--- title: "Malta Payments Regulation Monitor | World Payments Monitor" canonical: https://payments.gi/jurisdictions/malta/ source_html: /jurisdictions/malta/index.html description: "Malta payments and e-money regulation: 14 modules, 60 sourced findings, updated 2026-10-26. Licensing, safeguarding, stablecoins, AML/CFT." generated_at: 2026-10-26T19:20:26Z content_sha256: c20d7bf235acc55bc4ce58bba958e39d38966be101a95b54a41c55126550f2f6 generator: "fe-fleet/md-twin@1.0" --- # Malta MT schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-26 · 14 modules · 60 sourced findings · 140 sources in the cumulative register Download report (PDF) Expand all 14 Modules 0 Moved this cycle 1 Key judgments 2 Open gaps 60 Findings 16 Tier-1 sources Confidence mix 6 confirmed 8 unpopulated (sums to 14 rendered modules; click to filter) No modules moved this cycle. Law made at European Economic Area level that applies in Malta is covered once, on the [European Economic Area](/jurisdictions/european-economic-area/) page. This page covers Malta’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,347 Full executive summary 607 ###### Latest update · 25 October 2026 #### Lead Signal Malta's payments regulatory picture is dominated by a confirmed correction to the operational-resilience framework governing outsourcing by payment institutions and electronic money institutions. The Malta Financial Services Authority's Financial Institutions Rulebook, version 6.00 of FIR/03, requires at least 60 calendar days' prior notice to the MFSA before a licence holder outsources a critical or important operational function, under rule R3-2.8.12. Verification against the rulebook text also corrected a prior claim: rule R3-2.8.13 does not grant the MFSA a power to require a licence holder to exit an outsourcing arrangement, as had previously been asserted; it in fact only requires the licence holder to notify the MFSA of changes to previously-submitted outsourcing information and to make such information available to the MFSA on request. This is a meaningful correction for any institution modelling its regulatory exposure around outsourcing arrangements in Malta: the MFSA's confirmed powers here are notification and information-access powers, not a power to direct termination of a vendor relationship. #### Other Developments Licence cancellation for safeguarding breaches. The MFSA cancelled the licence of MTACC Ltd on 26 February 2025, citing in part breaches of safeguarding requirements under Article 10B(1) of the Financial Institutions Act. Malta's licensed financial-institution population currently comprises 64 licensed financial institutions, of which 31 are e-money issuers. The cancellation sits within this wider population as a dated enforcement event rather than a change to the safeguarding rule itself, and it is a reminder that safeguarding compliance is an active supervisory focus for the MFSA rather than a dormant requirement. Classification question for prediction markets carries payments-adjacent implications. The MFSA's 19 October 2026 circular on prediction markets and event contracts, whose primary focus is classification under MiFID II, the Markets in Crypto-Assets Regulation, and gambling law, also carries implications for how such products would be settled and how client money would be treated depending on which classification applies. A product found to be a financial instrument carries different settlement and client-money obligations than one found to be a crypto-asset or a gambling product, meaning the payments architecture required of a Malta-based platform in this space cannot be finalised until the underlying classification question is resolved for a given product. #### Cross-Monitor Connections The outsourcing-notification finding under FIR/03 connects to the operational-resilience expectations being developed for critical third parties more broadly, as supervisory authorities elsewhere extend direct oversight to critical service providers rather than relying solely on the institutions that use them; Malta's 60-day notification rule positions the MFSA to identify and assess such dependencies at the point they are created rather than only after the fact. The MTACC Ltd cancellation for safeguarding breaches also connects to the broader industry-structure picture: a reduction in the licensed e-money-issuer population through enforcement, set against Malta's still-substantial base of 64 licensed financial institutions, is a data point relevant to assessing market concentration and exit risk among Malta-licensed payment institutions. #### Outlook The corrected understanding of the MFSA's outsourcing powers under FIR/03 should inform how institutions and their advisers characterise Malta's resilience regime going forward: the notification and information-access framework is real and binding, but the broader directive power some had previously assumed is not supported by the rule text. On the product-classification side, the payments implications of the MFSA's prediction-markets circular will only crystallise once a specific product receives a classification determination; until then, settlement and client-money architecture for this product category in Malta remains provisional. No further MT-specific development was identified beyond these three areas. 5 earlier updates not shown here. ###### Standing brief · as of 6 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Malta's electronic-money and payment-institution regime continues to rest on the Financial Institutions Act and its implementing FIR rules, under which the Malta Financial Services Authority sets EMI initial capital EUR350,000; PI initial capital EUR125,000 for firms seeking Maltese authorisation and onward EEA passporting. That standing capital architecture is now set against a firm European timetable. Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the successor PSD3/Payment Services Regulation package means the current PI and EMI licensing tracks are due to converge, with the reform expected operational late 2027. The agreement merges PI/EMI into a unified authorisation, repeals EMD2, and current planning points to ~24-month grandfathering expected for MT-licensed institutions, giving Malta-licensed firms a multi-year runway before reauthorisation is required under the unified regime. For a jurisdiction whose payments sector has built its market-access model around EMI and PI licensing under Malta's EU-harmonised framework, the grandfathering window is the operative planning variable over the coming two years, and it is the single development this cycle with clear forward-looking materiality for Malta's licensee population. #### Other Developments Beneath this headline reform trajectory, Malta's conduct-side rules for e-money issuers remain unchanged this cycle. Under the FIR/03 safeguarding regime, EMIs must safeguard client e-money funds directly with EU credit institutions — the rule permits no intermediary between licensee and safeguarding bank — and the same regime requires mandatory reconciliations plus annual safeguarding audit as ongoing conduct obligations. Layered on top of this conduct regime, DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, layering ICT incident-reporting and third-party risk-testing obligations atop the MFSA conduct regime — a standing operational-resilience requirement rather than a new development this cycle, but one that continues to shape supervisory expectations for MT payment firms. The safeguarding and licensing findings above pertain specifically to Malta's non-bank payment-institution and e-money-institution population; bank-provided payment services in Malta operate under separate prudential capital and deposit-protection arrangements rather than the FIR/03 direct-safeguarding mechanism, a distinction that runs through this cycle's W1a and W1b findings and that the PSD3/PSR reform track (which applies to both bank and non-bank licensees) will need to reconcile at EU level. Separately, market-guide commentary continues to put MFSA licensing timelines at Roughly 3-9 months depending on file completeness for new EMI/PI applications; this figure derives from a single low-tier legal-services source rather than regulator-published guidance and should be read as indicative rather than confirmed. No MT-specific stablecoin, scheme-compliance, corridor, merchant-acquiring, consumer-protection, AML/CFT, correspondent-banking, or commercial-intelligence development surfaced in this cycle's research pass, and the coverage-gap register flags that no Tier-1 MFSA or EU Official Journal primary citation has yet been retrieved for the capital-requirement and PSD3 findings above, which currently rest on Tier 3/4 market-commentary sources rather than regulator-published text. #### Cross-Monitor Connections No cross-monitor signal was flagged for Malta this cycle, and the research pass returned no findings for the AML/CFT and commercial-intelligence modules that most commonly generate cross-monitor linkages, leaving both as open watch items rather than active signals this cycle. The one connective thread worth noting is structural rather than event-driven: the PSD3/PSR unification track is a supranational reform that will eventually reshape the EU-wide EMI/PI population Malta sits within, and its progress over the next several cycles is the variable most likely to generate a genuine cross-jurisdiction signal for other EU-domiciled EMI/PI hubs tracked elsewhere in this monitor. #### Outlook Looking ahead, the operative horizon marker is regulatory rather than domestic. PSD3 and the Payment Services Regulation merge the current PI and EMI regimes into a unified payment-institution authorisation and repeal EMD2, with roughly 24-month grandfathering expected for existing MFSA-licensed institutions; the reform is tracked against an expected date of 2027-Q4 with a half_year uncertainty band. Malta's EMI/PI capital-requirement and safeguarding regime remains stable and EU-harmonised; the material forward development for MT-licensed institutions is the PSD3/PSR unification timeline rather than any domestic MT-specific change this cycle, and the near-term monitoring priority for Malta is tracking formal adoption milestones and any MFSA transposition guidance as the grandfathering clock starts running. Malta's jurisdiction-level trajectory remains assessed as stable across the primary domains this cycle covers — licensing, conduct/safeguarding, and operational resilience — with no change in regulatory direction expected before the PSD3/PSR transposition process advances further. Absent a primary MFSA or EU Official Journal citation, confidence in the capital-requirement and reform-timeline findings remains Assessed rather than Confirmed, and closing that sourcing gap is the standing research priority for the next cycle. Read full brief · 1347 words ###### Latest update · 25 October 2026 #### Regulatory Status Malta's payments regulatory position rests on three confirmed and clarified points. First, the Financial Institutions Rulebook's FIR/03 (version 6.00) confirms a 60-calendar-day prior notification requirement to the MFSA for outsourcing of critical or important operational functions under rule R3-2.8.12, with a corrected understanding that the adjacent rule R3-2.8.13 grants the MFSA only notification and information-access powers over outsourcing arrangements, not a power to compel exit. Second, the MFSA cancelled the licence of MTACC Ltd on 26 February 2025, in part for safeguarding breaches under Article 10B(1) of the Financial Institutions Act, within a population of 64 licensed financial institutions including 31 e-money issuers. Third, the MFSA's 19 October 2026 circular on prediction markets and event contracts carries payments-adjacent implications for settlement and client-money treatment of such products, contingent on the underlying MiFID II / MiCA / gambling-law classification question. #### Outlook The corrected outsourcing-power finding should inform institutional risk assessments of Malta's operational-resilience regime going forward. The payments treatment of prediction-market and event-contract products remains provisional pending classification determinations for specific products, and the safeguarding enforcement action against MTACC Ltd should be monitored for whether it represents an isolated case or the start of a pattern. 