Use the Lexology Navigator tool to compare the answers in this article with those from other jurisdictions.
General climate and trends
General innovation climate
What is the general state of fintech innovation in your jurisdiction, including any notable trends, innovations, innovators and future prospects?
Malta already enjoys a solid reputation as a financial services and IT hub within the European Union; extending this prestige to the fintech world appear to be a natural progression. The government has thus been exploring new niches in the financial services sector, focusing on fintech as one of the main drivers for growth in the Maltese financial services industry. For this reason, and as part of a national strategy for the growth of the fintech population in Malta, there has been considerable interest from policymakers in promulgating new regulations for the fintech industry. Several authorities have released consultation documents asking various industries for feedback on their proposals. The legislature is aware of the importance of striking a balance between the regulation and innovation, and the authorities will continue to consult with industry players in the development of the fintech industry in order to promote Malta as an attractive environment for technology-based businesses.
Fintech start-ups have access to a technology business incubator based at the University of Malta, in addition to an innovation hub run by the Malta Information Technology Agency, and the government is in the process of building a state-of-the-art technology park, with full completion scheduled for 2021. Together, these initiatives will further enhance the supportive environment and infrastructure for fintech companies operating in the IT, gaming and financial services sectors.
Have there been any particular developments – regulatory or commercial – in any of the following fintech sectors?
(a) Distributed ledger technology and digital currencies (eg, blockchain, smart contracts and Bitcoin)?
Malta has made significant strides in the areas of distributed ledger technology and digital currencies in the last 12 months. In its 2018 budget the government announced that it intends to set up a new blockchain lab at the Malta Information Technology Agency and launch a government web portal that will focus on distributed ledger technology and cryptocurrencies. The government will also continue to assist start-ups developing this technology by launching a blockchain hub.
Further, in September 2017 the government announced the establishment of a blockchain taskforce, which will be responsible for reviewing proposals made to it, as well as making recommendations for a structured route for the implementation of the National Blockchain Strategy.
The Malta Financial Services Authority (MFSA) has published several consultation documents in this field. In November 2017 the MFSA published a discussion paper on initial coin offerings, virtual currencies and related service providers. In October 2017 the MFSA issued a consultation document on the proposed regulation of collective investment schemes investing in virtual currencies. This consultation was followed by a feedback statement in January 2018 and the publication of the “Supplementary Conditions applicable to Professional Investor Funds (“PIFs”) investing in Virtual Currencies”.
The Malta Gaming Authority (MGA) has published a white paper and draft law on Malta’s new gaming law, which will include ‘virtual currencies’ within its scope. The MGA has also announced the imminent launch of a sandbox test, in which virtual currencies will be released into a controlled and monitored environment.
The Malta Stock Exchange has announced that it intends to issue a call for proposals on the applicability of blockchain to capital markets. This call has not been issued as yet.
(b) Alternative lending platforms?
Maltese law has not yet adapted to this rapidly developing platform. It is debatable whether a lender which regularly or habitually lends through a fintech platform to borrowers in Malta is licensable under the relevant local laws and regulations (fintech platforms do not themselves lend funds and are not party to lending agreements between funders and borrowers). Even though Maltese regulation does not specifically cater for alternative lending platforms, they could potentially be regarded as financial institutions under the Financial Institutions Act 1994 (Cap 376 of the Laws of Malta), and would therefore require a licence in order to transact business in or from within Malta.
(c) Digital payments, remittances and foreign exchange?
There have been no noteworthy developments in this space. At present, digital payments are regulated under the Financial Institutions Act, which transposes the EU payment services framework and allows payment institutions to execute payment transactions where the consent of the payer to a payment transaction is transmitted by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, acting solely as an intermediary on behalf of the payment service user and the supplier of the goods and services. The local regulatory framework follows the guidelines issued by the European Banking Authority in respect of security measures to be adopted over internet payments. Once they come into force, Malta will also adopt the regulatory technical standards on strong customer authentication and secure communication under the EU Second Payment Services Directive (2015/2366/EU).
In addition to digital payments activities, the Financial Institutions Act also allows licensable payment institutions to engage in money remittance, whereby funds are received from a payer – without any payment accounts being created in the name of the payer or payee – for the sole purpose of transferring a corresponding amount to a payee or another payment service provider acting on behalf of the payee, or where such funds are received on behalf of and made available to the payee. These are also subject to the requirements of the EU Second Payment Services Directive.
Regarding foreign exchange, licencing requirements under the Financial Institutions Act are triggered by the activity of regularly or habitually trading, for oneself or for customers, in foreign exchange in or from Malta. Foreign exchange services which are connected to the provision of investment services are also considered to be licensable activities under the Investment Services Act.
