The Malta Financial Services Authority (MFSA) has published a comprehensively rewritten Financial Institutions Rule 1 (FIR/01) on the 14th October 2025. This is not a minor update, but a complete structural overhaul that fundamentally modernises the framework, replacing the previous FIR/01/2020. The revised rule, now structured as Chapter 1 of the Financial Institutions Rulebook, signals a policy shift towards enhancing regulatory scrutiny, demanding tangible local substance, and formalising the entire authorisation lifecycle.
This article analyses the most significant changes and unpacks the practical impact for both prospective new licence applicants and existing regulated institutions.
The Major Changes
The move from a standalone document to a modular rulebook format is the most visible change, but the substantive shifts within are far more significant.
- Emphasis on “Substance” and “Minimum Expectations”:
The revised FIR/01 introduces a new “gatekeeping” section (Title 2, Section 1) outlining the MFSA’s “minimum expectations” prior to submitting an application. This includes demonstrating a viable business strategy, availability of capital, and, crucially, “local mind and management” and tangible “substance”. The rule expressly warns that the MFSA does not have an appetite for the so-called ‘Letterbox entities’”. - Formalised Pre-Application Phase:
What was previously an informal recommendation for a pre-application meeting has now become a formal, mandatory step in the process. Applicants are now required to submit a detailed presentation to the MFSA at least 10 working days prior to this meeting. This presentation must cover a comprehensive list of items, including the full group structure, flow of funds diagrams, 3-year financial projections, and how the applicant intends to comply with the DORA Regulation. - Full Integration of DORA Obligations:
The revised FIR/01 and its annexes fully integrate the DORA requirements, for instance Annex 1 demands a description of ICT business continuity plans and security measures that ensure a high level of digital operational resilience in accordance with Regulation (EU) 2022/2554 (‘DORA’). - Clarity on professional indemnity insurance (PII): The revised FIR/01 establishes the PII requirements for Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs) under Annex II. This annex provides a concrete formula for calculating the minimum monetary amount, offering clarity for the applicants.
- Formalising Post-Licensing Scrutiny: The revised rule formalises “pre-licensing requirements” (to be met after in-principle approval) and “post-licensing, pre-commencement of business requirements”. Most notably, it reserves the MFSA’s right to impose further post-licensing conditions for a period of 6 to 18 months after commencement, such as requiring an independent internal audit report.
What This Means for New Applicants
The message from the MFSA is unequivocal: the authorisation bar is higher, and comprehensive preparation is non-negotiable. With the number of applications for a Financial Institutions licence reaching an all time high, the regulator has greater discretion to be selective and to prioritise applicants demonstrating stronger governance and substance.
The Rule now formalises the ‘Substance’ criteria. What were previously supervisory expectations on substance have now been formalised into explicit criteria. Applicants must demonstrate a genuine commitment to Malta from day one. The expectation of “substance” and “local mind and management” means that the business plan must be built around tangible local presence, not just a regulatory flag. The explicit warning against “letterbox entities” indicates that applications perceived as hollow or overly reliant on outsourcing will be filtered out at an early stage.
Undoubtedly, the regulator must proceed carefully in this matter, as it may present both advantages and challenges. The demand for local expertise will likely lead market participants to recruit talent from competitors, potentially resulting in a cycle of headhunting. Similarly, the regulator needs to balance imposing such a stringent requirement with respect to applicants forming part of a larger group of entities, whereby synergies may be gained from reliance on certain group functions such as IT development, business development and other support functions.
There are several stages to the Application journey which is now better structured under the revised FIR/01.
- Stage 1 (Pre-Application): The new mandatory presentation means applicants must have their business model, governance structure, flow of funds, and DORA strategy substantially finalised before the first formal meeting. This is no longer an informal discussion but a first test.
- Stage 2 (Application): The information requirements, detailed in Annex I are more rigorous and clearly delineate between payment services and other financial institution activities.
- Stage 3 (Post-Licensing): Applicants must be prepared for an extended “probationary” period. The ability for the MFSA to impose conditions for up to 18 months after commencement such as submitting an independent internal audit report covering the first 12 months of operations means the business must prove its model is as robust in practice as it was on paper.
What This Means for Currently Regulated Institutions
While Title 2 of the new rule is aimed at new applicants, existing licensed institutions should not ignore this update to the Rule. It signals a clear shift in supervisory expectations.
A New Benchmark for Governance and Substance The explicit standards for governance, substance, and the detailed expectations for the role of the Compliance Officer will inevitably become the new benchmark for ongoing supervision. Existing FI’s, especially those with lean local structures or significant outsourcing arrangements, should proactively review their setups against these new, higher standards. The MFSA’s “letterbox” warning is a principle that applies conceptually to all licence holders, not just new ones.
Clearer Rules for Change Title 3 of the new FIR/01 is a welcome addition, as it consolidates and clarifies procedures for post-authorisation changes. It provides a clear roadmap for:
- Modification of a Licence such as adding a new activity;
- Change in Participation or Control such as having a new qualifying shareholder;
- Surrender of Licence.
This provides a single, clear “how-to” guide for managing material changes to the firm, which was previously fragmented across the old rule.
Focus on DORA and Exemptions The rule’s deep integration of DORA reinforces the fact that all financial institutions must have their digital operational resilience strategies finalised and in focus. Furthermore, firms operating under an exemption, such as the limited network exemption or the electronic communications exemption, must be aware of the new, formalised annual notification requirements detailed in Title 1, Section 5.
In conclusion, the new FIR/01 is a significant step-change. It comes out as a stricter, more transparent, and substance-focused regulatory approach. For new applicants, the demand is for more local substance and preparedness while for existing FI’s it is a signal for them to “review and align” with the MFSA’s elevated expectations for a robust and reputable financial sector.
If you are considering applying for a Malta-based EMI, PSP, or FI, we invite you to contact us to explore the various ways in which we can support your objectives. Whether you require comprehensive assistance with your application, updates, or guidance on compliance matters, our team at Embark Malta is ready to provide expert support.
This article was authored by Jean Paul Gauci, Regulatory Advisory Manager at Embark Malta Limited. For further information or tailored guidance, you may reach out to Jean Paul at jean.gauci@embark.mt or through info@embark.mt