EMI License in Malta

A Malta EMI license is granted under the Financial Institutions Act, Cap. 376 of the Laws of Malta, which transposes EMD2 (Directive 2009/110/EC). The Act sets the €350,000 minimum capital under EMD2 Art. 4 and the governance, safeguarding and reporting rules on EMIs. It is supplemented by the MFSA Financial Institutions Rulebook: Chapter 1 (FIR/01) was republished in fully rewritten form on 14 October 2025, replacing FIR/01/2020 with a three-title structure covering application, licensing and post-licensing, while Chapter 3 (FIR/03) is the EMI-specific chapter.

Cap. 376 also hosts the Maltese Payment Institution (PSP-only) regime, transposing PSD2. A Payment Institution may execute payment services listed in PSD2 Annex I (cash placement and withdrawal, execution of payment transactions, issuing and acquiring of payment instruments, money remittance, payment initiation and account information), with capital tiers of €20,000, €50,000 or €125,000 depending on the activity mix. A Malta EMI license adds the right to issue electronic money: redeemable monetary value stored electronically against funds received, which is what makes prepaid cards, e-wallets and stablecoin-style products possible. That extra right is why MFSA EMI authorisation requires €350,000 of paid-up capital rather than a PSP tier, and why an EMI may also carry on payment services and certain ancillary services within the same licence.

EMD2 is on a defined sunset path. The Council posted the final compromise texts of PSD3 and the Payment Services Regulation (PSR) on 23 April 2026, with Official Journal publication anticipated in mid-2026 (June–July, with a possible slip to September). The bulk of PSR conduct rules apply roughly 18 months after entry into force, in practice late 2027. PSD3 carries an 18-month transposition deadline, putting the national deadline in Q2/Q3 2028, at which point EMD2 is repealed and the EMI as a standalone authorisation disappears. Existing EMIs benefit from a 24-month grandfathering period, extendable to 30 months at national competent authority discretion, to re-authorise as Payment Institutions permitted to issue e-money. A Malta EMI license obtained today carries forward into the new framework rather than expiring on transposition day.

The MFSA fee schedule was revised under S.L. 376.03 with effect from 1 January 2025. The pre-revision €3,500 / €2,500 figures that still circulate on competitor pages are outdated and should not be used to budget a new file. Under the current schedule, both the application fee and the annual supervisory fee scale with the activity mix, and the supervisory fee carries a variable component on top of the fixed floor, capped at €250,000 per year.

On top of the fixed component, the supervisory fee adds a variable component equal to the higher of (i) 0.02% of total assets, or (ii) the aggregate of 0.0003% of total payment-transaction value plus 0.01% of average daily outstanding e-money. The total annual supervisory fee is capped at €250,000, and first-year fees are prorated from the date of authorisation.

A Malta EMI is not a low-cost authorisation. Budget the full Year-1 cost of entry, not the advisory fee alone: regulatory capital, MFSA fees, premises, governance hires and the statutory audit dominate the spend. The table below shows the range from a single-Cat. 2 file at the lower bound to a dual-Cat. 2 file with MiCA EMT overlay at the upper bound.

Fee bands depend on the activity mix elected and should be confirmed against the current consolidated S.L. 376.03 fee schedule at the time of application.

The Malta Financial Services Authority is the single authoriser and supervisor for EMIs under the Financial Institutions Act (Cap. 376) and the MFSA Financial Institutions Rulebook. Its reputation sits between the heavyweight (BaFin, ACPR) and the light-touch (Bank of Lithuania) regulators: substantive enough that MFSA-authorised entities carry weight with EU correspondent banks and MiCA host states, pragmatic enough to engage with novel fintech business models in pre-application meetings.

The 30-jurisdiction EEA passport is the headline benefit, but the operational edge is the euro. Malta sits inside the eurozone, so SEPA and SEPA Instant settlement are domestic, not cross-border, an ongoing cost advantage over EMIs based in non-eurozone EEA jurisdictions such as Sweden, Denmark or Poland.

