What Every MFSA License Type Means (And How to Check One in Seconds)
Published
If you're doing business with a Maltese company — lending it money, hiring it as a service provider, or researching a counterparty — one question matters more than almost any other: is this entity actually licensed, and for what?
Malta's regulator, the Malta Financial Services Authority (MFSA), keeps the official Financial Services Register of every bank, investment firm, insurer, crypto provider, trustee and company service provider authorised to operate in or from Malta. But the register alone doesn't tell you what a licence means — what a company is allowed to do, and what it isn't.
This guide breaks down every major MFSA licence category in plain language, so you can read a company's authorisation and immediately understand its scope. At the end, we show you how to verify one yourself.
Key takeaways
- MFSA licences aren't interchangeable — a Payment Institution cannot take deposits like a bank, and an insurance agent is not the same as an insurance broker.
- The licence category sets the ceiling on what a company can legally do. Activity outside that scope is a red flag.
- You can see the MFSA licences held by any Malta-registered company — category, status and recorded changes — on its Malta Company Search profile, built from the MFSA's own register.
Why licence categories matter before you sign anything
A licence isn't a stamp of general trustworthiness — it's a defined permission. A company licensed to give investment advice is not automatically licensed to hold your money, execute trades or manage a fund. Confusing these categories is one of the most common ways people get blindsided, whether they're onboarding a vendor, investing, or vetting a potential partner.
Below, each category covers what the licence allows, a real-world example, and what it specifically does not cover.
Banking and credit institutions
A credit institution is a bank authorised under Malta's Banking Act (Cap. 371). It can take deposits from the public and grant credit, and usually also provides payment and other financial services.
The defining feature is deposit-taking, which no other financial licence permits. If a company is soliciting deposits or savings products but isn't licensed as a credit institution, treat that as an immediate warning sign.
Example: a retail bank offering savings accounts and mortgages.
Financial institutions: payment and e-money firms
“Financial institution” is a broad bucket under the Financial Institutions Act (Cap. 376), and one of the most frequently misunderstood categories.
- Payment Institutions — provide regulated payment services — payment accounts, money transfers, card acquiring and similar. They can hold client funds only to execute payments, must safeguard them, and cannot take deposits.
- Electronic Money Institutions (EMIs) — can also issue electronic money, in addition to payment services. Digital wallets and prepaid card providers typically fall here.
- Other financial institutions — cover specific activities such as lending, financial leasing, guarantees, foreign exchange and money broking — each requiring its own authorisation.
Example: a fintech app offering instant money transfers is likely a Payment Institution; one issuing a stored prepaid balance is likely an EMI.
Investment services and investment firms
This is the largest and most nuanced licence family, because “investment firm” covers several distinct, separately licensable activities under the Investment Services Act (Cap. 370).
- Reception and transmission of orders — the firm passes your buy/sell instruction to another firm for execution, without executing it itself.
- Execution of orders — the firm actually carries out the trade on your behalf.
- Dealing on own account — the firm trades with its own capital rather than client money, so it carries direct market exposure.
- Portfolio management — the firm makes discretionary investment decisions for you within an agreed mandate.
- Investment advice — personalised recommendations, as opposed to general market commentary.
- Underwriting — the firm takes on the risk of placing a new securities issue with investors.
- Placing without a firm commitment — the firm markets an issue but doesn't guarantee it will sell.
- Custody and safekeeping — holding or administering client assets, including trustee and custodian services for investment funds.
- Operating an MTF or OTF — running a multilateral or organised trading facility — an organised venue distinct from a regulated stock exchange.
Why it matters: a firm licensed only for reception and transmission of orders has no authority to manage your money at its discretion. Always match the specific service to the specific licence.
Fund management: AIFMs, UCITS managers and de minimis managers
Fund managers decide where a fund's capital is invested.
- AIFM (Alternative Investment Fund Manager) — manages alternative funds — private equity, real estate, hedge strategies, private debt.
- UCITS management company — manages UCITS, the tightly regulated, retail-oriented fund structure used across the EU.
- De minimis fund manager — an AIFM below the EU size thresholds. Where the EU directive only requires registration for these managers, Malta still licenses them, under a proportionate regime.
Fund administration, custody and depositary services
These roles are deliberately kept separate from fund management as an investor-protection safeguard.
A fund administrator handles the operational side: NAV calculations, investor registers, fund accounting, and processing subscriptions and redemptions. It does not decide where the fund invests.
A custodian or depositary safeguards the fund's or client's assets and oversees how they are handled. The manager decides what to buy; the depositary makes sure those assets are held safely and independently.
Why it matters: it stops the person deciding where your money goes from also being the only one holding it.
Insurance undertakings
An insurance undertaking is authorised under the Insurance Business Act (Cap. 403) to carry on insurance business, broadly split into:
- General insurance — motor, property, travel, liability, marine and other non-life cover.
- Long-term insurance — life insurance and certain savings or investment-linked policies.
- Reinsurance — insurance sold to insurance companies themselves.
- Captive insurance — an insurer set up mainly to cover the risks of its own parent company or group.
Insurance intermediaries: brokers, agents and tied intermediaries
Intermediaries distribute or arrange insurance without being the insurer, and are regulated under the Insurance Distribution Act (Cap. 487).
- Insurance broker — works independently of insurers, arranging cover on the client's behalf.
- Insurance agent — represents one or more insurers and distributes their products. On the register an agent is listed against each insurer it acts for.
- Tied insurance intermediary — acts under the full responsibility of a specific insurance undertaking or intermediary.
- Ancillary insurance intermediary — sells insurance as a side-line to its main business — for example travel cover sold with a holiday.
- Insurance manager — a separate category: a firm that runs the operations of insurance undertakings (often captives) rather than selling cover to the public.
