Malta for operators.

Company setup

Entity types. The usual vehicle is the private limited liability company (Ltd). Its commonly cited minimum share capital is €1,165, with at least 20% paid up at incorporation (law-firm source). Public limited companies (plc) and partnerships are also available. Licensed financial firms must also meet MFSA initial capital requirements: for example, €350,000 for an EMI and €20,000 to €125,000 for a PI depending on the services (secondary source).

Time to incorporate. Unverified. The MBR's own pages give no processing time. Filing is electronic through the BAROS portal, and no notarisation is needed.

Local director. No. Maltese company law requires at least one director, with no residence or nationality requirement, and corporate directors are allowed. A company secretary is required. Source: a law-firm summary first published in 2014, so confirm before relying on it. MFSA-licensed firms face separate substance and key-function expectations.

MBR registration fees scale with authorised share capital. For electronic registration they run from €100 for capital up to €1,500 to a cap of €1,900 for capital over €2.5m. The MBR fee page cited here is labelled for commercial partnerships, so confirm the current schedule for companies. Corporate service providers are themselves MFSA-authorised. Expect bank or EMI onboarding, not incorporation, to set the timeline.

Sources: ganado.com · mbr.mt · mbr.mt · csbgroup.com

Banking & EMI access

Opening a bank account for a foreign-owned company, especially in iGaming, crypto or payments, is widely reported to be difficult in Malta. Trade press reports that from 2019 de-risking led Bank of Valletta and other institutions to close the accounts of many iGaming operators. Industry experts quoted in June 2025 estimated that only two Maltese banks can support large iGaming groups.

HSBC Bank Malta is changing hands: CrediaBank agreed in September 2025 to buy HSBC Continental Europe's 70% stake for €200m, signed in December 2025, and the CEO expects completion in Q2 2027, subject to approvals. Maltese banks face the FIAU's AML and CBAR reporting regime. Bank of Valletta was fined €2.6m in December 2021 over CBAR beneficial-ownership reporting, and BNF Bank €69,000 in March 2026 over CBAR delays.

In practice many operators use MFSA-licensed EMIs and PIs for collections, payouts and IBANs, and some market themselves to iGaming. EMI balances are safeguarded but not covered by the Depositor Compensation Scheme.

Sources: sigma.world · maltabusinessweekly.com · maltabusinessweekly.com · fiaumalta.org · maltatoday.com.mt

EMI regime & enforcement

EMIs and PIs are licensed by the MFSA as 'financial institutions' under the Financial Institutions Act 1994 (Cap. 376) and its rulebooks, and can passport across the EEA. A corporate services firm reports 36 EMIs and 30 PIs authorised as of March 2025 and 12 new EMI/PI licences in 2024. Neither figure was confirmed against the MFSA register, so treat both as unverified.

The MFSA reported 91 enforcement actions in 2025 totalling €570,673, 63 of them for late or missing statutory filings. It flagged safeguarding failures (segregation and reconciliation) at PIs and EMIs, and cancelled one financial institution's licence partly over safeguarding. Named cases: on 26 February 2025 the MFSA cancelled MTACC Ltd's licence for governance, safeguarding and non-cooperation breaches and directed a winding-up.

On 13 September 2024 it ordered Em@ney plc to stop onboarding new clients, lifting the directive on 31 January 2025. On the FIAU side, MiFinity Malta Ltd settled on 27 August 2026: an original €266,833 penalty was cut 40% to €160,099 for risk assessment, profiling and transaction-monitoring failures. Em@ney plc settled on 31 August 2026: €162,704 cut to €97,622 for CBAR reporting breaches.

MTACC Ltd was fined €52,000 on 30 April 2024 over CBAR. Voluntary licence surrenders include EFT Global Ltd (effective 11 June 2025). The MFSA's penalty regime is also being challenged in court: on 27 April 2026 the Constitutional Court ruled, in a case brought by Phoenix Payments (now Lazarus Long Ltd), that the regime likely breaches fair-hearing rights.