Under MiCA, an authorised EMI can issue Electronic Money Tokens by notifying the MFSA, which receives but does not formally approve the whitepaper. For founders building euro- or USD-pegged stablecoin rails, Malta lets you anchor both the EMI and the EMT under one regulator instead of stitching together authorisations across two jurisdictions.

English is an official working language of Malta alongside Maltese. Legislation is enacted bilingually, while MFSA correspondence, audit reports and the regulator’s pre-application meetings run in English; court proceedings default to Maltese but are conducted in English by consent of the Maltese-speaking parties under the Judicial Proceedings (Use of English Language) Act, Cap. 189 — the practice in most commercial matters. The legal system is a civil-law/common-law hybrid, with common-law overlay in fiscal, corporate, shipping and trust law from the British colonial era, which reduces translation friction for UK, US, Irish, Indian and Commonwealth-domiciled founders. Big-Four and mid-tier auditors, Maltese-warranted advocates, and fintech-experienced compliance officers are all available in-market.

Malta’s nominal corporate rate is 35%, but the full imputation system delivers an effective rate of ~5% on trading income via the 6/7 shareholder refund on dividend distribution. Malta is the only EU member state operating a full imputation system, so this is an EU-internal tax outcome, not an offshore shelter. Groups that prefer a flat rate can elect the FITWI regime (15% final tax) introduced in September 2025.

The defining activity of an EMI is issuing electronic money: monetary value stored electronically against funds received from the holder, redeemable at par, and accepted by third parties. The legal basis is EMD2 (Directive 2009/110/EC), transposed into Cap. 376 and supplemented by the MFSA FIR/03. Funds received against e-money are not deposits and cannot be lent. They sit under the safeguarding regime at all times.

A Malta EMI may, alongside e-money issuance, elect any of the payment services in Annex I of PSD2 (Directive (EU) 2015/2366), transposed into Cap. 376:

• Cash placement and withdrawal on a payment account, including all related operations.
• Execution of payment transactions: direct debits, card payments and credit transfers, whether funded by the user’s balance or by a credit line.
• Issuing and/or acquiring of payment instruments: card issuing, wallet issuing, merchant acquiring.
• Money remittance: transfer of funds without a payment account in the payer’s or payee’s name.
• Payment initiation services (PIS): initiating a payment order at the user’s request from an account held at another PSP.
• Account information services (AIS): consolidated account information from one or more PSPs.

Cap. 376 also permits a closed list of ancillary services tied to the EMI’s core scope: foreign exchange in connection with payment services, safekeeping activities and storage and processing of data related to payment services, and the operation of payment systems. Ancillary credit may be granted only where it is strictly incidental to a payment transaction: short-term, never granted from funds received against e-money or from safeguarded payment-service funds, and consistent with the EMI’s own funds. Standalone lending and deposit-taking remain outside the licence.

Under Regulation (EU) 2023/1114 (MiCA), an authorised EMI may issue Electronic Money Tokens without a separate crypto-asset licence, provided it continues to satisfy Cap. 376 in full and complies with the MiCA EMT regime mapped out in the MFSA MiCA Rulebook. The whitepaper is not formally “approved” by the MFSA. The issuer notifies the Authority within the lead times below.

The Instant Payments Regulation extends SEPA Instant to every eurozone PSP on a phased schedule, with separate timetables by PSP type: eurozone credit institutions must be able to receive SEPA Instant credit transfers from 9 January 2025 and send them from 9 October 2025, while eurozone payment institutions and EMIs have a single deadline of 9 April 2027 for both receive and send. Verification of Payee (VoP) applies to all eurozone PSPs (including EMIs) from 9 October 2025, with later deadlines for non-eurozone PSPs. In 2025 the MFSA amended FIR/03 to set out the procedure for PIs and EMIs to participate in designated payment systems supporting instant credit transfers. A Malta EMI moving euro flows now plans for SEPA Instant access at authorisation, not as a later upgrade.

