Financial Integrity Monitor

Malta MT

Domains (D1–D6)
5
Sources
10
Role actions
8
Jurisdiction profile
Clean (Formerly Grey-Listed June 2021 - June 2022)Tier BRisk: StableMixed

Malta's AML/CFT regime rests on the Prevention of Money Laundering Act and PMLFTR regulations, supervised by FIAU (FIU) and MFSA (financial/VASP licensing).

MoreMalta was FATF/MONEYVAL grey-listed June 2021-June 2022; it retains a bespoke citizenship-by-investment programme (ruled unlawful by the CJEU in April 2025), an active crypto-licensing hub, and a large maritime flag registry exposed to sanctions-evasion shipping.

Key deficiencies
  • Citizenship-by-investment (golden passport) programme ruled contrary to EU law but not yet formally repealed/replaced
  • ESMA-identified gaps in MFSA's crypto-asset licensing authorisation and supervision process
  • Maritime flag registry exposure to shadow-fleet reflagging and false-flag practices
  • Continued reliance on shipping-industry revenue creating political resistance to stricter EU shadow-fleet enforcement
Recent developments (18m)
  • CJEU ruled Malta's investor citizenship scheme illegal (29 April 2025)
  • FIAU fined OKX's Maltese subsidiary EUR1.1 million for AML failures (April 2025)
  • ESMA completed a fast-track peer review criticising MFSA's crypto-authorisation process (July 2025)
  • EU Commission opened infringement procedure against Malta over recognition of judgments against Maltese-licensed gaming companies (June 2025)
  • Malta publicly resisting tightening of EU crypto-asset regulation (reported April 2026)
Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Maltas Financial Intelligence Analysis Unit has materially modernised its enforcement toolkit this cycle. LN 82 of 2026 grants the FIAU power to enter settlement agreements, capped at a fifty percent penalty reduction, and introduces periodic penalty payments for ongoing deficiencies. The same instrument formally defines the terms AML/CTF and immovable property agent, tightening the supervisory perimeter around a recognised enabler category in real estate. This structural expansion of enforcement tooling is corroborated across the FIAU own publications, GTG Legal, Mondaq, Shoulder.mt and Lawyers In Malta, and it sits alongside a live enforcement action: the FIAU issued a remediation directive against a notary public for failure to fully comply with the PMLFTR, a classic gatekeeper-category action reported by ACAMS. Read together, an architecture-over-incident reading favours the statutory reform as the more durable signal, with the notary action serving as early evidence that the new perimeter is being actively applied rather than left dormant.

Other Developments

Sanctions cadence divergence. United States and European Union sanctions posture is diverging in the same window: reported Congressional pressure over a seventeen-month pause in new Russia-related OFAC designations sits against continued EU Council autonomous listings, including Decision (CFSP) 2026/1939 freezing the assets of five Russian defence and military-technology executives. This is a posture gap rather than an architectural change, and it is assessed rather than confirmed given the reliance on a single secondary compliance-blog source for the US side.

Lao PDR retained under increased monitoring. The Financial Action Task Force June 2026 statement retains Lao PDR under increased monitoring, naming casino and Special Economic Zone supervisory deficiencies including fit-and-proper checks, a high-confidence finding drawn directly from FATF primary publication.

Beneficial ownership register widened. Maltas Centralised Bank Account Register Regulations were amended by LN 83 of 2026 to permit register-data sharing with foreign and supranational bodies, subject to confidentiality and data-protection equivalence checks. This widening of the account-register interconnection layer arrives ahead of the Anti-Money Laundering Authority direct-supervision build-out.

DeFi perimeter under study. The Malta Financial Services Authority published a June 2026 discussion paper exploring whether decentralisation should be treated as a spectrum rather than a binary test for MiCAs DeFi exclusion, noting many DeFi projects retain centralised features that could bring them inside the perimeter.

Grey-list status stable. Malta remains off the FATF grey list, from which it was removed in June 2022, and is not named in the June 2026 increased-monitoring statement, a status that stands in explicit contrast to comparator Lao PDR.

Cross-Monitor Connections

The standing EU AML Package sits as durable structural backdrop to this cycles Malta findings: the AML Regulation (Regulation (EU) 2024/1624, directly applicable), the sixth AML Directive (transposed per Member State), and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority together shift supervision from a purely national footing toward a hybrid EU-level regime, with AMLA this cycle opening a data-collection exercise to identify entities eligible for direct supervision and consulting on draft technical standards for suspicion-reporting formats. The Malta Financial Services Authoritys DeFi discussion paper connects directly to the crypto monitors on-chain-activity-regime coverage of the same instrument. The Centralised Bank Account Register widening and the closing of Maltas MiCA grandfathering window both bear on the world-payments monitors correspondent-banking and licensing coverage, where a MiCA-regulated entity recently received a payment-services licence tied to electronic money tokens; that licensing event is a world-payments finding, not re-analysed here.

