Services · Licences & special services

Malta payment institution license (PSP)

Updated 3 October 2026

The application fee has nearly tripled, and supervision now costs at least EUR 25,000 a year. In return, a Maltese payment institution license can be passported to 30 European countries, and the regulator works in English.

Since 1 January 2025, having a payment license application reviewed in Malta costs $12,000 instead of $4,000, and annual supervision starts at $29,000 instead of a former minimum of $2,900. The Malta Financial Services Authority (MFSA) multiplied the price of entry in a single fee overhaul. An island that spent years marketing itself as a low-cost gateway to European payments is now deliberately screening out projects without capital and people.

In return, Malta still offers what applicants come for: an EU payment institution license that can be passported to all 27 EU member states plus Norway, Iceland and Liechtenstein. Since Brexit, Malta and Ireland are the only EU countries where English is an official language, so every exchange with the regulator happens in English. The rulebook is the same as in Lithuania or Cyprus: the EU-wide PSD2 directive.

What this means for a project. Statutory initial capital runs from $23,000 to $150,000, and it is the smallest line in the budget. The real costs are a team that genuinely runs the company from Malta, supervisory fees, audit and a bank willing to hold client money. Below: what the law requires, what it costs on top of our fees, how long the process takes and what the new PSD3 directive, whose final text was agreed in April 2026, will change.

What is a PSP license and how is it different from an EMI license

PSP (payment service provider) is the umbrella term for anyone who executes payments for customers: banks, electronic money institutions and payment institutions. When people talk about a Malta PSP license, they almost always mean a payment institution (PI) license. The MFSA grants it under the Financial Institutions Act (Chapter 376 of the Laws of Malta), into which Malta transposed PSD2 (the second Payment Services Directive, EU 2015/2366) through Act XXVI of 2019.

A license is needed if the company provides customers with at least one of the eight services in Annex I to PSD2. In plain business terms, these are:

• placing cash on a payment account and withdrawing it;
• credit transfers, direct debits and card payments, including those covered by a customer's credit line;
• issuing payment cards and other payment instruments, and acquiring, meaning accepting payments on behalf of merchants;
• money remittance, meaning transfers without opening an account;
• payment initiation services (PIS): the provider sends a payment from the customer's account at another bank on the customer's instruction;
• account information services (AIS): the provider pulls the customer's data from accounts at different banks into a single view.

The key difference from an EMI (electronic money institution) is what happens to customer money. A payment institution may operate payment accounts, but it cannot issue e-money or take deposits: money on the account is there only to execute payments. An EMI holds customer balances as electronic money, essentially a wallet balance, which is why its capital requirement is almost three times higher. We explain how companies use such accounts on our page on payment system and EMI accounts.

Malta has no lighter regime for small payment institutions. PSD2 lets member states exempt firms with monthly payment volume of up to $3.4 million from full authorisation (Article 32), but the MFSA chose not to transpose that article. A small project goes through the same procedure as a large one.

How much capital does a Malta payment license require

Initial capital under Article 7 of PSD2 depends only on the services provided: $23,000 for money remittance, $57,000 for payment initiation and $150,000 for accounts, transfers, cards and acquiring. These amounts are identical across the EU, so choosing a country for a lower capital threshold makes no sense.

Own funds are the harder part: the capital a company must hold once it is operating. Article 9 of PSD2 sets out three calculation methods, and the regulator decides which one applies:

• Method A: 10% of the previous year's fixed overheads;
• Method B: a percentage of average monthly payment volume on a sliding scale: 4% of the first $5.7 million, 2.5% of the slice from $5.7 million to $12 million, 1% from $12 million to $120 million, 0.5% from $120 million to $290 million and 0.25% above that;
• Method C: a percentage of income from payment services.

Illustrative calculation. A payment institution processing $68 million a year handles an average of $5.7 million a month. Under Method B it needs 4% of $5.7 million, or $230,000 of own funds, 1.6 times the initial minimum. For a money remittance business the result is multiplied by 0.5, for payment initiation by 0.8. Capital grows with volume, and this belongs in the financial model before the application is filed.

Client money does not count as capital. It must be kept apart from the company's own funds: in a segregated account at a bank, in secure liquid low-risk assets, or covered by an insurance policy or a guarantee from a bank or insurer (Article 10 of PSD2). Finding a bank that will open such an account for a Maltese payment institution is one of the hardest parts of the project; more on that below.

How much does a Malta PSP license cost: MFSA fees and the costs on top

Since 2025, regulatory fees have become a noticeable budget line even for a small project. The MFSA approved the new schedule on 24 December 2024, and it applies from 1 January 2025.

