The Malta Financial Services Authority (MFSA) has published a revised Chapter 1 of the Financial Institutions Rulebook (FIR/01), marking an important update to Malta’s regulatory framework for financial institutions, payment providers and e-money issuers. The new chapter, which became effective upon publication, follows a public consultation process launched in August 2025 and introduces greater clarity around licensing, governance and operational requirements under the Financial Institutions Act.
The revised rulebook sets out in detail the procedures for applications, authorisation, modifications and surrender of licences. It provides a clearer definition of what constitutes financial institution activities, explicitly distinguishing them from deposit-taking business reserved for credit institutions. It also elaborates on the concept of “regular or habitual” undertaking, which determines when an activity requires licensing, and it reaffirms that institutions must not raise repayable funds from the public. Entities benefitting from exemptions, such as the limited network or electronic communications exemptions, are now required to notify the MFSA annually, with quantitative thresholds clearly set out.
A major focus of the updated Chapter 1 is on substance and governance. Applicants are expected to demonstrate local substance by evidencing effective mind and management in Malta. The MFSA will also require visibility of robust internal controls and risk management arrangements that ensure the institution operates independently and soundly. The MFSA has bolstered the pre-application presentation requirement, whereby prospective applicants must deliver a detailed overview of their business model, group structure, fund flows, projections, outsourcing arrangements and safeguarding mechanisms at least ten working days before their preliminary meeting with the Authority. This step aims to make the authorisation process more structured and transparent.
The new framework also reinforces requirements around professional indemnity insurance or equivalent guarantees, particularly for payment initiation and account information service providers. Annex II of the Rulebook provides the methodology for calculating the minimum insurance coverage, while Annex I specifies the information to be collected during the authorisation process. The MFSA reserves the right to determine initial capital requirements on a case-by-case basis, reflecting the risk profile and scale of each institution’s activities.
Post-licensing expectations have likewise been clarified. After in-principle approval, applicants must satisfy all pre-licensing conditions, such as finalising governance appointments, outsourcing contracts and client safeguarding arrangements. Once a licence is issued, institutions must complete post-commencement obligations within six to eighteen months, including internal audit or compliance reviews, system testing and operational verification. Any changes to ownership, qualifying holdings, or business model require MFSA notification or prior approval, ensuring that supervisory oversight continues throughout the institution’s lifecycle. In the case of licence surrender or cessation, firms must present a structured exit plan, settle outstanding obligations and obtain formal MFSA approval before terminating their operations.
Overall, the revised Chapter 1 delivers enhanced regulatory clarity and proportionality, balancing oversight with flexibility. The MFSA’s emphasis on local substance and the prevention of “letterbox” entities signals a firmer stance on ensuring that licensed institutions maintain genuine operational presence in Malta. For new entrants, the changes provide a clearer roadmap for authorisation, while for existing institutions they represent a call to review governance, outsourcing and insurance arrangements to ensure ongoing compliance.
The legal team at BDO is ready to assist you in your fintech journey. For start-ups, a case study of how we help clients in such can be found here. Alternatively, we would be able to align existing operations with the requirements of the revised Rulebook. Should you require any further information or assistance, the team may be contacted here.
Get in touch