Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

The Malta Financial Services Authority (MFSA) and the Malta Digital Innovation Authority are the main competent authorities regulating the provision of fintech products and services.

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

The local financial services regulatory framework comprises:

  • the Investment Services Act, Chapter 370 of the Laws of Malta (ISA), which outlines the regulatory requirements of operators wishing to set up investment services undertakings and collective investment schemes. It transposes the Markets in Financial Instruments Directive (2014/65/EU) (MiFID II) into Maltese law and regulates services outlined therein when they are carried out in or from Malta and in relation to one or more ‘instruments’, as defined therein;
  • the Banking Act, Chapter 371 of the Laws of Malta, which is the law regulating credit institutions that carry out the ‘business of banking’, defined as:
    • accepting deposits of money from the public that are withdrawable or repayable on demand, after a fixed period or after notice;
    • borrowing or raising money from the public with the purpose of using all or some of such money to lend to others; or
    • otherwise investing for the account and at the risk of the person accepting this money; and
  • the Financial Institutions Act, Chapter 376 of the Laws of Malta (FIA), which sets out the licensing and ongoing obligations of non-banking institutions. These can be classified into two categories; namely, institutions that carry out:
    • payment services or the issuance of electronic money; and
    • activities such as lending, financial leasing, the provision of guarantees and commitments, foreign exchange services and money brokering.


The FIA, the subsidiary legislation and the regulations promulgated under the FIA transpose the second Payment Services Directive (2015/2366/EU) (PSD 2) and the second Electronic Money Directive (2009/110/EC), are:

  • the Virtual Financial Assets Act, Chapter 590 of the Laws of Malta (VFAA), which regulates services that are provided in relation to distributed ledger technology assets that have been determined to be a virtual financial asset. Such services listed in the VFAA are mostly similar to those listed in the ISA; and
  • the Insurance Business Act, Chapter 403 of the Laws of Malta (IBA), which regulates the business of insurance, namely, effecting and carrying out contracts of insurance for long-term business or general business as defined in the IBA.


Consumer lending

Is consumer lending regulated in your jurisdiction?

Lending is a regulated activity under the Banking Act as it falls under the definition of ‘business of banking’, which requires a licence in Malta. Moreover, lending is a regulated activity under the FIA, irrespective of whether it is provided to consumers. Article 5 of the FIA outlines the requirements for the authorisation of an institution to carry out lending activities, including:

  • an initial capital in the amount established by the MFSA;
  • at least two individuals effectively directing the business of the institution in Malta;
  • all qualifying shareholders, controllers and all persons effectively directing the institution’s business are suitable persons to ensure its prudent management; and
  • sound and prudent management and robust governance arrangements.


In addition, the Consumer Credit Regulations (Subsidiary Legislation 378.12) implement into Maltese law the provision of the Consumer Credit Directive (Directive 2008/48/EC), which regulates credit agreements involving a total amount of credit more than €200 or less than €75,000, which are provided to consumers.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

There are no particular restrictions applicable to trading loans in the secondary market in Malta.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

Collective investment schemes (CIS) are regulated under the ISA. CIS that fall within the scope of the local regulations are:

  • retail collective investment schemes, primarily undertaking in collective investment transferable securities;
  • professional investor funds;
  • alternative investment funds (AIFs); and
  • notified alternative investment funds.


Investment-based crowdfunding is regulated under a separate regime.

With respect to peer-to-peer (P2P) or marketplace lenders, it is pertinent to refer to the FIA, which regulates ‘money broking’, defined as the activity of introducing counterparties that wish to deal at mutually agreed terms with respect to wholesale and retail financial products. This regulation may have implications for both marketplace lenders and P2P platforms.

Alternative investment funds

Are managers of alternative investment funds regulated?

An alternative investment fund manager (AIFM) who operates in or from Malta fall within the scope of the ISA and the Alternative Investment Fund Managers Regulations (Subsidiary Legislation 370.23 of the Laws of Malta), which transpose the Alternative Investment Fund Managers Directive (2011/61/EU) (AIFMD) into Maltese law. An AIFM may be subject to a lite regime akin to the regime under the MiFID II if it qualifies as a de minimis AIFM. This will be the case where the assets under management are worth less than:

  • €100 million; or
  • €500 million and the portfolio consists of AIFs that are unleveraged and have no redemption rights in the first five years following the date of initial investment.


