The MFSA Payment Institution Route, Laid Out Honestly

Read this first

Two facts that reframe every Malta pitch

First, the statutory clock cuts against you. Article 5(2) gives the MFSA three months from receipt of a complete application - or from the submission of the information it requires, whichever is later - and Article 5(5) deems a missed deadline a refusal, not an approval. The clock protects the regulator, not the applicant.

Second, a 100% buyout is not a shortcut past authorisation. Article 9(2) leaves it to the MFSA's discretion to treat an acquisition that makes the institution a subsidiary as a request to apply for a licence - the change-of-control filing becomes, in effect, a fresh licensing exercise.

The perimeter

What the licence covers - and what it must not touch

Article 3(1) is the gate: no First Schedule activity may be transacted regularly or habitually, in or from Malta, except by a licensed company - with account information services carved out into a registration regime. Item 4 of the First Schedule is the Second Schedule payment services: placing cash on and taking it off payment accounts, executing payment transactions, issuing or acquiring payment instruments, money remittance and payment initiation.

The perimeter guards matter as much as the list. A payment institution may only hold payment accounts used exclusively for payment transactions; the funds it receives are neither deposits nor electronic money; and credit is permitted only where ancillary to a payment transaction, repaid within twelve months and not funded from customer money. Cross any of those lines and you are in a different licence class.

One terminology note. Cap. 376 licenses "financial institutions", and a payment institution is one licensed for Second Schedule services. "Authorised Payment Institution" and "API" are market usage, not statutory class names - read the register for the exact service list.

Capital classes

EUR 20,000 to EUR 125,000 - and the EUR 350,000 question

Initial capital follows the service class, per the table in Chapter 3 of the Rulebook: EUR 125,000 for payment services 2(a) to 2(e), EUR 20,000 for money remittance only, EUR 50,000 for payment initiation only. These are the PSD2 minima with no Maltese gold-plating - though the MFSA may set a higher figure for services across multiple Schedules.

E-money issuance is the EUR 350,000 question. The EMI variant lives under the same Act and Rulebook chapter, at nearly three times the capital of a full payment institution. Whether your model needs it - stored value against pure processing - is the decision we take apart in Malta EMI vs payment institution.

Ongoing own funds are the higher of initial capital or Method B, the Rulebook's default: a sliding scale from 4% to 0.25% across slices of one-twelfth of the prior year's payment volume, scaled by 0.5 for remittance-only firms. The MFSA may direct Method A (10% of fixed overheads) or Method C instead, and may flex the figure by 20% either way. An EMI instead holds the higher of EUR 350,000 or 2% of average outstanding e-money. At least 75% of own funds must be CET1, and payment-initiation applicants carry professional indemnity insurance per Annex II of Chapter 1.

Safeguarding

Your own name, no intermediaries

Article 10B of the Act, the Safeguarding of Funds Regulations (S.L. 376.04) and Chapter 3 require every euro received from payment service users to be safeguarded. The deposit method needs a credit institution authorised in an EU Member State, or a Malta branch of a third-country one - and the safeguarding account must be opened directly, in the licence holder's own name. The Rulebook says it plainly: intermediaries such as e-money institutions or payment institutions may not be used.

The alternatives are equally prescriptive: investment in listed debt of EU governments or central banks (or MFSA-approved equivalents), or an insurance policy or comparable cover from an EU-authorised insurer or credit institution outside your group. Funds received through agents count the moment the agent takes them.

Substance

The MFSA will not accept letterbox entities

Chapter 1 states the expectation in terms: Maltese financial institutions must carry out at least part of their business in Malta, demonstrate local mind and management, and "the MFSA will not accept so-called Letterbox entities". Chapter 3 localises the four-eyes principle: the business must be effectively directed from Malta by at least two individuals, as executive directors or senior management.

Fit-and-proper assessment reaches every qualifying shareholder, beneficial owner, board member, senior manager, the MLRO and the Compliance Officer - the same population re-examined when an institution changes hands. What that means in headcount:

The process as published

Five stages under Chapter 1 - and the only real clocks

The application path was rewritten on 14 October 2025, when Chapter 1 of the Rulebook replaced the 2019 rules. The statutory clock sits above it: three months to determine a complete application, deemed refusal on silence. The MFSA's Authorisation Process Service Charter adds working-level commitments - initial review feedback within six weeks on Financial Institutions Act applications, twenty working days per response iteration.

No official end-to-end duration exists beyond that. The "4 to 6 months" totals on advisory sites are their estimates, not MFSA statements - treat them as market colour.

