Buy-side PI acquisition · Malta
Buy a Payment Institution in Malta
The Malta Financial Services Authority is the integrated supervisor for Maltese payment institutions, regulating the perimeter under the Financial Institutions Act (Cap. 376) and the Financial Institutions Rules. Authorised Maltese PIs passport into the EU 27 plus the three EEA states under PSD2. Cadena Brokers represents acquirers only — every Maltese PI we put in front of a buyer has been pre-vetted on banking continuity, qualifying-shareholding history, and MFSA substance posture before it reaches the brief.
Why Malta
MFSA supervision, English-language jurisdiction, PSD2 passporting from a small EU member state
The Malta Financial Services Authority (MFSA) is the single supervisor for banks, insurance, investment services, e-money institutions and payment institutions on the island. Authorisation files for Maltese PIs sit inside the Authorisations function and move into ongoing supervision under the Financial Institutions Supervision function, alongside e-money institutions and the other Cap. 376 firms (lenders, leasing companies, FX dealers, money brokers). That placement is operationally meaningful for an acquirer. A Maltese PI is examined by case officers fluent in the same conduct, capital and ICT lenses applied across the Cap. 376 perimeter, which produces a supervisory file that pan-European correspondent banks read without translation friction. The entire MFSA rulebook, Cap. 376 itself and the supporting Financial Institutions Rules are issued in English.
The statutory framework is built on the Financial Institutions Act, Cap. 376 of the Laws of Malta, which transposes Directive (EU) 2015/2366 (the Second Payment Services Directive) and Directive 2009/110/EC (the Second Electronic Money Directive) into Maltese law. Supervisory detail sits in the Financial Institutions Rules issued by MFSA under the Act. FIR/01 sets out the licensing criteria, initial capital and own-funds requirements; FIR/02 covers conduct of business; FIR/03 (issued October 2024, fully applicable from 15 December 2024) governs corporate governance, outsourcing, safeguarding and consolidated regulatory reporting. Authorised Maltese PIs passport across the EU 27 plus Iceland, Liechtenstein and Norway under Articles 28 and 29 PSD2 by MFSA notification to the host competent authority. The notification is administrative, not a second authorisation file in the host country.
Three reasons acquirers shortlist Malta. First, the language: every regulator interaction, every rule, every internal policy template can be drafted in English without sworn translation, which materially reduces the document-production drag that Italian, Spanish or Greek files carry. Second, the size of the supervised population: roughly thirty payment institutions and a similar count of electronic money institutions sit on MFSA’s authorised register, which gives the regulator capacity to handle a qualifying-shareholding file without the queue depth larger member states impose. Third, the FIR/03 reset. The late-2024 rulebook update means every Maltese PI in market today has had to refresh its governance, safeguarding-audit and outsourcing posture, which gives an acquirer arriving in 2026 a clean baseline rather than the legacy patchwork some EU jurisdictions are still working through.
What a Maltese PI authorisation permits
Service scope, capital tiers, and the obligations a buyer inherits
Authorised activities follow PSD2 directly. Under Cap. 376 and FIR/01, statutory minimum initial capital scales with service scope. EUR 20,000 applies where the institution provides only money-remittance services. EUR 50,000 applies where the institution provides only payment-initiation services (PSD2 paragraph 2(g)). EUR 125,000 applies where the institution operates payment accounts, executes credit transfers and direct debits, or issues or acquires payment instruments (paragraphs 2(a) to 2(e)), the tier that covers the bulk of acquirer use cases. Own funds are maintained continuously above the higher of the initial-capital floor and the calculation produced by one of the three PSD2 methods. Active issuers most commonly run on Method B, the volume-linked formula.
Customer payment funds must be safeguarded under FIR/03: held in a segregated account at a credit institution outside the PI’s group, or covered by an insurance policy or comparable financial guarantee from an institution that is not part of the same group. The acquirer inherits the named safeguarding-bank relationship at signing, which is why Cadena Brokers screens banking continuity before targets reach the buyer. Maltese PIs typically safeguard either with one of the Maltese credit institutions (Bank of Valletta, HSBC Malta, APS Bank, MeDirect) or with an EU correspondent operating into Malta — the choice has implications for the change-of-control re-papering exercise the acquirer will run during the qualifying-shareholding window.
