[email protected]
+44 7563 115980 (phone and WhatsApp)
Malta's financial institutions will have to be re-authorised under PSD3. The Malta Financial Services Authority (MFSA) wrote to the boards and chief executives of payment and electronic money institutions in June 2026 setting out its minimum expectations for PSD3 preparedness. It said that PSD2 payment institutions and EMD2 e-money institutions must go through re-authorisation, that the institution must obtain re-authorisation within 27 months to continue providing services, and that boards should aim for compliance as soon as the final text is published.
Of the regulators covered in our PSD3 country guides, the MFSA has been the most specific so far. For Maltese institutions, the letter turns PSD3 from a future project into a current supervisory expectation. This guide summarises the letter and sets out how to meet it. Our PSD3 re-authorisation guide covers the EU-wide process.
The table counts firms with a current Maltese home licence on the EBA Central Register at 30 October 2026, from the Buckingham register of licensed EU payment and e-money firms. Maltese payment and e-money institutions are licensed as financial institutions under the Financial Institutions Act.
| Firms with a home licence in Malta | Number |
|---|---|
| E-money institutions | 38 |
| Payment institutions | 40 |
| Registered account information firms | 1 |
| Firms passporting into at least one other country | 57 |
Close to 80 authorised institutions, many of them serving gaming, cross-border commerce and crypto-related businesses, will need to be re-authorised by one supervisory team in the same period. The MFSA's early letter is partly a way of spreading that work: institutions that prepare now will reach the formal process with a file that can be assessed quickly.
| Step | Timing |
|---|---|
| Council adopts its first reading position on PSD3 and the PSR | 29 October 2026 |
| European Parliament approves the texts in plenary | Expected around the end of 2026 |
| Entry into force | 20 days after publication in the Official Journal |
| PSD3 applies through national law; the PSR applies directly | 21 months after entry into force |
| Transition for existing institutions ends | 27 months after entry into force, extendable by up to 3 months in exceptional cases |
The MFSA expected publication in the Official Journal towards the end of 2026. It also reminded boards that the EBA must submit a regulatory technical standard on authorisation and registration to the European Commission within 12 months of publication, and that this standard will shape the re-authorisation requirements. The MFSA is working with the Central Bank of Malta on transposition.
| Area | What the MFSA highlights |
|---|---|
| Safeguarding | Next business day timing; safeguard the amount owed to users; clear user information including applicable insolvency law; manage concentration risk from the outset |
| Governance | Proportionate, sound internal controls and ICT arrangements consistent with DORA; clear structure and risk procedures |
| Security incidents | Procedures to monitor, handle and follow up incidents and security complaints, aligned with DORA incident reporting |
| Business continuity | Critical operations identified; ICT continuity, response and recovery plans; regular testing |
| Winding-up plan | A proportionate plan covering return of safeguarded funds in a disorderly wind-down |
On safeguarding, the letter makes points that go beyond a summary of the directive. It notes that safeguarding does not apply where funds pass directly to the payee's provider or a single intermediary, but does apply where more than one intermediary is involved. It points to the recital on acquiring through international card schemes, which matters for Maltese acquirers. And it expects concentration risk to be identified and managed from the outset, not added later. Our PSD3 safeguarding rules guide explains the PSD3 rule.
The letter sets no calendar date for the gap analysis or plan, but it asks institutions to begin compliance work as soon as possible and without undue delay, and to act on EBA standards and guidelines immediately when they are published. The MFSA has said it will assess compliance with those standards when deciding on re-authorisation, particularly for governance and safeguarding. In practice, a Maltese institution should expect to be asked for its gap analysis and board-approved plan in supervisory meetings well before the formal re-authorisation window opens.
Malta was an early mover on crypto regulation and several Maltese groups combine an e-money or payment institution with a crypto-asset service provider. PSD3 and MiCA meet at several points. A crypto-asset service provider applying for payment institution authorisation may reuse information it already filed for its MiCA authorisation, provided it is still up to date, and must identify any changes. Because MiCA treats e-money tokens as electronic money, payment services involving them fall within the payment services framework, which is why the two authorisations need to be read together.