Outlook

The Anti-Money Laundering Authority build-out through the second half of 2026, including its first work programme and supervisory methodology, is the primary structural item to watch, together with the outcome of the Malta Financial Services Authoritys DeFi-perimeter discussion paper, expected around the fourth quarter of 2026. Maltas own six AML Directive transposition status was not independently verified this cycle and remains an open gap that should be closed before the enforcement-modernisation signal can be read as complete.

weekly_brief_draft · JID MT
Domain intelligence (D1–D6)

D1 Sanctions

Sanctions

Continue reading

Malta itself carries no sanctions-architecture finding this cycle, but the global sanctions picture against which every enabler jurisdiction is read has shifted, and it forms the necessary context for assessing Maltas own posture. United States and European Union cadence is diverging: reported Congressional pressure over a seventeen-month pause in new Russia-related OFAC designations, raised amid stalled peace talks, sits against continued European autonomous listings, including Council Decision (CFSP) 2026/1939 freezing the assets of five Russian defence and military-technology executives in the same window. This is an assessed, not confirmed, finding, drawn from a single Tier 3 compliance-blog source, and the correct reading is a widening posture gap rather than an architectural change to either regime.

Separately, the Financial Action Task Force June 2026 increased-monitoring statement retains Lao PDR, naming casino and Special Economic Zone supervisory deficiencies, including fit-and-proper checks, mapped to FATF Recommendations 26 and 28. This is a high-confidence, Tier 1 primary-source finding. Malta itself is not named in the same statement and remains off the grey list, a status addressed in the AML/CTF Regime brief below rather than here, but the contrast between a retained-monitoring jurisdiction and a stable one is the frame through which sanctions-adjacent enabler risk should be read this cycle.

Outlook

The US/EU cadence gap is a watch item rather than a resolved architectural shift; a reversal of the reported OFAC pause, or a further EU autonomous listing round, would sharpen the divergence read. Lao PDRs monitoring status is unlikely to change materially inside this cycle horizon given the structural nature of the named deficiencies.

D2 Beneficial Ownership

Beneficial Ownership

Continue reading

The durable structural backdrop against which any Malta beneficial-ownership signal should be read is the EU AML Package, which comprises three distinct instruments: the AML Regulation, or AMLR (Regulation (EU) 2024/1624, directly applicable across Member States), the sixth AML Directive, or 6AMLD (transposed individually by each Member State), and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority. Together these instruments are shifting supervision from a purely national footing toward a hybrid EU-level regime, with AMLA building out a direct and indirect supervision perimeter over cross-border obliged entities. This is standing architecture, not a single-cycle development, and it is the frame against which this cycles Malta-specific signal is read.

Within that frame, the one Malta-specific development this cycle is the amendment of the Centralised Bank Account Register Regulations by LN 83 of 2026, which permits register-data sharing with foreign and supranational bodies, subject to confidentiality and data-protection equivalence checks. This is an assessed-confidence, Tier 3-sourced finding that widens the account-register interconnection layer ahead of AMLAs own direct-supervision build-out, itself confirmed at Tier 1 through AMLAs data-collection exercise to identify entities eligible for direct supervision and its consultation on draft technical standards for suspicion-reporting formats under AMLR Article 69(3).

Outlook

AMLAs work programme through the second half of 2026 is the primary item to watch; a published direct-supervision entity list would sharpen the read on how Maltas own CBAR widening interacts with the EU-level perimeter. No MT-specific 6AMLD transposition confirmation was obtained this cycle and remains an open gap.

D3 Enabler Jurisdictions

Enabler Jurisdictions

Continue reading

Maltas FIAU has undertaken the most substantial enforcement-architecture reform identified for any jurisdiction this cycle. LN 82 of 2026 amends the PMLFTR to grant the FIAU power to enter settlement agreements, capped at a fifty percent penalty reduction with a six-month window for pending appeals, and to impose periodic penalty payments for ongoing deficiencies rather than a single point-in-time fine. The same instrument formally defines, for the first time in Maltese statute, the terms AML/CTF and immovable property agent, a deliberate tightening of the supervisory perimeter around a professional category long recognised internationally as a money-laundering enabler channel for property-based layering. This is a high-confidence finding, corroborated across the FIAU own publications, GTG Legal, Mondaq, Shoulder.mt and Lawyers In Malta.

