Malta has for decades occupied a unique position in European financial services — a small EU member state with an outsized financial sector, driven by iGaming, aviation finance, and payment services. The Malta Financial Services Authority (MFSA) licenses and supervises payment institutions and electronic money institutions under Malta's Financial Institutions Act (FIA), which implements PSD2 and AMLD into Maltese law. For businesses seeking EU passporting capability with access to an established iGaming ecosystem, a Malta MFSA licence remains highly relevant — though the post-grey-listing regulatory environment requires a more serious compliance investment than was historically the case.
Licence Categories
Under the Financial Institutions Act 1994 (as extensively amended), the MFSA issues three categories of financial institution licence relevant to payment businesses:
Category 1: Payment Institution
A Category 1 licence covers one or more payment services as defined under PSD2, including money remittance, payment initiation services, account information services, and the execution of payment transactions. Minimum initial capital for a Category 1 PI is €20,000 for money remittance, rising to €125,000 for a full payment institution offering all regulated payment services. Category 1 licence holders can passport their services across all EEA member states — a significant commercial advantage for businesses serving European customers.
Category 2: Electronic Money Institution
A Category 2 licence covers the issuance of electronic money. Minimum initial capital is €350,000, consistent with the EMD2 requirements across all EU member states. EMIs can additionally provide payment services and can passport across the EEA. For iGaming operators needing to issue e-money to players (crediting player accounts with promotional funds, handling deposit/withdrawal e-money flows), a Category 2 licence provides the cleanest regulatory structure.
Application Requirements
The MFSA application process requires, at minimum: a detailed business plan covering the proposed services, target markets, financial projections, and technology architecture; a programme of operations; governance structure with fit and proper confirmation for all directors, shareholders with qualifying holdings (10% or more), and key function holders; AML/CFT policies, procedures, and controls; a safeguarding/segregation plan for client funds; capital adequacy demonstration; and a wind-down plan. Post-grey-listing, the MFSA scrutinises AML framework quality with particular intensity — applications with generic or incomplete AML documentation are routinely returned for resubmission.
The typical authorisation timeline for a Malta financial institution licence is 6-12 months for a well-prepared application. The MFSA operates a pre-licensing consultation process for novel business models. Applications involving crypto asset activities, complex offshore ownership structures, or high-risk sector client bases should expect more intensive review and potentially longer timelines.
The iGaming Nexus
Malta is unique globally in having both a major gaming regulator (the Malta Gaming Authority, MGA) and a major financial services regulator (MFSA) in the same small jurisdiction. This creates a natural ecosystem where iGaming operators licenced by the MGA can also obtain payment services capabilities through MFSA-licenced entities — either by the operator obtaining its own MFSA licence, or by working with MFSA-licenced payment firms already embedded in the iGaming sector.
The MGA and MFSA have a formal information-sharing arrangement, and both regulators take a coordinated approach to firms operating across the gaming-payments nexus. An MGA-licenced operator that also holds an MFSA payment licence faces dual supervisory obligations and must satisfy both regulators' AML expectations — though in practice the frameworks are complementary rather than conflicting.
Post-Grey-Listing Compliance Environment
Malta's 2021-2022 FATF grey-listing had a chilling effect on the jurisdiction's reputation, particularly for correspondent banking. Many EU and UK banks imposed enhanced due diligence on Malta-registered entities during the grey-listing period, creating material banking access difficulties. Since removal from the grey list in June 2022, the situation has improved, but the reputational impact has not fully dissipated. Payment firms and iGaming operators operating from Malta should maintain proactive communication with their banking partners about the post-grey-listing reform programme and be prepared to evidence the enhanced compliance frameworks now in place.
Passporting and EU Market Access
The most commercially significant advantage of a Malta MFSA payment licence over an FCA EMI licence (post-Brexit) is EU passporting. An MFSA-licenced EMI or PI can passport its services into all 27 EU member states by notifying the MFSA and the host state regulator. This is a significant operational and commercial advantage for businesses serving European customers across multiple markets — a single Maltese entity can serve the entire EU without requiring separate authorisation in each member state. For UK-focused businesses, the FCA licence provides equivalent coverage within the UK, but for EU-focused businesses, Malta (or another EU member state) remains the practical choice for the licensed entity.
CCYFX provides specialist banking infrastructure for complex businesses. UK, European & US IBANs, FX hedging, crypto on/off ramp, and global payouts to 180+ countries.
Speak to Our Team