Setting Up a Payment Institution in Malta: Licence, Capital and Process

Start with the service, not the company

You have a product, a target market and perhaps a Maltese company name ready to reserve. The uncomfortable question comes next: does the proposed business need its own Malta licence, or would passporting an existing EU permission achieve the same result with less infrastructure? That choice should come before incorporation and funding.

The Malta Financial Services Authority is the competent authority for payment institutions, which are regulated as financial institutions under the Financial Institutions Act, Chapter 376. A Maltese PI may provide authorised payment services within its approved scope, but incorporation does not itself create authorisation, regulatory substance or tax residence.

The Second Schedule services include operating payment accounts, withdrawals, payment execution, issuing and acquiring payment instruments, money remittance, payment initiation and account-information services. An account-information-only model follows a registration process rather than the ordinary PI licence route, so the service map should be settled before drafting the application.

PI, EMI, bank or passport?

A payment institution is not a bank. It may not fund its activities by accepting deposits or other repayable funds from the public. Customer funds received for payment services are dealt with through safeguarding rules, not ordinary bank-deposit treatment.

A PI may grant credit in connection with payment services, except that customer money cannot be used to fund that credit. That permission should not be confused with deposit-taking, general consumer lending or banking. The product design and funding model still need to be tested against the relevant rules.

An EMI route deserves consideration where the product will issue and redeem electronic money rather than merely execute payment services. Investment advice, dealing, portfolio management, custody, deposit-taking and crypto-asset activities should be tested separately; they should not be assumed to fit inside a PI permission.

If a group already has an authorised EEA payment institution, passporting may be more proportionate than creating a Maltese subsidiary. The MFSA confirms that an EU-regulated PSP can provide services in Malta on the basis of an EU passport, including through freedom to provide services, a branch or an agent, subject to the applicable notification framework.

Passporting is not available to a non-EEA firm simply because its parent has an international footprint. It also does not create a Maltese licence. The home-state authorisation, notification and permitted service scope remain decisive.

Legal form, Malta presence and substance

A Malta application needs an applicant with constitutional documents, proposed initial capital, a defined programme of operations and a credible plan to perform its obligations after authorisation. The MFSA assesses whether the applicant can comply on an ongoing basis, not merely whether a company has been incorporated.

There is no fixed universal headcount formula, but the current MFSA rules require substantive Malta presence. At least part of the business must be carried out in Malta, and the applicant must explain its local mind and management, the personnel directing the business from Malta, and the key function holders and internal control functions it intends to appoint or establish locally.

The MFSA expressly states that it will not accept letterbox entities and will scrutinise heavy outsourcing, including intra-group outsourcing. A technology provider can support the model, but it cannot substitute for local direction, control capability and an applicant that can discharge its regulatory responsibilities.

The MFSA will examine qualifying shareholders, beneficial owners, directors, senior managers, MLROs, compliance personnel, key function holders and other persons able to influence the applicant. Due diligence and fitness-and-properness assessment are part of the authorisation analysis, alongside source of funds and the proposed governance structure.

Capital: the entry point, not the budget

The standard minimum initial capital is €20,000 for a PI providing only the relevant money-remittance service, €50,000 for payment initiation services and €125,000 for the core payment services in paragraphs 2(a) to 2(e) of Malta’s Second Schedule.

Those figures are only statutory entry thresholds. Payment institutions must hold the higher of the applicable initial-capital amount or the own-funds amount calculated under the relevant method. The MFSA may also set a higher initial-capital requirement where services from multiple schedules are proposed.

The applicable own-funds calculation may depend on the method selected or imposed, including fixed overheads and payment volume. A €125,000 figure should therefore never be presented as the likely total funding requirement for a live business.

The applicable fee legislation provides for a €3,500 application and processing fee and an annual supervision fee calculated at 0.0002 of total assets, subject to a €2,500 minimum. Verify the current regulations before filing and budget separately for professional advice, audit, staffing, technology, banking, safeguarding and implementation.