The reform is not merely legislative: the FIAU issued a remediation directive, an administrative measure, against an unnamed notary public for failure to fully comply with PMLFTR obligations, a classic gatekeeper-category enforcement action reported by ACAMS at Tier 2 confidence, without a directly located FIAU primary publication for this specific case. Architecture-over-incident framing favours reading the statutory reform, not the individual notary case, as the primary signal: Malta has widened both its supervisory perimeter (new immovable property agent definition) and its enforcement toolkit (settlements, periodic penalties) in a single legislative cycle, positioning it to escalate gatekeeper supervision going forward. The amended Centralised Bank Account Register Regulations, discussed under Beneficial Ownership, are a companion instrument in the same legislative package and reinforce the same enabler-perimeter-tightening reading.

Separately, and outside Malta, the UK Economic Crime and Corporate Transparency Act 2023 failure-to-prevent-fraud offence is expected to commence around the fourth quarter of 2026, a Tier 1, assessed-confidence structural development for enabler-adjacent corporate liability that sits on the same D3 typology axis, though general industry practice on reasonable prevention procedures remains uneven pending finalised guidance.

Outlook

Watch for the FIAUs first use of its new settlement power and for any published penalty-payment schedule under the periodic-penalty mechanism; both would convert this cycles statutory reform into an observable enforcement pattern. The UK failure-to-prevent-fraud offence commencement is the parallel non-Malta item most likely to reshape the enabler-jurisdiction typology reading next cycle.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Continue reading

The Malta Financial Services Authority published a discussion paper in June 2026 examining whether decentralisation should be assessed as a spectrum rather than a binary determination for whether a DeFi project falls within MiCAs perimeter. The paper notes that many DeFi projects retain centralised features, such as an identifiable operator, upgrade-key holder, or fee-collection mechanism, that could bring them inside MiCAs intermediary-based scope notwithstanding the Regulations general exclusion of fully decentralised services. This is an assessed-confidence finding, reported by CoinDesk at Tier 3 from what is understood to be a Tier 1 MFSA primary paper not directly retrieved this cycle, and it is not yet a binding rule change of any kind.

This is the first substantive Malta-specific regulatory engagement with the DeFi perimeter question identified in the record, and it should be read as an early-stage consultation signal rather than a settled supervisory position. It sits within the same MiCA build-out period during which Maltas VFA-to-CASP grandfathering window closed on 1 July 2026, a related but distinct development in the crypto-licensing typology rather than the DeFi-perimeter one addressed here.

Outlook

Whether the discussion paper converts into a formal consultation or rulebook change is the key open question; no such follow-through was identified this cycle. A firmer MFSA position, expected around the fourth quarter of 2026, would materially sharpen Maltas DeFi-perimeter typology exposure reading.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

AML/CTF Regime

Continue reading

Malta was removed from the FATF grey list in June 2022 and does not appear in the FATFs 19 June 2026 increased-monitoring statement, a high-confidence, Tier 1 finding drawn directly from the Malta Business Registry. This stable grey-list status is the backdrop against which this cycles enforcement-architecture reform, addressed in full under Enabler Jurisdictions, should be read: the FIAU has modernised its settlement and periodic-penalty toolkit and widened its supervisory definitions at the same time as maintaining its clean FATF standing, a combination that reads as regime modernisation from a position of relative strength rather than remediation from a position of deficiency, distinguishing Malta from the comparator case of Lao PDR addressed under Sanctions.

A specific gap remains open this cycle: Maltas own sixth AML Directive transposition status was not independently verified, and this should not be assumed complete simply because the jurisdiction remains off the grey list. Grey-list status and 6AMLD transposition completeness are related but analytically distinct questions, and the record this cycle only speaks to the former.

Outlook

Closing the 6AMLD transposition-verification gap is the single most valuable research item that would firm up Maltas AML/CTF regime read next cycle. Continued absence from any future FATF monitoring statement would further reinforce the stable-regime reading.

Regulatory horizon
No dated horizon items this cycle. 4 items tracked without a confirmed date.
4 pending date · baseline financial-integrity-2026-07-05
Role action cards
MLROHigh

FIAU gains settlement and periodic-penalty powers and issues a notary remediation directive.

New settlement authority (up to fifty percent penalty reduction) and periodic penalty payments change the calculus for how a Malta-supervised entity should approach an FIAU finding, and the notary directive confirms gatekeeper-category enforcement is live.