(d) Alternative financing (including crowdfunding)?
Maltese law has not as yet adapted to alternative financing. The MFSA issued a consultation paper in November 2016 seeking initial feedback from the industry before deciding whether to go forward with detailed proposals for a legal framework on crowdfunding. However, crowdfunding is presently unregulated.
(e) Investment, asset and wealth management?
As an EU member state, Malta has fully transposed the EU Directive on Markets in Financial Instruments II (2014/65/EU) and the EU Regulation on Markets in Financial Instruments (600/2014), which became applicable on January 3 2018.
(f) Robo-advice and artificial intelligence?
Malta has not yet promulgated any regulation regarding robo-advice and artificial intelligence. However, in January 2018 the Maltese parliamentary secretary responsible for financial services, digital economy and innovation announced that the government has been working closely with industry to come up with a legal framework that is in line with anti-money laundering rules and know-your-client regulations to regulate, among other things, artificial intelligence and internet-of-things devices in the coming months.
(g) Any other technologies?
How would you describe the regulatory policy for fintech products and services in your jurisdiction?
The Malta Financial Services Authority (MFSA) has taken an active role in issuing consultations and discussion papers in connection with the fintech industry. Over the past few years Malta had already become an attractive jurisdiction for fintech start-ups, and this was increased by the promulgation of the EU First Payment Services Directive (2007/64/EC) and the EU Electronic Money Directive (2009/110/EC). As a result, Malta has experienced an influx of fintech start-ups, whose businesses are based on providing payment services. This momentum is expected to be sustained following the transposition of the EU Second Payment Services Directive (2015/2366/EU).
In November 2017 the MFSA issued a discussion paper on initial coin offerings, virtual currencies and related service providers, further reaffirming its welcoming approach and commitment to growing the fintech industry in Malta. As the MFSA becomes more aware of the risks and innovation in the fintech world, it is also expected to enhance its expertise in the sector, thus placing Malta on par with other global financial services hubs (eg, the United Kingdom, Germany, the United States, Singapore, Russia, the United Arab Emirates and Gibraltar), which have taken steps to regulate fintech initiatives to different extents.
Have any fintech-specific laws or regulations been enacted in your jurisdiction? Are any envisaged?
Malta has not as yet enacted any fintech-specific laws or regulations. Nevertheless, the Malta Financial Services Authority (MFSA) has been actively working with stakeholders in the fintech industry in order to introduce regulations, rules and policies which address the specific risks connected to fintech innovations. In this respect, the government has taken the approach that the regulation should strike a balance between the protection of investors and the encouragement of fintech innovation. This resonates with the attitude that authorities have taken to date, insofar as the financial services industry is concerned. The MFSA, for example, prides itself in adopting a firm but flexible approach to regulation, which is adaptable to different businesses and which develops alongside industry players.
Which government authorities regulate the provision of fintech products and services?
The Malta Financial Services Authority and Malta’s economic development agency Malta Enterprise are responsible for regulating fintech products and services in Malta.
Financial regulatory framework
Which laws and regulations governing the provision of financial services apply to fintech businesses?
Malta's financial services legislation is organised under four main acts, together with the rules and regulations made thereunder:
- the Banking Act (Cap 371 of the Laws of Malta);
- the Investment Services Act (Cap 370 of the Laws of Malta);
- the Insurance Business Act (Cap 403 of the Laws of Malta); and
- the Financial Institutions Act (Cap 376 of the Laws of Malta).
Provided that they fall within the scope of the regulatory perimeter, fintech businesses which conduct alternative activities to the traditional regulated activities relating to credit institutions, financial institutions, investment services and insurance would most probably be regulated by one or more of the above acts.
Under what conditions are fintech businesses subject to licensing requirements? Are there any exemptions?
Banking Act Fintech businesses are subject to licensing requirements under the Banking Act if, as their main activity, they:
- accept deposits of money from the Maltese public, withdrawable or repayable:
- on demand;
- after a fixed period; or
- after notice; and
- borrow or raise money from the Maltese public, for the purpose of employing such money in whole or in part by lending to others or otherwise investing for, and at the risk of, the party accepting the money.
Further, fintech businesses must notify the Malta Financial Services Authority (MFSA) in order to extend their banking licences to cover additional services, such as:
- payment services;
- issuing and administering other means of payment (eg, travellers cheques and bankers’ drafts);
- trading in various financial instruments, for customers or on their own account;
- portfolio management and advice;
- safe custody;
- guarantees and commitments;
- underwriting share issues and participation in such issues;
- money broking services;
- credit referencing services;
- safekeeping and administrative of securities; and
- issuing of electronic money.