A Malta EMI must hold a minimum initial capital of €350,000, fully paid-up before the licence is issued. The figure derives from Article 4 of EMD2 (Directive 2009/110/EC) and is transposed into Cap. 376 and FIR/03. MFSA verifies the deposit at the in-principle approval stage. Capital is injected once the application has cleared substantive review, alongside the other pre-licensing conditions (banking, premises, key personnel).

If the entity will not issue e-money and instead seeks a Payment Institution (PSP) authorisation under Cap. 376 transposing PSD2 Article 7, the initial capital scales to the activity mix:

An EMI authorisation supersedes these PSP tiers: the €350,000 EMI threshold applies regardless of which PSD2 services are bundled into the licence.

EMD2 Article 5 and FIR/03 require Malta EMIs to hold own funds at all times equal to the higher of (i) the €350,000 initial capital floor, and (ii) the calculated own-funds requirement under FIR/03: broadly 2% of average outstanding electronic money, plus, where the EMI also carries out payment services unrelated to e-money issuance, additional Method A / B / C scaling from PSD2 (commonly 0.25%–4%). The calculation is recomputed on each reporting cycle. Any shortfall must be remediated immediately, and an own-funds breach is a supervisory trigger.

The €350,000 must be paid-up share capital deposited with a Maltese credit institution and evidenced to MFSA before licence issuance. It cannot be commingled with client funds, which sit separately under the safeguarding rules (see the Ongoing Compliance section). Securing a Maltese banking relationship for the capital account is one of the more time-sensitive pre-licensing tasks and should be scoped from week one of the engagement.

The business plan must explain the target customer, product mix, distribution model, programme of operations across the requested PSD2 / EMD2 activities, organisational structure and reporting lines, and the planned Maltese substance: head office, on-island staffing and the board and committee architecture. Every other document (capital plan, AML risk assessment, IT policy) ties back to it.

Financials run on a three-year horizon (P&L, balance sheet and cash-flow statements), with stress-testing scenarios that demonstrate the EMI can meet the ongoing own-funds requirement under adverse conditions. Volumes of e-money outstanding and payment transactions should be modelled month-by-month so the MFSA can assess capital adequacy and safeguarding capacity at submission.

The MFSA expects a full internal control framework, not template documents lifted from another jurisdiction. Each policy must be tailored to the applicant’s business model and reflect Maltese law, FIR/03 and the relevant EU Regulations. The core suite includes:

• AML/CFT manual: risk-based methodology, customer due diligence, ongoing monitoring and STR procedures aligned with the PMLFTR and FIAU Implementing Procedures.
• Safeguarding policy: chosen method — segregation (by deposit in a credit institution or investment in secure, liquid, low-risk assets) or insurance / comparable guarantee — and operational controls evidencing daily reconciliation.
• Conflicts of interest policy: identification, mitigation and disclosure across board, shareholders, agents and outsourcing providers.
• Complaints handling procedure: intake, escalation, regulator reporting and customer-facing disclosure.
• Outsourcing policy: critical-and-important function identification, due diligence, contract minimums and exit plans.
• IT and security policy: mapped to DORA (Regulation (EU) 2022/2554) requirements on ICT risk management, incident reporting, resilience testing and third-party ICT oversight.

Personal Questionnaires are submitted via the MFSA LH Portal at least one month before appointment and are required for all proposed directors, qualifying shareholders and key function holders (Compliance Officer, MLRO and equivalent roles). PQ scope covers:

• Qualifying shareholders: any holder of ≥10% of capital or voting rights.
• Ultimate beneficial owners further up the ownership chain.
• Chairperson and all directors (executive and non-executive).
• Chief officers (CEO, CFO, COO and equivalents).
• Compliance Officer and the MLRO.
• Internal auditor and other key function holders.

Each PQ is supported by certified passport, proof of address, CV, professional references, regulatory references where the candidate has prior FS roles, and a clean police-conduct certificate. MFSA assesses the file against the MFSA Fitness & Properness Guidance and the MFSA PQ Guidelines. Weakness in any individual PQ is the most common cause of avoidable delay.