FIR/03 also introduced direct reporting obligations for those performing safeguarding audits and stricter outsourcing-governance expectations. The consolidated FI Return tightens reporting cadence (the January submission deadline replaces what was previously fragmented across separate filings). Operational-resilience expectations on Maltese PIs follow the Digital Operational Resilience Act (Regulation EU 2022/2554), which has applied to all Cap. 376 firms since 17 January 2025; MFSA’s supervisory expectations on incident classification, the third-party ICT-provider register, and threat-led penetration testing for larger institutions are integrated into the FIR/03 governance chapter. AML/CFT supervision runs in parallel under the Prevention of Money Laundering Act and the FIAU Implementing Procedures, with on-site reviews testing transaction-monitoring rules, sanctions-screening cadence and the seniority of the Money Laundering Reporting Officer.
What we broker here
The Maltese PI profiles in our book
Specific entities are not disclosed outside an executed NDA. The general profile of what reaches an acquirer’s brief from the Maltese shelf falls into three patterns. Mid-cap PIs running niche service mixes (B2B cross-border payouts, marketplace-payment programmes, remittance corridors into the Mediterranean and North Africa), sitting at the EUR 125,000 capital tier with multi-cycle MFSA files and named safeguarding relationships at one of the four main Maltese credit institutions. PI carve-outs from larger Maltese or international fintech groups, where the parent is rationalising the EU-payments footprint and willing to exit the Maltese charter while retaining other entities. Cross-border specialists: PIs originally authorised to service iGaming, e-commerce or affiliate-marketing payment flows under Malta’s broader gambling-and-fintech ecosystem, whose passporting reach into Continental Europe is intact and whose service mix maps to acquirers building a focused EU payment-operations platform.
The diligence gates that run on every Maltese file are four. Banking continuity: which Maltese or pan-EU credit institution holds the safeguarded balances, what re-papering looks like at change-of-control, and whether scheme memberships (Visa, Mastercard, SEPA payment-scheme participation through a sponsor bank) survive the new controlling group. AML programme depth: MFSA and FIAU expectations on transaction monitoring, sanctions screening and MLRO seniority, including any open recommendations from the most recent on-site inspection that the acquirer would inherit. Substance test in Malta: real headcount on-island, real office (typically Valletta, Sliema or Birkirkara), the four-eyes principle on senior management, and the local heads of compliance and AML staying through closing or being replaceable on a pre-agreed timetable. FIR/03 readiness: the governance-framework refresh, the safeguarding-audit reporting line, and the outsourcing-register completeness that MFSA has been examining since the 15 December 2024 application date — gap-lists in this area are now the most common diligence finding on Maltese PIs in flight to closing.
Acquisition path
MFSA non-objection under Article 16 of the Financial Institutions Act
Acquisition runs through a share purchase of the entity holding the MFSA authorisation, with prior non-objection under Article 16 of Cap. 376 — the qualifying-shareholding regime that Maltese law applies to financial institutions. The notification thresholds are the standard EU set: 10%, 20%, 30%, 50%, plus any move that hands the buyer control. The fit-and-proper assessment covers beneficial owners, the proposed members of the Board of Directors and senior management, group-structure transparency, source and provenance of funds, and the strategic plan for the PI post-acquisition. MFSA consults the home supervisor of any EU-regulated acquirer. The assessment clock under the EBA, ESMA and EIOPA Joint Guidelines runs sixty working days from a complete file, extendable by thirty working days in defined cases. The bottleneck for unprepared acquirers is the completeness gate, not the substantive review.
One procedural specific worth flagging at file-opening. MFSA expects the qualifying-shareholding application pack to land with the same depth of documentation as a fresh authorisation file: beneficial-owner certifications, audited acquirer accounts for the most recent three financial years, criminal-record certificates apostilled from the jurisdiction of habitual residence, the strategic plan and three-year financial projections for the PI under the new control, and a personal questionnaire from every proposed director. The advantage Malta confers (everything proceeds in English) reduces translation drag but does not relax the depth expectation. See the four-step acquisition process on the homepage for the standing checklist that runs in parallel.
Why Cadena
Buy-side only, transactional, fast
The mandate is buy-side only. Cadena Brokers works for the acquirer. MFSA notices when the same broker name appears on both sides of a transaction, and the qualifying-shareholding file lands cleaner when the buyer arrives with independent representation. We do not run listing brokerage, we do not split fees with sellers, and we do not present targets whose seller is paying a placement bonus to push the entity in front of a particular buyer.