Investment Services Act The Investment Services Act governs the provision of investment services in or from within Malta, in relation to certain instruments. The services and products caught under the act reflect the provisions of Annex 1 of the EU Directive on Markets in Financial Instruments II (2014/65/EU) (MiFID II). Therefore, fintech businesses conducting an investment service in or from within Malta in relation to certain instruments are subject to licensing conditions under the Investment Services Act.
Financial Institutions Act The Financial Institutions Act governs the business of a financial institution in or from Malta. The business of a financial institution is defined as being:
“a person that regularly or habitually acquires holdings or undertakes the carrying out of any activity listed in the First Schedule of the Financial Institutions Act for the account and at the risk of the person carrying out the activity.”
The first schedule of the act refers to a number of activities, including:
- financial leasing;
- payment services under the EU Second Payment Services Directive (2015/2366/EU);
- issuing of electronic money;
- trading in various financial instruments, for customers or on one’s own account;
- underwriting share issues and participation in such issues;
- money broking services;
- guarantees and commitments; and
- issuing and administering other means of payment (eg, travellers cheques and bankers’ drafts).
Fintech businesses that regularly or habitually provide the above services in or from Malta are subject to a Financial Institutions Act licence.
Exemptions The Banking Act, the Investment Services Act and the Financial Institutions Act provide no specific licensing exemptions for parties carrying out the above services. Nevertheless, fintech businesses should carry out the following activities in order to mitigate the chances of triggering licensing requirements under the acts:
- Regarding the Investment Services Act, and pursuant to the EU Regulation on Markets in Financial Instruments (600/2014) (MiFIR), a fintech business may provide investment services or perform investment activities with or without any ancillary services to eligible counterparties and to professional clients within the meaning of Section I of Annex II of MiFID II (ie, ‘de facto professional clients’) established in Malta without the establishment of a branch, provided that the requirements of Article 46 of MiFIR are met. Further, where a retail client or a professional client within the meaning of Section II of Annex II of MiFID II (ie, an ‘elective professional client’) that is established or situated in Malta initiates on its own initiative the provision of an investment service or activity by a fintech business, the fintech business shall not be required to establish a branch or otherwise obtain a licence in Malta.
- Regarding the Banking Act, a licence is triggered where the business of banking is provided in or from Malta. A license is also triggered if the business of banking is advertised or solicited. Hence, the acceptance of deposits should not be carried out in or from Malta as a regular feature of business and no advertising or solicitation should be carried out. The decision regarding whether the business of banking is being carried out in or from Malta is determined by the MFSA.
- Regarding the Financial Institutions Act, a company must not carry out of any of the activities covered by the act in or from within Malta habitually or regularly, as this would trigger a licence requirement.
Are any fintech products or services prohibited in your jurisdiction?
No specific types of fintech business are presently prohibited in Malta. However, the MFSA issued a warning in July 2017 whereby it advised the public to exercise caution and be vigilant when dealing with virtual currencies and to ensure that they have understood the risks involved. Further, the MFSA has consistently cautioned investors and potential investors to exercise caution and be vigilant when seeking to invest in contracts for difference, binary options, forex and other highly speculative products. The provision of fintech services would also be prohibited if this would constitute a licensable activity in terms of the Banking Act, Financial Institutions Act or Investment Services Act, and the service provider does not obtain authorisation to provide such services from the MFSA.
Data protection and cybersecurity
What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?
In terms of data processing and transfer, fintech activities are subject to the same rules and regulations that govern non-fintech businesses. Since Malta is a member of the European Union, Maltese data protection law is in line with EU legislation. The applicable rules and regulations are the Data Protection Act (Cap 440 of the Laws of Malta) and its subsidiary legislation, including the Electronic Communications Networks and Services (General) Regulations (SL 399.28).
What cybersecurity regulations or standards apply to fintech businesses?
Malta does not have a general cybersecurity framework in place as yet. However, Chapter V of the Criminal Code of Malta (Cap 9 of the Laws of Malta) refers to computer misuse.
The Processing of Personal Data (Electronic Communications Sector) Regulations (Subsidiary Legislation 440.01) states that data retained under the provisions of this act must be:
- of the same quality and subject to the same security and protection as the data on the network;
- subject to appropriate technical and organisational measures to protect it against:
- accidental or unlawful destruction;
- accidental loss or alteration; or
- unlawful storage, processing, access or disclosure; and
- subject to appropriate technical and organisational measures to ensure that it can be accessed by specially authorised personnel only.
