Malta Investment Services Licence: Categories, Capital and Requirements

Start with the activity, not the company

The business plan says “investment advice”, but the operating model also routes orders and may touch client cash. That is the moment to stop treating the licence as a company-formation formality. In Malta, the permission follows the activity, client type, instruments and custody model.

The starting rule remains that a person may not provide, or hold itself out as providing, an investment service in or from Malta without a valid investment-services licence, unless a statutory exemption, passporting regime or other applicable route applies. The MFSA supervision page now distinguishes current rulebooks from superseded versions, so the filing-date version matters.

Which Malta licence category fits?

The familiar Malta taxonomy contains Categories 1A, 1B, 2, 3, 4A and 4B. These are activity and custody labels. They are not the same thing as the current prudential Classes 1, 1 Minus, 2 and 3 used for MiFID firms under the Investment Firms Regulation and Directive framework.

Category 1A is traditionally associated with receiving and transmitting orders, investment advice and/or placing instruments without a firm commitment, without holding or controlling client money or customer assets. It excludes collective-investment-scheme managers, and the actual permission remains limited to the instruments and services written into the licence.

Category 1B has a similar non-custody profile but is limited to receiving and transmitting orders and/or providing investment advice for professional clients and/or eligible counterparties. That client segment must be established and managed properly; it is not simply a marketing label.

Category 2 traditionally permits a wider range of investment services and the holding or control of client money or customer assets, but excludes operating a multilateral trading facility, dealing on own account and underwriting or placing instruments on a firm-commitment basis. Category 3 is broader, permitting any investment service and the holding or control of client money or customer assets, subject to the licence conditions and current prudential rules.

Categories 4A and 4B are legacy labels for collective-investment-scheme custody or depositary functions. Current MFSA materials use Depositary and Depositary Lite terminology. Depositary Lite is associated with specific eligibility conditions, including certain third-country AIF marketing situations and AIFs with no redemption rights for five years that generally do not invest in assets requiring custody. The current depositary rulebook should control the application.

Client assets change the capital and control model

The practical dividing line is often whether the firm holds or controls client money or client securities. Advice, order transmission or portfolio management without that control may fit a lower-capital profile, while custody, settlement or safeguarding arrangements can move the business into a different permission and prudential class. Brokerage, execution and portfolio management therefore cannot be classified from their marketing description alone.

The current March 2026 Part BI rulebook sets out €75,000 for specified non-custody services, €150,000 for those services where client money or client securities are held, and €750,000 for higher-capital activities such as own-account dealing and firm-commitment underwriting or placing, subject to the detailed provisions. These are minimum initial-capital bands, not a complete launch budget.

Ongoing own-funds needs can exceed opening capital. The relevant analysis may include fixed-overheads requirements, K-factors, liquidity, capital buffers, reporting and the firm’s prudential Class. The current Part BI rulebook applies to MiFID firms and expressly does not apply to UCITS fund managers, AIFMs or custodians, which follow separate rulebooks.

The €125,000 AIFM, UCITS management-company and de minimis AIFM figures, and the €730,000 Depositary and €125,000 Depositary Lite figures found in the older Part A table should not be presented as current filing figures without checking the current fund-management and depositary rulebooks. The MFSA changed the depositary framework on 24 March 2026 and amended investment-services rulebooks again on 30 April and 6 August 2026.

What the MFSA will assess

The fit-and-proper assessment covers integrity, competence and solvency. The MFSA may also consider investor protection, Malta’s reputation, competition and choice, and information it obtains independently of the application. The exercise is therefore broader than checking whether a proposed director has held a similar job before.

The 2023 rulebook described personal questionnaires for directors, senior managers, the CEO or equivalent, the MLRO, the Compliance Officer and other key functionaries. For a new filing, however, applicants should use the current MFSA application pack and suitability assessments rather than assume that the older questionnaire wording is the complete process.

Governance should be designed alongside the commercial model. The application should make clear who is accountable for compliance, AML/CFT, risk management, internal controls, conflicts, complaints, record-keeping, outsourcing, ICT and operational resilience. The question the MFSA will reasonably ask is simple: who will actually perform and oversee each control once the firm is live?

The current MFSA application process

The current MFSA authorisations page directs investment-firm applicants to the revised New Authorisation Process. The sequence begins with a submission of intent and continues through the LH Portal, using the current investment-firm application form and supporting materials such as the AX01 Corporate Questionnaire, AX02 Involvement Suitability Assessment, AX03 Third Party Outsourcing Assessment and AX05 Digital Operational Resilience Assessment.

Depending on the structure, the current application materials may also require information on source of wealth and source of funds, ICT third-party arrangements, outsourcing, financial resources, trading venues or tied agents. The precise pack depends on the proposed permission; a founder should not treat incorporation documents as the application dossier.

The older Part A rulebook described preparatory, pre-licensing and post-licensing or pre-commencement phases and stated that in-principle approval could be valid for three months. That remains useful historical context, but the current submission-of-intent and LH Portal process should be treated as the starting point for a filing on or after 1 October 2026. In-principle approval is not permission to begin business.

