Buying a Maltese payment institution: the Article 9 trap

Cap. 376 licenses a company, not a transaction. When ownership changes the licence does not move and it is not re-issued as a matter of course: the MFSA assesses the incoming owners and either approves the acquisition, approves it subject to conditions, or opposes it. That is the change-of-control route, and for most stake purchases it is the whole of the process.

The alternative is the fresh-application route the MFSA runs for a first-time licensee: a written application under Article 4(1), a three-month determination clock under Article 5(2), and - importantly - a deemed refusal under Article 5(5) if the MFSA does not decide in time. The clock there protects the regulator, not the applicant. Article 9(2) is the bridge that can push an acquisition off the first route and onto the second.

Article 9(1)(a) puts the duty on the acquirer. A person who takes, or intends to take, any action to acquire or dispose of a qualifying shareholding in a financial institution, or to increase or reduce one so that the voting rights or capital held reaches, exceeds or falls below 20%, 30% or 50%, or so that the institution becomes or ceases to be that person's subsidiary, must obtain the MFSA's prior approval. Acting without it triggers the Authority's power to oppose and to rectify.

A qualifying shareholding takes its meaning from the Capital Requirements Regulation, Article 4(1)(36): a direct or indirect holding of 10% or more of the capital or voting rights, or one giving significant influence over management. So the operative gates are 10% to begin with, then 20%, 30%, 50% and subsidiary status. Disposals are caught on the same wording - reducing or ceasing control carries its own duty.

The notice is given in advance and in writing, stating the size of the intended shareholding, on the form the Rulebook prescribes (Article 9(4)(a)). There is a corporate-side trigger too: under Article 9(1)(b) the institution itself needs prior approval to sell or dispose of its business or a significant part of it, to merge, to reconstruct, to vary its share capital, or to make a material change in voting rights.

Here is the fact that decides most Maltese deals, and the one the for-sale listings do not mention. Article 9(2) provides that where an acquisition would make the institution a subsidiary of, or otherwise subject to the control of, the person acquiring the shares, it is within the MFSA's discretion to consider whether the request constitutes a request to apply for a licence.

Read plainly: a 100% buyout does not automatically run as a light-touch change-of-control approval. The MFSA can convert it into what is, in substance, a fresh licensing exercise - the preliminary-meeting presentation, the full application file, the substance and fit-and-proper tests, the three-month determination clock and the Article 5(5) deemed refusal on silence. That is the single most important caveat on any "ready-made API" pitch.

The Rulebook does not publish the criteria the MFSA will weigh in exercising that discretion. The superseded 2019 Rulebook once said the Authority would be guided by the prudential-assessment criteria in Banking Rule BR/13; the 2025 Rulebook carries no such cross-reference, so treat BR/13 as historical practice rather than a current rule. No adviser can guarantee that a given buyout escapes Article 9(2).

What a buyer controls is the quality and posture of the file. If the MFSA does treat the request as an application, the full authorisation machinery applies, including the mandatory preliminary-meeting presentation and the six-month cap on satisfying pre-licensing conditions. Engaging the Authority early, presenting to application standard, and keeping the target's substance intact through completion are the levers that decide how that discretion resolves.

Approval under the Rulebook follows only if the incoming controller passes the MFSA's fitness-and-properness assessment (R1-3.3.1 to R1-3.3.3). The institution must notify the Authority immediately upon becoming aware of a change, and any change in the qualifying-holding or beneficial-ownership structure requires prior approval, with the notification showing the post-change holders and the percentage movements.

The fit-and-proper net is wide. It reaches every person with a qualifying holding in the institution, every beneficial owner, every board member, senior manager, the Money Laundering Reporting Officer and the Compliance Officer (R1-2.3.7). Article 9(5) adds that full particulars of anyone proposed to become - or to cease to be - a controller or director must be notified in writing, and the MFSA may order the removal of a person it finds unsuitable.

A change of control does not reset the licence conditions; it hands them to the new owner intact. A Maltese financial institution must be effectively directed from Malta by at least two individuals (R3-2.7.2), carry a board of at least three with at least one independent non-executive director and at least one Malta-resident member (R3-2.7.8), and maintain a compliance officer outside the operations, an MLRO and an independent internal-audit function.

The substance is enforced, not nominal - the MFSA states that it will not accept letterbox entities. An acquired institution may also carry unexpired obligations: post-licensing conditions can run for six to eighteen months after commencement, including a mandatory independent internal-audit report covering the first year of business (R1-2.5.3). Diligence has to price the conditions the entity is still working through, not only the permissions it holds.

Article 9 is not a courtesy filing. Acquiring or increasing control without the MFSA's prior approval, or against its opposition, exposes the transaction to restraining and restoration orders, to being treated as void, and to the suspension or nullity of the voting rights of the shares acquired (Article 9(1A) and 9(4)(b)-(c)). Administrative penalties sit on top.

The MFSA's penalty ceiling for an infringement dealt with without a court hearing is EUR 150,000 (Article 23(1)), and the Authority does impose penalties on financial institutions for administrative breaches. Orders and objections under Article 9 are appealable to the Financial Services Tribunal. No sign-now-approve-later structure survives contact with this Article.

Buyers who have run a UK deal expect a clock. Under Part 12 of the UK's FSMA 2000, the FCA has a 60-working-day statutory assessment period from a complete notice, deemed approval if it stays silent, and a one-year window to complete - the mechanics we set out in our UK section 178 guide.

Malta has the opposite shape. Article 9 and Chapter 1 set no published decision window for a shareholding approval, and silence is not deemed approval - on the fresh-application route it is deemed refusal. A Maltese deal therefore cannot be anchored to a statutory deadline, which is exactly why the file, the sequencing and the MFSA relationship carry more weight here than in London.

That is also why an operational target matters more than a shelf. SKY7's live Maltese lot, a ready-made Authorised Payment Institution, is a working institution offered through a share sale, with every change of ownership subject to MFSA approval and full buyer diligence. Pricing is on request.