Illustrative calculation. A payment institution with $2.3 million in assets and $68 million in annual volume: 0.02% of assets is $450, 0.0003% of volume is $210. The higher figure applies, so the annual fee comes to $29,000. At this scale the variable part barely registers: what you mostly pay for is holding the license at all.

On top of the fees, the budget includes several other lines:

• salaries for the people who run the company from Malta and for the key functions: compliance, AML (anti-money laundering), risk management and internal audit;
• an annual audit of the financial statements by an external auditor;
• professional indemnity insurance for payment initiation and account information services;
• IT systems and their review under DORA (the Digital Operational Resilience Act, EU Regulation 2022/2554), which has applied to payment institutions since 17 January 2025;
• an office in Malta and relocation of staff.

Our fees for preparing the application, incorporating the company, opening the account, finding an office and registering employees are in the table on this page. Taxation of a Maltese company is covered separately on our page on taxes in Malta: the corporate tax rate is 35%, but the shareholder tax refund system brings the final burden down considerably.

What does the MFSA require from the team, office and owners

Malta does not license shell companies. In October 2025 the MFSA revised Chapter 1 of its Financial Institutions Rulebook (FIR/01) and explicitly required applicants to prove mind and management: genuine direction of the company from Malta. At least two individuals must effectively run the business from the country, so that no important decision rests with one person alone.

Who and what the regulator examines:

• directors and senior managers, for integrity, experience and reputation (the fit and proper test);
• holders of qualifying shareholdings, for the source of the funds used as capital and for business reputation;
• key functions: the compliance officer, the MLRO (money laundering reporting officer, who reports suspicious transactions), the risk manager and the internal auditor, organised as three lines of defence;
• outsourcing: which functions are handed to whom, especially IT and cloud services.

Anti-money laundering is supervised not only by the MFSA but also by the FIAU (Financial Intelligence Analysis Unit), Malta's financial intelligence unit. From 10 July 2027 a single EU rulebook, the AMLR (Anti-Money Laundering Regulation, EU 2024/1624), will apply across the Union, so procedures written today will need updating within a year or two.

Incorporation and capital can wait. The MFSA does not require applicants to set up the Maltese company, pay in capital or finalise appointments before in-principle approval: these are conditions met after it. But future directors and key staff must be named in the application, because the regulator vets them in advance. We describe the incorporation process on our page on company registration in Malta, and relocation of directors and staff on our page on Malta residence permits.

How long does it take to get a PSP license in Malta

By law the MFSA has three months to decide, but the clock only starts once the application is complete (Article 12 of PSD2). In practice, Murblz specialists plan for 9 to 12 months from the first meeting to the license, and longer if the regulator comes back with several rounds of questions. The sequence of stages is set out in the revised FIR/01.

A license has to be used. If the company does not start operating within 12 months, or stops for more than six months, the regulator may withdraw the authorisation (Article 13 of PSD2).

How does EU passporting work for a Malta payment license

A passport opens 30 markets with a single license. It is the right to operate in any EEA country (the European Economic Area: the 27 EU member states plus Norway, Iceland and Liechtenstein) without a separate local license.

The procedure is set out in Article 28 of PSD2. The company tells the MFSA which countries it plans to serve and which services it will provide: directly, through agents or through a branch. Within one month the MFSA forwards the details to the host regulator, which has one month to assess them, and the MFSA takes the final decision within three months of receiving complete information.

The passport has three limits. It does not work outside the EEA: the UK, Switzerland or the UAE each require their own license. Branches and agents in another country are subject to local AML rules and local supervision. Finally, Article 11 of PSD2 requires the head office to be in the country of registration and at least part of the payment business to be carried out there: a set-up with only a nameplate in Malta and all real activity elsewhere will not pass.

What will PSD3 and the PSR change for payment licenses

A license obtained in 2026 will almost certainly have to be revalidated under new rules. On 27 November 2025 the European Parliament and the Council of the EU reached a political agreement on a package made up of the PSD3 directive and the PSR (Payment Services Regulation, which will apply directly without national transposition). On 23 April 2026 the Council published the final compromise texts. Once formally adopted, the package will enter into force 20 days after publication in the Official Journal of the EU, and the core rules will apply 21 months after that.

Three points matter for anyone applying now. Electronic money institutions will disappear as a separate category: issuing e-money becomes one of the payment services, and an EMI offering the full range will need $450,000. Existing payment institutions and EMIs will have 27 months after PSD3 enters into force to demonstrate compliance with the new requirements, or lose the right to keep operating. And applications will require new documents, including a winding-up plan, so it makes sense to prepare them now.

