Malta (MT)

Licensing, Authorisation & Market Access

Malta consolidates payments licensing under the Financial Institutions Act (Cap. 376), with the Malta Financial Services Authority (MFSA) acting as single regulator. The Act provides the consolidated PI route transposing PSD2 and the EMI route transposing EMD2, with the distinct bank-PSP route sitting under the Banking Act (Cap. 371). The MFSA holds grant, refuse, cancel and suspend powers alongside administrative-penalty authority, with Cap. 376 enabling subsidiary legislation and MFSA Rules transposing the underlying EU directives. This single-regulator model is the gateway any payments operator must clear for market access and defines the EU-passportable authorisation pathway that has made Malta a major EMI/PI domicile.

Capital and substance thresholds set the cost of entry. The EMI regime requires not less than EUR 350,000 in minimum initial capital (with SEMIs reduced to roughly EUR 50,000-100,000), while payment institutions face EUR 25,000-125,000 depending on the services provided; at least two individuals must effectively direct the business from Malta, and a EUR 10,000 application fee applies. These floors and the management-presence requirement shape which firms domicile in Malta versus Ireland or Luxembourg. The clear distinction here between the non-bank PI/EMI cohort authorised under Cap. 376 and the bank-PSP route under Cap. 371 is the structural spine of Malta's licensing landscape, and it is precisely this distinction that the pending PSD3/PSR package will reshape.

The core commercial draw of the Malta licence is passporting. Once a Malta licence is obtained, notification-based passporting permits operators to provide services into other EU/EEA Member States, via branch or remotely under the freedom to provide services. EU single-market passporting from a Malta base is the primary reason for the jurisdiction's outsized EMI population and positions Malta as an EU alternative hub to the larger Dublin and Luxembourg centres.

Outlook

The W1a licensing position is established and well-evidenced. The forward variable is the PSD3/PSR package, which will not alter the passporting logic but will reconfigure the categorical structure beneath it by collapsing the separate EMI category into a payment-institution sub-category. Operators holding EMI authorisations under Cap. 376 should treat the anticipated Official Journal publication as the trigger for transposition planning rather than a distant horizon.

Conduct, Safeguarding & Promotions

Malta's safeguarding regime is anchored in the Financial Institutions Act (Cap. 376), the FIA (Safeguarding of Funds) Regulations (S.L. 376.04) and MFSA Financial Institutions Rules administered under the Fintech Supervision Function. Each EMI must safeguard and segregate funds representing e-money issued and is liable for any shortfall under S.L. 376.04. This segregation-and-shortfall-liability model determines customer-fund-protection obligations for Malta's large non-bank PI/EMI cohort, and it is distinct from the FSCS-style deposit cover applicable to bank PSPs operating under the Banking Act. Layered over the FIA, the MFSA Conduct Rules applicable to credit and financial institutions address disclosures, product oversight and governance, selling processes and conflicts-of-interest management; institutions are legally bound to comply.

The live development for this module is the legislative status of PSD3 and the Payment Services Regulation. The package is now post-trilogue: provisional political agreement was reached on 27 November 2025, Council final compromise texts were published on 23 April 2026, the ECON Committee recommended adoption at second reading without amendment on 18 May 2026, and Official Journal publication is anticipated June-July 2026, with the PSR applying roughly 21 months and PSD3 transposition within 18 months thereafter. The package is no longer in active parliamentary debate. Safeguarding reforms under proposed PSD3 Article 9 and the planned collapse of the EMI category into a PI sub-category are pending transposition. For a jurisdiction with a large EMI population, the collapse of the EMI/PI distinction and the revised safeguarding obligations move this from a watching brief to a transposition-planning item.

Outlook

The conduct and safeguarding baseline is stable but the trajectory is escalating because of the imminence of the PSD3/PSR enactment. The key dates to track are the Official Journal publication window and the subsequent transposition timeline, after which the EMD will be repealed and EMIs reconstituted as a sub-category of payment institutions. Maltese EMI operators should treat their current S.L. 376.04 safeguarding arrangements as subject to revision under the proposed PSD3 Article 9 framework.