Under FIR/03, the licence holder’s business must be effectively directed from Malta by at least two individuals serving as executive directors and/or senior management, and the board must comprise at least three members, including at least one Independent Non-Executive Director (INED). This is not codified as “two local directors”, but the practical evidence the MFSA expects is mind-and-management actually carried out on-island, typically a Malta-resident director (or directors) supported by local key personnel. Additional non-executive directors and an independent chair are normal, proportionate to the size and risk profile of the EMI.

A 10% holding of capital or voting rights (direct or indirect) makes a person a qualifying shareholder and triggers a full MFSA fitness assessment. The threshold matches the EU CRD-style transposition into the Financial Institutions Act (Cap. 376). Subsequent changes that cross the 20%, 30% or 50% thresholds, and any change of control, also require prior MFSA notification and approval. Personal Questionnaires, source-of-funds evidence and ultimate beneficial-owner disclosures must be lodged for every qualifying shareholder.

The fit-and-proper assessment under the MFSA Fitness and Properness Guidance applies to directors, qualifying shareholders, key personnel, the MLRO and the internal auditor. The MFSA examines competence and experience (relevant payments, EMI or financial services background), reputation and integrity (criminal, regulatory and civil record), independence of mind, and conflicts of interest. Adverse findings against any one person on this list can hold up the whole application until the individual is replaced or the concern is resolved.

The MLRO is an MFSA-approved officer, not an internal hire the EMI makes unilaterally. Prior MFSA approval is required before the MLRO takes up the role. The MFSA Guidance for Money Laundering Reporting Officers in the Financial Services Sector (14 March 2024) sets out what the regulator expects: adequate AML/CFT experience, sufficient seniority and authority within the organisation, independence from commercial functions, and a direct reporting line to the board. A Personal Questionnaire is submitted via the LH Portal in good time before the proposed start date to allow for the MFSA’s due-diligence process on the role.

Safeguarding of e-money holders’ funds is governed by Article 7 of EMD2 and, at Maltese level, by the Financial Institutions Act (Safeguarding of Funds) Regulations (S.L. 376.04). The framework offers two permitted methods — segregation or insurance — and Malta EMIs must document which method (or combination) they rely on and how it operates in practice.

1. Segregation: client funds are kept separate from the EMI’s own funds, either by depositing them in a separately designated account at an authorised credit institution, or by investing them in secure, liquid, low-risk assets held in a separately designated custody account. In both cases the funds are ring-fenced from the EMI’s general estate and from insolvency creditors.
2. Insurance policy or comparable guarantee: coverage from a credit institution or insurance undertaking that does not belong to the EMI’s group, payable to e-money holders if the EMI fails to meet its obligations.

The full text of S.L. 376.04 is available on legislation.mt; the EMD2 baseline is summarised by the FCA.

A Malta EMI is a “subject person” under the PMLFTR and must run a full risk-based AML/CFT programme: business-wide risk assessment, customer due diligence, ongoing monitoring, sanctions screening, training and an MLRO function with a direct reporting line to the board. Suspicious Transaction Reports and Suspicious Activity Reports (STRs / SARs) are filed to the FIAU through the goAML Malta portal; the MFSA acts as agent of the FIAU for supervisory purposes on the prudential side.

Customer identification, transaction and due-diligence records must be retained for a minimum of 5 years and no more than 10 years after the end of the business relationship or completion of the occasional transaction, per the PMLFTR and FIAU Implementing Procedures Part 1 (2025).

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to Malta EMIs since 17 January 2025. The four pillars an EMI must build into its operating model are: ICT risk management (governance, identification, protection, detection, response and recovery); ICT-related incident reporting on the supervisory timeline; digital operational resilience testing, including threat-led penetration testing for significant entities; and third-party ICT risk oversight, including a register of contractual arrangements and contractual safeguards with critical providers.