What the MFSA application must prove

The core pack includes a programme of operations, constitutional documents, proposed capital, a business plan, organisational and governance arrangements, internal controls and forecast budgets for the first three financial years. The current MFSA process also expects a preliminary presentation covering the group structure, licensable activities, flow of funds, operating model, competitive analysis, IT platform, DORA compliance, outsourcing and safeguarding.

The operational material must address AML/CFT, fraud and security, sensitive payment data, ICT security, incident procedures, business continuity and recovery. It should also cover intended agents, branches, outsourcing and participation in payment systems where relevant.

Applicants seeking payment-initiation or account-information services must hold professional indemnity insurance covering the territories in which the services are offered, or a comparable guarantee. The required amount is calculated under the applicable MFSA and EBA methodology, and the cover must be maintained on an ongoing basis.

The MFSA’s authorisations guidance highlights shareholding, methods of operation, governance, key function holders, resources, safeguards, systems and controls, financial planning and source of funds. Expect questions about who is funding the business, who controls it and whether the proposed people can operate it safely.

Safeguarding is central to the model

Customer funds received for specified payment services must be safeguarded under the applicable regulations and kept separate from the institution’s own money. Where the separate-account method is used, funds still held by the end of the following business day generally must be deposited in a separate account or invested in secure, liquid, low-risk assets, subject to the permitted insurance or comparable-guarantee alternative.

Current rules distinguish client funds from fees and other non-client amounts. Fees deducted from client funds and other amounts are to be transferred out of the segregated account as frequently as practicable throughout the day, while reconciliation, access controls, insolvency insulation and the safeguarding account arrangements must be documented and maintained.

Safeguarding should not be described as deposit insurance. The MFSA’s Depositor Compensation Scheme concerns depositors of failed licensed banks, while payment-institution customer funds are addressed through safeguarding and insulation against claims by other creditors, particularly in insolvency.

Technology, outsourcing and DORA

Payment institutions fall within DORA’s scope, which has applied since 17 January 2025, subject to the Regulation’s detailed provisions and any entity-specific proportionality or exemption treatment. The current MFSA rules also require payment institutions to comply with DORA and relevant ICT and security-risk guidance.

The MFSA application requirements connect DORA with ICT-risk arrangements, incident reporting, critical operations, continuity and recovery plans, response procedures and regular testing. DORA should be read with the current technical standards, implementing measures and supervisory guidance rather than treated as a one-time policy document.

Agents, branches and outsourced providers can be part of the operating model, but they must be disclosed where required, governed and monitored. The regulated PI remains accountable for the control environment and for the services delivered under its authorisation.

Timing and the formal launch sequence

The MFSA’s formal decision period is three months from receipt of a formal and complete application. In any event, the Authority must determine the relevant application within six months of its initial receipt. These are statutory determination periods, not a guaranteed authorisation-to-launch timetable.

The current process includes a preliminary meeting, an in-principle approval stage, pre-licensing conditions, the issue of the licence, post-licensing conditions and a commencement-of-business letter. An in-principle approval is therefore not the same as permission to begin accepting client orders.

A sensible sequence is to map every intended service, compare PI, EMI, passporting and agent routes, confirm the ownership chain and source of funds, then design governance, safeguarding, AML/CFT, ICT and outsourcing controls. Only after that should the group finalise the Maltese structure, fund the applicant and submit a complete pack.

After in-principle approval, the applicant may need to finalise constitutional documents, recruit identified key functionaries, evidence capital, execute outsourcing agreements, appoint required control holders and satisfy other pre-licensing conditions. After licensing, it must demonstrate that its safeguarding bank arrangements, policies, agreements, systems, employees and contact arrangements are ready before the MFSA issues the commencement-of-business letter.

