Malta

This standing architecture is now moving toward consolidation. Provisional political agreement reached 27 November 2025 between EU Parliament and Council on the PSD3/Payment Services Regulation package confirmed that the current, separately authorised PI and EMI tracks are being folded into a single unified payment-institution authorisation, with the reform package expected operational late 2027. Under the agreed approach, the reform merges PI/EMI into a unified authorisation, repeals EMD2, and — of direct relevance to Malta's existing licensee population — current planning anticipates ~24-month grandfathering expected for MT-licensed institutions. That grandfathering period is the critical operational variable for MFSA-licensed EMIs and PIs: it sets the outer boundary by which existing licences must be reauthorised or restructured under the unified regime, rather than requiring an immediate transition.

Alongside the reform trajectory, market-guide sources continue to describe MFSA processing timelines in indicative terms only. One low-tier source puts new-application processing at Roughly 3-9 months depending on file completeness, a range that is plausible on its face but has not been corroborated against MFSA-published guidance and should be treated as a market estimate rather than a regulator-confirmed benchmark.

The findings above pertain specifically to Malta's non-bank payment-institution and e-money-institution population; the PSD3/PSR consolidation applies to both bank and non-bank payment-services licensees at EU level, but its Malta-specific operational consequence — the roughly two-year grandfathering clock — is most acute for the non-bank PI/EMI licensees this module tracks. The overarching gap this cycle is sourcing quality rather than substantive volatility: every W1a finding above rests on Tier 3 or Tier 4 market-commentary sources, and no Tier-1 MFSA rulebook or EU Official Journal citation has yet been retrieved to anchor the capital-requirement or PSD3-timeline claims directly against primary text.

Outlook

The near-term trajectory for W1a is one of managed continuity rather than domestic change: Malta's EMI/PI regime is expected to hold its current shape through the PSD3/PSR transposition window, with the reform's expected in-force date of 2027-Q4 carrying a half_year uncertainty band around it. The practical monitoring task for the coming cycles is tracking formal EU adoption of the PSD3/PSR package, any MFSA consultation or transposition guidance signalling how the roughly two-year grandfathering period will be operationalised for Malta's existing licensee base, and closing the Tier-1 sourcing gap so that the capital-requirement and reform-timeline findings can be upgraded from Assessed to Confirmed status.

The safeguarding obligation is reinforced by ongoing verification requirements: the regime requires mandatory reconciliations plus annual safeguarding audit as standing conduct obligations, meaning Malta-licensed EMIs must demonstrate, on a recurring basis, that safeguarded-fund balances match outstanding e-money liabilities, with an independent annual audit providing an additional layer of assurance to the MFSA. Together, the direct-safeguarding mandate and the reconciliation/audit cycle form the operational backbone of Malta's e-money conduct regime, and both elements are treated this cycle as standing, unchanged features of the framework rather than new developments — the underlying source is a single Tier 4 market commentary rather than MFSA rule text, so the finding is carried at Low confidence pending stronger sourcing.

No new financial-promotions or conduct-rule development specific to Malta surfaced this cycle beyond the safeguarding baseline described above; the bank-versus-non-bank distinction that structures much of the wider W1a/W1b analysis is particularly salient here, since the FIR/03 direct-safeguarding requirement applies specifically to the non-bank PI/EMI population rather than to bank-provided payment services, which safeguard client funds under separate prudential capital and deposit-protection arrangements rather than the FIR/03 mechanism.

Outlook

Malta's safeguarding regime is not currently flagged for near-term domestic change, but it sits inside the same PSD3/PSR consolidation horizon tracked under W1a: as PI and EMI authorisations merge into a single regime ahead of the reform's 2027-Q4 expected in-force date, safeguarding obligations for the unified authorisation category will need to be reconciled with Malta's existing FIR/03 direct-safeguarding model, and any divergence between the current national approach and the harmonised PSR safeguarding standard is a watch item for the next several cycles. Strengthening the sourcing base for this module — moving beyond the current single Tier 4 citation to MFSA rulebook text — remains the standing research priority.

The regime is operative rather than theoretical. The MFSA supervises Maltese stablecoin issuer StablR (EURR) as an EMT issuer under MiCA. EMT issuance is restricted to licensed EMIs or credit institutions, and MiCA Article 36 requires EMT issuers to hold at least 30% of reserves in credit-institution deposits (60% for significant EMTs), with redemption at par on demand. StablR demonstrates that Malta hosts operative MiCA-compliant EMT issuance, a competitive differentiator versus slower-implementing Member States. The link between this module and the licensing framework is direct: because EMT issuance requires an EMI or credit-institution licence, the non-bank EMI cohort authorised under Cap. 376 is the natural pool of EMT issuers, while reserve-composition rules tie issuers back into the bank-deposit system.

