Regulatory Update in Malta: Q1 2026

Malta';s regulatory landscape has shifted considerably in recent months, with new rules affecting financial services, corporate governance, data protection, and employment. Businesses operating in or through Malta need to act on several of these changes now to avoid penalties and maintain their licences. This guide covers the most material developments in malta regulatory 2026, explains what each change means in practice, and identifies the steps businesses should take in response.

The Malta Financial Services Authority (MFSA) has continued its programme of supervisory intensification, issuing updated guidance on governance standards for licence holders across banking, investment services, and insurance. The revised guidance aligns Malta more closely with the European Banking Authority';s expectations on internal controls and risk appetite frameworks. Firms that hold Category 2 or Category 3 investment services licences are now expected to demonstrate documented risk appetite statements reviewed at board level at least annually.

On the anti-money laundering front, the Financial Intelligence Analysis Unit (FIAU) has published updated implementing procedures that expand the scope of enhanced due diligence obligations. The changes follow Malta';s ongoing commitment to the Financial Action Task Force standards and address specific weaknesses identified in earlier mutual evaluation follow-up reports. Notably, the updated procedures introduce more prescriptive requirements for politically exposed persons screening, including mandatory re-screening at defined intervals rather than only at onboarding.

Payment institutions and e-money institutions face additional scrutiny under the revised FIAU framework. Firms in these categories must now maintain more granular transaction monitoring records and demonstrate that their automated systems produce alerts that are genuinely risk-sensitive rather than volume-driven. The FIAU has signalled that on-site inspections will focus heavily on the quality of suspicious transaction reports filed, not merely their quantity.

A common mistake among smaller licence holders is treating AML compliance as a documentation exercise rather than an operational one. In practice, the FIAU assesses whether compliance officers have genuine authority and resources, and whether escalation paths from front-line staff to senior management are functional. Firms that have not reviewed their compliance function since their initial licence application should treat this as a priority.

The Malta Business Registry (MBR) has introduced procedural changes affecting annual return filings and beneficial ownership disclosures. Under the Companies Act, Chapter 386 of the Laws of Malta, all companies are required to maintain an accurate beneficial ownership register and submit updates within a defined window following any change. Recent enforcement activity by the MBR has demonstrated a willingness to impose administrative penalties on companies that file late or submit incomplete information.

The MBR has also tightened its approach to dormant companies. Entities that have not filed financial statements for two or more consecutive years are now subject to accelerated strike-off procedures. Foreign founders who set up Maltese holding structures and then leave them unattended frequently encounter this problem. Many underestimate the ongoing administrative burden of maintaining a Maltese company, particularly when the entity has no local director and relies entirely on a corporate services provider.

A non-obvious requirement that has caught several international groups off guard is the obligation to update the MBR when a company';s registered office address changes, even if the change is within the same building. Failure to notify the MBR within the statutory period can result in correspondence from regulatory authorities going undelivered, which compounds compliance failures.

The current period has also seen increased attention to the substance requirements for companies claiming Maltese tax residence. The Commissioner for Revenue has been more active in requesting evidence of genuine management and control being exercised in Malta, including board meeting minutes, director attendance records, and evidence that strategic decisions are made locally rather than abroad.

If your corporate structure in Malta requires a governance review or beneficial ownership update, contact info@vlolawfirm.com. We can assist with documents and filings to bring your entity into full compliance.

The Information and Data Protection Commissioner (IDPC) has published updated guidance on data transfers to third countries following recent developments in EU adequacy decisions. Maltese businesses that transfer personal data outside the European Economic Area must now review their transfer mechanisms, particularly where they rely on standard contractual clauses, to ensure alignment with the current European Data Protection Board recommendations.

The IDPC has also issued sector-specific guidance for financial services firms, noting that the combination of AML obligations and data protection requirements creates genuine tension that firms must manage carefully. Specifically, the guidance addresses how long firms may retain customer due diligence records and under what conditions they may share those records with group entities in other jurisdictions. The five-year retention rule under the Prevention of Money Laundering Act must be balanced against data minimisation principles under the General Data Protection Regulation.

Enforcement activity by the IDPC has increased in volume and in the size of penalties issued. Recent decisions have targeted failures in data subject access request handling, with several organisations receiving formal reprimands for exceeding the one-month response deadline. The IDPC has made clear that systemic failures - where an organisation repeatedly misses deadlines across multiple requests - will attract higher penalties than isolated incidents.

Businesses operating websites or digital platforms targeting Maltese consumers should also note updated guidance on cookie consent. The IDPC has aligned its position with the approach taken by several other EU data protection authorities, requiring that consent be freely given, specific, and as easy to withdraw as to give. Pre-ticked boxes and consent bundled with terms of service acceptance are explicitly non-compliant.

Malta';s Employment and Industrial Relations Act has been amended to reflect recent EU directives on transparent and predictable working conditions. Employers are now required to provide written statements of employment conditions to all workers, including those on short-term or variable-hours contracts, within seven days of the start of employment. The previous threshold, which excluded certain categories of short-term workers, has been removed.

