Malta Financial Institution License in 2026: The Complete MFSA Guide

Why Malta is still a relevant fintech jurisdiction in 2026

Malta has been the EU's smallest but most visible common-law fintech jurisdiction since the early 2010s. The Malta Financial Services Authority (MFSA) regulates banks, PIs, EMIs, MiFID firms, AIFMs, UCITS ManCos, insurance and pensions, all under a common "gatekeeper" authorisations regime under the MFSA Act.

For payment and e-money firms, Malta offers four practical advantages.

Malta's weak point is scale: smaller service-provider market than Ireland or Luxembourg, smaller banking base for safeguarding, and occasionally slower onboarding with Tier-1 correspondent banks.

The Financial Institutions Act framework

Payment and e-money firms fall under the Financial Institutions Act (Chapter 376 of the Laws of Malta). The Act transposes PSD2 and EMD2 and is supplemented by the MFSA Financial Institutions Rulebook: FIR/01 covers authorisation, and FIR/03 holds the ongoing rules for payment and e-money institutions. Two licence categories exist.

Small PI and small EMI are not commonly used in Malta; authorised scope is the standard track. AISP-only firms can register under a lighter variant of the PI regime.

The day-to-day rules sit in FIR/03 (Chapter 3 of the Financial Institutions Rulebook). It covers sound and prudent management (governance), outsourcing, safeguarding, prudential requirements, agents and distributors, passporting, and record keeping and reporting. The May 2025 amendments aligned it with DORA and the updated EBA guidelines on ICT and security risk management. Together these set the operational bar above the PSD2 minimum.

The MFSA authorisation process: Statement of Intent first

Unlike most EU NCAs, MFSA requires a formal Statement of Intent before a full authorisation file is accepted. This is the gate that filters out unsuitable candidates early.

1. Statement of Intent (SoI). A high-level document presenting the applicant, proposed business model, organisational structure, beneficial ownership, type of authorisation required and indicative funding plan. 10 to 30 pages typical.
2. Preliminary meeting. MFSA reviews the SoI, may request additional information, meets the applicant. The outcome is either "no objection to proceed" or "declined to proceed", allowing founders to re-scope or withdraw before significant cost.
3. Full application. Only filed after the SoI no-objection. Includes business plan, governance, AML, ICT, safeguarding, fit-and-proper questionnaires, capital evidence and all FIR-required policies.
4. Completeness check. MFSA confirms the file is complete, typically within 2 to 4 weeks.
5. Substantive assessment. RFIs, interviews, independent experts where relevant. Statutory clock is 3 months from a complete file; real-world is 4 to 8 months for PI and 6 to 10 for EMI.
6. Conditions precedent. Capital paid up, key hires on board, safeguarding account operational, IT systems tested.
7. Passporting notifications. Submitted to MFSA post-licence; host states notified through MFSA.

End-to-end timelines for a well-prepared PI file: 9 to 14 months. EMI: 12 to 18 months. SoI phase alone can take 2 to 4 months; founders who skip it waste 6 months later on a full file that MFSA was never going to approve.

Substance and key function holders

MFSA substance expectations are roughly in line with Ireland's and heavier than Lithuania's. The governance section of FIR/03 is explicit.

• Local directors. At least one resident director, preferably two. Non-resident chairs are tolerated if the executive bench is local.
• Key function holders. CEO, Head of Risk, Head of Compliance (often dual-hat as MLRO), Head of Internal Audit, CFO. All subject to individual MFSA approval.
• Four-eyes principle. Two executive directors sign off on material decisions.
• Outsourcing. FIR/03 allows outsourcing of IT, processing and back office but requires full MFSA oversight. Intra-group outsourcing acceptable with clear service levels and exit plans.
• Physical office. Real rented office in Malta, visited by MFSA. Virtual addresses refused.

Malta has publicly tightened its substance bar after the FATF grey-listing (2021-2022). The current posture is "credible, proportionate and demonstrable substance", and enforcement is visible.

Fees, supervision and tax

• Application fee. EUR 10,000 for a PI (or an EMI that only issues e-money) and EUR 15,000 for an EMI that also provides payment services, under the Financial Institutions (Fees) Regulations as amended by L.N. 366 of 2024 (in force since 1 January 2025). Non-refundable.
• Annual supervisory fee. A fixed EUR 25,000 for a PI (or e-money only) and EUR 35,000 for an EMI that also provides payment services, plus a variable part based on total assets, payment volume or outstanding e-money. The variable part is capped at EUR 250,000. The first year is prorated from the licence date.
• Corporate income tax. Headline 35%. Refund system produces an effective rate often between 5% and 10% for non-resident shareholders, subject to meeting the conditions of the Maltese tax refund framework.
• VAT. Core payment services exempt under EU financial-services exemption. Maltese VAT at 18% on ancillary services.
• Audit and reporting. Annual audited accounts, quarterly prudential and safeguarding reports, AML supervisory return, major-incident reporting.

MFSA publishes an annual supervisory plan. Expect onsite inspections every 2 to 4 years for PIs/EMIs and thematic deep-dives on AML, safeguarding and governance.

Banking partners and operational reality

The single most common pain point of a Maltese PI or EMI is opening safeguarding and operational bank accounts. The Maltese banking market is concentrated and has historically been conservative on fintech onboarding.

• Local banks. BOV, HSBC Malta, APS Bank, MeDirect, Lombard. Onboarding timelines 3 to 6 months, documentation-heavy.
• Alternative safeguarding. Many Maltese EMIs and PIs use EU credit institutions outside Malta (Clearbank, Citibank Europe, ING, Commerzbank) for safeguarding. Permitted under the Act.
• Payment rails. No equivalent of Lithuania's CENTROlink. Most Maltese PIs rely on correspondent banking or EMI partner rails.
• Card schemes. Visa and Mastercard membership possible but typically via BIN sponsor.

Plan banking onboarding at the same time as the MFSA file. A licensed entity without bank accounts cannot go live.

PSD3 and DORA: what changes

The Council and the European Parliament reached political agreement on PSD3 and the PSR on 27 November 2025. Once formally adopted and published, the new rules are expected to apply around 2028. PSD3 folds the e-money regime into the payment institution regime, so the Maltese PI and EMI categories will move into a single payment institution licence that can include e-money services. Expect MFSA to update FIR/03 before the new rules apply, and existing licensees to get a transition period to show they meet the new requirements.

DORA has applied since 17 January 2025. MFSA expects DORA-aligned ICT risk management, incident reporting, threat-led penetration testing and third-party ICT register from day one of a new authorisation file. See the PSD3 and PSR guide for the full roadmap.

Ship a Maltese PI or EMI product with Crassula

A Maltese licence is the legal wrapper. The core banking layer is what wins or loses customers. Crassula Core keeps the ledger, client accounts with virtual IBANs, SEPA and SEPA Instant flows and the audit trail. Cards come through pre-integrated issuers you contract with directly, and identity checks run through connected verification providers. Transaction monitoring, sanctions screening, safeguarding and regulatory reporting to the MFSA stay with you and your chosen providers; Crassula supplies the ledger balances, transaction exports and, as your ICT provider, the incident and outsourcing information you need for DORA.

FAQ