A Malta Payment Institution license authorizes a company to provide regulated payment services under the supervision of the Malta Financial Services Authority (MFSA). The license is structured around PSD2, covers a defined range of payment activities, and provides access to the wider European market through EU and EEA passporting.
This guide covers the three initial capital tiers, the scope of permitted activities, the application process, and the upcoming PSD3 changes that will merge the PI and EMI frameworks into a single authorization category.
What Is a Payment Service Provider?
A Payment Service Provider (PSP) is a regulated financial institution that enables merchants and businesses to accept and process electronic payments. PSPs operate between the payer, the merchant, banks, card networks, and other payment infrastructure.
PSPs are particularly relevant for businesses with an online presence. As digital channels continue to expand across e-commerce, financial services, subscriptions, and entertainment, companies require secure and compliant infrastructure for electronic transactions.
A PSP may support credit and debit card payments, bank transfers, direct debit payments, real-time online banking transfers, e-wallet payments, merchant payment processing, payment gateway solutions, and — where the license scope permits — selected digital or crypto-related payment flows. Companies that also plan to offer crypto-asset services from Malta may consider a MiCA CASP authorization alongside or instead of a PI license, depending on the business model.
Malta Payment Services Regulation
Payment Institutions in Malta are regulated under the Financial Institutions Act (Cap. 376) and supervised by the MFSA. The framework transposes the EU Payment Services Directive (PSD2) and provides a licensing route for companies that want to offer regulated payment services from a Maltese base.
A Malta PI license may suit companies that plan to provide payment services domestically and, subject to notification procedures, expand across the EU and EEA through passporting.
The regulatory framework supports innovation in payments while maintaining standards for governance, risk management, AML/CFT compliance, client fund protection, and operational security.
Permitted Activities for Payment Institutions in Malta
A licensed Payment Institution in Malta may carry out a range of regulated payment services, depending on the scope of authorization granted by the MFSA. Under PSD2 Annex I, the categories include:
- Services enabling cash to be placed on a payment account, and all operations required for operating that account.
- Services enabling cash withdrawals from a payment account.
- Execution of payment transactions — credit transfers (including standing orders), direct debits (including one-off payments), and payment transactions through a card or similar device.
- Execution of payment transactions where the funds are covered by a credit line for a payment service user.
- Issuing payment instruments and/or acquiring payment transactions.
- Money remittance.
- Payment initiation services.
- Account information services.
The exact license scope should be aligned with the company's business model, payment flows, client types, and target markets.
Additional Activities for Licensed Payment Institutions
In addition to core payment services, a Payment Institution in Malta may be allowed to perform certain ancillary activities connected to its licensed operations. These may include operational services closely linked to payment services, data processing and storage, safekeeping activities related to payment services, foreign exchange services strictly connected to payment services, and the operation of payment systems.
Other business activities are permitted provided they do not threaten the institution's financial soundness or regulatory compliance.
Payment Institutions may only hold payment accounts used for payment transactions. Funds received from users for payment services are not treated as deposits or other repayable funds under banking rules.
Credit Linked to Payment Services
In certain cases, a Payment Institution may provide credit connected to specific payment services. This is subject to restrictions under PSD2.
Credit may generally be provided only where it is ancillary to payment services, granted only in connection with the execution of a payment transaction, repaid within a short period (not later than 12 months), and not granted from funds received or held for payment execution. The institution must also maintain sufficient own funds in relation to the total credit granted.
Companies planning to include credit-related features in their payment model should assess this carefully before applying.
Prohibited Activities for Payment Institutions
Payment Institutions are not banks. Their activities must remain within the scope of the services authorized by the MFSA.
In general, PSPs may not access or control the payer's bank account beyond what the authorized service requires, access sensitive payment data beyond what is necessary for the specific transaction, use client funds as deposits, provide unauthorized banking services, or operate outside the approved license scope.
Security credentials must be transmitted securely, and payment authentication must follow strong customer authentication (SCA) standards where applicable.
Minimum Initial Capital Requirements
The minimum initial capital for a Malta Payment Institution depends on which payment services the company intends to provide. PSD2 Article 7 sets three tiers, based on the Annex I service categories:
EUR 20,000 — for institutions that provide only money remittance services (Annex I, point 6). This is the entry-level threshold for remittance-only operators.