Engagement is transactional. We take the acquirer’s brief, map it to two to four pre-vetted Maltese profiles, run side-by-side regulatory and banking diligence, and file the qualifying-shareholding notification with MFSA while target negotiations close in parallel. Each Maltese PI we present has a live, named safeguarding-bank relationship that has been personally confirmed within the prior quarter. Our diligence checklist is mapped to Cap. 376, FIR/01 on capital, FIR/03 on governance and safeguarding, and the DORA-implementation expectations MFSA has issued since January 2025. If the acquisition thesis depends on a particular service mix or a specific passporting corridor, we can tell you in the first meeting which targets in the Maltese book are board-ready for it and which are not.
FAQ
Maltese PI: questions buyers ask us
How do you buy a payment institution in Malta?
Phrased the way a buy-side acquirer would phrase it: you acquire the entity, not the licence as a standalone item. The transaction is structured as a share purchase of the company holding the MFSA authorisation, with prior non-objection under Article 16 of the Financial Institutions Act (Cap. 376) — the qualifying-shareholding regime. Cadena Brokers does not list targets publicly and does not represent sellers. We work for the acquirer; the entity opens up under NDA after the initial fit conversation, and the change-of-control filing runs in parallel with target negotiation.
What is the minimum capital for a Maltese payment institution?
Three tiers under FIR/01, transposing Article 7 PSD2. EUR 20,000 if the institution provides only money remittance. EUR 50,000 if the institution provides only payment-initiation services (PSD2 paragraph 2(g)). EUR 125,000 if the institution operates payment accounts, executes credit transfers and direct debits, or issues or acquires payment instruments (paragraphs 2(a) to 2(e)), the tier covering most acquirer use cases. Own funds are maintained continuously above the higher of that floor and the figure produced by one of the three PSD2 calculation methods. Active issuers most commonly fall under Method B, the volume-linked formula.
How does MFSA change-of-control approval work?
A qualifying-shareholding notification filed under Article 16 of Cap. 376. Thresholds are 10%, 20%, 30%, 50%, plus any move that hands the buyer control. MFSA assesses fit-and-proper standing of beneficial owners and the proposed Board of Directors, financial soundness and source of funds, group-structure transparency, the strategic plan for the PI, and AML/CFT integration. The assessment clock under the EBA-ESMA-EIOPA Joint Guidelines is sixty working days from a complete file, extendable by thirty working days in defined cases. MFSA consults the home supervisor of any EU-regulated acquirer. The completeness gate, not the substantive review, is what stalls unprepared filings.
Can a Maltese PI passport into other EU member states?
Yes. An MFSA-authorised PI passports across the EU 27 plus Iceland, Liechtenstein and Norway under Articles 28 and 29 PSD2 by MFSA notification to the host competent authority. Both cross-border services and establishment of branches, agents and distributors are available. Common host markets for Maltese PIs include Italy, Germany, France, Spain and the United Kingdom (the UK route is now via the FCA’s temporary permissions regime or a fresh FCA authorisation file post-Brexit). The notification is administrative; it is not a second authorisation file in the host country.
How long does a Maltese PI acquisition take?
The qualifying-shareholding clock is sixty working days from a complete file, extendable by thirty working days in defined cases. Practical wall time depends on file completeness rather than MFSA throughput. A buyer arriving with prepared fit-and-proper documentation, audited acquirer accounts, apostilled criminal-record certificates and a clear strategic plan typically clears the file inside the statutory clock. Buyers who file incomplete papers face the completeness gate, not a substantive disagreement with MFSA. Cadena Brokers does not publish closing-timeline guarantees because supervisory clocks are not ours to commit; we file expedited where the brief allows.
What is the difference between a Maltese PI and a Maltese EMI?
Both are MFSA-supervised under Cap. 376 and both passport across the EEA under PSD2 / EMD2. The PI (Payment Institution) provides payment services from the PSD2 list: credit transfers, direct debits, money remittance, payment-initiation, account-information services, issuing or acquiring of payment instruments. The EMI (Electronic Money Institution) does all of that and additionally issues electronic money under EMD2, which means it can hold customer balances on a stored-value basis. A PI cannot. If the acquirer’s post-close thesis includes issuing prepaid wallets, virtual IBANs as e-money accounts, or branded card programmes on a stored-value basis, the EMI charter is the right perimeter; if not, the PI is the cleaner fit at lower capital and lower governance overhead.
Next step
Open a buy-side mandate on Maltese PIs
Send a one-paragraph profile of the acquirer, the post-close service scope, banking-stack constraints if any, and any preference on passporting corridors or service-mix specialisation. Cadena Brokers responds inside one business day with the matching set from the current Maltese book, plus the banking-stack readout and substance-posture score for each. Buy-side only: no listing brokerage, no double-ended deals.
Start the buy-side conversation Request the Maltese shortlist