Malta has also been a signatory to the Council of Europe Cybercrime Convention since 2001.
What anti-fraud, anti-money laundering or other financial crime regulations govern the provision of fintech products and services?
Malta's main legislation regarding fraud, money laundering and other financial crimes are:
- the Prevention of Money Laundering Act (Cap 373 of the Laws of Malta); and
- the Prevention of Money Laundering and Funding of Terrorism Regulations (Subsidiary Legislation 373.01).
These legislative instruments transpose the requirements of the EU Fourth Anti-money Laundering Directive (2015/849/EU). Fintech businesses carrying out either a ‘relevant financial business’ or ‘relevant activity’ shall be considered as subject persons under the Prevention of Money Laundering Act and the Prevention of Money Laundering and Funding of Terrorism Regulations. In addition, subject persons must also comply with the Implementing Procedures, and other guidance as issued and updated by the financial crime regulator in Malta, the Financial Intelligence and Analysis Unit.
What precautions should fintech businesses take to ensure compliance with these provisions?
Fintech businesses that are considered to be subject persons under the Prevention of Money Laundering Act and the Prevention of Money Laundering and Funding of Terrorism Regulations must comply with the following obligations, among others:
- to take appropriate steps, proportionate to the nature and size of the business, to identify and assess the risks of money laundering and funding of terrorism that arise out of its activities or business, taking into account:
- risk factors relating to customers, countries or geographical areas, products, services, transactions and delivery channels, among others; and
- any national or supranational risk assessments relating to risks of money laundering and the funding of terrorism;
- to implement measures, policies, controls and procedures proportionate to the nature and size of the business, such as:
- customer due diligence measures, record-keeping procedures and reporting procedures; and
- risk-management measures, including customer acceptance, internal control, compliance management, communications and employee-screening policies and procedures;
- to appoint, where appropriate with regard to the nature and size of the business, an officer at management level whose duties shall include the monitoring of the day-to-day implementation of the measures, policies, controls and procedures adopted under the Prevention of Money Laundering Act and the Prevention of Money Laundering and Funding of Terrorism Regulations;
- to implement, where appropriate with regard to the size and nature of the business, an independent audit function to test the internal measures, policies, controls and procedures;
- from time to time, to provide employees with training in the recognition and handling of operations and transactions which may be related to proceeds of criminal activity, money laundering or the funding of terrorism; and
- to monitor and, where appropriate, enhance the measures, policies, controls and procedures adopted better to achieve their intended purpose.
What consumer protection laws and regulations apply to the provision of fintech products and services?
In terms of consumer protection, fintech activities are subject to the same rules and regulations that govern non-fintech businesses. Since Malta is a member of the European Union, Maltese consumer protection law is in line with EU legislation. The applicable rules and regulations are the Consumer Affairs Act (Cap 378 of the Laws of Malta) and its subsidiary legislation, including the Consumer Credit Regulations (SL 378.12).
Does the provision of fintech products or services in your jurisdiction raise any particular competition regulatory concerns?
The mere fact that a product or service is a fintech product or service not raise any particular competition regulatory concerns, provided that it complies with general EU and domestic competition law.
Are there any particular regulatory issues concerning the cross-border provision of fintech products and services (eg, operating jurisdiction rules and currency controls)?
Where a fintech company is a licensable entity within the European Union or the European Economic Area and it is seeking to provide its services by carrying out its activities in Malta in exercise of an EU passport right, it is exempt from acquiring a banking or investment licence in Malta. However, the activities that may be carried out in Malta by a fintech company in exercise of an EU passport right are limited to those it may undertake in its home member state.
Further, a fintech company may exercise an EU passport right to provide services by carrying out its activities in Malta, provided that:
- it has given the EU regulatory authority of the home member state a services passport notification to provide services in Malta; and
- the Maltese Financial Services Authority (MFSA) has received such notification from the EU regulatory authority of the home member state.
If the fintech company is established in a third country (ie, outside the European Union) and seeks to offer services in or from within Malta, it must be authorised by the MFSA and must establish a branch in Malta, provided that it does not qualify for any of the exemptions to the relevant laws.
Exchange control limitations have been abolished in Malta and Maltese persons may enter into foreign currency transactions without limitation. The only requirement is that statistical data relating to certain foreign currency transactions is submitted by Maltese credit institutions in the appropriate forms to the Central Bank of Malta, in terms of the External Transactions Act (Cap 233 of the Laws of Malta). Failure to so notify will not impinge on the ability of the non-Maltese counterparty to claim payment and will have no impact on the validity of the underlying transaction. However, in the event that a party needs to prove or claim in a Maltese liquidation, the solvent party’s claim must be expressed in euros and the rate of exchange will generally be the rate applicable when the underlying obligation was due.