Stablecoins & Digital Money

Malta has a live, in-force stablecoin and digital-money regime. The Markets in Crypto-Assets Act (Cap. 647) implements MiCA (Regulation (EU) 2023/1114) in Malta, with transposition facilitated through Act XIV of 2024 integrating Titles III and IV on asset-referenced tokens and e-money tokens, and the MFSA amending Chapter 3 of the VFA Rulebook. Title III/IV became effective on 30 June 2024 and the full CASP regime applied from 30 December 2024. This implementation makes Malta a live EU stablecoin and CASP authorisation venue, attracting EMT issuers and crypto-asset service providers.

The regime is operative rather than theoretical. The MFSA supervises Maltese stablecoin issuer StablR (EURR) as an EMT issuer under MiCA. EMT issuance is restricted to licensed EMIs or credit institutions, and MiCA Article 36 requires EMT issuers to hold at least 30% of reserves in credit-institution deposits (60% for significant EMTs), with redemption at par on demand. StablR demonstrates that Malta hosts operative MiCA-compliant EMT issuance, a competitive differentiator versus slower-implementing Member States. The link between this module and the licensing framework is direct: because EMT issuance requires an EMI or credit-institution licence, the non-bank EMI cohort authorised under Cap. 376 is the natural pool of EMT issuers, while reserve-composition rules tie issuers back into the bank-deposit system.

Outlook

The stablecoin module trajectory is escalating, driven by continued CASP authorisation activity. The February 2026 BVNK CASP licence (tracked in W13 as a commercial event) and the live StablR EURR issuance evidence a maturing venue. Going forward, the intersection with the pending PSD3/PSR EMI-into-PI collapse warrants watching, since EMT issuance is anchored to the EMI/credit-institution licensing categories that the package will restructure.

Operational Resilience & Critical Infrastructure

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies in Malta from 17 January 2025 with the MFSA as designated national supervisor. In-scope obligations include ICT risk management, incident reporting, maintenance of the Register of Information on ICT third-party arrangements, and Threat-Led Penetration Testing (TLPT/TIBER-MT under Legal Notice 166 of 2024, DORA Articles 26-27). DORA imposes binding ICT-resilience and critical-third-party obligations on all in-scope Maltese financial entities, a recurring compliance cost that falls on bank PSPs and non-bank PI/EMI operators alike.

The reporting lifecycle is now established. From 2026 the full Register of Information must be submitted annually to the MFSA between 1 January and 21 March, reflecting status as of 31 December of the prior year. The inaugural 2025 window ran 1-8 April 2025, establishing a continuous DORA reporting cycle. This converts DORA from a one-off implementation event into a standing annual obligation embedded in the Maltese supervisory calendar.

Outlook

The resilience module is stable and well-evidenced through two MFSA primary anchors. The recurring forward item is the next full Register of Information submission window, which runs 1 January to 21 March 2027 reflecting status as of 31 December 2026. Beyond the annual RoI cycle, the live TIBER-MT framework means in-scope entities should anticipate periodic threat-led penetration testing obligations.

Commercial Intelligence (M&A, Investment & Product)

This module renders discrete commercial events from the trailing window. On product/licensing, in February 2026 stablecoin payment-infrastructure company BVNK obtained a CASP licence under the MiCA framework issued by the MFSA — a completed event evidencing Malta's MiCA fast-track attracting stablecoin payment-infrastructure firms.

On M&A, HSBC sold its Maltese subsidiary to Athens-based CrediaBank, and MDB Group was acquired by Prague-based Banka Creditas; both deal values are not publicly disclosed. These foreign acquisitions reshape the correspondent/settlement-access and banking-concentration landscape among Malta's significant banks and reconfigure the concentrated Maltese banking market and its correspondent footprint — a direct link to the access analysis in W12.

On investment, Malta fintech funding peaked in 2025 at over $2bn (the highest in a decade), with Binance the highest-funded Malta fintech at roughly $2.02bn; 35 companies in the sector have received funding to date. The aggregate funding figure is dominated by Binance-related raises and signals Malta's continued attraction of large crypto/fintech players despite its small size. On market development, US-based crypto exchange Gemini relocated its European headquarters to Malta in 2025 as its core EU compliance hub under MiCA, while OKX designated Malta as a regional hub in 2024; values are not publicly disclosed. These hub designations reinforce Malta's role as an EU MiCA compliance base for large international CASPs.