3 earlier updates not shown here. ###### Standing brief · as of 6 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Regulatory Status Malta's payments regulatory position this cycle is defined by two elements: a stable, EU-harmonised standing regime for e-money and payment-institution licensing and safeguarding, and a supranational reform track that will reshape that regime's structure over the coming two years. On the standing side, Malta regulates EMIs and PIs under the Financial Institutions Act and FIR rules, supervised by the MFSA, with the licensing regime built around EMI initial capital EUR350,000; PI initial capital EUR125,000 and EEA passporting rights. FIR/03 requires that EMIs must safeguard client e-money funds directly with EU credit institutions (no intermediaries permitted), reinforced by mandatory reconciliations plus annual safeguarding audit. Malta-licensed EMIs and PIs have separately operated under a resilience regime in which DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, adding an ICT operational-resilience compliance layer to the existing conduct regime. On the reform side, Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the PSD3/Payment Services Regulation package sets Malta's licensing regime on a consolidation path: the reform merges PI/EMI into a unified authorisation, repeals EMD2, expected operational late 2027, with ~24-month grandfathering expected for MT-licensed institutions. This is the single most consequential forward-looking development for Malta's payments sector identified this cycle, and it applies to Malta by virtue of Malta's EU membership rather than through any domestic Maltese legislative action. No material development surfaced this cycle across Malta's stablecoin/digital-money, scheme-and-network-compliance, payment-corridor, industry-structure, litigation, merchant-acquiring, product-innovation, consumer-protection, AML/CFT, correspondent-banking, or commercial-intelligence modules; Malta's risk position across those modules is carried as stable by absence of new signal rather than by an affirmative stability finding. #### Outlook Malta's jurisdiction-level trajectory is assessed as stable, with the PSD3/PSR unification timeline as the defining medium-term variable: MFSA-licensed institutions have a multi-year window, running through the reform's expected 2027-Q4 in-force date and an anticipated roughly two-year grandfathering period, to prepare for reauthorisation under the unified PI/EMI regime. The standing research priority for Malta is closing the Tier-1 sourcing gap — no MFSA or EU Official Journal primary citation has yet been retrieved to confirm the capital-requirement, safeguarding, or reform-timeline findings carried in this cycle's baseline — and monitoring for any Malta-specific instant-payments, merchant-acquiring, AML/CFT, correspondent-banking, or commercial-intelligence development in subsequent cycles, none of which surfaced this cycle. Read full brief · 607 words × 14 of 14 modules Signal Moved Judgment Gap Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### W1aLicensing, Authorisation & Market AccessConfirmedconfirmed 2026-06-27▾# Malta regulates EMIs and Payment Institutions under the Financial Institutions Act and implementing FIR rules, supervised by the MFSA, within the EU PSD2/EMD2 harmonised regime enabling EEA passporting. PSD3/PSR reached provisional political agreement 27 November 2025, expected in force late 2027 with ~24-month grandfathering for existing MFSA-licensed institutions. Horizon · 2027-Q4 (± a year) PSD3/PSR PI-EMI licence category merger Proposed · Tier 3 source Standing sub-brief · as of 6 August 2026 517 words · last cycle 2026-10-18 #### Licensing, Authorisation & Market Access Malta's payment-institution and e-money licensing architecture remains anchored in the Financial Institutions Act and its implementing FIR rules, administered by the Malta Financial Services Authority (MFSA) within the EU's harmonised PSD2/EMD2 framework. The regime's defining feature for market entrants is its capital-requirement structure: EMI initial capital EUR350,000; PI initial capital EUR125,000, a differential that continues to shape which licence class prospective entrants pursue depending on the scale and type of payment activity they intend to conduct. Firms holding either authorisation gain access to EEA-wide passporting, allowing a single Maltese licence to underpin cross-border payment-service or e-money issuance activity across the bloc — a structural advantage that has made Malta a recurring jurisdiction of choice for non-bank payment and e-money firms seeking a single EU entry point. This standing architecture is now moving toward consolidation. Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the PSD3/Payment Services Regulation package confirmed that the current, separately authorised PI and EMI tracks are being folded into a single unified payment-institution authorisation, with the reform package expected operational late 2027. Under the agreed approach, the reform merges PI/EMI into a unified authorisation, repeals EMD2, and — of direct relevance to Malta's existing licensee population — current planning anticipates ~24-month grandfathering expected for MT-licensed institutions. That grandfathering period is the critical operational variable for MFSA-licensed EMIs and PIs: it sets the outer boundary by which existing licences must be reauthorised or restructured under the unified regime, rather than requiring an immediate transition. Alongside the reform trajectory, market-guide sources continue to describe MFSA processing timelines in indicative terms only. One low-tier source puts new-application processing at Roughly 3-9 months depending on file completeness, a range that is plausible on its face but has not been corroborated against MFSA-published guidance and should be treated as a market estimate rather than a regulator-confirmed benchmark. The findings above pertain specifically to Malta's non-bank payment-institution and e-money-institution population; the PSD3/PSR consolidation applies to both bank and non-bank payment-services licensees at EU level, but its Malta-specific operational consequence — the roughly two-year grandfathering clock — is most acute for the non-bank PI/EMI licensees this module tracks. The overarching gap this cycle is sourcing quality rather than substantive volatility: every W1a finding above rests on Tier 3 or Tier 4 market-commentary sources, and no Tier-1 MFSA rulebook or EU Official Journal citation has yet been retrieved to anchor the capital-requirement or PSD3-timeline claims directly against primary text. #### Outlook The near-term trajectory for W1a is one of managed continuity rather than domestic change: Malta's EMI/PI regime is expected to hold its current shape through the PSD3/PSR transposition window, with the reform's expected in-force date of 2027-Q4 carrying a half_year uncertainty band around it. The practical monitoring task for the coming cycles is tracking formal EU adoption of the PSD3/PSR package, any MFSA consultation or transposition guidance signalling how the roughly two-year grandfathering period will be operationalised for Malta's existing licensee base, and closing the Tier-1 sourcing gap so that the capital-requirement and reform-timeline findings can be upgraded from Assessed to Confirmed status. Read full sub-brief · 517 words Periodic update · new data 2026-10-18 #### Licensing, Authorisation & Market Access Malta's electronic-money institution prudential rule has been confirmed revised this cycle. The Malta Financial Services Authority's own index of its Financial Institutions Rulebook now lists the 2011 and 2019 versions of Chapter 3, FIR/03, under superseded rulebooks, which confirms that a current, revised FIR/03 is the operative prudential rule for EMIs licensed in Malta. The current text of the revised FIR/03 was not independently re-fetched this cycle, so the specific content of what changed between the superseded 2019 text and the current revision has not been independently verified beyond the fact of supersession itself. What is confirmed to carry through unchanged in substance is the headline capital requirement: a minimum initial capital of EUR 350,000 for an EMI, with ongoing own funds required at the greater of EUR 350,000 or 2% of average outstanding e-money under Method D. This threshold derives from the superseded 2019 FIR/03 text and has not been shown to have moved under the current revision. Malta's EMI licensing route continues to see new authorisation grants: Fast Shift Limited, part of the Badalyan Brothers Group, was granted MFSA EMI authorisation, opening an EEA-passporting gateway from its Malta base. This is a market-access event for a nonbank payment institution specifically, illustrating that Malta's EMI authorisation route remains an active entry pathway into the EEA payments market for new entrants. #### Outlook The item to watch is whether the current revised FIR/03 text, once independently reviewed, reveals any substantive prudential change beyond the capital-requirement continuity already confirmed, and whether further EMI authorisation grants follow the Fast Shift pattern in coming cycles. 