Malta: Fintech

Payment services and payment services providers are regulated under the Financial Institutions Act (chapter 376 of the laws of Malta) and its subsidiary legislation. The Maltese legislator has also directly transposed EU directives regulating payment services into the Financial Institutions Act, including implementing the changes introduced through directive 2015/2366/EU of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending directives 2002/65/EC, 2009/110/EC and 2013/36/EU and regulation (EU) No 1093/2010, and repealing directive 2007/64/EC, more commonly referred to as PSD2.

The Banking Act (chapter 371 of the laws of Malta) provides the legislative framework for credit institutions, referencing the Financial Institutions Act. The Civil Code (chapter 16 of the laws of Malta) also regulates the civil law private aspect of payments.

The licensing of payment services providers falls within the remit of the Malta Financial Services Authority (MFSA) which in turn issues rules for licensees. The Central Bank of Malta also oversees and regulates the operation of, and the participation in, both domestic and cross-border payment and securities settlement systems. Approval must first be authorised by the Bank before new payment and securities settlement systems can operate. Furthermore, the Bank may also issue directives in respect of payment and securities settlement systems, cross-border credit transfer services and electronic payment services.

Yes. The Financial Institutions Act sets out the different types of payment services that can be provided by licensed institutions. These are:

1. Services enabling cash to be placed on a payment account and withdrawn from a payment account as well as all the operations required for operating a payment account;
2. Execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider: execution of direct debits (including one-off direct debits), of payment transactions through a payment card or a similar device, and of credit transfers (including standing orders);
3. Execution of payment transactions where the funds are covered by a credit line for a payment service user for the executions listed above;
4. Issuing of payment instruments and/or acquiring of payment transactions;
5. Money remittance;
6. Payment initiation services; and
7. Account information services.

The term payment service provider on the other hand includes credit institutions, electronic money institutions, post office giro institutions, payment institutions and account information service providers.

Electronic money institutions and payment institutions that seek to offer payment services must be duly licensed by the MFSA before offering such services.

As a leader in the regulation of cryptocurrencies, the Maltese legislator also sought to regulate the provision of payment services where this involves virtual financial assets (VFAs) (as defined under the Maltese act). The Maltese Virtual Financial Assets Act (chapter 590 of the laws of Malta) provides that any person conducting a transaction on behalf of a third party that moves a VFA from one VFA address or account to another must be in possession of a VFA licence issued by the MFSA.

Over the last decade, the collective shift to the digital sphere has led most individuals to seek faster and more efficient payment methods. This change in mentality brought about a rise in internet banking use, and more recently, mobile banking. The use of payment services providers has also increased, more commonly seen as offering efficiency in making online purchases. However, on a day-to-day basis, the use of cash still remains strong in Malta and the use of cheques is still common, particularly in certain sectors.

As an EU member state, PSD2 was transposed into Maltese legislation in 2019. This did not trigger any obligation for a bank or financial institution already licensed by the MFSA as a home state regulator to provide payment services to seek any re-authorisation of these activities in terms of passporting rights exercised by the operator prior to the implementation of these amendments.

Nevertheless, despite banks taking the necessary steps to permit open banking by making their application programming interface (API) technologies available, the practical use of open banking in Malta remains limited. This is due to the small number of live and operative account information service providers (AISPs) or payment initiation service providers (PISPs) operating within Malta.

Since the General Data Protection Regulation (2016/679 – the GDPR) came into force in May 2018, the protection of personal data that is processed by financial services providers, and also generally, gained more prominence in Malta. The GDPR itself did not produce any new obstacles concerning the processing of personal data by financial services providers, at least within the context of the contractual relationship for a financial services product / service between the financial service provider and the respective consumer. Rather, the GDPR introduced more complex and demanding data protection accountability and compliance obligations together with more enhanced transparency disclosure requirements.

Specifically with regards to banks, it should be noted that data protection guidelines were issued locally by the Malta Banker’s Association in consultation with the Information and Data Protection Commissioner.

The MFSA released a Fintech Regulatory Sandbox in 2020, making it possible for fintech operators to test their innovations in a regulated environment for a set time frame, under specific prescribed conditions. It is available for fintech service providers and fintech suppliers, including start-ups, technology firms and established financial services providers using technology-enabled innovations.

The sandbox has four main objectives: innovation, sustainability, legal certainty, and knowledge. Technological solutions that can utilise the sandbox include: APIs, AI, machine learning and biometrics.