Life after authorisation

Post-authorisation obligations include maintaining governance and controls, safeguarding and reconciliation, AML/CFT compliance, regulatory reporting, audits, ICT resilience and oversight of agents and outsourcing. Current FIR/03 also provides for safeguarding audits, prudential returns and ongoing ICT and DORA requirements.

A PI providing payment-initiation or account-information services must continue to maintain the required professional indemnity insurance or comparable guarantee and review the required amount under the applicable methodology.

Certain payment service providers whose home or host Member State is Malta may also have CESOP registration and reporting obligations for qualifying cross-border payments. Registration and payment-data reporting are separate questions, so the analysis should be performed against the transaction flows, customers and payment-service role rather than assumed from the licence alone.

Tax and VAT: avoid the headline-rate trap

Malta’s general corporate-tax framework taxes Maltese companies at 35% on worldwide income and capital gains, with a shareholder refund mechanism potentially available after distributions subject to statutory conditions. That general framework is not a payment-institution incentive and does not guarantee a particular effective rate.

Incorporation or licensing alone does not establish tax residence, entitlement to a refund, treaty treatment, fiscal-unit treatment or a particular tax outcome. Those questions depend on facts including management, ownership, distributions, classification, anti-abuse rules and the applicable legislation.

The VAT treatment of payment-related revenue should be analysed service by service. The relevant outcome can depend on the precise payment service, contractual chain, customer location and exemption provisions; financial projections should not rely on a blanket assumption that all payment revenue receives the same VAT treatment.

The decision a founder should make next

Before incorporating, prepare a one-page regulatory perimeter: every customer-facing feature, money flow, account type, use of funds, technology provider, jurisdiction and proposed revenue stream. Then ask whether the business genuinely needs a Maltese PI, or whether an existing EU licence, agent structure, EMI or different regulated permission better matches the intended operation.

For a serious application, the next workstream should bring together regulatory counsel, tax advisers, AML/CFT expertise, technology and DORA specialists, and the people who will actually own the control functions in Malta. This article is general information, not tailored legal, tax, regulatory or investment advice; check the latest MFSA rules, technical standards and fee legislation before filing.

Questions people ask

Can a Malta payment institution take deposits?

No. A payment institution may not fund its activities through deposits or other repayable funds from the public. Payment-service-user funds are handled under safeguarding rules.

Can a payment institution issue electronic money?

No. A PI may provide payment services within its authorised scope, but electronic-money issuance is an EMI activity and requires a different regulatory route.

What is the minimum capital for a Malta payment institution?

The standard thresholds are €20,000 for the relevant money-remittance-only service, €50,000 for payment initiation services and €125,000 for core payment services in paragraphs 2(a) to 2(e). The MFSA may require more where multiple regulatory schedules are involved, and ongoing own-funds requirements may be higher.

Does a Malta PI need real local substance?

Yes. There is no universal statutory headcount formula, but the MFSA requires at least part of the business to be carried out in Malta, local mind and management, and appropriate local key-function and internal-control capability. The MFSA will not accept a letterbox entity.

Do payment-initiation and account-information services require insurance?

Yes. Applicants and licence holders providing those services must maintain professional indemnity insurance or a comparable guarantee covering the territories in which the services are offered.

Can an existing EU payment institution operate in Malta?

Yes, a qualifying EEA-authorised PSP may use EU passporting through the applicable notification route, including services, a branch or an agent. That does not create a Maltese licence.

Are payment-institution customer funds covered by Malta’s depositor-compensation scheme?

They should not be presented as covered by the ordinary depositor-compensation scheme. Payment-institution balances are addressed through safeguarding and insolvency-insulation rules, while the depositor scheme concerns deposits with failed licensed banks.

How long does MFSA authorisation take?

The formal decision period is three months from a formal and complete application, with an outer six-month period from initial receipt for the relevant applications. In-principle approval, pre-licensing conditions, post-licensing conditions and the commencement-of-business letter mean that preparation and operational launch can take longer.