Malta

MFSA Banking Rule on outsourcing by credit institutions (version 6.00, 2025). It defines cloud services and deployment models (para. 9) and requires cloud outsourcing details in notifications (para. 17(f)) and in the outsourcing register (para. 44(g)). DORA prevails on contractual terms for ICT third-party services (para. 8A).

National Act implementing Regulation (EU) 2023/1114 (MiCA) in Malta. It gives the MFSA powers to grant, refuse, cancel and suspend licences and to impose administrative penalties; the MFSA also publishes a MiCA Rulebook under it.

Regulations setting up the centralised bank account register. The FIAU enforces Regulation 4(2) on periodic submissions and Regulation 8 on administrative penalties.

MFSA guidance (version 1.01, 11 December 2020) on technology arrangements, ICT and security risk management and outsourcing, applying to licence holders across the sectors it supervises. The MFSA ICT page records an update of 26 March 2024 and an addendum to it, and says the guidance sets expectations for entities outside DORA's scope.

Rule issued under Article 16(2)(a) of the MFSA Act creating a supervised environment in which technology-driven financial innovations are tested for a limited period. Version 1.00 was issued on 22 July 2020; version 2.00, issued on 13 March 2023, is the current text. It covers regulated and unregulated FinTech providers and technology providers.

Act XX of 2018, which states in Article 2 that it implements and further specifies Regulation (EU) 2016/679. It appoints the Commissioner (Art. 11) and provides for administrative fines (Arts. 20-21) and appeals (Art. 26).

Earlier national framework for virtual financial assets. Legislation.mt shows it as repealed by the Act numbered 36 of 2024 (shown in Roman numerals), with a withdrawal date of 3 July 2026; the MFSA's crypto-assets page now points to the Markets in Crypto-Assets Act.

Subsidiary legislation issued as L.N. 372 of 2017, implementing Directive (EU) 2015/849. It sets customer due diligence, internal procedures, record keeping and reporting duties for subject persons, with FIAU penalties under Regulation 21 and settlements under Regulation 22. In force from 1 January 2018 and amended up to L.N. 82 of 2026.

Requires employers to run internal reporting procedures (Art. 12) and sets external reporting arrangements through authorities named in the First Schedule, including the FIAU, the MFSA and the Permanent Commission Against Corruption.

Procedures issued under Regulation 17 of the PMLFTR, first issued on 20 May 2011 and last amended on 27 April 2026. The procedures state they bind subject persons from the date of issue; sector-specific Part II documents exist for crypto-assets, remote gaming, company service providers and others.

National statute on market abuse, listed by the MFSA beside Regulation (EU) No 596/2014 and the Reporting of Infringements Regulations (S.L. 476.04).

Principal statute for insurance and reinsurance undertakings, supported by subsidiary legislation including the Solvency II regulations and the MFSA Insurance Rules.

Principal banking statute, with Banking Rules issued by the MFSA under it. The MFSA states that its Banking Rules are binding on licence holders under Article 4(9).

Licensing statute for payment institutions and electronic money institutions. The MFSA states the Act, its rules and subsidiary legislation transpose PSD2 and the second E-Money Directive, and relies on Article 7B for fit-and-proper directions.

Licensing and supervision statute for investment services and collective investment schemes. The MFSA cites Article 7(3)(b) for licence cancellation and Article 15 for directives in its published enforcement notices.

Primary AML/CFT statute. The FIAU relies on Article 13 for administrative penalties and Article 13C for the publication of settlement agreements.

Statute covering regulated markets and related capital markets activity. The MFSA lists it with its regulations on regulated markets, MTFs and OTFs, sponsors and markets in financial instruments.

Statute under which the MFSA operates. The MFSA describes it as the Act of Parliament that set the Authority up, and relies on Article 16 of the Act to impose directives and publish notices.

Statute establishing the Permanent Commission Against Corruption, which the Commission's website cites as its basis.

Primary statute for the Central Bank of Malta. The Bank's own legislation page links the text and a summary of the Act.