Similarly, the Malta Gaming Authority (MGA) launched a sandbox framework for the acceptance of cryptocurrencies and DLT through its licenses back in 2019. This established the possibility of MGA licensees to accept payment in VFAs, while also starting applications for the use of Innovative Technology Arrangements (ITAs). These include DLT platforms and smart contracts. In 2021, the MGA released the “Guidance on the use of Innovative Technology Arrangements and the acceptance of Virtual Financial Assets and Virtual Tokens through the implementation of a Sandbox Environment”, extending the term of the sandbox up to 31^st December 2022.

Furthermore, in July 2020, the Malta Digital Innovation Authority (MDIA) released a consultation document inviting stakeholders to comment on the ITA Sandbox, finishing the MDIA’s ITA full certification framework, with the intention to set up an ITA sandbox to complement Malta’s certification framework. This resulted in the creation of the Technology Assurance Sandbox (MDIA-TAS) Version Two, effective 1^st of June 2022, catering for start-ups and smaller players seeking to correctly develop their innovative digital product or service (IDPS) through analysis by MDIA-recognized technical experts and monitoring by the Authority.

The enactment of the VFA Act and the Innovative Technology Arrangements and Services Act in 2018, as well as the setting up of the MDIA saw an increased interest as to what Malta could offer, not only in the virtual currencies sphere, but also as a fintech hub.  In its Fine-Tuning Strategy for 2022/2023, the MFSA solidified its intentions to focus on innovative and technological activities (specifically Malta’s payment and electronic money service industry) and be forward-thinking in its supervisory techniques while allowing innovation.

It is also important to consider the impact that the prospective EU regulation on Markets in Crypto-assets (MiCA), is expected to have on Malta’s homegrown DLT framework.

The MFSA has announced that it will ensure that Malta’s VFA framework can evolve in a ‘seamless manner into the new regulation once this comes into force’. This is expected to lead to a legislative amendment of the local VFA framework, which is intended to align the VFA Act and related legislation with MiCA.

Unfortunately, the covid-19 pandemic inevitably led innovative projects to move at a slower pace or to be postponed altogether, particularly due to financial constraints. This is now followed by rising prices due to increases in inflation rates and worldwide shortage of materials, which will inevitably affect new projects.

Malta Enterprise, Malta’s economic development agency has issued various incentives offering access to finance schemes, investment aid as well as schemes specifically targeted to start-ups.

The Micro Invest programme, which is one of the tax incentive plans offered, grants eligible undertakings the possibility to claim a tax credit of 45% of eligible expenditure and wage costs. Eligible undertakings include start-ups, female-owned undertakings, family businesses and single undertakings. Additional incentives are offered to undertakings operating from Gozo.

Malta also offers attractive tax residency rules for certain levels of employees in particular sectors whereby they can benefit from a flat rate of 15% on income tax on particular income streams provided that certain requirements are met.

The most prominent areas that have seen an increased interest are the payments sector as well as a continued interest in start-ups and companies (Series A and B) looking to venture into the cryptocurrency sphere. This includes established gaming companies (Series C) that seek to introduce an element of virtual tokens or cryptocurrency acceptance into their operations. On the tech front there is also a significant interest from market players as well as regulators with regards to the peer-to-peer economy and decentralised finance (DeFi).

While Malta has made a name for itself in the cryptocurrency sphere, one cannot forget that for many years prior to the enactment of the VFA framework, Malta had already established itself as a prominent financial services jurisdiction.

Operators wishing to establish themselves in Malta can thus benefit from a knowledgeable regulator that has always prided itself with being open to meet and discuss different projects and their licensable elements. Innovative projects may also benefit from the opportunity of working within the ambit of a sandbox (please refer to question 6 above for more information).

Start-ups, especially those in the fintech sector, find Malta a particularly attractive jurisdiction due to the concentration of industry players, talent, and suppliers on the island. Malta offers the right conditions for tech companies to develop, launch and scale their products within affordability.

The local labour pool caters for the needs of ICT employers across the range of technical and creative skills, while specialist knowledge can easily be sourced from overseas due to an incentive program for foreign workers. Salaries are lower than in other Western European IT centers, thus enabling small and medium-sized companies to afford the development of new products.