Outlook

The commercial-intelligence module trajectory is escalating, with active bank-level M&A and continued international CASP interest. The forward watch is whether the HSBC Malta and MDB Group acquisitions complete their integration and reshape the correspondent landscape, and whether further large CASPs designate Malta as an EU hub. Deal-value disclosure is under-indexed for the private and cross-border bank transactions; amounts remain undisclosed, limiting precision on individual deals.

Consumer Protection & APP Fraud

Malta lacks a UK-style mandatory APP-reimbursement regime, and the de facto allocation framework is set by the Office of the Arbiter for Financial Services. The OAFS published a model allocating responsibility between PSPs and payment-service users in payment-fraud scam cases, setting criteria and weightings to determine the gross negligence required to deny full reimbursement under PSD2. This model defines PSP liability exposure for scam reimbursement in the absence of an EU-wide mandatory APP regime and connects directly to the adjudicated PSP-liability decisions tracked in W7.

The live event for this module is the anti-fraud public-private partnership. On 8 April 2026 the MFSA launched a partnership to combat financial fraud, with permanent participants including the MFSA, Malta Police Force, OAFS, FIAU and Central Bank of Malta, prioritising consumer-facing retail payment fraud. The scale is significant: Malta recorded 10,024 fraud incidents over a six-month period with close to EUR 3.76m in losses, mostly from credit transfers — directly relevant given the instant-payments rollout analysed in W5.

Outlook

The consumer-protection module trajectory is escalating, driven by the new anti-fraud partnership and the rising salience of credit-transfer fraud as instant payments expand. The forward watch is how the OAFS allocation model is applied in subsequent scam-reimbursement decisions and whether the public-private partnership produces operational or regulatory output. The intersection between fraud loss concentration in credit transfers and the IPR-driven instant-payments rollout is the analytical thread to track.

Scheme & Network Compliance

The Central Bank of Malta acts as national authority for the Interchange Fee Regulation (EU) 2015/751. The IFR enforces interchange caps of 0.2% of transaction value on consumer debit cards and 0.3% on consumer credit cards, with Member-State discretion to set lower domestic caps. Beyond the caps, the IFR prohibits territorial licensing restrictions, mandates per-category merchant-service-charge disclosure and constrains the Honour-All-Cards rule. The scheme operators directly affected are Visa and Mastercard.

This module sits at the interface between the card schemes and the acquiring market. The caps and the unblending obligations are stable and in force, and the analytical weight of W4 is on how scheme rules layer over the EU regulatory floor. Because the IFR is a directly-applicable EU regulation with the CBM as national authority, the framework applies uniformly to bank and non-bank acquirers operating in Malta.

Outlook

The scheme and network compliance module is stable. The interchange caps and unblending obligations are settled features of the operating environment, and no near-term legislative change is signalled for this cycle. Monitoring focus remains on scheme-rule schedule changes flowing through acquirers to merchants, which connect this module to merchant acquiring in W8.

Payment Corridor Dynamics

Malta's euro corridors run on real-time rails. SEPA Instant Credit Transfer (SCT Inst) and TARGET Instant Payment Settlement (TIPS) settle euro transfers in under 10 seconds, while SWIFT handles non-euro and cross-border flows over 1-5 business days. The Central Bank of Malta is the lead authority for SEPA implementation. This dual structure defines the corridor map: a deepening real-time euro corridor domestically and into the SEPA zone, alongside slower correspondent-based rails for non-euro flows.

The escalating driver is the EU Instant Payments Regulation, in force from 9 January 2025, which mandated universal instant euro transfers and drove Maltese banks including IIG Bank, APS and MeDirect to introduce SEPA incoming instant payments for domestic and cross-border euro transfers. The IPR rollout is observable at the bank level, evidencing the corridor opening in practice rather than merely in regulation. The non-euro corridor picture connects directly to the correspondent-banking constraints analysed in W12, where USD access remains the structural weak point.

Outlook

The payment-corridor module trajectory is escalating as the Instant Payments Regulation continues to deepen real-time euro connectivity. The MT-EU-SEPA corridor is opening, with SCT Inst/TIPS rollout broadening across Maltese banks. The MT-US-USD corridor remains uncertain and is tracked under correspondent banking in W12, where the legacy of constrained USD access continues to shape access direction.