Why it matters: a broker owes you a different duty from an agent tied to one insurer's products.
Pensions and retirement schemes
Under the Retirement Pensions Act (Cap. 514), the MFSA also regulates private pensions: retirement scheme administrators, personal and occupational retirement schemes, retirement funds, and their custodians and investment managers. This matters whenever you assess a company involved in pension or retirement products.
Company service providers (CSPs)
A company service provider offers corporate services to third parties — forming companies, acting as director or company secretary, and providing a registered office or business address — under the Company Service Providers Act (Cap. 529). Since amendments that came into force in May 2025, there are three tiers:
- Authorised CSP — provides company services as a business and holds a full MFSA authorisation.
- Limited CSP — an individual with no more than 10 involvements at any time, who registers with the MFSA and follows a lighter rulebook.
- Restricted CSP — an individual serving at most five companies across no more than two groups, who only notifies the MFSA rather than registering or being authorised.
Why it matters: if a company's director is acting as a CSP, check which tier they fall into. Each carries different obligations and a different level of MFSA oversight.
Trustees and fiduciaries
A professional trustee or fiduciary is authorised under the Trusts and Trustees Act (Cap. 331) to administer trusts, foundations and other fiduciary structures.
A trustee of family trusts is a narrower category: a company that acts only for specific settlors and their family trusts (no more than five settlors at a time) and doesn't offer trustee services to the public. It is registered with the MFSA rather than authorised.
Crypto-asset service providers (CASPs) and issuers
Malta's crypto framework now runs under the EU's Markets in Crypto-Assets Regulation (MiCA) and the local Markets in Crypto-Assets Act (Cap. 647), which replaced the earlier Virtual Financial Assets regime. Older VFA-era entries can still appear on the register.
A crypto-asset service provider (CASP) can be authorised for services such as custody, operating a trading platform, exchanging crypto for funds or other crypto, executing or receiving and transmitting orders, placing, transfer services, and advice or portfolio management. The exact scope depends on the services listed in its authorisation.
Issuing tokens is a separate matter:
- ART issuer — issues an asset-referenced token, designed to keep a stable value against a basket of assets or currencies. This needs its own authorisation.
- EMT issuer — issues an e-money token pegged to a single official currency. Only a bank or an Electronic Money Institution may do so.
- Other crypto-assets — tokens that are neither ARTs nor EMTs. Offering them doesn't need an authorisation, but a compliant white paper must be notified to the regulator.
Why it matters: a CASP authorised for custody isn't automatically allowed to issue its own stablecoin, and a token issuer isn't automatically allowed to run an exchange.
Capital markets infrastructure
Separately from investment firms, the MFSA regulates capital markets infrastructure — recognised investment exchanges and other trading venues, plus listing-related activity. An investment firm trades and provides services; a trading venue provides the marketplace itself.
Credit servicers
A credit servicer manages credit agreements — typically portfolios of non-performing loans — on behalf of the buyers of that debt, under the Credit Servicers and Credit Purchasers Act (Cap. 645), which implements the EU Credit Servicers Directive. The category has grown as secondary markets for distressed debt have developed across the EU.
How to check any of these licences yourself
Reading the category is only half the job. The other half is confirming that a specific company actually holds the licence it claims, and that the licence is still in force.
On Malta Company Search, each company profile shows the MFSA licences matched to it from the MFSA's Financial Services Register. You can:
- Search a company by name or registration number and see each licence's category and current status.
- Check whether the entity holds the licence for the activity it advertises (portfolio management versus advice, say).
- See changes we've recorded over time, such as a licence being suspended, surrendered or dropped from the register.
- Cross-reference directors, shareholders and related companies from the Malta Business Registry before you sign a contract or make a payment.
Before transferring funds, signing a service agreement or investing through a Malta-registered entity, that's the quickest way to confirm the counterparty is who — and what — it claims to be. For anything legally binding, confirm the final position on the MFSA register itself.
FAQ
- What's the difference between a Payment Institution and an Electronic Money Institution?
- A Payment Institution provides payment services such as transfers and card transactions but cannot issue electronic money. An Electronic Money Institution (EMI) can do both: issue e-money (such as a prepaid balance or digital wallet) and provide payment services. Neither may take deposits — that is reserved for banks.
- Can an investment firm licensed for advice also manage my portfolio?
- Not unless its licence also covers portfolio management. Investment advice and discretionary portfolio management are distinct activities under the Investment Services Act, and a firm may only carry out the ones its licence lists.
- Is a CSP the same as a Limited or Restricted CSP?
- No. A full Company Service Provider is authorised by the MFSA to provide corporate services as a business. A Limited CSP is an individual with no more than 10 involvements who registers with the MFSA under a lighter regime. A Restricted CSP is an individual serving at most five companies across no more than two groups, who only notifies the MFSA. These categories were introduced by amendments in force since May 2025.
- Does a crypto company need separate authorisations to issue a token and to run an exchange?
- Generally yes. Operating a trading platform is a CASP service under MiCA and Malta's Markets in Crypto-Assets Act, while issuing an asset-referenced token (ART) needs its own authorisation, and an e-money token (EMT) can only be issued by a bank or an Electronic Money Institution. One authorisation does not imply the other.
- Where can I verify a company's actual MFSA licence status?
- The authoritative source is the MFSA's Financial Services Register (fsr.mfsa.mt). Malta Company Search shows the MFSA licences matched to each Malta-registered company on its profile — category, current status and the changes we've recorded over time — alongside its Malta Business Registry details.
This guide is general information, not legal advice. Licence scope is set by each entity's individual authorisation and the relevant rulebooks; always confirm with the MFSA or a qualified adviser before relying on it.