As an EU Member State Malta respects the principle of freedom of movement. EU citizens thus do not require a work permit to work and reside in Malta. EU citizens are however required to apply for a Maltese residence permit after having resided in Malta for 3 months. On the other hand, non-EU nationals are required to obtain a single-work permit to work and reside in Malta; this permit is valid for one year and is renewable for further 1-year periods. Certain occupations in particular sectors are also exempt from the requirement of employers having to open vacancies locally and within the EU before submitting an application for a prospective non-EU employee. This list changes depending on the exigencies of the Maltese labour market but currently includes computer network professionals, IT consultants, engineers, systems analysts and tech developers.

In a bid to attract more foreign talent, Malta implemented the EU directive 2014/66/EU on the Conditions of Entry and Residence of Third-Country Nationals in the Framework of an Intra-Corporate Transfer. This allowed the secondment of non-European managers/specialists/trainee employees within the EU as an intra-corporate transfer. As Malta’s aim is to establish itself as a FinTech hub, the Maltese government has launched various work/residence schemes to improve accessibility as well as advantages to foreign talent wishing to relocate to Malta.

One such scheme is the Key Employee Initiative (KEI) which is available to highly specialised non-EU nationals wanting to work in Malta. Its goal is to speed up the permit application process, placing a 5-working day approval process from the submission of the application. This initiative is only available to applicants who have an annual gross salary of at least €30,000. This is also available to innovators involved in start-up projects endorsed by Malta Enterprise. Once approved, applicants receive a residence permit valid for a year which may be renewed for a maximum period of three years (subject to conditions).

Malta also offers attractive tax residency schemes to employees in specific sectors such as the ICT industry and financial services. Subject to satisfying the requirements, employees would be eligible to benefit a flat tax rate of 15% with no further tax chargeable on income in excess of €5,000,000.

A Fintech can rely in Malta on essentially the same intellectual property protections which are generally available under generally recognised intellectual property rights for any industry.

Trademarks are mostly relevant for protection of apps, brand names, website domains, company names, and logos. Registered trademark rights are granted in Malta against successful trademark registration, although the concept of an unregistered trademark right also exists.

Copyright protection is also possible under the Maltese Copyright Act (chapter 415 of the Laws of Malta) and tends to be the main source of intellectual property protection relied upon by fintechs. Copyrights protect creative expressions, including source code of software and the way graphics, images, texts or designs are displayed. Database rights are also recognised in Malta as a sub-category under the Copyright Act.

Design rights are sometimes also used in Malta, as an addition to copyrights, especially for protection of user interfaces.

Generally, patents are unlikely to be the focus for fintechs since under the Maltese Patents and Designs Act (chapter 417 of the Laws of Malta), software programs as such are expressly excluded from patent protection.

Otherwise, the protection of know-how and trade secrets has recently been subject to specific legislative recognition, namely through the Trade Secrets Act (chapter 589 of the Laws of Malta), which was promulgated mid-2019 and to date has not been tested by Malta’s courts.

The enactment of the VFA Act sought to regulate cryptocurrencies that are deemed to be VFAs under the Maltese legal framework. The Act distinguishes between four different types of DLT assets, namely, virtual tokens, financial instruments, electronic money, and VFAs.

The term VFA refers to any form of digital medium recordation that is used as a digital medium of exchange, unit of account or store of value, and that is not electronic money, a financial instrument or a virtual token.

To offer legal clarity regarding this distinction, the MFSA created the Financial Instrument Test. The test must be applied to each DLT asset to determine its nature and the respective applicable legal framework based on the token’s features.

Once the type of DLT asset is determined, the following legal regime will be applicable:

1. virtual tokens are not regulated by any specific body of law in Malta;
2. financial instruments are defined as set out in the MiFID and thus regulated by financial services legislation;
3. electronic money is regulated in Malta by the Financial Institutions Act; and
4. VFAs are regulated by the VFA Act.

The VFA Act also regulates the provision of VFA services including the custody of VFAs, operating a VFA exchange, providing advice in relation to investment in VFAs, and dealing on own account. VFA service providers are deemed to be subject persons under AML rules and regulations, and are thus required to conduct AML/CFT checks on users of their platforms.

The concept of an initial coin offering under the VFA Act is termed as an Initial Virtual Financial Asset Offering (IVFAO). Any person wishing to offer a VFA to the public in or from Malta, or wishing to apply for the VFA’s admission to trading on a DLT exchange, must draw up a white paper in line with the VFA Act and register it with the MFSA at least 10 working days before the date of its circulation in any way whatsoever.