Outlook

The stablecoin module trajectory is escalating, driven by continued CASP authorisation activity. The February 2026 BVNK CASP licence (tracked in W13 as a commercial event) and the live StablR EURR issuance evidence a maturing venue. Going forward, the intersection with the pending PSD3/PSR EMI-into-PI collapse warrants watching, since EMT issuance is anchored to the EMI/credit-institution licensing categories that the package will restructure.

This cycle surfaced no new Malta-specific DORA development: the finding is a standing-applicability baseline rather than a fresh regulatory action, and it was identified this cycle as a cross-reference from a W1b-sourced document rather than from a dedicated resilience-focused source. That sourcing path is itself informative — it suggests Malta-specific DORA commentary remains thin relative to the conduct and licensing literature, and dedicated resilience-focused sourcing is a module priority going forward.

Outlook

No Malta-specific resilience development is expected imminently beyond continued DORA supervisory embedding; the module's standing position is that DORA obligations are now a fixed feature of the operating environment for MT-licensed payment firms, with the near-term research task being direct sourcing of any MFSA-specific DORA guidance, incident-reporting statistics, or third-party-risk oversight actions that would move this module beyond baseline-applicability status.

This module sits at the interface between the card schemes and the acquiring market. The caps and the unblending obligations are stable and in force, and the analytical weight of W4 is on how scheme rules layer over the EU regulatory floor. Because the IFR is a directly-applicable EU regulation with the CBM as national authority, the framework applies uniformly to bank and non-bank acquirers operating in Malta.

Outlook

The scheme and network compliance module is stable. The interchange caps and unblending obligations are settled features of the operating environment, and no near-term legislative change is signalled for this cycle. Monitoring focus remains on scheme-rule schedule changes flowing through acquirers to merchants, which connect this module to merchant acquiring in W8.

The escalating driver is the EU Instant Payments Regulation, in force from 9 January 2025, which mandated universal instant euro transfers and drove Maltese banks including IIG Bank, APS and MeDirect to introduce SEPA incoming instant payments for domestic and cross-border euro transfers. The IPR rollout is observable at the bank level, evidencing the corridor opening in practice rather than merely in regulation. The non-euro corridor picture connects directly to the correspondent-banking constraints analysed in W12, where USD access remains the structural weak point.

Outlook

The payment-corridor module trajectory is escalating as the Instant Payments Regulation continues to deepen real-time euro connectivity. The MT-EU-SEPA corridor is opening, with SCT Inst/TIPS rollout broadening across Maltese banks. The MT-US-USD corridor remains uncertain and is tracked under correspondent banking in W12, where the legacy of constrained USD access continues to shape access direction.

The domestic champion layer is led by home-grown firms: Papaya (an EMI offering IBAN accounts and Mastercard-linked services), SysPay (modular payment services, card processing and anti-fraud) and Truevo Payments (an acquirer and PSP). The sector's economic footprint is material — in 2025 the fintech industry accounted for 8.2% of real gross value added and employed over 14,700 people. This concentration of non-bank PI/EMI activity is the commercial spine of the Maltese payments market and the reason the pending PSD3/PSR EMI-into-PI collapse carries outsized local significance.

Outlook

The industry-structure module is stable but flagged for staleness. The March 2025 institution counts should be refreshed via a direct MFSA Financial Services Register pull on the next cycle to confirm whether the EMI/PI population has grown or contracted. The structural story — a large non-bank cohort against a small, concentrated banking sector being foreign-acquired (see W13) — is the analytical thread to carry forward.

On adjudicated PSP liability, the Office of the Arbiter for Financial Services decided Case ASF 095/2021 (SE v Trust Payments (Malta) Limited), an internet-fraud reimbursement claim in which the PSP disputed eligibility on the basis of the absence of a direct customer relationship. The OAFS is the ADR/ombudsman route under Chapter 555 (Act XVI of 2016) for natural persons and micro-enterprises. The decision shapes how PSP liability is allocated in fraud-reimbursement disputes and connects to the broader consumer-protection allocation model analysed in W10.

Outlook

The legal and litigation module is stable, built on MFSA primary publication anchors and an OAFS decision. The forward watch is whether the OAFS continues to develop its PSP-liability jurisprudence and whether MFSA administrative-penalty activity against payment and e-money institutions accelerates. Both strands feed the consumer-protection picture in W10.

The market has seen structural restructuring at the acquirer level. Malta-based payment processor Credorax (later Finaro) was acquired by Shift4 Payments in 2023; in 2024 the company surrendered its credit-institution licence and shifted to a financial-institution licence. This is a dated episode treated as a short entry for structural context, illustrating the bank-to-non-bank licence migration that recurs across the Maltese acquiring landscape.

Outlook

The merchant-acquiring module is stable but rests partly on tertiary sources, with acquirer chargeback and high-risk-MCC operational data not directly evidenced this cycle. The forward watch is whether scheme-rule schedule changes materially shift acquirer cost structures, and whether further licence migrations occur among Maltese acquirers. Quantitative open-banking and acquiring-ops data is flagged as under-indexed for the next cycle.