3 earlier distinct update(s) Periodic update · new data 2026-10-06 #### Licensing, Authorisation & Market Access Malta's licensing and authorisation framework for payment institutions and electronic money institutions tightened this cycle through provisions in the MFSA's Financial Institutions Rulebook Chapter 3 (FIR/03), version 6.00 of November 2025, that extend supervisory control over structural and operational changes at licence holders. The Rulebook requires a licence holder implementing a material change to its business or organisational structure to obtain the MFSA's written consent in advance, submitting a transition plan for any proposed board change and an updated business plan, and to do so at least one month before the change is intended to take effect, regardless of whether the change itself would separately require authorisation. This places a standing notify-and-wait obligation on licence holders contemplating structural change, rather than a case-by-case discretionary filing. The same Rulebook also extends MFSA oversight into outsourcing and distribution arrangements. Where a licence holder intends to outsource a critical or important operational function relating to the provision of payment services or electronic money services, it is required to submit an FI Outsourcing Notification Form to the MFSA, and separately, the Rulebook's provisions on agent and distributor appointment require MFSA consent before a licence holder decides to use an agent or distributor. Both requirements function as gateway controls on how a Maltese-licensed payment or e-money business can structure its operational footprint and distribution network, reinforcing the MFSA's visibility into material changes before they take effect rather than relying solely on retrospective supervisory review. Taken together, these provisions describe a licensing regime in which authorisation is not a one-time event but a continuing relationship requiring advance notice and, in the case of material structural change, affirmative written consent. The 60-calendar-day advance notice period applicable to outsourcing and safeguarding-arrangement changes, and the one-month advance consent requirement for material business or organisational change, both function as structural brakes on the pace at which a Maltese licence holder can reorganise without first clearing the change with its supervisor. #### Outlook Firms holding or seeking a Maltese payment institution or electronic money institution licence should build the one-month advance consent requirement for material structural change, and the 60-calendar-day advance notice requirement for outsourcing and distributor changes, into their change-management planning as binding lead times rather than best-practice guidelines. Any board transition or significant change to business model should be planned with the MFSA consent process as a gating step, supported by the required transition plan and updated business plan, rather than treated as a notification formality to be completed after the fact. Open findings on Financial Institutions Act (Cap. 376) article 8C(2) outsourcing-liability provisions and the precise approval mechanics for distributor appointment under article 8A were not supported by a verbatim quote this cycle and remain pending further verification rather than confirmed findings. Periodic update · new data 2026-10-04 #### Licensing, Authorisation & Market Access Gate Technology Ltd obtained a Payment Institution licence under PSD2 from the Malta Financial Services Authority, enabling EU-passported payment execution services, credit transfers and direct debits. This licence complements a MiCA CASP permit the entity had already obtained in October 2025, meaning Gate Technology now holds both a PSD2-based payment authorisation and a crypto-asset-service authorisation from the same Maltese regulator. The development was reported via a press-release wire rather than confirmed against the Authority's own public register this cycle, and the finding is accordingly held at probable rather than confirmed confidence pending that corroboration. The practical significance of this licensing combination lies in what it signals about Malta's positioning in the payments-crypto intersection: entities are able to assemble a PSD2 payment-execution capability and a MiCA crypto-asset-service capability under a single Maltese regulatory relationship, rather than needing to establish separate licensed entities in different jurisdictions for each function. This is consistent with Malta's established dual positioning as both a payments licensing centre and a crypto-asset licensing centre within the EU's single market, allowing a passported payment capability to sit alongside a passported crypto-asset-service capability from one base. #### Outlook No Tier-1 Malta Financial Services Authority register source was reached this cycle to independently confirm Gate Technology's PI licence grant or its current capital position; confirming the licence against the Authority's own public register, and establishing the current capital requirements applicable to Malta PI/EMI licensees generally, would sharpen the market-access picture for this corridor in a future cycle. Periodic update · new data 2026-09-05 #### Licensing, Authorisation & Market Access The Malta Financial Services Authority is the single gatekeeper for payment institution and electronic money institution licensing, regulating both categories under the Financial Institutions Act (Chapter 376), which transposes PSD2. Minimum initial capital for an EMI is EUR 350,000, while PI capital requirements range from EUR 20,000 to EUR 125,000 depending on the licensed service class. This is a standing baseline position, assessed at probable confidence, reflecting the settled structure of Malta's non-bank payments licensing regime. The forward-looking development this cycle is the anticipated PSD3/Payment Services Regulation reform, which is expected to merge Malta's separate PI and EMI licence categories into a single unified status, described as a payment institution authorised to issue e-money, with an anticipated timeline around late 2027 and grandfathering protection for existing licensees. This is an assessed, Tier 3-sourced forward-looking finding requiring regulatory-horizon tracking rather than a confirmed rule change, but it is the most consequential structural item in Malta's licensing landscape this cycle, since it would collapse a distinction that has structured market entry since PSD2 transposition. A discrete, non-structural licensing event this cycle further illustrates the regime's dynamism: a MiCA-regulated Malta entity received an MFSA Limited Financial Institutions licence on 27 February 2026, authorising payment services exclusively in relation to electronic money tokens. This licence addresses the overlap between MiCA and PSD2 scopes directly, and is a high-confidence, Tier 2-sourced commercial development distinct from the structural licence-category question above; it should be read as a dated entry illustrating active MFSA management of the MiCA/PSD2 perimeter rather than as a standing-brief development in its own right. #### Outlook The PSD3/PSR merger timeline, anchored around late 2027, is the primary item to watch for Malta's PI/EMI licensing landscape; any firmer legislative timeline or draft text would materially sharpen this reading. A direct MFSA primary-source citation for the FIR/01 and FIR/03 rulebooks remains an open coverage gap from this cycle. Evidence 5 Sources and findings (5) - T1[https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/)retrieved 2026-06-27 - T1[https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/)retrieved 2026-06-27 - T3[https://www.tetraconsultants.com/jurisdictions/register-company-in-malta/malta-emi-license/](https://www.tetraconsultants.com/jurisdictions/register-company-in-malta/malta-emi-license/)retrieved 2026-06-27 - T3[https://www.mondaq.com/fin-tech/867616/fintech-guide-2019](https://www.mondaq.com/fin-tech/867616/fintech-guide-2019)retrieved 2026-06-27 - T3[https://gvzh.mt/services/practice-areas/banking-finance/credit-financial-institutions-banks/emi-malta-electronic-money-institutions/](https://gvzh.mt/services/practice-areas/banking-finance/credit-financial-institutions-banks/emi-malta-electronic-money-institutions/)retrieved 2026-06-27 ### W1bConduct, Safeguarding & PromotionsProbableconfirmed 2026-06-27▾# Malta EMIs must safeguard client e-money funds directly with EU credit institutions (FIR/03 bars intermediaries), with mandatory reconciliations and an annual safeguarding audit. DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025. Horizon · 2026-Q3 (± a quarter) PSD3 / Payment Services Regulation (PSR) Official Journal publication and entry into force Adopted, not yet in force · Tier 3 source Standing sub-brief · as of 6 August 2026 399 words · last cycle 2026-10-06 #### Conduct, Safeguarding & Financial Promotions Malta's conduct-of-business regime for e-money issuers centres this cycle on the FIR/03 safeguarding rules, which impose a direct, disintermediated model for protecting client funds. Under FIR/03, EMIs must safeguard client e-money funds directly with EU credit institutions, with the rule text explicit that no intermediary arrangement sits between the licensed e-money institution and the credit institution holding safeguarded funds. This directness requirement narrows the range of custody structures available to Malta-licensed EMIs relative to jurisdictions that permit layered or delegated safeguarding arrangements, and it places the onus for counterparty selection and ongoing monitoring of the safeguarding credit institution squarely on the licensed EMI itself. The safeguarding obligation is reinforced by ongoing verification requirements: the regime requires mandatory reconciliations plus annual safeguarding audit as standing conduct obligations, meaning Malta-licensed EMIs must demonstrate, on a recurring basis, that safeguarded-fund balances match outstanding e-money liabilities, with an independent annual audit providing an additional layer of assurance to the MFSA. Together, the direct-safeguarding mandate and the reconciliation/audit cycle form the operational backbone of Malta's e-money conduct regime, and both elements are treated this cycle as standing, unchanged features of the framework rather than new developments — the underlying source is a single Tier 4 market commentary rather than MFSA rule text, so the finding is carried at Low confidence pending stronger sourcing. No new financial-promotions or conduct-rule development specific to Malta surfaced this cycle beyond the safeguarding baseline described above; the bank-versus-non-bank distinction that structures much of the wider W1a/W1b analysis is particularly salient here, since the FIR/03 direct-safeguarding requirement applies specifically to the non-bank PI/EMI population rather than to bank-provided payment services, which safeguard client funds under separate prudential capital and deposit-protection arrangements rather than the FIR/03 mechanism. #### Outlook Malta's safeguarding regime is not currently flagged for near-term domestic change, but it sits inside the same PSD3/PSR consolidation horizon tracked under W1a: as PI and EMI authorisations merge into a single regime ahead of the reform's 2027-Q4 expected in-force date, safeguarding