Once authorised, the obligations continue. Investment firms must meet ongoing prudential, conduct, AML/CFT, record-keeping, reporting and governance requirements. A 5 May 2026 MFSA enforcement notice records a €20,776 settlement penalty for late audited financial statements, quarterly reporting and other regulatory information; it is a case-specific enforcement outcome, not a standard tariff.

Passporting across the EU and EEA

A Malta-authorised MiFID firm may generally provide authorised services in another EU or EEA state through the freedom-to-provide-services route, by establishing a branch or through a tied agent. The MFSA publishes Schedule DI for freedom of services and Schedule EI for branch and tied-agent arrangements.

The route depends on the services covered by the Malta licence, the target states, whether there is a physical establishment, whether a tied agent is used and the applicable host-state conduct requirements. Passporting is therefore a notification and supervisory process, not a blanket permission to offer every product everywhere.

Family office, holding company or regulated firm?

A family office, holding company or investment vehicle is not automatically an investment-services provider, but its name does not decide the perimeter. Advising or dealing for others, managing portfolios, receiving orders, marketing to external investors, controlling external client assets or delegating regulated functions can change the analysis.

The MFSA describes a conditional NPIF route for a family-office vehicle investing private wealth without raising external capital. Where the NPIF is managed by a Malta-based exempt fund manager, each qualifying or professional investor must invest at least €5 million, and the investors within the overall family-office structure must collectively have aggregate net assets exceeding €50 million. The €50 million test is assessed on a look-through basis.

Those thresholds apply to that particular NPIF family-office route. They do not create a general exemption for a multi-family office, external asset manager or business serving third-party investors. The post-28 April 2026 NPIF rulebook and any related confirmation, due-diligence and ongoing obligations should be checked before relying on the structure.

Fund managers, AIFMs, UCITS management companies, depositaries and outsourced service providers may follow separate authorisation routes and rulebooks. A fund manager should therefore not automatically be described as a Category 2 or Category 3 MiFID firm simply because it manages investment assets.

Tax and Malta substance: keep the concepts separate

The Malta Tax and Customs Administration states that Maltese companies are generally subject to 35% corporate tax on worldwide income and capital gains, while the wider system includes exemptions, refunds and other mechanisms subject to detailed conditions. That headline rate does not predict a particular company’s effective tax outcome.

A Malta incorporation or investment-services licence does not, by itself, answer the separate questions of tax residence, management and control, economic substance, treaty access or shareholder-level taxation. Those issues should be analysed against the entity’s actual activities, decision-making, income, shareholders, residence, treaty position and anti-avoidance rules.

A practical filing checklist

Before approaching the MFSA, prepare a permission matrix covering every service, instrument, client category and jurisdiction. Decide who holds money and securities, identify the intended prudential Class, map settlement and outsourcing arrangements, and document the people responsible for each control.

Then assemble the current application form, corporate questionnaire, suitability assessments, outsourcing and digital-operational-resilience materials, financial projections, capital evidence, governance chart, AML/CFT framework, ICT arrangements and pre-commencement plan. The current MFSA application page should be treated as the checklist, not an older PDF remembered from a previous filing.

The sensible next step is a written perimeter and licensing memo based on the intended business model, followed by preliminary engagement with the MFSA and advice from Malta regulatory and tax counsel. That sequence is usually more efficient than incorporating first and discovering that the proposed service, custody model or management structure belongs in another regulatory lane.

Questions people ask

Does incorporating a Maltese company create an investment-services licence?

No. The company must separately assess whether its activities constitute investment services and obtain the required MFSA authorisation or rely on a clearly applicable statutory route. Incorporation alone does not authorise advice, dealing, portfolio management or custody.

Is Category 3 always the best licence for a broad investment business?

No. Category 3 is the broadest traditional category described in the legacy taxonomy, but the correct route depends on the services, instruments, client types, custody model and current prudential framework. A broader permission can also mean greater capital, governance, reporting and operational obligations.

Are €75,000, €150,000 and €750,000 the total amount needed to launch?

No. They are current MiFID minimum initial-capital bands in the March 2026 Part BI rulebook. Ongoing own-funds requirements, fixed overheads, K-factors, liquidity, buffers, staffing, technology, compliance and reporting can require substantially more funding.

Are Categories 4A and 4B still the complete description of Malta’s depositary regime?

No. They are legacy labels. Current MFSA materials use Depositary and Depositary Lite terminology and apply more specific eligibility and operational conditions. Check the depositary rulebook in force when filing.

Can a family office operate without an investment-services licence?

Sometimes, but there is no general family-office exemption. For the particular NPIF route involving a Malta-based exempt manager, qualifying or professional investors must invest at least €5 million each and the relevant family-office structure must meet the aggregate-net-assets test exceeding €50 million on a look-through basis, alongside other conditions.

Can a Malta investment firm passport services across the EU and EEA?

Generally, a Malta-authorised MiFID firm can use freedom of services, a branch or a tied-agent route for services covered by its authorisation. The correct notification and host-state requirements depend on the target state and operating model.

Does an MFSA licence guarantee a particular Malta tax result?

No. Regulation and taxation are separate analyses. The company’s activities, management and control, income, shareholders, residence, treaty position and applicable tax rules must be assessed independently.