The Malta Financial Services Authority (MFSA) has published a comprehensively rewritten Financial Institutions Rule 1 (FIR/01) on the 14th October 2025. This is not a minor update, but a complete structural overhaul that fundamentally modernises the framework, replacing the previous FIR/01/2020. The revised rule, now structured as Chapter 1 of the Financial Institutions Rulebook, signals a policy shift towards enhancing regulatory scrutiny, demanding tangible local substance, and formalising the entire authorisation lifecycle.

This article analyses the most significant changes and unpacks the practical impact for both prospective new licence applicants and existing regulated institutions.

The Major Changes

The move from a standalone document to a modular rulebook format is the most visible change, but the substantive shifts within are far more significant.

1. Emphasis on “Substance” and “Minimum Expectations”:
   The revised FIR/01 introduces a new “gatekeeping” section (Title 2, Section 1) outlining the MFSA’s “minimum expectations” prior to submitting an application. This includes demonstrating a viable business strategy, availability of capital, and, crucially, “local mind and management” and tangible “substance”. The rule expressly warns that the MFSA does not have an appetite for the  so-called ‘Letterbox entities’”.
2. Formalised Pre-Application Phase:
   What was previously an informal recommendation for a pre-application meeting has now become a formal, mandatory step in the process. Applicants are now required to submit a detailed presentation to the MFSA at least 10 working days prior to this meeting. This presentation must cover a comprehensive list of items, including the full group structure, flow of funds diagrams, 3-year financial projections, and how the applicant intends to comply with the DORA Regulation.
3. Full Integration of DORA Obligations:
   The revised FIR/01 and its annexes fully integrate the DORA requirements, for instance Annex 1 demands a description of ICT business continuity plans and security measures that ensure a high level of digital operational resilience in accordance with Regulation (EU) 2022/2554 (‘DORA’).
4. Clarity on professional indemnity insurance (PII): The revised FIR/01 establishes the PII requirements for Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs) under Annex II. This annex provides a concrete formula for calculating the minimum monetary amount, offering clarity for the applicants.
5. Formalising Post-Licensing Scrutiny: The revised rule formalises “pre-licensing requirements” (to be met after in-principle approval) and “post-licensing, pre-commencement of business requirements”. Most notably, it reserves the MFSA’s right to impose further post-licensing conditions for a period of 6 to 18 months after commencement, such as requiring an independent internal audit report.

What This Means for New Applicants

The message from the MFSA is unequivocal: the authorisation bar is higher, and comprehensive preparation is non-negotiable. With the number of applications for a Financial Institutions licence reaching an all time high, the regulator has greater discretion to be selective and to prioritise applicants demonstrating stronger governance and substance.

The Rule now formalises the ‘Substance’ criteria.  What were previously supervisory expectations on substance have now been formalised into explicit criteria. Applicants must demonstrate a genuine commitment to Malta from day one. The expectation of “substance” and “local mind and management” means that the business plan must be built around tangible local presence, not just a regulatory flag. The explicit warning against “letterbox entities” indicates that applications perceived as hollow or overly reliant on outsourcing will be filtered out at an early stage.

Undoubtedly, the regulator must proceed carefully in this matter, as it may present both advantages and challenges. The demand for local expertise will likely lead market participants to recruit talent from competitors, potentially resulting in a cycle of headhunting.  Similarly, the regulator needs to balance imposing such a stringent requirement with respect to applicants forming part of a larger group of entities, whereby synergies may be gained from reliance on certain group functions such as IT development, business development and other support functions.

There are several stages to the Application journey which is now better structured under the revised FIR/01.

• Stage 1 (Pre-Application): The new mandatory presentation means applicants must have their business model, governance structure, flow of funds, and DORA strategy substantially finalised before the first formal meeting. This is no longer an informal discussion but a first test.
• Stage 2 (Application): The information requirements, detailed in Annex I are more rigorous and clearly delineate between payment services and other financial institution activities.
• Stage 3 (Post-Licensing): Applicants must be prepared for an extended “probationary” period. The ability for the MFSA to impose conditions for up to 18 months after commencement such as submitting an independent internal audit report covering the first 12 months of operations means the business must prove its model is as robust in practice as it was on paper.