obligations for the unified authorisation category will need to be reconciled with Malta's existing FIR/03 direct-safeguarding model, and any divergence between the current national approach and the harmonised PSR safeguarding standard is a watch item for the next several cycles. Strengthening the sourcing base for this module — moving beyond the current single Tier 4 citation to MFSA rulebook text — remains the standing research priority. Read full sub-brief · 399 words Periodic update · new data 2026-10-06 #### Conduct, Safeguarding & Financial Promotions Evidence 4 Sources and findings (4) - T3[https://www.mamotcv.com/insights/payments-insights-1/](https://www.mamotcv.com/insights/payments-insights-1/)retrieved 2026-06-27 - T3[https://www.mamotcv.com/insights/payments-insights-1/](https://www.mamotcv.com/insights/payments-insights-1/)retrieved 2026-06-27 - T3[https://www.lexology.com/library/detail.aspx?g=dc2b8924-1452-4d33-a93b-7e4cff411b05](https://www.lexology.com/library/detail.aspx?g=dc2b8924-1452-4d33-a93b-7e4cff411b05)retrieved 2026-06-27 - T1[https://www.mfsa.mt/our-work/financial-institutions/](https://www.mfsa.mt/our-work/financial-institutions/)retrieved 2026-06-27 ### W2Stablecoins & Digital Money1 judgment1 gapConfirmedconfirmed 2026-06-27▾# Malta's domestic cryptoasset framework is now exclusively MiCA (Cap. 647); the VFA Act (Cap. 590) was repealed 3 July 2026. Key judgment — Probable · impact ELEVATED Malta's EMI prudential framework (FIR/03) has been revised with substantively unchanged capital thresholds, while the MiCA transitional cliff-edge (1 July 2026) and VFA Act repeal (3 July 2026) have consolidated crypto-asset services onto the single CASP authorisation route, reinforcing Malta's EMI+CASP combined-licence commercial model. claims: wpm-2026-W42-001, wpm-2026-W42-002 Open gap — wpm-int-2 Stablecoin/digital-money delta for Malta not researched this cycle. Bank-vs-non-bank AML supervision gap in Malta not separately quantified this cycle. Horizon · 2027-Q1 (± a quarter) MFSA MiCA Rulebook register-of-information annual filing window In force · Tier 1 source Horizon · 2027-Q1 (± a year) EBA binding RTS on reserve-asset liquidity for significant EMTs (MiCA Art 45(7)(b)) not yet adopted Consultation · Tier 1 source Standing sub-brief · as of 27 June 2026 275 words · last cycle 2026-10-18 #### Stablecoins & Digital Money Malta has a live, in-force stablecoin and digital-money regime. The Markets in Crypto-Assets Act (Cap. 647) implements MiCA (Regulation (EU) 2023/1114) in Malta, with transposition facilitated through Act XIV of 2024 integrating Titles III and IV on asset-referenced tokens and e-money tokens, and the MFSA amending Chapter 3 of the VFA Rulebook. Title III/IV became effective on 30 June 2024 and the full CASP regime applied from 30 December 2024. This implementation makes Malta a live EU stablecoin and CASP authorisation venue, attracting EMT issuers and crypto-asset service providers. The regime is operative rather than theoretical. The MFSA supervises Maltese stablecoin issuer StablR (EURR) as an EMT issuer under MiCA. EMT issuance is restricted to licensed EMIs or credit institutions, and MiCA Article 36 requires EMT issuers to hold at least 30% of reserves in credit-institution deposits (60% for significant EMTs), with redemption at par on demand. StablR demonstrates that Malta hosts operative MiCA-compliant EMT issuance, a competitive differentiator versus slower-implementing Member States. The link between this module and the licensing framework is direct: because EMT issuance requires an EMI or credit-institution licence, the non-bank EMI cohort authorised under Cap. 376 is the natural pool of EMT issuers, while reserve-composition rules tie issuers back into the bank-deposit system. #### Outlook The stablecoin module trajectory is escalating, driven by continued CASP authorisation activity. The February 2026 BVNK CASP licence (tracked in W13 as a commercial event) and the live StablR EURR issuance evidence a maturing venue. Going forward, the intersection with the pending PSD3/PSR EMI-into-PI collapse warrants watching, since EMT issuance is anchored to the EMI/credit-institution licensing categories that the package will restructure. Read full sub-brief · 275 words Periodic update · new data 2026-10-18 #### Stablecoins & Digital Money Two dated structural events closed out Malta's transition to the MiCA crypto-asset regime this cycle. First, the EU-wide MiCA transitional period for pre-existing crypto firms expired on 1 July 2026: ESMA's own statement confirms that any entity still serving EU clients without a MiCA licence after that date is in breach and must wind down its activities. Second, Malta's Virtual Financial Assets Act, Chapter 590, was formally repealed with effect from 3 July 2026 under Act XXXVI of 2024, two days after the EU-wide cliff-edge, leaving MiCA and Chapter 647 as the sole legal basis for crypto-asset services in Malta. Together these two dated events mark the completion of Malta's move from a dual VFA/MiCA transitional posture to a single MiCA-only regime. This consolidation is already shaping commercial structuring in Malta: BVNK secured an MFSA CASP licence under MiCA in addition to its existing Malta EMI authorisation, which by its own account will allow it to offer digital-asset services across all EEA member states from its Malta base where it is already authorised as an e-money institution. This combined EMI-plus-CASP structure is a direct commercial consequence of Malta's now-settled single-track crypto licensing regime. Separately, a still-open item on the EU stablecoin rulebook is the binding regulatory technical standard under MiCA Article 45(7)(b), which will set final reserve-asset liquidity composition requirements for significant e-money tokens. As of the European Banking Authority's consultation response dated 24 September 2026, this RTS has not been adopted, and the EBA's own response references but does not propose changing the existing 30% and 60% deposit-floor figures. #### Outlook The binding RTS on reserve-asset liquidity for significant EMTs under MiCA Article 45(7)(b) remains in consultation as of September 2026 and is not expected to be adopted before 2027; its eventual terms will be the next material development for any significant e-money token issuer operating from Malta. 1 earlier distinct update(s) Periodic update · new data 2026-10-12 #### Stablecoins & Digital Money Malta's digital-asset regulatory perimeter completed a significant structural simplification this cycle. The Virtual Financial Assets Act, Malta's domestic crypto-licensing framework that had operated alongside MiCA during the transitional period, was repealed on 3 July 2026 following the end of the maximum eighteen-month MiCA grandfathering period available to Member States. This leaves MiCA, and its domestic implementing legislation, as the sole framework governing crypto-asset service providers operating from Malta, removing what had been a dual-track licensing landscape. Separately, the MFSA's MiCA Rulebook sets a binding outsourcing-notification obligation for CASPs: a MiCA Outsourcing Notification Form must be filed via the LH Portal at least sixty calendar days before a critical or important outsourcing arrangement is entered into. This is explicitly a notification requirement rather than a prior-approval gate, meaning a CASP does not need to wait for MFSA sign-off before proceeding with the arrangement, but must give the regulator sixty days' advance visibility into it. This distinction matters operationally: a CASP planning a critical outsourcing arrangement, such as moving custody infrastructure or core transaction-processing functions to a third-party provider, needs to build the sixty-day notice period into its project planning, but does not face a licensing-style approval bottleneck on the arrangement itself. Taken together, the VFA repeal and the outsourcing-notification requirement describe a digital-asset regulatory environment in Malta that is now fully harmonised with the EU-wide MiCA framework, with Malta-specific procedural detail, such as the LH Portal filing mechanism, sitting on top of that harmonised base rather than constituting a separate substantive regime. #### Outlook The next formal compliance checkpoint under this framework is the MFSA's annual register-of-information filing window for outsourcing arrangements, which opens between 1 January and 21 March 2027 and applies to all in-scope entities including microenterprises. CASPs operating from Malta should treat that filing window as a recurring annual obligation layered on top of the ad hoc sixty-day notification requirement for any new critical or important outsourcing arrangement entered into during the year. Evidence 4 Sources and findings (4) - T1[https://www.mfsa.mt/our-work/crypto-assets/](https://www.mfsa.mt/our-work/crypto-assets/)retrieved 2026-06-27 - T3[https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/malta](https://cms.law/en/int/expert-guides/cms-expert-guide-to-crypto-regulation/malta)retrieved 2026-06-27 - T3[https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers](https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers)retrieved 2026-06-27 - T3[https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757](https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757)retrieved 2026-06-27 ### W3Operational Resilience & Critical Infrastructure1 gapConfirmedconfirmed 2026-06-27▾# Malta requires at least 60 calendar days' prior notice for outsourcing of critical or important operational functions under MFSA FIR/03 v6.00, R3-2.8.12. A prior claim that R3-2.8.13 grants the MFSA a power to compel exit from an outsourcing arrangement is not supported by the rule's text, which covers only change-notification and information-access duties. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/malta/) Open gap — wpm-int-1 DORA common minimum contractual terms (WPM-SUP-03:K1) not independently re-verified this cycle. Private-company / live-register signal under-indexed; recommend direct MFSA Financial Services Register pull on next cycle. Horizon · 2027-Q1 (± a quarter) DORA Register of Information annual submission window (Malta) In force · Tier 3 source Horizon · 2027-Q1 (± a quarter) DORA Register of Information annual submission window (Malta) In force · Tier 3 source Standing sub-brief · as of 6 August 2026 252 words · last cycle 2026-10-25 #### Operational Resilience & Critical Infrastructure Malta's payment and e-money licensees now operate under a second, EU-wide resilience layer alongside their MFSA conduct obligations. DORA has applied to Malta-licensed EMIs/PIs since 17 January 2025, meaning the Digital Operational Resilience Act's ICT risk-management framework has been in force for MT payment firms for well over a year at this point. The Act's substantive effect on Malta-licensed EMIs and PIs is that it is layering ICT incident-reporting and third-party risk-testing obligations atop the MFSA conduct regime, adding a distinct compliance track — covering incident classification and reporting timelines, resilience testing, and oversight of critical ICT third-party providers — that sits alongside, rather than replacing, the FIR-based conduct and safeguarding rules tracked under W1b. This cycle surfaced no new Malta-specific DORA development: the finding is a standing-applicability baseline rather than a fresh regulatory action, and it was identified this cycle as a cross-reference from a W1b-sourced document rather than from a dedicated resilience-focused source. That sourcing path is itself informative — it suggests Malta-specific DORA commentary remains thin relative to the conduct and licensing literature, and dedicated resilience-focused sourcing is a module priority going forward. #### Outlook No Malta-specific resilience development is expected imminently beyond continued DORA supervisory embedding; the module's standing position is that DORA obligations are now a fixed feature of the operating environment for MT-licensed payment firms, with the near-term research task being direct sourcing of any MFSA-specific DORA guidance, incident-reporting statistics, or third-party-risk oversight actions that would move this module beyond baseline-applicability status. Read full sub-brief · 252 words Periodic update · new data 2026-10-25 #### Operational Resilience & Critical Infrastructure Malta's Financial Institutions Rulebook, specifically Chapter 3 of FIR/03 at version 6.00, confirms that a licence holder must give the MFSA at least 60 calendar days' prior notice before outsourcing a critical or important operational function, under rule R3-2.8.12. The research also corrected a prior understanding of the adjacent rule, R3-2.8.13: verified against the rulebook text, this provision does not grant the MFSA a power to direct a licence holder to exit an outsourcing arrangement. It instead requires the licence holder to notify the MFSA of any change to previously-submitted outsourcing information and to make such information available to the MFSA on request. This distinction matters for how an institution and its advisers assess the MFSA's practical leverage over outsourcing arrangements: the confirmed regime is one of advance notification and ongoing information access, not one of direct intervention power over an existing vendor relationship. The common minimum contractual terms expected under this framework were not independently re-verified against primary text, and that remains an open item for a future cycle rather than a confirmed gap in the rule itself. #### Outlook With the 60-day notification requirement and the scope of the MFSA's information-access power now confirmed directly against the rulebook text, the operational-resilience position for Malta-licensed payment institutions and e-money institutions is on firmer footing than before the verification work. What remains open is independent confirmation of the common minimum contractual terms the regime is understood to require, which should be checked against primary text in a future cycle. 1 earlier distinct update(s) Periodic update · new data 2026-09-05 #### Operational Resilience & Critical Infrastructure The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied in Malta since 17 January 2025. The Malta Financial Services Authority now expects DORA-aligned ICT risk management, incident reporting, threat-led penetration testing, and a third-party ICT register to be evidenced from day one of any new payment institution or electronic money institution authorisation file, rather than treated as a post-authorisation build-out item. This is a probable, Tier 3-sourced baseline finding describing standing MFSA supervisory practice for Malta's non-bank payments sector. The expectation is not confined to the authorisation stage: existing MFSA-supervised EMIs and PIs must continue to evidence DORA-aligned ICT incident handling and vendor-risk oversight as part of ongoing supervision. This distinguishes an initial-authorisation requirement from a continuing supervisory obligation, and it means operational-resilience compliance is now embedded as a standing cost of doing business in Malta's payments sector rather than a one-time hurdle cleared at licensing and then set aside. Both the day-one and the ongoing dimensions of this expectation are assessed-to-probable confidence findings sourced from secondary regulatory-advisory commentary rather than a directly retrieved MFSA supervisory handbook citation this cycle. #### Outlook Watch for any MFSA-published supervisory guidance or thematic review specifically addressing DORA compliance in the payments sector, which would upgrade this cycle's secondary-sourced findings to primary-source confidence. The day-one and ongoing DORA expectations described here should be read together as a single operational-resilience posture rather than as two separate requirements. Evidence 4 Sources and findings (4) - T1[https://www.mfsa.mt/news-item/mfsa-outlines-minimum-expectations-on-digital-operational-resilience-preparedness-for-financial-entities/](https://www.mfsa.mt/news-item/mfsa-outlines-minimum-expectations-on-digital-operational-resilience-preparedness-for-financial-entities/)retrieved 2026-06-27 - T1[https://www.mfsa.mt/our-work/supervisory-ict-risk-and-cybersecurity/](https://www.mfsa.mt/our-work/supervisory-ict-risk-and-cybersecurity/)retrieved 2026-06-27 - T1[https://www.mfsa.mt/wp-content/uploads/2025/03/Regulation-EU-20222554-on-Digital-Operational-Resilience-for-the-Financial-Sector-%E2%80%93-Register-of-Information-Submission-Guidance.pdf](https://www.mfsa.mt/wp-content/uploads/2025/03/Regulation-EU-20222554-on-Digital-Operational-Resilience-for-the-Financial-Sector-%E2%80%93-Register-of-Information-Submission-Guidance.pdf)retrieved 2026-06-27 - T3[https://shoulder.mt/mfsa-circular-on-dora-register-of-information-reporting-timelines-for-2026-and-beyond/](https://shoulder.mt/mfsa-circular-on-dora-register-of-information-reporting-timelines-for-2026-and-beyond/)retrieved 2026-06-27 ### W4Scheme & Network ComplianceConfirmedconfirmed 2026-06-27▾# Card-scheme compliance in Malta operates within the EU Interchange Fee Regulation (Regulation (EU) 2015/751), with the Central Bank of Malta as the national authority for IFR. Interchange is capped at 0.2% (debit) and 0.3% (credit) on consumer cards; Visa/Mastercard scheme rulebooks, PCI DSS, and surcharging restrictions (no surcharging on regulated-IFR cards) apply. PSD2 SCA requirements bind issuers/acquirers. Standing sub-brief · as of 27 June 2026 196 words · last cycle 2026-06-27 #### Scheme & Network Compliance The Central Bank of Malta acts as national authority for the Interchange Fee Regulation (EU) 2015/751. The IFR enforces interchange caps of 0.2% of transaction value on consumer debit cards and 0.3% on consumer credit cards, with Member-State discretion to set lower domestic caps. Beyond the caps, the IFR prohibits territorial licensing restrictions, mandates per-category merchant-service-charge disclosure and constrains the Honour-All-Cards rule. The scheme operators directly affected are Visa and Mastercard. This module sits at the interface between the card schemes and the acquiring market. The caps and the unblending obligations are stable and in force, and the analytical weight of W4 is on how scheme rules layer over the EU regulatory floor. Because the IFR is a directly-applicable EU regulation with the CBM as national authority, the framework applies uniformly to bank and non-bank acquirers operating in Malta. #### Outlook The scheme and network compliance module is stable. The interchange caps and unblending obligations are settled features of the operating environment, and no near-term legislative change is signalled for this cycle. Monitoring focus remains on scheme-rule schedule changes flowing through acquirers to merchants, which connect this module to merchant acquiring in W8. Read full sub-brief · 196 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.centralbankmalta.org/ifr](https://www.centralbankmalta.org/ifr)retrieved 2026-06-27 - T1[https://eur-lex.europa.eu/EN/legal-content/summary/fees-for-card-based-payments.html](https://eur-lex.europa.eu/EN/legal-content/summary/fees-for-card-based-payments.html) Applies beyond this jurisdiction (EU)retrieved 2026-06-27 - T1[https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) Applies beyond this jurisdiction (EU)retrieved 2026-06-27 - T2[https://www.mastercard.com/europe/en/regulatory/european-interchange.html](https://www.mastercard.com/europe/en/regulatory/european-interchange.html)retrieved 2026-06-27 ### W5Payment Corridor DynamicsConfirmedconfirmed 2026-06-27▾# As a Eurozone member, Malta's principal corridors run through SEPA (SCT, SCT Inst, SDD), settling via TARGET (T2) and TIPS, with SWIFT for non-euro/cross-border. The EU Instant Payments Regulation (in force 9 January 2025) mandates universal instant euro transfers; Maltese banks (e.g., IIG Bank, APS, MeDirect) have rolled out SEPA Instant. Central Bank of Malta is the lead authority for SEPA implementation. Standing sub-brief · as of 27 June 2026 217 words · last cycle 2026-06-27 #### Payment Corridor Dynamics Malta's euro corridors run on real-time rails. SEPA Instant Credit Transfer (SCT Inst) and TARGET Instant Payment Settlement (TIPS) settle euro transfers in under 10 seconds, while SWIFT handles non-euro and cross-border flows over 1-5 business days. The Central Bank of Malta is the lead authority for SEPA implementation. This dual structure defines the corridor map: a deepening real-time euro corridor domestically and into the SEPA zone, alongside slower correspondent-based rails for non-euro flows. The escalating driver is the EU Instant Payments Regulation, in force from 9 January 2025, which mandated universal instant euro transfers and drove Maltese banks including IIG Bank, APS and MeDirect to introduce SEPA incoming instant payments for domestic and cross-border euro transfers. The IPR rollout is observable at the bank level, evidencing the corridor opening in practice rather than merely in regulation. The non-euro corridor picture connects directly to the correspondent-banking constraints analysed in W12, where USD access remains the structural weak point. #### Outlook The payment-corridor module trajectory is escalating as the Instant Payments Regulation continues to deepen real-time euro connectivity. The MT-EU-SEPA corridor is opening, with SCT Inst/TIPS rollout broadening across Maltese banks. The MT-US-USD corridor remains uncertain and is tracked under correspondent banking in W12, where the legacy of constrained USD access continues to shape access direction. Read full sub-brief · 217 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T3[https://www.lightspark.com/knowledge/instant-payments-malta](https://www.lightspark.com/knowledge/instant-payments-malta)retrieved 2026-06-27 - T3[https://iigbank-malta.com/page/news-202501b](https://iigbank-malta.com/page/news-202501b)retrieved 