EUR 50,000 — for institutions that provide only payment initiation services (Annex I, point 7). Payment initiation service providers (PISPs) may alternatively satisfy this requirement through professional indemnity insurance or a comparable guarantee.
EUR 125,000 — for institutions that provide any of the payment services listed in Annex I, points 1 through 5. This covers the full range of account-related payment transactions, payment instrument issuance, and acquiring services.
These are minimum thresholds. The MFSA may require higher capital depending on the company's risk profile, business plan, and projected transaction volumes. Ongoing own-funds requirements also apply after authorization, calculated according to the methods set out in PSD2 Article 9.
Under PSD3, these thresholds are expected to increase to EUR 25,000, EUR 50,000, and EUR 150,000 respectively, reflecting inflation indexation. The PSD3 figures are not yet in force and will apply only after national transposition of the new directive.
Malta PSP License and the iGaming Sector
Malta has a well-established iGaming market, and payment service providers play a significant role in supporting online gaming operators. iGaming businesses process high volumes of deposits and withdrawals, often across multiple currencies, markets, and payment methods.
Because of the sector's risk profile, iGaming operators must follow strict compliance standards. A reliable PSP can help operators manage payment flows securely while supporting AML, fraud prevention, and customer protection requirements.
For iGaming businesses, PSPs may provide secure payment gateways, deposit and withdrawal solutions, e-wallet and bank transfer options, multi-currency payment support, fraud prevention tools, and AML/transaction monitoring support. This makes payment infrastructure a core part of the iGaming business model.
How to Obtain a Malta Payment Institution License
To apply for a Malta Payment Institution license, a company must submit an application to the MFSA and demonstrate compliance with the required regulatory standards.
The MFSA will typically assess whether the company has sufficient own funds for its intended service scope, the business plan is clear and realistic, at least two individuals will effectively direct the business in Malta, shareholders, controllers, directors, and key officers are fit and proper, the company has sound governance and prudent management, the organizational structure is clear, AML/CFT controls are adequate, and internal systems and procedures are suitable for the proposed activities.
The regulator may request additional information during the review process.
Documents Required for a Malta PSP License
Applicants must prepare a detailed application package for the MFSA. The required documentation typically includes:
- Memorandum and articles of association or equivalent constitutional documents
- Proposed initial capital amount and evidence of funding
- Operational plan and business plan
- Description of internal control systems
- AML and CFT policies and procedures
- Financial statements for the previous three years (where applicable)
- Details of statutory auditors or audit firms
- Corporate structure and management information
- Legal status and registered office details
- Information about shareholders and qualifying holdings
- Details of officers, controllers, and persons effectively directing the business
The application should clearly explain the company's services, payment flows, client segments, target markets, risk profile, and compliance framework.
EU Passporting for Malta Payment Institutions
One of the main advantages of obtaining a Payment Institution license in Malta is EU and EEA passporting. Once licensed, a Maltese Payment Institution may provide services in other member states through notification procedures.
Passporting may allow the company to operate remotely under the freedom to provide services, through a branch in another member state, or across multiple European markets without applying for a separate local license in each country.
This makes Malta a practical jurisdiction for fintech and payment companies planning cross-border European operations.
PSD2 and Payment Services in Europe
The EU payment services framework is currently governed by PSD2 (Directive 2015/2366). The directive strengthened consumer protection, improved payment security, and introduced clearer rules for new payment market participants.
PSD2 created a regulatory framework for third-party providers, including Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs). These providers support digital payment models by allowing users to initiate payments or access consolidated account information with consent.
PSD2 also introduced stronger customer authentication (SCA) requirements, improved protection against fraud, and clearer information obligations for payment service users.
PSD3 and the Merger of the EMI and PI Frameworks
The EU is in the process of replacing PSD2 with a new Payment Services Directive (PSD3), accompanied by a directly applicable Payment Services Regulation (PSR). A provisional political agreement was reached on November 27, 2025, and final texts are expected in the Official Journal in the first half of 2026. Member states will have 18 months from entry into force to transpose PSD3 into national law, placing the likely application date in the second half of 2027 or later.
