addition to its existing Malta EMI authorisation, enabling it to offer digital-asset services across all EEA member states from its Malta base where it is already authorised as an e-money institution; the exact grant date was not disclosed in the retrieved source, and no transaction value was publicly disclosed for this licensing event either. Both events are licensing grants rather than priced commercial transactions, and both illustrate the same underlying commercial pattern: building a combined EMI-plus-CASP structure from a single Malta base to serve EEA-wide payment and digital-asset business. This pattern sits downstream of Malta's regulatory consolidation onto the MiCA/CASP crypto-licensing route and its confirmed revised EMI prudential rulebook, both covered under the licensing and digital-money modules above. #### Outlook Watch for further EMI-licensed Malta firms adding a CASP licence, or vice versa, as the combined-licence commercial model continues to be the dominant pattern in Malta's fintech licensing activity. **1 earlier distinct update(s)** Periodic update · new data 2026-10-12 #### Commercial Intelligence & Fintech Ryft, a UK-domiciled payments-infrastructure platform, raised a Series B funding round of EUR23.3 million led by Gresham House Ventures, announced 21 September 2026. Alongside that round, Ryft is reported to be pursuing a full EU payments licence from the Malta Financial Services Authority. The regulatory-review record for this pursuit shows a status of notified with the MFSA, which is distinct from a granted licence: as at this cycle, Ryft's application has not progressed to an authorisation decision, and the funding round itself should not be read as evidence that MFSA authorisation has been secured. This development is a data point on Malta's continuing attractiveness as an EU payments-licensing venue for firms headquartered elsewhere in the EU or UK, consistent with the jurisdiction's established role as a licensing base for payments and e-money institutions seeking EU-wide passporting. The source for this item is trade-press reporting rather than a primary MFSA disclosure, so the funding figures and the characterisation of Ryft's licensing intent carry that sourcing caveat. #### Outlook Whether Ryft's MFSA application converts from notified status into a granted EU payments licence is the principal item to watch arising from this development. No other Malta-specific commercial event, such as an M&A transaction or additional funding round among payments or fintech firms, was identified this cycle. **Sources and findings (4)** 1. T3 [https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757](https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757) retrieved 2026-06-27 2. T3 [https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta) retrieved 2026-06-27 3. T3 [https://tracxn.com/d/explore/fintech-startups-in-malta/4REGIIkWsxeReT-nPEnSBDRnMU6CEtlEa6BmN2ev7_U#top-companies](https://tracxn.com/d/explore/fintech-startups-in-malta/4REGIIkWsxeReT-nPEnSBDRnMU6CEtlEa6BmN2ev7_U#top-companies) retrieved 2026-06-27 4. T3 [https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/) retrieved 2026-06-27 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Malta| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 60 finding(s), 137 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).