Industry Structure & Commercial

Malta's payments market structure is defined by a disproportionately large non-bank institution population. As of March 2025, the MFSA had authorised 36 e-money institutions and 30 payment institutions, with 12 licences issued in 2024, ranking Malta alongside Germany on new authorisations. This snapshot is approximately 15 months old relative to the June 2026 run and may not reflect subsequent authorisations or withdrawals; confidence is held at Assessed pending verification against the MFSA live register. With that caveat, Malta's outsized EMI/PI population for its size positions it as an EU alternative hub to Dublin and Luxembourg.

The domestic champion layer is led by home-grown firms: Papaya (an EMI offering IBAN accounts and Mastercard-linked services), SysPay (modular payment services, card processing and anti-fraud) and Truevo Payments (an acquirer and PSP). The sector's economic footprint is material — in 2025 the fintech industry accounted for 8.2% of real gross value added and employed over 14,700 people. This concentration of non-bank PI/EMI activity is the commercial spine of the Maltese payments market and the reason the pending PSD3/PSR EMI-into-PI collapse carries outsized local significance.

Outlook

The industry-structure module is stable but flagged for staleness. The March 2025 institution counts should be refreshed via a direct MFSA Financial Services Register pull on the next cycle to confirm whether the EMI/PI population has grown or contracted. The structural story — a large non-bank cohort against a small, concentrated banking sector being foreign-acquired (see W13) — is the analytical thread to carry forward.

Legal & Litigation

The Maltese enforcement and litigation record for payments is anchored in two strands. On administrative penalties, the MFSA imposed a EUR 7,050 penalty on a financial institution on 13 March 2025 under Article 16(8) of the MFSA Act (Ref 2025-13), with a companion action (Ref 2025-12) imposing EUR 650 the same day. These are dated episodes evidencing active MFSA enforcement against the non-bank PI/EMI cohort.

On adjudicated PSP liability, the Office of the Arbiter for Financial Services decided Case ASF 095/2021 (SE v Trust Payments (Malta) Limited), an internet-fraud reimbursement claim in which the PSP disputed eligibility on the basis of the absence of a direct customer relationship. The OAFS is the ADR/ombudsman route under Chapter 555 (Act XVI of 2016) for natural persons and micro-enterprises. The decision shapes how PSP liability is allocated in fraud-reimbursement disputes and connects to the broader consumer-protection allocation model analysed in W10.

Outlook

The legal and litigation module is stable, built on MFSA primary publication anchors and an OAFS decision. The forward watch is whether the OAFS continues to develop its PSP-liability jurisprudence and whether MFSA administrative-penalty activity against payment and e-money institutions accelerates. Both strands feed the consumer-protection picture in W10.

Merchant Acquiring & Risk

Merchant acquiring in Malta operates under the IFR transparency regime. Acquirers must offer individually-specified merchant service charges per card category and brand unless the payee requests blended charges in writing, and must include applicable MSC, interchange and scheme fees in agreements. Scheme rules govern chargeback windows, 3DS/SCA, surcharging and PCI DSS, with scheme fines flowing through acquirers to merchants via indemnification. The unblending obligation is the analytical core of this module, and it links acquiring directly to the scheme-compliance framework in W4.

The market has seen structural restructuring at the acquirer level. Malta-based payment processor Credorax (later Finaro) was acquired by Shift4 Payments in 2023; in 2024 the company surrendered its credit-institution licence and shifted to a financial-institution licence. This is a dated episode treated as a short entry for structural context, illustrating the bank-to-non-bank licence migration that recurs across the Maltese acquiring landscape.

Outlook

The merchant-acquiring module is stable but rests partly on tertiary sources, with acquirer chargeback and high-risk-MCC operational data not directly evidenced this cycle. The forward watch is whether scheme-rule schedule changes materially shift acquirer cost structures, and whether further licence migrations occur among Maltese acquirers. Quantitative open-banking and acquiring-ops data is flagged as under-indexed for the next cycle.