Fee honesty

The EUR 3,500 application fee died on 1 January 2025

The superseded schedule - EUR 3,500 to apply, supervision from EUR 2,500 - still sits in a legacy 2019 rulebook PDF that remains online, and most pages ranking for this licence still quote it. It ceased to apply on 1 January 2025. The mechanics are now categorical: payment services and e-money issuance are the two "Category 2" activities, and whether you pay EUR 10,000 or EUR 15,000 to apply - and EUR 25,000 or EUR 35,000 a year - turns on holding one or both.

Adding e-money later is a licence modification at the application fee less 25%, not a second authorisation. Government fees above are the regulation's figures; SKY7 engagement fees are quoted on request.

The acquisition rail

Article 9: prior approval, no clock - and the re-licensing trap

Buying into a Maltese payment institution runs on Article 9, and its first feature is the tense: prior approval, not post-completion notification. Acquiring or disposing of a qualifying shareholding - the CRR definition, 10% of capital or voting rights or significant influence - or crossing 20%, 30% or 50%, or the institution becoming or ceasing to be your subsidiary, needs the MFSA's approval before the transaction, on written notice stating the intended size of the holding.

The Rulebook doubles the lock: any change in a licence holder's qualifying holding or beneficial-ownership structure needs the Authority's prior approval, notification is due immediately on becoming aware, and approval issues only where the incoming person passes the fitness-and-properness assessment. The institution itself needs approval before a sale, merger, restructuring or capital variation.

Then the trap. Article 9(2): where the acquisition would make the institution a subsidiary of, or subject to the control of, the acquirer, the MFSA has discretion to treat the request as an application for a licence. A 100% buyout - precisely what a for-sale mandate contemplates - can lawfully be re-run as a fresh licensing exercise: substance, people, programme of operations, the lot. This is the single most important sentence in any Maltese ready-made pitch, and the one the listings never quote. We take it threshold by threshold in the Article 9 guide.

Completing without approval has teeth: restraining orders, nullity of the transaction, suspension or nullity of the voting rights on shares acquired against opposition, and administrative penalties. And note what Article 9 omits - a decision deadline. Unlike the UK's section 178 regime, with its 60-working-day clock and deemed approval, Malta publishes no statutory window for shareholding approvals, so deal timelines cannot be anchored to one. The trade-off is in buy an EMI vs apply fresh.

The live lot

What an honest ready-made listing looks like

Our live mandate, Ready-made Maltese Authorised Payment Institution (API) for Sale, is written against the rules on this page - the Article 9 gate up front, figures traced, pricing on request. Test any listing - ours or anyone's - against Article 9(2) first: a seller who does not mention it is describing a transaction that does not exist.

European rights

The PSD2 passport is real - stated precisely

A Maltese payment institution licence carries European rights under the European Passport Rights for Financial Institutions Regulations (S.L. 376.07): the right to provide payment services in other EU and EEA states under freedom of services, through a branch, or via agents. The mechanics are codified - the MFSA forwards a complete passport notification to the host regulator within one month, tracking Article 28 of PSD2.

Precision cuts both ways. The passport is a feature of a licence once granted; it is not a promise that authorisation, or any host notification, will succeed. And it reaches the EU and EEA only - a Maltese licence does not passport into the UK, Switzerland or any other non-EU market. If your revenue map is European, that is the structural edge over the non-EU regimes; if not, the passport should not be why you pay Malta's supervision floor.

MiCA note

A payment institution gets nothing from MiCA

E-money token issuance sits with the EMI: Chapter 3 routes EMT issuers into MiCA Title IV by derogation, and a plain payment institution licence confers no MiCA rights at all. The March 2025 amendments also route outsourcing and safeguarding changes through the LH Portal sixty days before they take effect. If tokens are on the roadmap, the EMI variant is the instrument.

Enforcement

Small fines, close reading - the supervision style

The MFSA's published actions against financial institutions are not headline numbers: EUR 650 for a late auditor's management letter, EUR 7,050 for late audited financial statements, both March 2025, and a EUR 4,200 settlement over management letters in June 2026. Read them as style, not leniency - a regulator that polices filing discipline line by line, with authority to impose up to EUR 150,000 per infringement without a court hearing.

Moving target

What changed, and what is next - as of July 2026

The recent sequence matters because most secondary content predates it: Chapter 3 consolidated ongoing requirements in October 2024; the fee schedule was replaced on 1 January 2025; the MiCA rulebook and Rulebook amendments landed in March 2025; Act XI of 2025 amended Cap. 376 in May, moving ICT incident reporting into DORA; and Chapter 1 replaced the 2019 application rules on 14 October 2025.

On the horizon, the EU's PSD3/PSR package will eventually replace the PSD2 foundations of this regime; no Maltese transposition instrument exists yet, so treat it as horizon risk, not current law. Statements on this page are made as of July 2026 - verify the current texts of Cap. 376 and its subsidiary legislation on legislation.mt, and the Rulebook chapters on mfsa.mt, before committing capital.