3 evidence refs
ComplianceAssessed

New statutory immovable property agent definition and widened CBAR data-sharing gateway change the Malta control perimeter.

Firms with real-estate-adjacent activity in Malta now sit under a formally defined supervisory category, and CBAR data may now flow to foreign and supranational bodies subject to equivalence checks, both of which are control-framework inputs to review.

3 evidence refs
LegalAssessed

US/EU sanctions cadence is diverging in the same window.

A reported pause in new US Russia-related OFAC designations alongside continued EU Council autonomous listings widens the gap between the two regimes, a posture divergence relevant to cross-border sanctions-nexus risk assessment.

2 evidence refs
BoardAssessed

Malta enforcement architecture is modernising while the jurisdiction remains off the FATF grey list.

The combination of a strengthened FIAU enforcement toolkit and stable FATF standing is a reputational-risk-reducing signal for institutions with Malta exposure, though a live notary enforcement action shows individual-firm risk persists.

3 evidence refs
CTOAssessed

MFSA is testing a decentralisation-spectrum approach to the MiCA DeFi perimeter.

A discussion-paper-stage MFSA proposal could, if it advances, bring DeFi projects with centralised features inside MiCAs authorisation perimeter, a architecture question relevant to any digital-asset infrastructure with Malta touchpoints.

1 evidence refs
RiskAssessed

Three structural shifts intersect this cycle: CBAR data-sharing widening, DeFi perimeter study, and sanctions cadence divergence.

Each represents an emerging exposure-shaping development rather than a settled rule, and together they illustrate why AML, CTF, and CPF findings should not be weighted purely by enforcement-action volume.

3 evidence refs
OperationsPossible

No material change for this persona this cycle beyond the standing CBAR and settlement-framework developments.

The FIAU settlement mechanism and CBAR widening are policy-level changes; no new screening or transaction-monitoring threshold instruction was identified this cycle.

2 evidence refs
AuditPossible

New periodic-penalty mechanism and a live notary enforcement action are both auditable enforcement-pattern inputs.

Whether the FIAUs new settlement and periodic-penalty tools have been used, and how, will be a natural control-testing scope item once observable enforcement data accumulates.

2 evidence refs
Decision lens
MLRO

FIAU gains settlement and periodic-penalty powers and issues a notary remediation directive.

Compliance

New statutory immovable property agent definition and widened CBAR data-sharing gateway change the Malta control perimeter.

Legal

US/EU sanctions cadence is diverging in the same window.

Board

Malta enforcement architecture is modernising while the jurisdiction remains off the FATF grey list.

CTO

MFSA is testing a decentralisation-spectrum approach to the MiCA DeFi perimeter.

Risk

Three structural shifts intersect this cycle: CBAR data-sharing widening, DeFi perimeter study, and sanctions cadence divergence.

Operations

No material change for this persona this cycle beyond the standing CBAR and settlement-framework developments.

Audit

New periodic-penalty mechanism and a live notary enforcement action are both auditable enforcement-pattern inputs.

Shared evidence: 6 refs
Scenario sketches

AMLA direct-supervision transition and the national-to-hybrid supervisory shift

As the Anti-Money Laundering Authority builds out its direct and indirect supervision perimeter under the AMLA Regulation, alongside the directly-applicable AMLR and per-state 6AMLD transposition, the supervisory landscape for cross-border obliged entities could gradually shift from a purely national footing toward a hybrid EU-level regime. Illustratively, national authorities such as Maltas FIAU may retain frontline supervision of smaller domestic obliged entities while AMLA assumes direct oversight of the largest cross-border groups, with data-sharing gateways such as Maltas amended Centralised Bank Account Register Regulations serving as one of the connective mechanisms feeding this transition. Evasion patterns could correspondingly migrate toward entities structured to remain below whatever size or cross-border threshold triggers direct AMLA supervision. This is an illustrative structural sketch, not an observed development.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion ArchitecturewatchUS Congressional pressure over a 17-month pause in new Russia-related OFAC designations contrasts with continued EU Council autonomous listings (Decision (CFSP) 2026/1939).
T2 · EU AML Package / AMLAwatchAMLA launched its data-collection exercise to identify entities eligible for direct supervision and opened consultation on draft ITS for suspicion-reporting formats under AMLR Article 69(3); MT amended CBAR mechanics via LN 82/83 ahead of AMLA build-out.
T3 · FATF Grey ListstableMalta remains off the grey list; Lao PDR remains listed with named casino/SEZ deficiencies; Cambodia remains off the list.
T4 · Beneficial-Ownership Register StatuswatchMalta's Centralised Bank Account Register Regulations amended by LN 83/2026 to permit register-data sharing with foreign/supranational bodies subject to equivalence checks.
T5 · Crypto & Digital-Asset IntegritywatchMFSA discussion paper on DeFi/MiCA perimeter; MT's MiCA CASP grandfathering ended 1 July 2026; Crypto.com's MiCA entity received an MFSA Limited Financial Institutions licence 27 Feb 2026.
T6 · Sanctions Regime DivergenceescalatingUS Congressional pressure over a 17-month OFAC designation pause contrasts with continued EU Council autonomous listings in the same window.
Registers