The white paper issued for an IVFAO must include information that, according to the particular nature of the issuer and of the VFAs offered to the public, is necessary to enable investors to make an informed assessment of the prospects of the issuer, the proposed project and the features of the VFA.

The IVFAO process is overseen by the VFA agent whose role is to advise and guide the issuer as to its responsibilities and obligations under the VFA Act. This includes ensuring that the issuer is considered to be a fit and proper person, and demonstrating how the issuer has complied and, as far as it can be determined, will comply with its continuing obligations under the VFA Act.

The VFA Act also regulates the advertisement of any IVFAO. Such advertisement must be clearly identifiable as such and may not include inaccurate or misleading information.

The upcoming EU Regulation on Markets in Crypto Assets (MiCA) is expected to have a significant impact on Malta’s homegrown DLT framework. The MFSA’s aim is to ensure that the Maltese framework evolves in a seamless manner into the new Regulation once it comes into force.

The Malta Business Registry (MBR) which is the Maltese companies house has over the past few years been developing a system based on the Hyperledger Fabric to allow submission of companies’ documents via DLT. This new system is intended to improve transparency and management in the workflow, while increasing efficiency and reducing paperwork through a document management system. Its aim is to also facilitate the use of AI within the MBR.

The Maltese Government has also launched a project whereby academic credentials, such as diplomas and school leaving certificates will be issued to Maltese students via an international, instantly-verifiable digital format. Educational institutions are to receive official accreditation certificates on the blockchain for instant verification status. This minimises bureaucracy and provides instant access and better protection.

The government has also launched additional projects using blockchain technology including the provision of digital labelling through the use of DLT which provides further information to customers on the provision of Gozitan products including their manufacturing cycle, as well as strengthening the Maltese Planning Authority through the use of DLT, by improving the security of documents and allowing added transparency.

Currently AI technologies are being given a push for development by the Maltese government in the hopes of increasing foreign investment and improving both the public and private sector, including the financial sector. The Maltese AI Strategy is in place to establish Malta as a leading global hub for financial and digital industries. The Maltese government thus appointed a task force to establish a plan and timeline with the goal of AI integration, legalisation and research.  AI is currently being used in the Maltese financial sector through AI-driven based solutions for intelligent financial planning, investment and money management services for consumers. They are also helping financial institutions create smarter credit and risk analysis applications and streamline operational performance. The Maltese Government also plans to establish a Digital Innovation Hub, with a focus on AI alluring both public and private stakeholders to access sector-specific, technological and financial expertise.

Insurtech is one area that has seen an element of increased interest and growth over the past few years. A 2017 start-up proposed a new way for personal insurance to be delivered by offering a personal insurance account with unbiased guidance and personalised insurance through a digital mobile-friendly interface.

In 2018 one of the largest insurance players on the island launched a platform to promote the innovations of insurance-related solutions. Its focus was to help entrepreneurs get their innovative business ideas off the ground or to help already mature start-ups in consolidating their business. It included a collaborative model with universities and business schools for joint development of innovative projects while also acting as an investment vehicle for private equity companies that invest in innovation within the insurance world.

More recently another prominent insurance agency launched a health insurance management platform to allow companies to manage group health policies online. This pushes the focus onto digitalisation, reducing carbon footprint and increasing customers’ ease of access.

Being one of the front-runners in enacting comprehensive legislation regulating the issue of cryptocurrencies and the provision of crypto-related services, Malta quickly became recognised as one of the main crypto-friendly jurisdictions globally. This builds on Malta’s already established presence as a strong player in the financial services industry with a knowledgeable and experienced financial regulator.

As the Maltese government has chosen to prioritise the fintech sector, financial institutions are encouraged to explore the benefits offered by newer technologies. While long-standing credit and financial institutions may have been wary of exploring more innovative technological solutions, established players in the local financial services industry have shown an increased interest in embracing such changes to their business models.

The larger banks have over the past few years developed their own fintech products such as through the introduction of mobile banking and digitising the customer onboarding process. This has also included making upgrades to internal systems to provide simpler access to information and services.

The biggest impact that can be witnessed is primarily from e-money and payment institutions that have disrupted the more traditional relationship that customers were typically accustomed to with credit institutions. This has inevitably led banks to re-evaluate their services and to embrace newer technologies.