Earlier, in June 2024, a court annulled FIAU fines on Truevo Payments (€443,670) and Vivaro (€733,160) on procedural grounds. The FIAU introduced a settlement process in April 2026.

Sources: businessnow.mt · mfsa.mt · mfsa.mt · mfsa.mt · fiaumalta.org · fiaumalta.org · fiaumalta.org · moneylaundering.com · maltatoday.com.mt · maltatoday.com.mt · csbgroup.com

Licensed firms we track

Licence status and enforcement come from the regulator. Onboarding and sector details are only what each firm states publicly; "unknown" means it doesn't say. Check the register link before you rely on any firm.

Enforcement timeline

1. 31 Aug 2026Em@ney plc: FIAU settlement for CBAR reporting breaches lasting over 15 months: €162,704 reduced 40% to €97,622. Published 4 September 2026. source
2. 27 Aug 2026MiFinity Malta Ltd: FIAU settlement: original €266,833 penalty reduced 40% to €160,099 for breaches in customer risk assessment, customer profiling and transaction monitoring (examination in 2023 covering FY2021-2022). Published 2 September 2026. source
3. 27 Apr 2026Phoenix Payments Ltd (now Lazarus Long Ltd): In the company's challenge, the Constitutional Court ruled that the MFSA penalty regime likely breaches fair-hearing rights. The tribunal appeal is stayed pending amendment of the MFSA Act. source
4. 3 Mar 2026BNF Bank plc: FIAU administrative penalty of €69,000 for delayed CBAR submissions from April to September 2025, linked to a core banking migration. Not final; may be appealed. source
5. 26 Feb 2025MTACC Ltd: MFSA cancelled its financial institution licence for governance, client-fund safeguarding and non-cooperation breaches, and directed a court winding-up. The firm could not cover its dues. Not appealed. source
6. 13 Sept 2024Em@ney plc: MFSA directive to stop onboarding new clients and report weekly to the MFSA and an appointed Inspector, over governance and internal controls. Lifted 31 January 2025. source
7. 29 Jun 2024Truevo Payments Ltd: A Maltese court annulled the FIAU's €443,670 penalty (imposed in 2021) on procedural grounds. Date is the press report date. source
8. 30 Apr 2024MTACC Ltd: FIAU administrative penalty of €52,000 and a reprimand for late CBAR submissions (19 times in 2022). source
9. 5 Jun 2023Papaya Ltd (Blackcat): FIAU administrative penalty of €279,756, plus a reprimand and follow-up directive, for risk assessment, customer purpose and source-of-wealth failures. Date is the press report date; the penalty was reported as not yet final at the time. source
10. 23 Dec 2021Bank of Valletta plc: FIAU administrative penalty of €2.6m for failing to report beneficial ownership of 2,442 corporate customers to CBAR. Date is the press report date; the fine was issued the week before. source
11. 2 Oct 2021Phoenix Payments Ltd (now Lazarus Long Ltd): FIAU administrative penalty of €435,576 over crypto-related AML breaches, as reported on this date. AML Intelligence later cited €454,293. Upheld on appeal by Malta's top court in November 2024. source
12. 1 May 2021Em@ney plc: FIAU administrative penalty of €359,339 for CDD and EDD failures, as reported on this date. Em@ney disputed the findings. source
13. 11 Mar 2021Phoenix Payments Ltd (now Lazarus Long Ltd): MFSA administrative penalty of €32,400 and licence restriction (no new services to existing clients). Appealed. source

Crypto (MiCA)

Malta was an early mover with its own Virtual Financial Assets (VFA) Act regime from 2018. It notified ESMA of an 18-month MiCA transitional period. In a Dear CEO letter dated 25 June 2026, the MFSA and FIAU confirmed that transitional measures for VFA licence holders end on 30 June 2026.

Firms without a CASP licence by then had to stop onboarding and marketing, wind down client positions, and not delegate custody to non-CASPs. Early MFSA MiCA authorisations include Foris DAX MT Ltd (Crypto.com, announced 27 January 2025), OKX (licence received 27 January 2025, after pre-authorisation on 22 January 2025) and Gemini (20 August 2025). In July 2025 the MFSA register listed four CASPs: BP23 (Bitpanda), Foris DAX (Crypto.com), Okcoin Europe (OKX) and Zillion Bits.

