Regulatory Update in Malta: Q2 2026

Malta';s regulatory landscape has shifted meaningfully in recent months, with new rules affecting financial services licensing, corporate governance, data protection enforcement, and employment obligations. Businesses operating in or through Malta - whether holding a Malta Financial Services Authority licence, a gaming permit, or simply a registered company - face a more demanding compliance environment than before. This guide covers the most significant developments in malta regulatory 2026, explains what each change means in practice, and highlights the steps businesses should take to remain compliant.

The Malta Financial Services Authority has issued several updated supervisory frameworks that affect licensed entities across banking, investment services, and insurance. The most consequential change concerns enhanced due diligence requirements under the revised Prevention of Money Laundering Act framework. Subject persons - a category that includes banks, investment firms, trustees, and certain corporate service providers - must now maintain more granular beneficial ownership records and submit updated risk assessments to the MFSA on a defined cycle rather than on an ad hoc basis.

The MFSA has also tightened its fit-and-proper assessment process for key function holders. Applicants for director, compliance officer, and money laundering reporting officer roles must now submit expanded documentation, including structured competency questionnaires and evidence of continuous professional development. In practice, this means that companies planning to appoint or replace key function holders should budget additional lead time - typically several additional weeks compared with the previous process.

A further development concerns the passporting of investment services into Malta from EEA-based firms. The MFSA has clarified its expectations around substance requirements for firms relying on the passporting regime. Firms that maintain only a nominal presence in Malta while conducting substantive business from another jurisdiction risk having their passporting notifications challenged. Regulators have signalled that they will scrutinise staffing levels, decision-making location, and local management capacity more closely than before.

Practical tip: firms that have not reviewed their substance arrangements in the past twelve months should conduct an internal audit before the next supervisory cycle. A common mistake is assuming that a registered address and a single local director satisfy substance requirements when the MFSA';s current guidance sets a higher bar.

Recent amendments to the Companies Act (Chapter 386 of the Laws of Malta) have introduced new obligations around the maintenance and accuracy of the Beneficial Ownership Register held at the Malta Business Registry. All companies and partnerships must ensure that their beneficial ownership information is current and that any change is notified to the Registry within the prescribed period, which has been shortened under the recent amendments.

The Malta Business Registry has also updated its guidance on the annual return process. Companies that fail to file their annual return within the statutory deadline now face an escalating penalty structure that is more aggressive than the previous flat-fee regime. Directors bear personal responsibility for ensuring timely filing, and the Registry has indicated that it will pursue enforcement more actively against dormant companies that have accumulated filing arrears.

A non-obvious requirement that catches many foreign-owned companies off guard is the obligation to maintain a physical registered office in Malta that is genuinely accessible during business hours. The Registry has begun issuing notices to companies where the registered address appears to be a mail-forwarding service with no real operational capacity. Companies in this situation should review their registered office arrangements promptly.

For companies with cross-border structures, the recent transposition of the EU';s mobility directive provisions into Maltese law is also relevant. The rules governing cross-border mergers, divisions, and conversions have been updated to align with the directive, introducing new creditor and minority shareholder protection mechanisms. Any restructuring transaction involving a Maltese entity should be reviewed against the updated framework before proceeding.

The Office of the Information and Data Protection Commissioner has increased its enforcement activity, issuing a series of decisions that clarify how the General Data Protection Regulation applies in specific Maltese contexts. The Commissioner has focused particularly on the lawfulness of processing in the employment context, the use of legitimate interests as a legal basis, and the adequacy of data retention policies.

One significant decision concerned a Maltese employer that retained employee monitoring data beyond the period necessary for the stated purpose. The Commissioner found that the retention policy lacked a documented justification and that the employer had failed to carry out a legitimate interests assessment before deploying the monitoring system. The decision serves as a clear signal that employers must document their data processing decisions with greater rigour.

For businesses that transfer personal data outside the EEA, the Commissioner has reiterated that standard contractual clauses alone are insufficient without a transfer impact assessment. Companies relying on SCCs for transfers to third countries - particularly those using US-based cloud providers or HR platforms - should ensure that their transfer impact assessments are current and properly documented.

A practical scenario: a Maltese fintech company using a US-based customer data platform must maintain a transfer impact assessment that addresses the specific risks associated with that jurisdiction, document the supplementary measures in place, and review the assessment whenever there is a material change to the processing arrangement. Many companies complete the initial assessment but fail to build in a review trigger, which creates a compliance gap over time.

If your business is uncertain about its current data protection posture, reaching out to a qualified adviser is a sensible first step. We can assist with documents and filings, including transfer impact assessments and data processing agreements. Contact us at info@vlolawfirm.com.

Malta has transposed several EU employment directives into domestic law in recent periods, and the practical effects are now becoming visible in how the Department of Industrial and Employment Relations and the Employment and Training Corporation apply the rules.

The most significant change for employers concerns transparent and predictable working conditions. Under the updated Employment and Industrial Relations Act framework, employers must now provide written statements of employment conditions within a shorter timeframe after the start of employment, and those statements must cover a broader range of terms than previously required. The written statement must now include, among other things, information about training entitlements, the identity of social security institutions receiving contributions, and any probationary period arrangements.

Employers using flexible or on-demand work arrangements face additional scrutiny. The updated rules require that workers in unpredictable work patterns receive a guaranteed number of paid hours or, alternatively, adequate notice of cancellation with compensation. A common mistake among businesses that use casual or zero-hours arrangements is assuming that the previous informal practice remains acceptable. The updated framework creates enforceable rights that workers can assert before the Industrial Tribunal.