For Maltese groups, the practical step is to map which entity provides which service: e-money issuance, e-money token issuance, custody and transfer of crypto-assets, and payment services involving e-money tokens. Overlaps and gaps between the PSD3 service list and the MiCA authorisation should be fixed before the re-authorisation file is filed.
Many Maltese institutions serve gaming operators and use distributors or agents across Europe. Under PSD3, institutions remain fully responsible for their agents and distributors, and agents must be registered. The winding-up plan should show how funds collected through agents reach the institution and become safeguarded, and how users reached only through distributors would be repaid. For gaming clients, the institution should confirm how player funds, merchant settlements and reserves are treated for safeguarding, since the MFSA has asked boards to safeguard the amount that corresponds to each user's claim.
Based on the letter, a Maltese institution should be ready to show four things in its next supervisory meeting: the board minute recording PSD3 awareness and ownership, the gap analysis or its current draft, the implementation plan with dates and budget, and evidence that EBA consultation papers on PSD3 are being tracked. Key function holders, including the compliance officer, MLRO and risk officer, should each be able to explain what PSD3 changes for their area. Where an institution uses external support, the MFSA will expect the board to own the conclusions rather than simply receive a report, so the board minute should record the discussion and the decisions taken. The MFSA framed these as minimum expectations, so having them in place is the baseline rather than a mark of good practice.
All Maltese EMIs will become payment institutions with e-money issuance listed as a service. Each service must be listed expressly, and capital adds up by service: EUR 250,000 for e-money issuance and EUR 150,000 for the core payment services, for example. Ongoing own funds for e-money remain at 2% of average outstanding e-money. Our PSD3 capital requirements guide has worked examples.
The winding-up plan is new. The MFSA has asked for a proportionate plan that covers returning safeguarded funds in a disorderly wind-down. For institutions serving gaming operators or merchants with high volumes, the plan must deal with merchant settlement, chargebacks and reserves as well as consumer balances. Our PSD3 winding-up plan guide covers the contents.
Most Maltese institutions can meet the letter in three steps. First, a board session that records awareness of PSD3, the 27 month deadline and the EBA standard, with named owners for each area. Second, a documented gap analysis across the five areas in the letter, plus capital, services, agents and distributors, finished within the next quarter. Third, a board-approved implementation plan with dates, budget and reporting, reviewed at each board meeting until the file is submitted.
Institutions that already have DORA documentation, a recent safeguarding audit and an up-to-date recovery or wind-down plan will find the gap analysis shorter. Those that do not should start with safeguarding and the winding-up plan, since the MFSA has named both.
Budget for the work honestly. A gap analysis that is completed in a week usually means the institution has listed the PSD3 articles without testing its own arrangements against them. The MFSA has asked for a comprehensive gap analysis, which means evidence: copies of safeguarding letters, reconciliations, board minutes, outsourcing contracts and DORA documentation, each checked against the new requirement and marked as compliant, partly compliant or missing. That evidence becomes the backbone of the re-authorisation file, so the effort is not wasted.
Buckingham Capital Consulting has advised payment and e-money firms since 2013 on licensing, compliance and banking, including Own Solutions' EMI licence from the Central Bank of Ireland and FCA authorisations for Nexpay, Orbital and Hryze. We prepare MFSA-ready PSD3 gap analyses, board briefings, implementation plans, safeguarding reviews and winding-up plans for Maltese institutions. See our Malta EMI licence and Malta payment institution licence guides, or contact us to discuss your institution.
Yes. The MFSA has said PSD2 payment institutions and EMD2 e-money institutions must go through re-authorisation and obtain it within 27 months to keep providing services.
Eight minimum expectations, including board awareness, a documented gap analysis, a board-approved implementation plan and immediate action on EBA standards.
It is dated 8 June 2026 and was addressed to the boards and chief executives of authorised payment and e-money institutions.
The letter sets no calendar date, but asks institutions to start without undue delay and aim for compliance on publication.
Safeguarding, governance, security incidents, business continuity and the winding-up plan.
The MFSA is working with the Central Bank of Malta on transposition and implementation.
Get in touch: +44 7563 115980 (phone and WhatsApp) or [email protected].
This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.
Tell us where you are and where you want to be.
[email protected]
+44 7563 115980 (phone and WhatsApp)