There is good news too. The PSR requires banks to give payment institutions and applicants access to accounts on objective and non-discriminatory terms, and to justify any refusal or closure in writing, with a right of appeal. For fintechs that spend months looking for a bank, this may prove the most useful part of the reform, but it will not take effect before 2028.

Does a crypto company need a payment license

Since 2 March 2026, in many cases it does. E-money tokens (EMTs, stablecoins pegged to a single official currency such as the euro) are both crypto-assets and electronic money under EU law. In a letter of 10 June 2025, the EBA (European Banking Authority) clarified that when a crypto-asset service provider (CASP) holds customers' EMTs and transfers them, it is providing a payment service that requires authorisation under PSD2. The transition period ended on 1 March 2026.

Exchanging crypto for money or for other crypto is not a payment service. But an exchange or wallet that transfers customers' stablecoins can no longer operate without its own payment license or a licensed partner. The MFSA grants both CASP licenses under MiCA (Markets in Crypto-Assets, EU Regulation 2023/1114) and payment licenses, so both can sit with a single supervisor. For comparison, see our pages on the Estonia crypto license and a BVI company with a VASP (virtual asset service provider) license.

Malta, Lithuania, Cyprus or Ireland: where to get a payment license

Capital and core rules are the same across the EU, because they all come from PSD2. The differences lie in the regulator, taxes, fees and how closely supervisors check for real presence in the country.

Malta usually appeals to those who value an English-speaking regulator, the option of holding a payment license and a crypto license under one supervisor, and a clear procedure that starts with a preliminary meeting. Against Malta: high fixed fees and the requirement to keep real decision-makers on the island.

What are the pitfalls of a Malta payment license

The most common reason a licensed project fails to launch is not the regulator but the bank. Client money must sit in a safeguarding account, and without one the MFSA will not issue the commencement letter. Banks in Malta and elsewhere in the EU are cautious about payment institutions, especially new ones and those with complex ownership. The protection in the PSR will not arrive before 2028, so talks with banks are best started alongside the application. How we help with this is described on our page on business accounts in Malta.

Other risks worth knowing before you start:

• Costs before the first revenue. A supervisory fee from $29,000, salaries for managers in Malta, audit and insurance all start in year one, even with zero volume.
• Capital grows with the business. At $68 million a year in volume, own funds under Method B already reach $230,000, and if volume multiplies, more capital has to be injected.
• Real presence is checked. Nominee directors and a mailbox office no longer pass after the 2025 revision of FIR/01.
• Supervision does not end with the license. For up to 18 months after launch, the MFSA may require internal audit reports and systems reviews.
• PSD3 will require revalidation. The license will have to be confirmed within 27 months of the new rules entering into force.
• Country reputation affects banks. In June 2021 the FATF (Financial Action Task Force) placed Malta on its grey list and removed it only in June 2022. For some correspondent banks this still triggers extra questions.
• Sanctions restrictions. EU sanctions against Russia prohibit a range of financial transactions with Russian nationals and companies. If owners, managers or target customers are connected with Russia or other sanctioned countries, this has to be worked through before filing: the regulator and banks look at it among the very first things.

Who is a Malta PSP license not right for

A license is a tool for a business that itself moves other people's money at scale. In many cases it is more than you need.

• An online shop or service that only needs to accept payments. A contract with a licensed acquirer or payment provider is enough.
• A startup without funding to reach break-even. Fixed costs start long before revenue, and the procedure takes months.
• A project that needs to hold customer balances. That calls for an EMI license with $400,000 of capital, not a payment institution.
• A business focused on the UK, the US or the UAE. The EU passport does not work there.
• A team unwilling to keep managers in Malta. Without genuine management from the island the application will not be approved.
• Anyone who needs to launch within two or three months. A faster route is to act as an agent of an already licensed payment institution: PSD2 allows operating under another firm's license once the agent is registered with the regulator.

How we help obtain a PSP license in Malta

We start by stress-testing the model: which services the company will provide, what capital and fees follow from that, whether there are people to run the company from Malta, and whether owners and customers carry sanctions risks. If a project is not ready for a license, we say so before the company is incorporated, not after a refusal.

The work runs in three stages: preparing the MFSA application package, supporting the review of the application and the final licensing stage. In parallel we incorporate the Maltese company, assist with paying in the share capital and opening the bank account, find and lease office space and housing, register the employment of foreign staff and run compliance checks on all parties. If directors and staff from outside the EU need work permits and residence in Malta, we help with those as well. Other licenses and corporate services are collected in the section on licenses and special services.

Fees

FAQ