Malta MT

Malta's AML/CTF framework generated material, dated findings this cycle at the instrument level, all traceable to the PMLFTR (S.L. 373.01) and the FIAU's Implementing Procedures Part I. The central structural fact is that Malta does not operate a freestanding high-risk-jurisdiction list of its own; instead, PMLFTR regs 2 and 11 define a non-reputable jurisdiction as any jurisdiction with deficiencies in its national anti-money-laundering and counter-terrorist-financing regime, or inappropriate and ineffective preventive measures, and the EU's high-risk third-country list is applied to Maltese subject persons through this broader concept. The practical effect of this architecture is that EU list movements translate automatically into Maltese enhanced-due-diligence triggers without requiring a separate domestic listing step.

Two EU Commission Delegated Regulations moved the underlying list within the review period. Delegated Regulation 2025/1184, in force from 5 August 2025, added Algeria, Angola, Cote d'Ivoire, Kenya, Laos, Lebanon, Monaco, Namibia, Nepal and Venezuela, while removing Barbados, Gibraltar, Jamaica, Panama, the Philippines, Senegal, Uganda and the United Arab Emirates. More recently, Delegated Regulations 2026/46 and 2026/83, published 9 January 2026, added Russia, Bolivia and the British Virgin Islands, with Russia's addition entering into force on 29 January 2026. The FIAU issued a notice specifically addressing the two 2026 instruments, which means Maltese subject persons handling Russia-connected customers are now squarely within the mandatory enhanced-due-diligence perimeter via the non-reputable jurisdiction concept, a structural consequence of Malta's incorporation-by-reference architecture rather than a discretionary supervisory choice.

The second major finding concerns the treatment of electronic money under the PMLFTR's customer due diligence framework. Regulation 7A allows the FIAU, with the concurrence of the relevant supervisory authority, to exempt e-money issuers from the standard customer due diligence measures in reg. 7(1)(a) to (c), but this exemption is tightly bounded. It requires an appropriate risk assessment demonstrating low money-laundering and terrorist-financing risk, and it is available only where the instrument is non-reloadable or carries a EUR150 monthly limit usable solely within Malta, stores no more than EUR150 in total, can be used only to acquire goods or services, cannot be funded anonymously, and is not used for cash redemption above EUR50 or for remote payment transactions. Where no exemption has been granted, reg. 7A(2) makes clear that simplified due diligence under reg. 10 continues to apply, so the baseline obligation for e-money issuers remains risk-based due diligence rather than an automatic carve-out. This is a narrow, criteria-based exemption mechanism, not a general easing of the CDD regime for the e-money sector.

A related and distinct finding touches on customer identity verification methodology. The FIAU's Implementing Procedures Part I, in a provision last amended 27 April 2026, states that the first-payment verification method is not available where the relevant payment is made in e-money, because that verification method is built around the premise that the customer holds an account with a credit or financial institution. The quoted language is direct: e-money payments are not admissible for that purpose. This has a practical consequence for payment institutions, electronic-money institutions and crypto-asset operators that might otherwise have treated receipt of a first payment via e-money as sufficient identity verification; they must instead identify and apply an alternative verification route under the Implementing Procedures.

Taken together, these three findings describe a Maltese AML/CTF regime that is, in the sanctions-list dimension, structurally wider than some comparator jurisdictions because it incorporates the EU list through a broad non-reputable jurisdiction definition rather than maintaining a separate, potentially narrower domestic list, while simultaneously carving out a tightly bounded, criteria-specific accommodation for low-value e-money products in the customer due diligence context. The architecture-over-incident reading is that Malta's regime moves with the EU list automatically, removing discretion at the point of application but concentrating supervisory judgment at the point of any reg. 7A exemption grant, which is itself conditioned on an ongoing low-risk assessment rather than a one-time determination.

Outlook

Firms operating in or through Malta should expect the non-reputable jurisdiction mechanism to continue tracking EU Commission Delegated Regulation activity without a separate Maltese legislative step, meaning further EU list revisions will translate into Maltese EDD obligations on the EU instrument's own effective date. Any e-money issuer relying on, or considering seeking, a reg. 7A exemption should expect the underlying low-risk assessment to remain a live supervisory question rather than a settled position, particularly as the non-reputable jurisdiction list composition continues to shift. Outstanding findings on record-retention duration, reliance conditions under PMLFTR reg. 12, and the reg. 13(2) retention period applicable to electronic-money-institution distributor relationships were not confirmed this cycle because no verbatim primary-source text was available to support them as findings; these remain open items for subsequent verification rather than conclusions. Malta's 6AMLD transposition status was likewise not established this cycle, consistent with Malta's delta-only research posture relative to the EEA parent layer, and is not itself an indication of non-transposition.