What This Means for Currently Regulated Institutions

While Title 2 of the new rule is aimed at new applicants, existing licensed institutions should not ignore this update to the Rule. It signals a clear shift in supervisory expectations.

A New Benchmark for Governance and Substance The explicit standards for governance, substance, and the detailed expectations for the role of the Compliance Officer will inevitably become the new benchmark for ongoing supervision. Existing FI’s, especially those with lean local structures or significant outsourcing arrangements, should proactively review their setups against these new, higher standards. The MFSA’s “letterbox” warning is a principle that applies conceptually to all licence holders, not just new ones.

Clearer Rules for Change Title 3 of the new FIR/01 is a welcome addition, as it consolidates and clarifies procedures for post-authorisation changes. It provides a clear roadmap for:

• Modification of a Licence such as adding a new activity;
• Change in Participation or Control such as having a new qualifying shareholder;
• Surrender of Licence.

This provides a single, clear “how-to” guide for managing material changes to the firm, which was previously fragmented across the old rule.

Focus on DORA and Exemptions The rule’s deep integration of DORA reinforces the fact that all financial institutions must have their digital operational resilience strategies finalised and in focus. Furthermore, firms operating under an exemption, such as the limited network exemption or the electronic communications exemption, must be aware of the new, formalised annual notification requirements detailed in Title 1, Section 5.

In conclusion, the new FIR/01 is a significant step-change. It comes out as a stricter, more transparent, and substance-focused regulatory approach. For new applicants, the demand is for more local substance and preparedness while for existing FI’s it is a signal for them to “review and align” with the MFSA’s elevated expectations for a robust and reputable financial sector.

If you are considering applying for a Malta-based EMI, PSP, or FI, we invite you to contact us to explore the various ways in which we can support your objectives. Whether you require comprehensive assistance with your application, updates, or guidance on compliance matters, our team at Embark Malta is ready to provide expert support.

This article was authored by Jean Paul Gauci, Regulatory Advisory Manager at Embark Malta Limited. For further information or tailored guidance, you may reach out to Jean Paul at jean.gauci@embark.mt or through info@embark.mt

Maintaining momentum is one of the key ingredients to a successful business. When faced with loss of talent, some businesses may crawl until they get back on their feet. A strong succession plan bridges this gap, securing continuity, continued growth and making for a smoother transition. Today’s fast-paced reality is hardly forgiving – succession planning provides the peace of mind that the organisation can continue to run without interruption while people move on to either new opportunities, retirement or pass on.

One of the considerations which is often missed in this systematic process is that succession planning should be gradual. Knowledge-sharing is built through time, creating a strong foundation so in the eventuality, the transition is made smoother and is almost a non-event.

Far from a new concept, succession planning should be included as part of an organisation’s sustainability framework as part of good governance also with ESG principles in mind.

The hardest part is convincing people who are set in their own ways and who have always gone about doing things in a certain manner, dedicating long hours of their day to the operations of the company they helped to build.

Many businesses lack the level of preparedness and understanding the importance of long-term strategic planning. Succession planning creates peace of mind to both internal and the external stakeholder, assuring investors, directors and employees alike of the organisation’s plans for continued growth.

Investors are increasingly looking for these trends also with the increased awareness that ESG principles are bringing about.

Planning for succession and implementing these plans creates a more agile business; one which is ready to face challenges and changes without the knowledge being lost.

So how does a company prepare for the unexpected? A gap analysis followed by an introspective / inward look within can reveal employees with greatest potential; desired qualities such as intellect, aptitude, attitude, agility and leadership skills are among the traits mostly sought after. With an effective employee development plan in place and mentoring, this increases the level of employee engagement.

A carefully planned succession process ensures sustainable growth and continuity while leveraging a transition into a strategic opportunity. Afterall, great leadership, success and lasting values are measured by succession.

We partner with businesses to enable all this and craft a smooth succession process in a well-planned journey. We do this with passion with a view to ensure long-lasting success. Talk to us today for more information on how we can assist you in this transition. 

This article was authored by Robert Ancilleri (Chief Executive Officer)