Product Innovation & Market Development

The MFSA supports innovation through a FinTech Strategy with a FinTech Regulatory Sandbox under Rule 3 of the MFSA Act, launched in July 2020, offering a controlled testing environment under prescribed conditions. The MFSA operates a dedicated FinTech Supervision Function and holds GFIN membership, with open enrolment for regulated and unregulated providers and technology providers meeting four eligibility criteria. This positions Malta as an innovation-facilitative venue at the regulatory level.

On open banking, the framework rests on PSD2 APIs but adoption lags despite a digitally-savvy population. The PSD3/PSR package and the Financial Data Access (FiDA) framework, expected by late 2027, promise mandated multi-product data sharing that would expand the data-access surface beyond current open banking. Malta recorded a 43% increase in EMI/payment-services authorisations between 2022 and 2024, indicating market-development momentum even as open-banking uptake remains an under-indexed signal. This thematic regulatory product-access view is distinct from the discrete commercial events tracked in W13.

Outlook

The product-innovation module trajectory is established at the regulatory-facilitation level but constrained by the open-banking adoption gap. The key forward item is FiDA, expected by late 2027, which would mandate multi-product data sharing and deepen open finance. Quantitative open-banking penetration data for Malta is flagged as under-indexed and recommended for direct sourcing on the next cycle.

AML/CFT & Financial Crime

The intelligence for this module is sourced from the Sentinel feed and carried as provenance only; original illicit-finance analysis is routed to the Financial Intelligence Monitor (FIM) and is not a World Payments conclusion. Per the Sentinel feed, the FIAU's AML/CFT Supervisory Plan 2025-2026 focuses on crypto beneficial-ownership compliance, money remittances at financial institutions, and trade-based money laundering at credit institutions, with terrorist-financing risk examined across these areas.

Also per the Sentinel feed, Malta was the first EU member state grey-listed by FATF, from June 2022 to June 2023. To exit, it strengthened the FIAU, tightened oversight and increased enforcement. As a MONEYVAL member, Malta has been re-rated on eight FATF Recommendations (8, 13, 20, 24, 26, 28, 36, 38) and remains in enhanced follow-up. This grey-list history is the backdrop to ongoing correspondent-banking de-risking pressure on Maltese institutions, which is the WPM-relevant cross-reference into W12. The full illicit-finance assessment and any sanctions-evasion or stablecoin-misuse analysis belong to FIM. See the Sentinel feed for the underlying intelligence.

Outlook

The AML/CFT module is carried as a Sentinel-fed provenance layer with a stable trajectory. The WPM-relevant forward signal is the continued de-risking overhang that the grey-list legacy sustains, which feeds correspondent-banking access in W12. Depth on the FIAU enforcement pipeline and post-grey-list MONEYVAL follow-up is routed to FIM; the bank-versus-non-bank AML supervision gap in Malta is not separately quantified this cycle.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank-versus-non-bank access asymmetry. Bank of Valletta lost its last USD correspondent banking relationship (ING), terminating 14 December 2019, within a global de-risking scale-down that disproportionately hit small jurisdictions like Malta given low volumes against compliance costs. By 2024 the worst of the USD freeze had eased and BOV financials recovered (H1 2024 pre-tax profit EUR 148.2m, up 40.9%), but new-company onboarding remains difficult. The structural consequence is that many Malta firms run operations through EMIs such as Revolut Business or Wise alongside traditional bank accounts — a clear illustration of the non-bank rails substituting for constrained bank correspondent access.

Settlement supervision is split along the banking-union architecture. Significant institutions in Malta are directly ECB-supervised via joint supervisory teams, while less significant institutions are supervised by the MFSA as national competent authority under ECB oversight; as of 1 September 2025 the ECB listed two Maltese SIs and 18 LSIs. Settlement access runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta. This means euro settlement access for banks is structurally secure through the Eurosystem, while the constraint sits in non-euro (notably USD) correspondent access — the asymmetry that drives operators toward EMI rails.

Outlook

The correspondent-banking module is stable but flagged as an under-indexed structural overhang. USD-clearing access has eased from its 2019 nadir, yet onboarding difficulty persists and the grey-list legacy (W11) sustains de-risking pressure. The forward watch is whether foreign acquisition of Maltese banks (W13) reconfigures the correspondent footprint, and whether non-bank EMI rails continue absorbing the access gap. The MT-US-USD corridor access direction remains uncertain.