Financing, investment and government support
Does the government provide any incentives or support programmes to promote fintech innovation in your jurisdiction (eg, tax incentives, grants and regulatory sandboxes)?
In October 2017 the government announced that it intends to set up a new blockchain hub, which will enable the government to assist start-ups that are new to investing in this technology. A blockchain lab will also be launched, with good initiatives for start-ups.
More generally, employee share options plans are commonly used by start-ups in order to keep their salary bill low while retaining talent. These agreements between employers and employees allow employees to buy a share in the company once a certain time period has passed. This helps start-ups to attract and retain dedicated employees.
Additionally, Malta offers attractive tax residency rules for highly qualified individuals and high-net-worth individuals. Provided certain conditions are met, a 15% flat rate of income tax on particular income streams may apply to such individuals.
Has the government concluded any international cooperation agreements to promote and facilitate the cross-border expansion of fintech businesses?
No. However, at the Unlock Blockchain conference held in Dubai in January 2018, the Maltese parliamentary secretary responsible for financial services, digital economy and innovation announced that Malta is planning to cooperate with Dubai in several projects regarding the use of blockchain technology in a number of industries. The government is simultaneously seeking to establish relationships with other countries in order to mark itself out as the fintech hub of Europe.
Financing and investment
What private financing and investment schemes are available and commonly used for fintech start-ups in your jurisdiction?
Fintech start-ups planning to set-up their business in Malta would typically opt for equity financing, such as bank financing or financing from the management or parent company (if it is part of a group of companies). Raising alternative finance through capital markets would be challenging for start-ups, as they would require an established track record and a history of accounting statements. Nevertheless, through the Start-up Finance Regulations 2017 the country’s economic development agency Malta Enterprise has created financing opportunities for innovative undertakings in their early stages of development, supporting small start-up undertakings that demonstrate a viable business concept in the setup and initial growth phases.
Through this initiative, Malta Enterprise provides support linked to private equity, crowd funding and the procurement of machinery and equipment. Depending on the type of support provided, assistance may be up to €100,000 (if linked to crowd-funding campaigns) or €200,000 (if linked to private equity or required to fund the procurement of machinery and equipment).
What forms of IP protection are available for fintech innovations?
Fintech activities are regulated in the same way as non-fintech businesses. The forms of IP protection available are patents, designs, trademarks and copyright.
What rules govern the ownership of IP rights to fintech innovations?
The Patents and Designs Act (Cap 417 of the Laws of Malta) and its subsidiary legislation govern the protection of patents and designs. The Trademark Act (Cap 416 of the Laws of Malta) and its subsidiary legislation govern the protection of trademarks. Copyright owners enjoy automatic protection in terms of the local Copyright Act (Cap 415 of the Laws of Malta) and its subsidiary legislation without the need to pursue any formal registration. IP rights in general are also subject to the Intellectual Property Rights (Cross-Border Measures) Act (Cap 414 of the Laws of Malta) and the Enforcement of Intellectual Property Rights (Regulation) Act (Cap 488 of the Laws of Malta).
What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the tech or financial sector?
No specific immigration schemes are available for fintech businesses to recruit staff from abroad. However, as a general rule, an EU citizen will have the right to enter, remain and reside in Malta and to seek and take up employment or self-employment therein. In this respect, any EU citizen may reside in Malta; however, where such residence is to exceed three months, or when, during the six month period, such citizen takes up employment, he or she must apply for a residence permit or a residence document. Regardless of nationality, employment cannot be undertaken unless an employment licence has been issued in addition to a residence permit.
What immigration schemes are available for foreign investors and entrepreneurs wishing to invest in or establish a fintech business in your jurisdiction?
Fintech businesses can utilise the same immigration schemes as non-fintech businesses. An EEA citizen is free to work within Malta without any specific formalities, other than tax and social security registration. Persons residing outside of the European Economic Area must obtain a work permit.
Malta also offers an individual investor programme whereby an individual may be granted naturalisation as a citizen of Malta, provided that the applicant:
- is at least 18 years old;
- satisfies the contribution requirements;
- meets the application requirements;
- commits to provide proof of residence in Malta and proof of title to residential property in Malta; and
- commits to:
- invest in stocks, bonds, debentures or special purpose vehicles, among others; or
- make other investments as provided from time to time by citizenship agency Identity Malta.