A de minimis AIFM will be exempt from complying with certain provisions of the AIFMD but does not enjoy the use of the EU passporting rights.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

The FIA stipulates that any person that, as a lender, regularly lends money in or from Malta is carrying out a regulated activity and requires an MFSA licence prior to commencing operations. However, there is no specific regulation on P2P platforms or marketplaces lending under the local financial services framework.


Describe any specific regulation of crowdfunding in your jurisdiction.

While reward-based and donation-based crowdfunding platforms remain unregulated, the MFSA had introduced a framework initially under the ISA applicable to investment-based crowdfunding services and was now replaced by a completely separate licensing and regulatory framework specifically regulating crowdfunding platform service providers in light of Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (ECSP Regulation).

The ECSP Regulation is directly applicable in Malta and requires entities providing crowdfunding services to be authorised by the competent authority. By virtue of the Malta Financial Services Authority Act (European Crowdfunding Service Providers for Business) Regulations (Subsidiary legislation 330.15) of the laws of Malta, the MFSA is the designated competent authority and has issued Crowdfunding Rules to which Crowdfunding Service Providers are subject.

Further, the European Securities and Markets Authority (ESMA) has published the draft technical standards on crowdfunding under Regulation (EU) 2020/1503.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

Invoice trading falls within the scope of the FIA. Factoring and invoice discounting are listed as two types of lending activity that in turn trigger a licensing obligation under the FIA if and when they are carried out in or from Malta on a regular basis.

Payment services

Are payment services regulated in your jurisdiction?

The FIA includes a list of the payment services that are regulated in Malta and reflects the services outlined in the PSD 2. Institutions engaging in these payment activities must obtain authorisation from the MFSA prior to the provision of these services in or from Malta on a regular basis.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

There are no laws or regulations promoting competition among financial institutions through the use of available data. However, the concept of open banking has been locally introduced under the Financial Institutions Act through the regulation of third-party payment service providers, namely, payment initiation service providers and account information service providers.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Insurance and reinsurance undertakings carrying on the business of insurance in or from Malta including (re)insurance distribution activities or market (re)insurance services in or from Malta are regulated by two legislative instruments, namely:

  • the Insurance Business Act, Chapter 403 of the Laws of Malta; and
  • the Insurance Distribution Act, Chapter 487 of the Laws of Malta.


These Acts impose requirements from or with the MFSA depending on the nature of the insurance business activity being provided in or from Malta. These Acts, which implement EU Directive 2009/138/EC and EU Directive 2016/97/EU respectively, are supplemented by regulations promulgated under these two laws and by rules and guidelines issued by the MFSA.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

‘Credit reference agency’ is defined under the Trading Licence Act, Chapter 441 of the Laws of Malta and its subsidiary legislation, as any undertaking licensed by the Trade Licensing Unit, whose main business is to prepare, assemble and evaluate credit information and related credit and risk management services concerning legal and natural persons for the purpose of issuing credit scores to be furnished to third parties, provided that the agency is not precluded from carrying out other related tasks. The definition of ‘credit reference agencies’ pursuant to the draft law falls outside the scope of Regulation (EC) 1060/2009 and, therefore, ESMA would not have supervisory powers over these entities. Further, credit reference services are listed under the Banking Act as one of the additional activities exercisable by credit institutions.

The Central Bank of Malta Act, Chapter 204 of the Laws of Malta provides that credit reference agencies must be licensed by the Trade Licenses Unit in terms of regulation 47A of the Trading Licences Regulations, and the Central Bank of Malta is the supervisory authority in this regard solely for the purpose of overseeing and regulating the issuance of credit scores. The Central Bank has issued Central Bank of Malta Directive No. 15 on the Supervision of Credit Reference Agencies, which sets out the requirements to be met by licensed credit reference agencies.