Parental leave entitlements have also been extended. Both parents now have access to a longer non-transferable leave period, and the rules on pay during parental leave have been updated. Employers should review their HR policies and employment contracts to ensure alignment with the current statutory minimums, as contracts that provide less than the statutory entitlement are void to that extent.

A practical scenario: a technology company with a team of ten employees in Malta, some engaged on flexible contracts, should audit its employment documentation against the current statutory requirements. The audit should cover written statements, working time records, leave policies, and data processing notices for employee data. Companies that have not updated their standard employment contracts since the recent transpositions are likely to find gaps.

Malta retains a significant regulatory framework for remote gaming under the Malta Gaming Authority and for virtual financial assets under the Virtual Financial Assets Act (Chapter 590 of the Laws of Malta). Both regulators have issued updated guidance that affects licence holders and applicants.

The Malta Gaming Authority has revised its compliance contribution framework, adjusting the basis on which gaming tax and compliance contributions are calculated for B2B and B2C licence holders. Licence holders should review their financial projections against the updated contribution rates, as the changes affect the cost structure of operating under a Maltese gaming licence. The MGA has also updated its technical standards for remote gaming systems, requiring licence holders to implement updated player protection and responsible gaming controls within a defined transition period.

On the virtual assets side, the Malta Financial Services Authority has aligned its VFA framework more closely with the EU';s Markets in Crypto-Assets Regulation. Entities that hold a VFA licence or that are registered as VFA agents must assess whether their current authorisation covers the activities they intend to conduct under the MiCA framework, or whether a separate MiCA authorisation is required. The transition arrangements are complex, and firms that delay this assessment risk operating in a regulatory gap.

A non-obvious issue for VFA issuers is the interaction between the VFA Act';s white paper requirements and MiCA';s crypto-asset white paper regime. The two frameworks use similar terminology but differ in their disclosure requirements and liability provisions. Firms that have previously issued tokens under the VFA Act should obtain specific legal advice before relying on their existing documentation for MiCA purposes.

Across all the areas covered above, several common themes emerge for businesses seeking to maintain compliance with current Maltese regulatory requirements.

First, documentation discipline is more important than ever. Regulators across the MFSA, the Information and Data Protection Commissioner, and the MGA are placing greater weight on the quality and completeness of internal records. A business that has the right policies in place but cannot produce contemporaneous evidence of how those policies were applied will struggle in an enforcement context.

Second, the pace of regulatory change means that annual compliance reviews are no longer sufficient for many businesses. A more frequent review cycle - quarterly for regulated entities, semi-annual for standard companies - is now the practical standard for businesses that want to stay ahead of enforcement.

Third, cross-border structures require particular attention. Malta';s role as an EU member state means that EU-level regulatory developments - whether in financial services, data protection, or employment - flow through into Maltese law, often with additional local requirements layered on top. Businesses that monitor only the EU-level developments and assume automatic compliance in Malta will miss locally specific obligations.

We can help structure the compliance review correctly the first time, ensuring that your business addresses both the EU-level and Malta-specific requirements. Contact us at info@vlolawfirm.com to discuss your situation.

What is the most immediate compliance risk for a Maltese company following the recent beneficial ownership register changes?

The most immediate risk is a failure to notify the Malta Business Registry of changes to beneficial ownership within the shortened statutory deadline. Under the recent amendments, the notification window has been reduced, and the penalty structure for late or inaccurate filings has been made more severe. Directors bear personal liability for ensuring that the register is kept current. Companies with complex or frequently changing ownership structures should put in place an internal trigger process so that any change at the ultimate beneficial owner level automatically initiates the notification procedure. Relying on an annual review is no longer adequate.

How long does it typically take to obtain or renew a key function holder approval from the MFSA under the updated fit-and-proper process?

Under the updated process, the MFSA';s assessment of a key function holder application takes longer than before, largely because of the expanded documentation requirements. In practice, applicants should allow for a process of several weeks to a few months, depending on the complexity of the individual';s background and the nature of the role. Companies that are planning a board or senior management change should factor this lead time into their transition planning. Submitting an incomplete application is the single most common cause of delay, so ensuring that all required documentation is assembled before submission is essential.

Should a Maltese VFA licence holder apply for a MiCA authorisation, or does the existing licence provide a transition pathway?

The answer depends on the specific activities the firm conducts and the category of crypto-assets involved. The MiCA regulation provides transition arrangements for firms already authorised under national frameworks, but those arrangements are not automatic and have defined time limits. A firm that intends to continue operating after the transition period must assess whether its current VFA licence covers the relevant MiCA activity category and whether it needs to submit a MiCA authorisation application or a simplified notification. Given the differences in disclosure requirements and liability provisions between the two frameworks, firms should not assume that their existing VFA documentation satisfies MiCA requirements without a specific legal review.

Malta';s regulatory environment is evolving rapidly across financial services, corporate governance, data protection, employment, and the digital assets sector. Businesses that treat compliance as a periodic exercise rather than an ongoing discipline face increasing enforcement risk. The practical priority for most businesses is a structured review of current documentation, policies, and authorisations against the updated requirements described in this guide.

VLO Law Firms advises international clients on regulatory matters in Malta. We can assist with compliance reviews, MFSA licence applications and amendments, data protection documentation, employment contract updates, and VFA or MiCA authorisation assessments. To request a consultation, contact: info@vlolawfirm.com