2026-06-27 - T3[https://www.medirect.com.mt/pay/payments/](https://www.medirect.com.mt/pay/payments/)retrieved 2026-06-27 - T1[https://www.centralbankmalta.org/the-sepa](https://www.centralbankmalta.org/the-sepa)retrieved 2026-06-27 ### W6Industry Structure & Commerciallimited signalProbableconfirmed 2026-06-27▾# Malta is a disproportionately large EMI/PI domicile for its size, positioned as an EU alternative hub to Dublin/Luxembourg, with ~36 EMIs and ~30 PIs authorised by the MFSA (as of March 2025). Home-grown leaders include Papaya (EMI), SysPay and Truevo Payments (acquirer/PSP). The fintech sector accounted for ~8.2% of GVA and ~14,700 jobs in 2025. Banking is concentrated in BOV and HSBC Malta (latter sold to CrediaBank). Standing sub-brief · as of 27 June 2026 250 words · last cycle 2026-10-25 #### Industry Structure & Commercial Malta's payments market structure is defined by a disproportionately large non-bank institution population. As of March 2025, the MFSA had authorised 36 e-money institutions and 30 payment institutions, with 12 licences issued in 2024, ranking Malta alongside Germany on new authorisations. This snapshot is approximately 15 months old relative to the June 2026 run and may not reflect subsequent authorisations or withdrawals; confidence is held at Assessed pending verification against the MFSA live register. With that caveat, Malta's outsized EMI/PI population for its size positions it as an EU alternative hub to Dublin and Luxembourg. The domestic champion layer is led by home-grown firms: Papaya (an EMI offering IBAN accounts and Mastercard-linked services), SysPay (modular payment services, card processing and anti-fraud) and Truevo Payments (an acquirer and PSP). The sector's economic footprint is material — in 2025 the fintech industry accounted for 8.2% of real gross value added and employed over 14,700 people. This concentration of non-bank PI/EMI activity is the commercial spine of the Maltese payments market and the reason the pending PSD3/PSR EMI-into-PI collapse carries outsized local significance. #### Outlook The industry-structure module is stable but flagged for staleness. The March 2025 institution counts should be refreshed via a direct MFSA Financial Services Register pull on the next cycle to confirm whether the EMI/PI population has grown or contracted. The structural story — a large non-bank cohort against a small, concentrated banking sector being foreign-acquired (see W13) — is the analytical thread to carry forward. Read full sub-brief · 250 words Periodic update · new data 2026-10-25 #### Industry Structure & Commercial Dynamics The MFSA cancelled the licence of MTACC Ltd on 26 February 2025, with the cancellation attributed in part to breaches of safeguarding requirements under Article 10B(1) of the Financial Institutions Act. This sits within a licensed-institution population that currently comprises 64 licensed financial institutions in Malta, of which 31 are e-money issuers. The cancellation is a dated enforcement outcome rather than a change to the safeguarding rule itself, but it demonstrates that the MFSA treats safeguarding compliance as an actively supervised obligation rather than a dormant one, and it is a relevant data point for assessing exit risk and market concentration among Malta-licensed payment and e-money institutions. #### Outlook The MTACC Ltd cancellation should be read as one data point within a licensed population of 64 financial institutions rather than as evidence of a broader wave of safeguarding-driven exits; no further MT-specific licence action was identified. Future cycles should track whether safeguarding enforcement activity of this kind recurs, which would be a stronger signal of systemic weakness in safeguarding practice across Malta's e-money sector. Evidence 4 Sources and findings (4) - T3[https://advapay.eu/emoney-and-payment-institution-licensing/e-money-and-payment-institution-license-in-malta/](https://advapay.eu/emoney-and-payment-institution-licensing/e-money-and-payment-institution-license-in-malta/)retrieved 2026-06-27 - T3[https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/)retrieved 2026-06-27 - T3[https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta)retrieved 2026-06-27 - T3[https://www.legal500.com/guides/chapter/malta-fintech/?export-pdf=](https://www.legal500.com/guides/chapter/malta-fintech/?export-pdf=)retrieved 2026-06-27 ### W7Legal & LitigationProbableconfirmed 2026-06-27▾# Enforcement in the payments space is led by the MFSA (administrative penalties under the MFSA Act and FIA) and the FIAU (AML/CFT penalties). MFSA published financial-institution regulatory actions in 2025 (Ref 2025-12 €650; Ref 2025-13 €7,050). The FIAU fined a subsidiary of crypto group OKX €2.7m for AML failings — among the largest VASP actions in the jurisdiction. Arbiter decisions (e.g., SE v Trust Payments (Malta)) shape PSP liability allocation. Standing sub-brief · as of 27 June 2026 201 words · last cycle 2026-06-27 #### Legal & Litigation The Maltese enforcement and litigation record for payments is anchored in two strands. On administrative penalties, the MFSA imposed a EUR 7,050 penalty on a financial institution on 13 March 2025 under Article 16(8) of the MFSA Act (Ref 2025-13), with a companion action (Ref 2025-12) imposing EUR 650 the same day. These are dated episodes evidencing active MFSA enforcement against the non-bank PI/EMI cohort. On adjudicated PSP liability, the Office of the Arbiter for Financial Services decided Case ASF 095/2021 (SE v Trust Payments (Malta) Limited), an internet-fraud reimbursement claim in which the PSP disputed eligibility on the basis of the absence of a direct customer relationship. The OAFS is the ADR/ombudsman route under Chapter 555 (Act XVI of 2016) for natural persons and micro-enterprises. The decision shapes how PSP liability is allocated in fraud-reimbursement disputes and connects to the broader consumer-protection allocation model analysed in W10. #### Outlook The legal and litigation module is stable, built on MFSA primary publication anchors and an OAFS decision. The forward watch is whether the OAFS continues to develop its PSP-liability jurisprudence and whether MFSA administrative-penalty activity against payment and e-money institutions accelerates. Both strands feed the consumer-protection picture in W10. Read full sub-brief · 201 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-13/](https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-13/)retrieved 2026-06-27 - T1[https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-12/](https://www.mfsa.mt/publication/regulatory-action-against-financial-institution-ref-2025-12/)retrieved 2026-06-27 - T3[https://www.vixio.com/insights/pc-malta-unveils-intensified-amlctf-plan-year-ahead](https://www.vixio.com/insights/pc-malta-unveils-intensified-amlctf-plan-year-ahead)retrieved 2026-06-27 - T1[https://financialarbiter.org.mt/sites/default/files/oafs/decisions/303/ASF%20095-2021%20-%20SE%20vs%20Trust%20Payments%20(Malta)%20Limited.pdf](https://financialarbiter.org.mt/sites/default/files/oafs/decisions/303/ASF%20095-2021%20-%20SE%20vs%20Trust%20Payments%20(Malta)%20Limited.pdf)retrieved 2026-06-27 ### W8Merchant Acquiring & RiskProbableconfirmed 2026-06-27▾# Merchant acquiring in Malta is conducted by FIA-licensed financial institutions and global PSPs, within the EU IFR framework (merchant service charge transparency, unblending on request) and card-scheme rulebooks (chargeback windows, 3DS/SCA, dispute mechanics, PCI DSS). Domestic acquirers include Truevo Payments and historically Credorax/Finaro (now Shift4). Global PSPs (Stripe, Adyen, Worldpay) operate cross-border into Malta. Standing sub-brief · as of 27 June 2026 207 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk Merchant acquiring in Malta operates under the IFR transparency regime. Acquirers must offer individually-specified merchant service charges per card category and brand unless the payee requests blended charges in writing, and must include applicable MSC, interchange and scheme fees in agreements. Scheme rules govern chargeback windows, 3DS/SCA, surcharging and PCI DSS, with scheme fines flowing through acquirers to merchants via indemnification. The unblending obligation is the analytical core of this module, and it links acquiring directly to the scheme-compliance framework in W4. The market has seen structural restructuring at the acquirer level. Malta-based payment processor Credorax (later Finaro) was acquired by Shift4 Payments in 2023; in 2024 the company surrendered its credit-institution licence and shifted to a financial-institution licence. This is a dated episode treated as a short entry for structural context, illustrating the bank-to-non-bank licence migration that recurs across the Maltese acquiring landscape. #### Outlook The merchant-acquiring module is stable but rests partly on tertiary sources, with acquirer chargeback and high-risk-MCC operational data not directly evidenced this cycle. The forward watch is whether scheme-rule schedule changes materially shift acquirer cost structures, and whether further licence migrations occur among Maltese acquirers. Quantitative open-banking and acquiring-ops data is flagged as under-indexed for the next cycle. Read full sub-brief · 207 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T1[https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) Applies beyond this jurisdiction (EU)retrieved 2026-06-27 - T3[https://www.pxp.io/payments-glossary/card-scheme-rules](https://www.pxp.io/payments-glossary/card-scheme-rules)retrieved 2026-06-27 - T3[https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/)retrieved 2026-06-27 - T3[https://iclg.com/practice-areas/fintech-laws-and-regulations/malta/](https://iclg.com/practice-areas/fintech-laws-and-regulations/malta/)retrieved 2026-06-27 ### W9Product Innovation & Market Developmentlimited signalConfirmedconfirmed 2026-06-27▾# Innovation is anchored by the MFSA FinTech Strategy (2019), the FinTech Regulatory Sandbox (Rule 3 of the MFSA Act, launched 2020, revised v2), and a dedicated FinTech Supervision Function and Innovation Office. Open banking exists via PSD2 APIs but adoption remains nascent; PSD3/PSR and FiDA (expected ~2027) will deepen open finance. MFSA is a GFIN member and participates in the EU Supervisory Digital Finance Academy. Instant-payments rollout and EMT issuance are key product developments. Horizon · 2027-H2 (± a year) Financial Data Access (FiDA) open-finance framework Proposed · Tier 3 source Standing sub-brief · as of 27 June 2026 215 words · last cycle 2026-10-25 #### Product Innovation & Market Development The MFSA supports innovation through a FinTech Strategy with a FinTech Regulatory Sandbox under Rule 3 of the MFSA Act, launched in July 2020, offering a controlled testing environment under prescribed conditions. The MFSA operates a dedicated FinTech Supervision Function and holds GFIN membership, with