A secondary reading of ESMA's interim MiCA register (file dated 30 September 2026) counts 23 Malta-authorised CASPs; this was not checked against ESMA directly. An ESMA peer review published 10 July 2025 found the MFSA only 'partially met expectations' in authorising one CASP, which it did not name. CASPs filed 3,712 STRs with the FIAU in 2025, up from 1,751 in 2024.

Sources: mfsa.mt · crypto.com · prnewswire.co.uk · gemini.com · cointelegraph.com · unknowngravity.com · maltabusinessweekly.com

Tax

Companies pay 35% on chargeable income under a full imputation system. When dividends are paid, shareholders can claim refunds: usually 6/7 of the tax on trading profits (an effective rate of about 5%), 5/7 on passive interest or royalties, 2/3 where foreign tax relief was claimed, or a full refund on participating-holding income where the participation exemption is not used. No refunds apply to income from Maltese immovable property.

Legal Notice 188 of 2025 (2 September 2025) created the optional Final Income Tax Without Imputation (FITWI) regime: a final 15% tax with no shareholder refund or credit, available from Year of Assessment 2025 and binding for 5 years once elected. Tax is the higher of 15% and the net effective tax under the normal refund system. The MTCA set a 28 November 2025 deadline for YA 2025 elections; later elections are made in the tax return (MTCA notice, 27 March 2026).

For Pillar Two, Legal Notice 32 of 2024 transposed the EU minimum tax directive, and Malta used the option to defer the IIR and UTPR (to 31 December 2029 per KPMG). No QDMTT had been introduced at that time. Malta generally levies no withholding tax on dividends, interest or royalties paid to non-residents.

Sources: internationaltaxreview.com · deloitte.com · mtca.gov.mt · mtca.gov.mt · kpmg.com

Risk lists

FATF. Not on any FATF list. Malta was placed under increased monitoring (grey list) in June 2021 and removed in June 2022, when the FATF found it had completed its action plan.

EU high-risk list. Not applicable. Malta is an EU member state, and the EU high-risk third-country list covers only non-EU jurisdictions.

MONEYVAL's 2021 follow-up rated Malta compliant or largely compliant on all 40 FATF Recommendations for technical compliance (12 C, 28 LC). Malta's sixth-round MONEYVAL evaluation date was not confirmed. Under the FIAU's 2025 figures, the unit oversaw 2,150 subject persons, received 10,712 STRs (up 13%) and imposed €1,340,242 in administrative penalties, with €13.1m in fines under appeal. Several Maltese court rulings in 2024-2026 have questioned the procedure behind FIAU and MFSA penalties.

Sources: fatf-gafi.org · fiaumalta.org · commercialriskonline.com · businessnow.mt · maltabusinessweekly.com

Regulators

• Malta Financial Services Authority (MFSA): Single financial regulator. Licenses and supervises credit institutions, financial institutions (EMIs and PIs, under the Financial Institutions Act 1994) and CASPs under MiCA, and publishes enforcement notices and the Financial Services Register.
• Financial Intelligence Analysis Unit (FIAU): Malta's financial intelligence unit and AML/CFT supervisor. Receives STRs, runs the Centralised Bank Account Register (CBAR), and imposes and publishes AML administrative penalties and settlements.
• Malta Business Registry (MBR): Company registry. Handles name reservation, incorporation and statutory filings through the BAROS portal.
• Malta Tax and Customs Administration (MTCA, Commissioner for Tax and Customs): Tax authority. Administers corporate income tax, shareholder tax refunds and the FITWI election.
• Malta Gaming Authority (MGA): Licenses remote gaming operators. It is relevant to payments because a provider that processes payments and handles player registration for a gaming operator may need its own MGA licence or approval as a material supply.
• Central Bank of Malta: Central bank within the Eurosystem. Has oversight of payment systems.