The most significant structural change under PSD3 is the merger of the Payment Institution and Electronic Money Institution frameworks. The Electronic Money Directive 2 (EMD2) is being repealed. EMIs will no longer exist as a standalone authorization category. Instead, e-money issuance becomes a sub-activity within the unified PI license — a "payment institution authorized to issue e-money."
For companies currently licensed as EMIs, existing authorizations remain valid for 24 months after PSD3 enters into force, with the possibility of extension to 30 months at the national competent authority's discretion. During this period, EMIs must apply for reauthorization under the new PSD3 requirements, including updated governance arrangements, DORA-compliant ICT frameworks, and safeguarding policies aligned with the new regime. EMIs that comply are deemed authorized under PSD3; those that do not face suspension.
Existing PIs are similarly grandfathered. Current PI licenses remain valid during the transition period, and licensees must demonstrate compliance with PSD3 requirements within the same timeframe. To add e-money issuance, a PI notifies its home NCA and provides the additional information the merged regime requires.
For new applicants, the current PSD2/EMD2 framework still applies until PSD3 takes effect. A license obtained now will be grandfathered into the new regime automatically, which means the 2026–2027 window is a practical time to apply under the more familiar current framework.
For a detailed breakdown of what PSD3 means for existing EMI and PI license holders, see our article PSD3: What Happens to EMI and Payment Institution Licenses in the EU. Companies specifically considering e-money issuance from Malta should also review the Malta EMI license guide, which covers the current EMD2 requirements, MFSA application process, and the EUR 350,000 initial capital threshold that applies until the PSD3 transition.
Benefits of a Malta PSP License
A Payment Institution license in Malta can offer several practical advantages for fintech and payment businesses:
- Access to an EU-regulated payment services framework under PSD2
- Supervision by the MFSA, an experienced financial services regulator
- EU and EEA passporting for cross-border operations
- Authorization for a defined scope of payment services
- Suitability for online merchants, e-commerce platforms, and iGaming operators
- A practical base for European fintech expansion
- Credibility with banking partners, clients, and financial institutions
- A structured compliance environment under EU payment rules
Final Thoughts
A Malta Payment Institution license provides a regulated foundation for companies planning to offer payment services, merchant solutions, money remittance, payment initiation, or payment infrastructure in Europe.
Malta offers a recognized EU framework, passporting across the EEA, and a strong fintech and iGaming ecosystem. Obtaining a PSP license requires careful preparation — a clear business plan, capital matching the correct PSD2 tier, experienced management, AML/CFT procedures, internal controls, and operational readiness. The upcoming PSD3 transition will consolidate the PI and EMI regimes, and companies planning their licensing strategy should factor this timeline into their application.
Need Help With Licensing?
Equilex supports payment companies with MFSA application preparation, capital planning, EU passporting structuring, AML/CFT documentation, and regulatory compliance. Complete the contact form on our website, and a regulatory specialist will respond within 24 hours.
FAQ
What are the minimum capital requirements for a Malta Payment Institution license?
The minimum depends on the services provided. Money remittance only requires EUR 20,000, payment initiation services require EUR 50,000, and the full range of payment services (account transactions, payment instruments, acquiring) requires EUR 125,000. The MFSA may require higher capital based on the applicant's risk profile.
Can a Malta Payment Institution operate across the EU?
Yes. Once licensed by the MFSA, a Malta PI may passport its services to other EU and EEA member states through notification procedures, either under the freedom to provide services or by establishing a branch.
What happens to Malta PI licenses under PSD3?
Existing PI licenses will be grandfathered during the PSD3 transition. Licensees must demonstrate compliance with PSD3 requirements within 24 months of the directive entering into force, but do not need to reapply from scratch.
How does PSD3 affect EMI licenses in Malta?
PSD3 abolishes the standalone EMI category. Existing EMIs will be reclassified as payment institutions authorized to issue e-money and must reauthorize under the new framework within the transitional period.
What documents are needed for a Malta PSP license application?
The MFSA requires a business plan, constitutional documents, evidence of initial capital, AML/CFT policies, details of shareholders and key officers, internal control descriptions, and an operational plan covering payment flows, client segments, and target markets.