open enrolment for regulated and unregulated providers and technology providers meeting four eligibility criteria. This positions Malta as an innovation-facilitative venue at the regulatory level. On open banking, the framework rests on PSD2 APIs but adoption lags despite a digitally-savvy population. The PSD3/PSR package and the Financial Data Access (FiDA) framework, expected by late 2027, promise mandated multi-product data sharing that would expand the data-access surface beyond current open banking. Malta recorded a 43% increase in EMI/payment-services authorisations between 2022 and 2024, indicating market-development momentum even as open-banking uptake remains an under-indexed signal. This thematic regulatory product-access view is distinct from the discrete commercial events tracked in W13. #### Outlook The product-innovation module trajectory is established at the regulatory-facilitation level but constrained by the open-banking adoption gap. The key forward item is FiDA, expected by late 2027, which would mandate multi-product data sharing and deepen open finance. Quantitative open-banking penetration data for Malta is flagged as under-indexed and recommended for direct sourcing on the next cycle. Read full sub-brief · 215 words Periodic update · new data 2026-10-25 #### Product Innovation & Market Development The Malta Financial Services Authority's 19 October 2026 circular on the classification of prediction markets and event contracts, while primarily addressing whether such a product is a MiFID II financial instrument, a Markets in Crypto-Assets Regulation crypto-asset, or a gambling product, carries implications beyond that classification question for how such products are settled and how client money attached to them is treated. A product found to be a financial instrument attracts a different settlement and client-money treatment than one found to be a crypto-asset, which in turn differs from a gambling product's money-handling treatment under national gambling law. For a Malta-based platform developing a prediction-market or event-contract product, this means the payments architecture, including how customer funds are held and how settlement is executed, cannot be finalised independently of the underlying classification determination, since the two questions are structurally linked rather than separable. #### Outlook The payments-architecture implications of the MFSA's classification circular will only become concrete once specific products receive a classification determination; the evidence establishes the connection between classification and payments treatment without resolving it for any named product. A future cycle should track whether the MFSA or another body issues more specific guidance on settlement and client-money treatment for this product category as classification decisions accumulate. 1 earlier distinct update(s) Periodic update · new data 2026-10-04 #### Product Innovation & Market Development Payhound is reported to combine a Malta Financial Services Authority financial-institution licence with a MiCA CASP authorisation, obtained from 24 November 2025, to operate a crypto-deposit cashiering route for iGaming operators. The product design reported is one in which the iGaming operator itself does not take custody of crypto assets; instead, the combined-licence entity handles the crypto-deposit function on the operator's behalf, allowing an iGaming business to accept crypto-denominated deposits without itself becoming a crypto-custody entity subject to the attendant licensing and custody obligations. This reporting originates from vendor commentary rather than a primary Authority source and has not been independently corroborated against the Authority's own licensing record this cycle; it is held at uncertain confidence and should be read as an emerging product pattern in the Malta market rather than a verified structural fact. If accurate, it represents a notable product-innovation use case for a combined PI/EMI-plus-CASP licensing footprint specifically tailored to the iGaming sector's crypto-payment needs, distinct from the general payments-licensing development seen in the Gate Technology case. #### Outlook Independent verification of the Payhound licensing combination against the Malta Financial Services Authority's own register would resolve the confidence gap in this finding. If confirmed, the product model described here would be relevant to any iGaming operator in Malta's gambling licensing ecosystem assessing crypto-deposit payment-rail options without taking on direct crypto-custody licensing exposure itself. Evidence 4 Sources and findings (4) - T1[https://www.mfsa.mt/our-work/fintech/](https://www.mfsa.mt/our-work/fintech/)retrieved 2026-06-27 - T1[https://www.mfsa.mt/fintech/regulatory-sandbox/](https://www.mfsa.mt/fintech/regulatory-sandbox/)retrieved 2026-06-27 - T3[https://noda.live/articles/open-banking-in-malta](https://noda.live/articles/open-banking-in-malta)retrieved 2026-06-27 - T3[https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/)retrieved 2026-06-27 ### W10Consumer Protection & APP FraudProbableconfirmed 2026-06-27▾# No EU-wide mandatory APP-reimbursement regime; OAFS (Cap. 555) ADR route and published PSP/PSU responsibility-allocation model govern scam reimbursement; MFSA launched anti-fraud public-private partnership 8 Apr 2026 (MFSA, Police, OAFS, FIAU, CBM). Standing sub-brief · as of 27 June 2026 238 words · last cycle 2026-06-27 #### Consumer Protection & APP Fraud Malta lacks a UK-style mandatory APP-reimbursement regime, and the de facto allocation framework is set by the Office of the Arbiter for Financial Services. The OAFS published a model allocating responsibility between PSPs and payment-service users in payment-fraud scam cases, setting criteria and weightings to determine the gross negligence required to deny full reimbursement under PSD2. This model defines PSP liability exposure for scam reimbursement in the absence of an EU-wide mandatory APP regime and connects directly to the adjudicated PSP-liability decisions tracked in W7. The live event for this module is the anti-fraud public-private partnership. On 8 April 2026 the MFSA launched a partnership to combat financial fraud, with permanent participants including the MFSA, Malta Police Force, OAFS, FIAU and Central Bank of Malta, prioritising consumer-facing retail payment fraud. The scale is significant: Malta recorded 10,024 fraud incidents over a six-month period with close to EUR 3.76m in losses, mostly from credit transfers — directly relevant given the instant-payments rollout analysed in W5. #### Outlook The consumer-protection module trajectory is escalating, driven by the new anti-fraud partnership and the rising salience of credit-transfer fraud as instant payments expand. The forward watch is how the OAFS allocation model is applied in subsequent scam-reimbursement decisions and whether the public-private partnership produces operational or regulatory output. The intersection between fraud loss concentration in credit transfers and the IPR-driven instant-payments rollout is the analytical thread to track. Read full sub-brief · 238 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T3[https://gtg.com.mt/financial-service-providers-and-the-arbiter-for-financial-services-a-dive-into-dispute-resolution/](https://gtg.com.mt/financial-service-providers-and-the-arbiter-for-financial-services-a-dive-into-dispute-resolution/)retrieved 2026-06-27 - T1[https://www.financialarbiter.org.mt/content/model-allocation-responsibility-between-payment-service-provider-psp-and-payment-services](https://www.financialarbiter.org.mt/content/model-allocation-responsibility-between-payment-service-provider-psp-and-payment-services)retrieved 2026-06-27 - T3[https://www.ccmalta.com/publications/eu-payment-services-law-and-scam-refunds-what-victims-need-to-know-in-2026](https://www.ccmalta.com/publications/eu-payment-services-law-and-scam-refunds-what-victims-need-to-know-in-2026)retrieved 2026-06-27 - T3[https://www.crowdfundinsider.com/2026/04/274113-malta-mfsa-advances-financial-sector-resilience-with-new-anti-fraud-alliance-and-insurance-oversight-review/](https://www.crowdfundinsider.com/2026/04/274113-malta-mfsa-advances-financial-sector-resilience-with-new-anti-fraud-alliance-and-insurance-oversight-review/)retrieved 2026-06-27 ### W11AML/CFT & Financial Crime (Sentinel.gi-fed)Sourced from Sentinel.gi ↗Probableconfirmed 2026-06-27▾# sentinel: Malta's AML/CFT posture is led by the FIAU under the PMLFTR (transposing EU AML directives), with MFSA financial-crime compliance supervision. Malta was the first EU state grey-listed by FATF (June 2022–June 2023) and has since strengthened the FIAU and enforcement. The FIAU AML/CFT Supervisory Plan 2025–2026 targets crypto beneficial ownership, money remittances and trade-based ML. Carried as Sentinel feed only — no original illicit-finance analysis. Standing sub-brief · as of 27 June 2026 233 words · last cycle 2026-06-27 #### AML/CFT & Financial Crime The intelligence for this module is sourced from the Sentinel feed and carried as provenance only; original illicit-finance analysis is routed to the Financial Intelligence Monitor (FIM) and is not a World Payments conclusion. Per the Sentinel feed, the FIAU's AML/CFT Supervisory Plan 2025-2026 focuses on crypto beneficial-ownership compliance, money remittances at financial institutions, and trade-based money laundering at credit institutions, with terrorist-financing risk examined across these areas. Also per the Sentinel feed, Malta was the first EU member state grey-listed by FATF, from June 2022 to June 2023. To exit, it strengthened the FIAU, tightened oversight and increased enforcement. As a MONEYVAL member, Malta has been re-rated on eight FATF Recommendations (8, 13, 20, 24, 26, 28, 36, 38) and remains in enhanced follow-up. This grey-list history is the backdrop to ongoing correspondent-banking de-risking pressure on Maltese institutions, which is the WPM-relevant cross-reference into W12. The full illicit-finance assessment and any sanctions-evasion or stablecoin-misuse analysis belong to FIM. See the Sentinel feed for the underlying intelligence. #### Outlook The AML/CFT module is carried as a Sentinel-fed provenance layer with a stable trajectory. The WPM-relevant forward signal is the continued de-risking overhang that the grey-list legacy sustains, which feeds correspondent-banking access in W12. Depth on the FIAU enforcement pipeline and post-grey-list MONEYVAL follow-up is routed to FIM; the bank-versus-non-bank AML supervision gap in Malta is not separately quantified this cycle. Read full sub-brief · 233 words no periodic updates on record for this sub-brief Evidence 7 Sources and findings (7) - T3[https://www.acams.org/en/news/legal-brief-malta-implements-aml-reforms-to-avoid-fatf-gray-list](https://www.acams.org/en/news/legal-brief-malta-implements-aml-reforms-to-avoid-fatf-gray-list)retrieved 2026-06-27 - T?FIM (sentinel.gi) per-JID baseline profile — Malta — Malta's AML/CFT regime rests on the Prevention of Money Laundering Act and PMLFTR regulations, supervised by FIAU (FIU) and MFSA (financial/VASP licensing). Malta was FATF/MONEYVAL grey-listed June 2021-June 2022; it retains a bespoke citizenship-by-investment programme (ruled unlawful by the CJEU in April 2025), an active crypto-licensing hub, and a large maritime flag registry exposed to sanctions-evasion shipping. - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: absent-field-provenance - T1FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: OFSI divergence - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: regulatory-failure - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: legal-gap - T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: political-constraint ### W12Correspondent Banking, Settlement & AccessProbableconfirmed 2026-06-27▾# Settlement access in Malta runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta; significant institutions (BOV, and historically HSBC Malta) are directly ECB-supervised, while LSIs sit under MFSA day-to-day supervision. Malta has faced acute correspondent-banking de-risking pressure — BOV lost its last USD correspondent (ING) in 2019 amid global de-risking and reputational concerns — though USD-clearing and BOV's financials recovered by 2024. Many Malta firms run operations through EMIs (Revolut/Wise) alongside traditional bank accounts. Standing sub-brief · as of 27 June 2026 271 words · last cycle 2026-06-27 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank-versus-non-bank access asymmetry. Bank of Valletta lost its last USD correspondent banking relationship (ING), terminating 14 December 2019, within a global de-risking scale-down that disproportionately hit small jurisdictions like Malta given low volumes against compliance costs. By 2024 the worst of the USD freeze had eased and BOV financials recovered (H1 2024 pre-tax profit EUR 148.2m, up 40.9%), but new-company onboarding remains difficult. The structural consequence is that many Malta firms run operations through EMIs such as Revolut Business or Wise alongside traditional bank accounts — a clear illustration of the non-bank rails substituting for constrained bank correspondent access. Settlement supervision is split along the banking-union architecture. Significant institutions in Malta are directly ECB-supervised via joint supervisory teams, while less significant institutions are supervised by the MFSA as national competent authority under ECB oversight; as of 1 September 2025 the ECB listed two Maltese SIs and 18 LSIs. Settlement access runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta. This means euro settlement access for banks is structurally secure through the Eurosystem, while the constraint sits in non-euro (notably USD) correspondent access — the asymmetry that drives operators toward EMI rails. #### Outlook The correspondent-banking module is stable but flagged as an under-indexed structural overhang. USD-clearing access has eased from its 2019 nadir, yet onboarding difficulty persists and the grey-list legacy (W11) sustains de-risking pressure. The forward watch is whether foreign acquisition of Maltese banks (W13) reconfigures the correspondent footprint, and whether non-bank EMI rails continue absorbing the access gap. The MT-US-USD corridor access direction remains uncertain. Read full sub-brief · 271 words no periodic updates on record for this sub-brief Evidence 4 Sources and findings (4) - T3[https://www.maltatoday.com.mt/business/business_news/95724/bank_of_valletta_to_lose_us_dollar_transactions_provider_by_december](https://www.maltatoday.com.mt/business/business_news/95724/bank_of_valletta_to_lose_us_dollar_transactions_provider_by_december)retrieved 2026-06-27 - T3[https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta)retrieved 2026-06-27 - T3[https://jeangalea.com/malta-fatf-grey-list/](https://jeangalea.com/malta-fatf-grey-list/)retrieved 2026-06-27 - T3[https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta)retrieved 2026-06-27 ### W13Commercial Intelligence (M&A, Investment & Product)Probableconfirmed 2026-06-27▾# Trailing-12m commercial activity: BVNK MiCA CASP licence (Feb 2026); HSBC Malta sold to CrediaBank and MDB Group to Banka Creditas; 2025 fintech funding peak >$2bn (Binance-dominated); Gemini EU-HQ relocation 2025. Standing sub-brief · as of 27 June 2026 286 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) This module renders discrete commercial events from the trailing window. On product/licensing, in February 2026 stablecoin payment-infrastructure company BVNK obtained a CASP licence under the MiCA framework issued by the MFSA — a completed event evidencing Malta's MiCA fast-track attracting stablecoin payment-infrastructure firms. On M&A, HSBC sold its Maltese subsidiary to Athens-based CrediaBank, and MDB Group was acquired by Prague-based Banka Creditas; both deal values are not publicly disclosed. These foreign acquisitions reshape the correspondent/settlement-access and banking-concentration landscape among Malta's significant banks and reconfigure the concentrated Maltese banking market and its correspondent footprint — a direct link to the access analysis in W12. On investment, Malta fintech funding peaked in 2025 at over $2bn (the highest in a decade), with Binance the highest-funded Malta fintech at roughly $2.02bn; 35 companies in the sector have received funding to date. The aggregate funding figure is dominated by Binance-related raises and signals Malta's continued attraction of large crypto/fintech players despite its small size. On market development, US-based crypto exchange Gemini relocated its European headquarters to Malta in 2025 as its core EU compliance hub under MiCA, while OKX designated Malta as a regional hub in 2024; values are not publicly disclosed. These hub designations reinforce Malta's role as an EU MiCA compliance base for large international CASPs. #### Outlook The commercial-intelligence module trajectory is escalating, with active bank-level M&A and continued international CASP interest. The forward watch is whether the HSBC Malta and MDB Group acquisitions complete their integration and reshape the correspondent landscape, and whether further large CASPs designate Malta as an EU hub. Deal-value disclosure is under-indexed for the private and cross-border bank transactions; amounts remain undisclosed, limiting precision on individual deals. Read full sub-brief · 286 words Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech Two discrete licensing events mark Malta's commercial fintech activity this cycle. Fast Shift Limited, an electronic money institution and part of the Badalyan Brothers Group, was granted EMI authorisation by the Malta Financial Services Authority, opening an EEA-passporting gateway from its Malta base; the event was reported 3 August 2026, and the deal value was not publicly disclosed. Separately, BVNK secured an MFSA CASP licence in addition to its existing Malta EMI authorisation, enabling it to offer digital-asset services across all EEA member states from its Malta base where it is already authorised as an e-money institution; the exact grant date was not disclosed in the retrieved source, and no transaction value was publicly disclosed for this licensing event either. Both events are licensing grants rather than priced commercial transactions, and both illustrate the same underlying commercial pattern: building a combined EMI-plus-CASP structure from a single Malta base to serve EEA-wide payment and digital-asset business. This pattern sits downstream of Malta's regulatory consolidation onto the MiCA/CASP crypto-licensing route and its confirmed revised EMI prudential rulebook, both covered under the licensing and digital-money modules above. #### Outlook Watch for further EMI-licensed Malta firms adding a CASP licence, or vice versa, as the combined-licence commercial model continues to be the dominant pattern in Malta's fintech licensing activity. 1 earlier distinct update(s) Periodic update · new data 2026-10-12 #### Commercial Intelligence & Fintech Ryft, a UK-domiciled payments-infrastructure platform, raised a Series B funding round of EUR23.3 million led by Gresham House Ventures, announced 21 September 2026. Alongside that round, Ryft is reported to be pursuing a full EU payments licence from the Malta Financial Services Authority. The regulatory-review record for this pursuit shows a status of notified with the MFSA, which is distinct from a granted licence: as at this cycle, Ryft's application has not progressed to an authorisation decision, and the funding round itself should not be read as evidence that MFSA authorisation has been secured. This development is a data point on Malta's continuing attractiveness as an EU payments-licensing venue for firms headquartered elsewhere in the EU or UK, consistent with the jurisdiction's established role as a licensing base for payments and e-money institutions seeking EU-wide passporting. The source for this item is trade-press reporting rather than a primary MFSA disclosure, so the funding figures and the characterisation of Ryft's licensing intent carry that sourcing caveat. #### Outlook Whether Ryft's MFSA application converts from notified status into a granted EU payments licence is the principal item to watch arising from this development. No other Malta-specific commercial event, such as an M&A transaction or additional funding round among payments or fintech firms, was identified this cycle. Evidence 4 Sources and findings (4) - T3[https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757](https://www.weex.com/news/detail/the-mica-fast-track-for-cryptocurrency-licenses-why-okx-and-bvnk-choose-malta-714757)retrieved 2026-06-27 - T3[https://en.wikipedia.org/wiki/List_of_banks_in_Malta](https://en.wikipedia.org/wiki/List_of_banks_in_Malta)retrieved 2026-06-27 - T3[https://tracxn.com/d/explore/fintech-startups-in-malta/__4REGIIkWsxeReT-nPEnSBDRnMU6CEtlEa6BmN2ev7_U#top-companies](https://tracxn.com/d/explore/fintech-startups-in-malta/__4REGIIkWsxeReT-nPEnSBDRnMU6CEtlEa6BmN2ev7_U#top-companies)retrieved 2026-06-27 - T3[https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/](https://fintechnews.ch/fintechmalta/fintech-in-malta-2026-market-overview/81729/)retrieved 2026-06-27 No modules match. Filters combine as OR inside a group and AND across groups. Reset all filters ## Provenance and declared absence Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. Suppressed by doctrine: derived risk score; per-module RAG traffic light. Not shown on this page. Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-26. A year-precision row is never promoted into a tighter band. Orphan deltas: 1 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. Envelope: baseline resolved at jurisdiction_json.baseline ; 14 module(s), 60 finding(s), 140 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](/legal/#contact).