Payment initiation and account information services in Malta
Open banking providers in Malta fall under the Financial Institutions Act. Payment initiation needs a full payment institution licence, while account information service providers only register with the MFSA. Neither may hold client funds, but both need professional indemnity insurance and the MFSA still expects real governance in Malta.
Facts under review · last checked 2026-10-08 · confirm figures with the regulator before relying on them
Regulator · Malta Financial Services Authority (MFSA) ↗
Key facts
- Payment initiation (PIS) initial capital
- €50,000, plus professional indemnity insurance or a comparable guaranteePSD2-Art-7(b)as of 2026-10-08Source ↗
- Account information (AIS) capital
- No initial capital; registration instead of authorisation, with professional indemnity insurance or a comparable guaranteePSD2-Art-33as of 2026-10-08Source ↗
- MFSA fees for AIS providers
- €1,000 application fee; €5,000 registration fee on registration and every year afterMalta L.N. 366 of 2024, reg. 5Aas of 2026-10-08Source ↗
- MFSA fees for PIS providers
- €10,000 application fee; annual supervisory fee from €25,000 plus a variable elementMalta L.N. 366 of 2024, regs. 3 and 4as of 2026-10-08Source ↗
- EU reform status (PSD3/PSR)
- Negotiated text approved by the European Parliament ECON committee on 5 May 2026; plenary indicatively scheduled for 14 December 2026as of 2026-10-08Source ↗
Realistic timeline
Who does what, and how long each phase usually takes once work starts. The regulator’s share is outside anyone’s control.
- HartsizScoping and gap analysis2–4 weeks
- YouCompany set-up, hires, insurance and application pack6–12 weeksHartsiz drafts the pack; the client supplies people, insurance and decisions
- RegulatorMFSA review and decision16–40 weeksOutside our control; depends on MFSA workload and the quality of answers
Estimated end to end: 6–13 months. Not a guarantee.
What the regulator expects to see
- Maltese company with head office in Malta
- Directors and key function holders of good repute with relevant knowledge and time
- Professional indemnity insurance sized under the EBA guidelines
- Strong customer authentication and secure communication with banks' APIs
- ICT risk-management framework under DORA
Questions we get
Do we need a licence for account information only?
No full licence, but you must register with the MFSA, hold professional indemnity insurance and pay the €1,000 application fee and €5,000 annual registration fee.
Will PSD3 change this?
The new EU payments package is not yet adopted. Until it applies, PIS and AIS remain under the current PSD2-based rules.
Changes affecting this route
- UpcomingEuropean Union · Fintech & Crypto · medium impact
PSD3 and Payment Services Regulation indicative plenary vote
The European Parliament's procedure file lists 14 December 2026 as the indicative plenary date for the payment services file, after the committee approved the agreed text in May 2026. Adoption would start the countdown to new authorisation, safeguarding and fraud-liability rules for payment and e-money institutions. Indicative plenary dates can move.
Source ↗