Regulatory AlertsMalta: lending & credit regulation
RegulatedMalta: Lending regulated under MiCA/CCD II; MFSA supervises credit institutions and VASPs
- Lead regulator
- Malta Financial Services Authority (MFSA)
- Also involved
- Central Bank of Malta (payment services) · Data Protection Commissioner (GDPR)
- Core law
- Financial Services Act 2018 · Directive (EU) 2023/2225
- Entry capital
- EUR 730,000 (Credit Institution)
- Approval timeline
- 6-12 months for credit institution license
- Customer assets
- Segregated accounts required for client funds
- Data protection
- GDPR · Data Protection Commissioner
- Sandbox
- Yes - MFSA Regulatory Sandbox
Traditional lending is strictly regulated under the Financial Services Act, requiring a credit institution license from the MFSA. The jurisdiction has recently implemented the Consumer Credit Directive II (2023/2225), tightening consumer protection rules. Non-bank lending platforms face significant regulatory hurdles, often requiring authorization as credit intermediaries or financial services providers depending on the model.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Consumer lending | LicenceCredit Institution License[1] Requires full credit institution license under FSA; CCD II implementation ongoing | EUR 730,000 | 6-12 months | MFSA |
| SME / commercial lending | LicenceCredit Institution License Commercial lending typically falls under credit institution regime | EUR 730,000 | 6-12 months | MFSA |
| Microfinance | LicenceCredit Institution License No specific microfinance license; standard credit institution rules apply | EUR 730,000 | 6-12 months | MFSA |
| Buy-now-pay-later | LicenceCredit Institution License[1] BNPL treated as consumer credit; subject to CCD II rules | EUR 730,000 | 6-12 months | MFSA |
| P2P lending platform | LicenceInvestment Firm License P2P platforms often require investment firm authorization for matching services | EUR 125,000 | 6-12 months | MFSA |
| Credit bureau / scoring | RegistrationData Controller Registration Scoring services require GDPR compliance and DPC registration | — | — | Data Protection Commissioner |
| Debt collection | LicenceCredit Intermediary Licenseverify with regulator Debt collection may require credit intermediary authorization | — | — | MFSA |
New — what changed recently
- 2025-11-21MFSA Circular on Directive (EU) 2023/2225 — Implementation of Consumer Credit Directive II into Maltese law, updating consumer credit agreement requirements[1]
- 2023-06-21MFSA Circular on NPL Ratio Calculation — New guidance on non-performing loan ratio calculation methodologies for credit institutions[2]
Market-entry checklist
- 1Obtain MFSA Credit Institution LicenseApply for full credit institution authorization with EUR 730,000 minimum capital
- 2Implement CCD II ComplianceUpdate credit agreement templates and disclosure processes per Directive 2023/2225
- 3Establish NPL Reporting SystemsConfigure internal systems to calculate NPL ratios per MFSA 2023 circular guidance
- 4Register as Data ControllerRegister with Data Protection Commissioner for all credit scoring and processing activities
- 5Secure Segregated Client AccountsOpen dedicated client money accounts with licensed Maltese banks for fund segregation