The Department of Industrial and Employment Relations (DIER) has also updated its guidance on probationary periods. Under the amended rules, probationary periods are capped at six months for most roles, with a limited extension to twelve months available only for senior management positions. Employers who have historically used rolling probationary arrangements or extended probation without a documented senior management justification are now exposed to claims of unfair dismissal.

Minimum wage adjustments have taken effect following the annual cost-of-living review conducted by the government. Employers should verify that all employment contracts and payroll systems reflect the current national minimum wage and that any contractual provisions tied to the minimum wage have been updated accordingly. A common mistake is updating payroll systems without also updating the written contract, which can create discrepancies that become contentious in dispute proceedings.

Remote work arrangements continue to generate compliance questions. Malta does not yet have a standalone remote work law, but the DIER has issued administrative guidance indicating that employers must address health and safety obligations, working time rules, and equipment provision in any remote work policy. Employers with staff working remotely from Malta for a foreign entity should also consider whether the arrangement creates a permanent establishment risk for the foreign employer.

The Commissioner for Revenue has issued a number of practice notes and clarifications affecting corporate tax, VAT, and transfer pricing. On the corporate tax side, the notes address the application of Malta';s participation exemption to dividends received from non-EU subsidiaries, clarifying the conditions under which the exemption applies and the documentation required to support a claim. Groups that have relied on the exemption without maintaining adequate documentation should conduct an internal review.

Malta';s VAT framework, governed by the Value Added Tax Act, Chapter 406, has seen updated guidance on the place of supply rules for digital services. Businesses supplying electronically supplied services to Maltese consumers must ensure they are correctly registered and accounting for VAT, whether through a direct registration or the One Stop Shop mechanism available under EU rules. The Commissioner has indicated that VAT compliance in the digital economy is a current audit priority.

Transfer pricing is an area of growing focus. Although Malta does not yet have a standalone transfer pricing statute equivalent to those in larger EU jurisdictions, the Commissioner for Revenue has made clear that the arm';s length principle applies to transactions between related parties and that documentation supporting intercompany pricing should be maintained. Groups with significant intercompany flows through Maltese entities should treat this as a live risk rather than a theoretical one.

A practical scenario worth considering: a foreign group using a Maltese holding company to receive dividends from operating subsidiaries in other EU member states should review whether the participation exemption conditions are met for each subsidiary, particularly where the subsidiary is resident in a jurisdiction that Malta treats as having a low effective tax rate. The conditions are more nuanced than they appear on the face of the legislation.

For advice on structuring your Maltese tax position or responding to a Commissioner for Revenue enquiry, reach out to info@vlolawfirm.com. We can help structure the setup correctly the first time and assist with ongoing compliance.

What are the most urgent compliance actions for Malta-licensed financial services firms right now?

Firms should prioritise three areas: updating their AML/CFT procedures to reflect the latest FIAU implementing procedures, reviewing their governance documentation to meet MFSA';s revised expectations on risk appetite frameworks, and ensuring that beneficial ownership information held at the MBR is current. The FIAU has signalled that inspections will focus on operational effectiveness rather than paper compliance, so firms should test their transaction monitoring systems and escalation procedures rather than simply updating policy documents. Firms that have not conducted an internal AML audit in the past twelve months should commission one promptly.

How long does it typically take to bring a Maltese company back into good standing after a filing lapse?

The timeline depends on the nature and duration of the lapse. For companies that have missed one or two annual return filings, the MBR process to regularise the position typically takes several weeks, assuming all required documents and fees are submitted promptly. Where financial statements are also outstanding, the process involves the accountant or auditor preparing and filing the overdue accounts, which can extend the timeline to two to three months or more. Companies that have been struck off the register face a more complex reinstatement process, which requires a court application and can take considerably longer. Acting before the MBR initiates strike-off proceedings is always preferable.

Should a foreign company use a Maltese subsidiary or a branch for operations in Malta?

The choice depends on several factors, including the nature of the activity, liability considerations, and tax planning objectives. A subsidiary is a separate legal entity, which limits the parent';s exposure to the subsidiary';s liabilities and allows the Maltese entity to benefit from Malta';s corporate tax regime, including the participation exemption and the refundable tax credit system. A branch is not a separate legal entity and is generally simpler to establish, but it does not provide the same liability separation and may create different tax outcomes depending on the parent';s home jurisdiction. For regulated activities, the MFSA will typically require a locally incorporated entity rather than a branch. Groups with complex structures or cross-border flows should take specific advice before choosing between the two options.

Malta';s regulatory environment is becoming more demanding across financial services, corporate governance, data protection, and employment. The direction of travel is clear: authorities are moving from rule-setting to active enforcement, and the cost of non-compliance is rising. Businesses that treat compliance as a periodic exercise rather than an ongoing operational function will find themselves increasingly exposed.

VLO Law Firms advises international clients on regulatory matters in Malta. We can assist with MFSA licence compliance, MBR filings, FIAU procedure reviews, data protection assessments, employment contract updates, and tax structuring. To request a consultation, contact: info@vlolawfirm.com