Publication of the Revised MFSA FinTech Regulatory Sandbox Framework

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Publication of the Revised MFSA FinTech Regulatory Sandbox Framework The Malta Financial Services Authority (‘MFSA’) would like to inform the public that the revised MFSA FinTech Regulatory Sandbox as established in terms of Rule 3 of the MFSA Act (Chapter 330 of the Laws of Malta) (‘Rule’) (‘Sandbox’) was published on 13 March 2023. Initially published on the 22 July 2020, the Sandbox seeks to provide a regulatory environment which fosters sustainable technology-enabled financial innovation, or as more widely known, financial technology (‘FinTech’), through legal certainty and knowledge sharing whilst safeguarding consumer protection, market integrity and financial soundness. The revision takes into consideration the lessons learnt over the past two (2) years, feedback from the industry outreach carried out over 2022, and best practises adopted by other regulatory sandboxes established across Europe and the globe. Additionally, the revision of the Sandbox Framework does not only include the update to Rule 3 under the MFSA Act, but also various actions taken to revaluate every aspect of the Sandbox framework with the aim to operationalise it efficiently and effectively, including a revised Proposal Form and Application Stage. The main revisions are as follows:

1. Definitions In order to make to framework clearer, the definitions of FinTech Supplier and Other Applicant under the first iteration of the Framework have been revised to Technology Providers and Other Applicants and Unregulated FinTech Service Providers and are as follows: ‘Regulated FinTech Service Provider’ means a person who is duly authorised to provide or who intends to provide a service/s requiring an authorisation in terms of applicable financial services legislation currently in force in Malta and who utilises FinTech in its operations; ‘Technology Provider’ means a person, who provides or intends to provide a FinTech Solution which is only intended for use by one or more third-party financial services providers, and does not intend to use the 29 March 2023

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Solution to undertake any activity which triggers an authorisation in terms of any financial services law currently in force in Malta; ‘Unregulated FinTech Service Provider’ means an Applicant who has been determined by the Authority that notwithstanding the fact that the activity and/or product proposed and or/offered within the Solution may prima facie appears to classify as a financial service, it is either not regulated, or is otherwise exempt from, existing financial services law in Malta. 2. Simplified Sandbox Lifecycle The revised framework introduces a simplified MFSA Sandbox Lifecycle, which is clearer, more efficient, and easier to understand. The Sandbox Lifecycle has been restructured into four key stages, namely the Proposal, Application, Testing and Exit Stages, as follows: Moreover, the revised framework also introduces clear requirements in relation to (i) extensions and limits Sandbox Participants to extend the Testing Period by only a further six (6) months as revised under R3-4.4.5.1 of the Rule; (ii) approval of modifications of the Solutions during Testing as revised under R3-4.4.4.1 of the Rule and (iii) the Evaluation Assessment which replaces the Evaluation Stage under the initial version of the Sandbox. The Exit Stage and its requirements have also been revised to provide more clarity with respect to what types of strategies are expected by which Sandbox participants. In this respect, the revised rules specify the contents of the different strategies, and their applicability. In this respect, one of the main revisions relates to the disapplication of the Proposal Application Testing Exit Proposal Submission Eligibility Assessment Regulated FSP → Authorisation under Sectoral Law Technology Provider & Unregulated FSP → Integrity Confirmations Testing Framework 6/12 Months (‘M’) & 1 M Evaluation Period Exit Strategy Possibility of 6M Extension

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt discontinuation exit strategy to Eligible Applicants determined as Technology Providers or Unregulated FinTech Service Providers given that the MFSA does not have the power to cease the Solution from being offered to the public. 3. Revised Fitness and Properness Assessment The Fitness and Properness Assessment requirements under the previous Framework have been revised to better reflect the requirements in terms of Eligible Applicants determined by the MFSA as Technology Providers or Unregulated FinTech Service Providers. In this respect, such applicants will be required to submit a self-declaration to confirm their integrity or otherwise. Meanwhile, Eligible Applicants who are determined as Regulated FinTech Service Providers require authorisation, and therefore the Fitness and Properness Assessment is required under existing sectoral legislation. 4. Revised Matters to be Mutually Agreed Upon As indicated in R3-4.3.3.1, the revised Rule 3 introduces the Testing Framework. The Testing Framework builds on the previous Framework’s rules in relation to the Matters to be Mutually Agreed Upon and includes the testing period, testing plan, testing objectives, testing requirements, testing disclosures and the exit strategy. It is noted that for Eligible Applicants who are determined as Regulated Fintech Suppliers, the Testing framework will be developed as part of the authorisation process. Meanwhile, for Eligible Applicants determined by the MFSA as Technology Providers or Unregulated FinTech Service Providers, this framework would be developed during the Application Stage. Such applicants would have upon submitting their proposal a declaration that they would be abiding by the requirements stipulated under the revised Rule 3. Additionally, the revised framework includes a disclosure requirement which requires Eligible Applicants to inform their clients of (i) their admission to the Sandbox and (ii) the key risks associated with the solution. 5. Revision of Fees The fee structure has also been revised to provide more clarity on the fees involved and more proportionate to the scope and length of testing stage. The Proposal Fee has been reduced

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt to EUR 200 as indicated in R3-5.1.1 of the Rule and the revised Participation Fees as outlined in R3-5.2.1 of the Rule are as follows: Type of Applicant Participation Fee Submission Due Date Unauthorised Regulated FinTech Service Providers Applicable Application Fee as per sector-specific legislation As per Authorisation Process – Service Charter Authorised Regulated FinTech Service Providers Fee for Variation of Authorisation as per sector-specific legislation, if applicable As per applicable framework, if required. Technology Providers & Unregulated FinTech Service Providers EUR 500 per six (6) months Upon being informed by the Authority that the Applicant has to the satisfaction of the Authority fulfilled the required Integrity Confirmations Interested parties wishing to explore further the MFSA’s FinTech Regulatory Sandbox should refer to the dedicated MFSA webpage and contact the MFSA on fintech@mfsa.mt to discuss any ideas on the revised framework and/or solutions which may be explored within the context of the Sandbox. Otherwise, for further information of the MFSA’s initiatives on FinTech and Innovation, interested parties should refer to the MFSA dedicated pages on Digital Finance: FinTech and Innovation.