KYC & AML Compliance in Malta (2026): Requirements for Payment Institutions

A completed onboarding form tells an examiner almost nothing about a Malta payment institution's actual compliance posture. What matters is whether the identity, purpose, risk, review, and escalation decisions behind that form can be recovered later — and for a lot of institutions, they can't, because the evidence lives in three different systems and the reasoning lives in nobody's notes. VOVE ID helps payment and BaaS teams connect identity evidence, exceptions, and reviewer actions in one operational workflow instead.

A Malta payment institution needs a risk-based AML/CFT program that identifies and verifies customers, understands the purpose and intended nature of the relationship, identifies beneficial owners where relevant, monitors the relationship, and routes suspicion promptly to the correct internal and external reporting path.

Malta's Control Perimeter: Start With the Institution and the AML/CFT Framework

The Malta Financial Services Authority (MFSA) supervises financial institutions authorized under the Financial Institutions Act, including payment institutions and electronic-money institutions. The MFSA's financial-institutions overview is a useful first check for a fintech deciding which authorization perimeter it occupies.

For AML/CFT, the core framework includes the Prevention of Money Laundering Act (Cap. 373), the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR), and the Financial Intelligence Analysis Unit's (FIAU) Implementing Procedures. The MFSA confirms that the FIAU procedures are binding on subject persons and that non-compliance can lead to administrative penalties, in its AML legislation summary.

A payment product, licensing classification, and AML/CFT workflow can't be designed as separate workstreams. Teams need to validate their own exact perimeter with legal and compliance advisers, then map the operating controls to that perimeter.

For the underlying identity-control model, see our KYC requirements framework.

Customer Due Diligence: Collect Evidence That Supports a Decision

The FIAU's April 2026 Implementing Procedures Part I explains that Regulation 7 of the PMLFTR requires identification and verification of the customer using documents, data, or information from a reliable and independent source. For legal entities, the workflow also needs to establish legal status and identify directors or the people administering the entity.

In practice, a payment institution should design the file around the relationship, not around a document upload. It should connect the customer or business, authorized representative, beneficial ownership where relevant, product purpose, expected activity, screening result, risk rationale, and decision owner.

An incomplete file usually looks complete at the front end. The identity document has been captured, but the reason for the relationship, ownership context, or review decision remains in another system or an inbox.

Remote Onboarding and Exceptions: Make the Manual Path Explicit

Remote onboarding needs a clear evidence standard and an equally clear exception path. Teams should define what an automated result can resolve, what must be reviewed, which discrepancies require further evidence, and who has authority to accept a residual risk.

This is where VOVE ID plugs in: identity verification, biometric liveness, face matching, AML screening, and KYB, tuned to a wide range of document types and countries, with built-in checks for document-template inconsistencies, invalid MRZ checksums, barcode or QR inconsistencies, and image manipulation. Manual review still comes into play when a customer's compliance team has enough evidence in front of them to approve a verification themselves.

None of that touches a Maltese institution's regulatory status, risk appetite, or suspicious-reporting decision — those stay with the team. What it does is keep the approval logic from disappearing the moment onboarding ends.

Monitoring and Escalation: Treat Onboarding as the First Control, Not the Last

The FIAU procedures require subject persons to demonstrate that the scope and timing of due diligence are appropriate to the relationship's ML/FT risk. The framework also includes ongoing monitoring, which FIAU guidance describes as scrutiny of transactions against the institution's knowledge of the customer, business, and risk profile, while keeping customer information up to date.

A payment institution therefore needs both event-driven and periodic review logic. A change in activity, ownership, expected use, or documentation should create an accountable case, not a vague instruction to revisit the account later.

The FIAU is Malta's national central agency for collecting, analyzing, and disseminating information related to money laundering and terrorist financing. It requires internal and external reporting arrangements, and suspicious transaction reports must be submitted promptly under the PMLFTR. A team needs a documented, tested escalation route before a case becomes urgent.

For the broader screening, case-management, and escalation operating model, see our AML requirements framework.

Records and Privacy: Preserve the Reasoning, Not Only the Documents

Payment institutions handle highly sensitive identity and financial evidence. Access controls, retention decisions, vendor governance, and audit trails need to be designed into the case workflow. The applicable legal basis and retention periods depend on the institution's activity and circumstances; teams should obtain current specialist advice rather than copy a generic policy.

The practical test is simple: can a compliance reviewer reconstruct what was collected, why the customer was accepted or escalated, which information was later updated, and who made each decision? If reconstructing that file requires manual searching across tools, the workflow has a control gap.

Practical Malta KYC and AML Checklist

Governance

• Confirm the institution's authorization, AML/CFT perimeter, and accountable decision owner.
• Map outsourced or delegated onboarding steps to the records the institution must retain.
• Validate policies against current PMLA, PMLFTR, FIAU, and MFSA materials.

Customer due diligence

• Verify customer identity from appropriate reliable and independent evidence.
• Connect representative authority, ownership, purpose, and risk evidence before approval.
• Record the rationale for every exception, escalation, and manual decision.

Monitoring and reporting

• Define trigger events for activity, ownership, documentation, and risk changes.
• Compare activity against the known customer and relationship profile.
• Maintain a tested internal route for prompt FIAU escalation when reporting is required.

Records and audit

• Retain source evidence, reviewer actions, and final decisions together.
• Restrict sensitive identity and case information by role.
• Test whether a reviewer can reconstruct a case without relying on email threads.

FAQ

Which authority matters most for a Malta payment institution? The MFSA is the financial-services supervisor for authorized financial institutions, while the FIAU has central AML/CFT functions and issues the Implementing Procedures. The precise obligations depend on the firm's authorization and activities.

Does remote identity verification complete customer due diligence? No. It can provide important evidence, but teams still need a risk-based assessment, relationship purpose, beneficial-owner handling where relevant, exception management, monitoring, and retrievable records.

What should trigger an onboarding escalation? Examples include inconsistent evidence, unclear authority or ownership, an unexplained relationship purpose, screening concerns, or information that can't be resolved under the institution's policy.

What should a team retain for auditability? Retain the source evidence, relevant risk assessment, review actions, escalation record, and decision rationale in a way that's retrievable and access controlled.

Final Thoughts

Collecting documents was never the discipline Malta's regulators are actually testing for. What they're testing for is whether a payment institution can still explain, on request, why a relationship was accepted and how it was monitored from that point forward — which only works if identity, risk, review, and reporting evidence stayed connected the whole time.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.