On open banking, the framework rests on PSD2 APIs but adoption lags despite a digitally-savvy population. The PSD3/PSR package and the Financial Data Access (FiDA) framework, expected by late 2027, promise mandated multi-product data sharing that would expand the data-access surface beyond current open banking. Malta recorded a 43% increase in EMI/payment-services authorisations between 2022 and 2024, indicating market-development momentum even as open-banking uptake remains an under-indexed signal. This thematic regulatory product-access view is distinct from the discrete commercial events tracked in W13.

Outlook

The product-innovation module trajectory is established at the regulatory-facilitation level but constrained by the open-banking adoption gap. The key forward item is FiDA, expected by late 2027, which would mandate multi-product data sharing and deepen open finance. Quantitative open-banking penetration data for Malta is flagged as under-indexed and recommended for direct sourcing on the next cycle.

The live event for this module is the anti-fraud public-private partnership. On 8 April 2026 the MFSA launched a partnership to combat financial fraud, with permanent participants including the MFSA, Malta Police Force, OAFS, FIAU and Central Bank of Malta, prioritising consumer-facing retail payment fraud. The scale is significant: Malta recorded 10,024 fraud incidents over a six-month period with close to EUR 3.76m in losses, mostly from credit transfers — directly relevant given the instant-payments rollout analysed in W5.

Outlook

The consumer-protection module trajectory is escalating, driven by the new anti-fraud partnership and the rising salience of credit-transfer fraud as instant payments expand. The forward watch is how the OAFS allocation model is applied in subsequent scam-reimbursement decisions and whether the public-private partnership produces operational or regulatory output. The intersection between fraud loss concentration in credit transfers and the IPR-driven instant-payments rollout is the analytical thread to track.

Also per the Sentinel feed, Malta was the first EU member state grey-listed by FATF, from June 2022 to June 2023. To exit, it strengthened the FIAU, tightened oversight and increased enforcement. As a MONEYVAL member, Malta has been re-rated on eight FATF Recommendations (8, 13, 20, 24, 26, 28, 36, 38) and remains in enhanced follow-up. This grey-list history is the backdrop to ongoing correspondent-banking de-risking pressure on Maltese institutions, which is the WPM-relevant cross-reference into W12. The full illicit-finance assessment and any sanctions-evasion or stablecoin-misuse analysis belong to FIM. See the Sentinel feed for the underlying intelligence.

Outlook

The AML/CFT module is carried as a Sentinel-fed provenance layer with a stable trajectory. The WPM-relevant forward signal is the continued de-risking overhang that the grey-list legacy sustains, which feeds correspondent-banking access in W12. Depth on the FIAU enforcement pipeline and post-grey-list MONEYVAL follow-up is routed to FIM; the bank-versus-non-bank AML supervision gap in Malta is not separately quantified this cycle.

Settlement supervision is split along the banking-union architecture. Significant institutions in Malta are directly ECB-supervised via joint supervisory teams, while less significant institutions are supervised by the MFSA as national competent authority under ECB oversight; as of 1 September 2025 the ECB listed two Maltese SIs and 18 LSIs. Settlement access runs through the Eurosystem (T2/TIPS) via the Central Bank of Malta. This means euro settlement access for banks is structurally secure through the Eurosystem, while the constraint sits in non-euro (notably USD) correspondent access — the asymmetry that drives operators toward EMI rails.

Outlook

The correspondent-banking module is stable but flagged as an under-indexed structural overhang. USD-clearing access has eased from its 2019 nadir, yet onboarding difficulty persists and the grey-list legacy (W11) sustains de-risking pressure. The forward watch is whether foreign acquisition of Maltese banks (W13) reconfigures the correspondent footprint, and whether non-bank EMI rails continue absorbing the access gap. The MT-US-USD corridor access direction remains uncertain.

On investment, Malta fintech funding peaked in 2025 at over $2bn (the highest in a decade), with Binance the highest-funded Malta fintech at roughly $2.02bn; 35 companies in the sector have received funding to date. The aggregate funding figure is dominated by Binance-related raises and signals Malta's continued attraction of large crypto/fintech players despite its small size. On market development, US-based crypto exchange Gemini relocated its European headquarters to Malta in 2025 as its core EU compliance hub under MiCA, while OKX designated Malta as a regional hub in 2024; values are not publicly disclosed. These hub designations reinforce Malta's role as an EU MiCA compliance base for large international CASPs.

Outlook

The commercial-intelligence module trajectory is escalating, with active bank-level M&A and continued international CASP interest. The forward watch is whether the HSBC Malta and MDB Group acquisitions complete their integration and reshape the correspondent landscape, and whether further large CASPs designate Malta as an EU hub. Deal-value disclosure is under-indexed for the private and cross-border bank transactions; amounts remain undisclosed, limiting precision on individual deals.