Enforcement actions

  • FIAU imposed an administrative fine following an onsite compliance examination in April 2023 that found serious and systematic AML control failures at OKX's Maltese-licensed entity. 3 Apr 2025
  • ESMA completed a fast-track peer review of MFSA's licensing and supervisory processes, focused on the authorisation and oversight of a crypto-asset provider, after OKX, Gemini and Crypto.com received Maltese licences since the start of 2025. 10 Jul 2025
  • The CJEU ruled in a European Commission infringement case that Malta's investor citizenship ('golden passport') scheme breaches EU law because it commercialises nationality without requiring a genuine link to the Member State. 29 Apr 2025
  • The Commission opened an infringement procedure against Malta for imposing on its courts an obligation to systematically refuse recognition and enforcement of other Member States' judgments against Maltese-licensed gaming companies, a practice that shields Malta-domiciled licensees from cross-border civil enforcement. 18 Jun 2025

Sanctions changes

  • EU 19th sanctions package added 117 shadow-fleet vessel listings (bringing the total to 557), listed maritime registries providing false flags to shadow-fleet vessels, and for the first time sanctioned crypto/stablecoin infrastructure (A7A5) used to finance Russia's war economy; measures bear directly on Malta as a significant flag-state and maritime-services jurisdiction. 23 Oct 2025
  • EU Council sanctioned a further 41 shadow-fleet vessels (bringing designated vessels to almost 600) and nine shadow-fleet enablers, alongside a joint EU/Member State declaration on using international law-of-the-sea powers against the shadow fleet threatening undersea infrastructure. 18 Dec 2025
  • UK forces (Royal Marines/National Crime Agency) boarded a sanctioned shadow-fleet tanker in the English Channel, the first such UK-led interdiction, treating stateless/falsely-flagged vessels under UNCLOS Article 110 powers rather than relying solely on port-access bans. 14 Jun 2026

Regulatory horizon (register)

  • AML Regulation (AMLR) general application date for Malta
  • AMLA direct supervision of selected high-risk entities begins
  • 6th AML Directive transposition deadline for Malta
  • Malta's legislative response to CJEU golden-passport ruling

Active schemes

  • [HIGH] Malta citizenship-by-investment (golden passport) programme
  • [HIGH] Malta-licensed VASP exposure to laundering flows
  • Maltese flag reflagging in Russian shadow-fleet chain
Sources
  1. Financial Intelligence Analysis Unit (FIAU) Malta
  2. FATF
  3. European Commission / AMLA
  4. European Commission Representation in Malta
  5. Bloomberg
  6. Bloomberg
  7. OCCRP
  8. OCCRP
  9. Council of the European Union
  10. ICIJ
Coverage gaps
Malta's citizenship-by-investment programme has been ruled u…
Malta's citizenship-by-investment programme has been ruled unlawful by the CJEU but had not been formally repealed or replaced with a compliant alternative as of mid-2026, leaving a legal-gap window in which a PEP/opaque-wealth citizenship conduit could persist in modified form.
ESMA's 2025 peer review found deficiencies in MFSA's crypto-…
ESMA's 2025 peer review found deficiencies in MFSA's crypto-asset authorisation and oversight processes precisely during a period in which major global exchanges (OKX, Gemini, Crypto.com) obtained Maltese licences, indicating supervisory capacity has not kept pace with licensing volume.
Malta, alongside Greece and Cyprus, has expressed concern ov…
Malta, alongside Greece and Cyprus, has expressed concern over stricter EU shadow-fleet enforcement measures given the size of its maritime/shipping sector, constraining the pace and stringency of flag-state accountability reform.
No specific, dated post-2022 MONEYVAL follow-up report confi…
No specific, dated post-2022 MONEYVAL follow-up report confirming Malta's exit from (or continued status within) enhanced follow-up was located during this baseline; the FATF Malta country page shows only a generic 'latest update: June 2025' timestamp on the 2021 Follow-Up Report page.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.