Beyond AML and ICT, Malta EMIs file periodic prudential and statistical returns to the MFSA under the reporting obligations in Chapter 3 of the Financial Institutions Rulebook (FIR/03), submitted via the consolidated FI Return jointly designed by the MFSA, the Central Bank of Malta and the FIAU. The reporting package covers the balance sheet, income statement and capital-adequacy templates (tracking own funds against the higher of €350,000 and the calculated FIR/03 requirement), alongside audited annual financial statements and the interim data the MFSA uses for off-site supervision.

The compliance and reporting calendar is fixed and was clarified by an MFSA Circular dated 27 January 2026. The annual external audit is mandatory with no size-based exemption: MFSA-regulated EMIs cannot claim audit relief regardless of balance-sheet size.

Freedom of Services (FoS) lets you serve customers in another EEA state without any local presence. Freedom of Establishment (FoE) means operating through a branch in the host state, and (where the EMI also uses agents under right of establishment) the host may require a Central Contact Point under PSD2 Article 29(4) and the related EBA RTS.

EMIs may also extend their reach in other Member States through agents (for payment services, governed by PSD2 passporting rules applied mutatis mutandis via EMD2 Article 3(1)) and distributors (for the distribution and redemption of e-money under EMD2 Article 3(4)–(5)). Each agent or distributor must be notified to the MFSA, which in turn notifies the host-state authority. The EBA Opinion on passport notifications for e-money agents and distributors clarifies that these notifications are a form of passporting in their own right and must follow the established passport notification procedure.

All three routes (branch, services and agents/distributors) flow through the MFSA as home-state competent authority. The institution files a passport notification with MFSA specifying the host state(s), the services to be provided, and (for branches and agents) the local arrangements. MFSA reviews the file, then transmits it to the host competent authority within the statutory window set out in EMD2 and PSD2. Once the host authority confirms receipt and the home authority registers the passport, the institution can commence activity in the host state.

A single Malta EMI authorisation reaches 30 EEA jurisdictions: the 27 EU Member States plus the three EEA EFTA states (Iceland, Liechtenstein and Norway). Combined population is approximately 456 million consumers: the EU stood at ~450.4 million on 1 January 2025 per Eurostat, with the EEA EFTA trio adding roughly 6 million more.

A Malta-resident EMI is subject to corporate income tax at the standard 35% rate on its worldwide chargeable income (2026). The Malta Tax and Customs Administration administers the regime under the Income Tax Act. See the MTCA corporate tax overview for the current rates and filing mechanics.

Malta is the only EU member state still operating a full imputation system. The 35% tax paid at company level is imputed as a credit to shareholders on dividend distribution, and the company can claim a refund of 6/7, 5/7 or 2/3 of the Malta tax depending on the income type. For trading income (which covers most EMI fee revenue) the 6/7 refund typically brings the effective Malta tax burden down to around 5% for non-electing companies. This remains the default position for most EMI and fintech start-ups in 2026.

Introduced by Legal Notice on 2 September 2025 and effective from year of assessment 2025 onwards, the Final Income Tax Without Imputation (FITWI) regime lets any Maltese entity elect a flat 15% final tax with no shareholder refunds and no imputation credits. The election carries a 5-year lock-in, and switching back out of FITWI re-locks the company under its previous regime for a further 5 years, so the decision turns on the full distribution policy rather than a single year.

Malta has invoked the six-year derogation in Article 50 of the EU Pillar Two Directive, deferring the Income Inclusion Rule (IIR) and Undertaxed Profits Rule (UTPR) until financial years starting on or after 31 December 2029. As of early 2026, no Qualified Domestic Minimum Top-up Tax (QDMTT) has been enacted, and none is expected to be introduced in 2026, although Malta is consulting the European Commission on a regime of qualified refundable tax credits. In-scope multinational groups with consolidated revenues above €750 million remain within the global Pillar Two perimeter (top-up tax may be collected by another jurisdiction) but face no Maltese domestic top-up tax for now. Sub-threshold EMIs continue to apply the imputation or FITWI regimes described above.