Your Essential Guide To The MFSA's New FIR/01 Consultation: Navigating Malta's Financial Institutions Authorisation Process

On August 11, 2025, the Malta Financial Services Authority (MFSA) released a significant consultation document that could reshape how financial institutions approach authorisation in Malta. The proposed new version of Chapter 1 of the Financial Ins tu ons Rulebook (FIR/01) represents the most comprehensive overhaul of applica on procedures and requirements under the Financial Ins tu ons Act 1994 in recent years.

More Insights

A More Structured and Professional Framework

The revised FIR/01 introduces a three-title structure that significantly improves the organisation and

clarity of authorisation requirements:

• Title 1: Applications for authorisation under the Financial Institutions Act
• Title 2: Authorisation as a Financial Institution
• Title 3: Other authorisation procedures applicable to Financial Institutions

This restructuring moves away from the previous fragmented approach, creating a logical flow that

guides applicants through each stage of the authorisation journey. The enhanced organisation should

reduce confusion and streamline the application process for both new entrants and existing license

holders seeking modifications.

Enhanced Substance and Governance Requirements

Perhaps the most significant change is the heightened focus on substance and local presence. The MFSA has made clear that it will not accept "letterbox entities" and expects applicants to demonstrate meaningful operations in Malta. Key requirements include:

• Local Mind and Management Applicants must identify persons who will be effectively directing the business from Malta and demonstrate a robust local governance structure. The Authority expects clear reporting lines and the establishment of key function holders locally.
• Three Lines of Defence The new rules explicitly require applicants to implement a comprehensive three lines of defence framework, ensuring proper risk management, compliance oversight, and internal audit functions.

• Preliminary Meeting Requirements A notable procedural change requires applicants to submit a detailed presentation at least 10 working days prior to preliminary meetings with the MFSA. This presentation must cover: 
  • Full group structure and regulatory history 
  • Specific identification of licensable actvities 
  • Flow of funds diagrams 
  • Three-year organisational charts 
  • Financial projections
  • Operating model and business strategy 
  • IT systems and DORA compliance plans
  • Outsourcing and safeguarding arrangements

Strengthened Outsourcing and Digital Resilience Focus

The revised rules address modern operational realities with enhanced outsourcing provisions and explicit requirements for Digital Operational Resilience Act (DORA) compliance. Financial institutions must now demonstrate:

• Robust internal control frameworks to mitigate outsourcing risks
• Independent oversight of outsourced arrangements
• Comprehensive cybersecurity frameworks and digital risk mitigation measures
• Clear incident reporting mechanisms aligned with DORA requirements

The Authority emphasises that even intra-group outsourcing arrangements will face critical assessment, ensuring that local entities maintain adequate control and oversight capabilities.

Professional Standards and Fit & Proper Requirements

The consultation document reinforces the critical importance of compliance officers and Money Laundering Reporting Officers (MLROs), with detailed guidance on their roles and responsibilities.

Key expectations include:

• Enhanced Compliance Officer Role
  • Complete independence from business operations
  • Thorough understanding of the regulatory framework
  • Proactive identification and management of regulatory breaches
  • Regular training of staff on compliance requirement.
• Fit and Proper Assessments The rules extend fit and proper requirements to a broader range of individuals, including:
  • Persons with qualifying holdings
  • All beneficial owners
  • Board members and senior management
  • Compliance officers and MLROs
  • Any other persons deemed necessary by the Authority

Capital and Insurance Requirements Refinement

The proposed rules introduce more flexible initial capital requirements for traditional financial institutions, moving to a case-by-case assessment based on risk profiles and proposed activities. This represents a shift from rigid requirements to a more nuanced, risk-based approach.

For entities providing account information services or payment initiation services, professional indemnity insurance requirements have been updated with clearer calculation methodologies and annual review obligations.

Streamlined Application Process with Enhanced Oversight

The new framework maintains the three-month determination period while introducing clearer milestones and requirements at each stage:

1. Pre-Licensing Phase

• Submission of final certified constitutional documents
• Declaration of key functionary recruitment
• Executed outsourcing agreements
• Audited capital statements

2. Post-Licensing, Pre-Commencement Phase

• Safeguarding arrangements with designated credit institutions
• System testing and implementation confirmation
• Complete contact details and business address confirmation
• Employee recruitment declarations

The Authority reserves the right to impose additional post-licensing conditions for up to 18 months after commencement, including independent internal audit reports covering the first 12 months of operations.

Industry Impact and Strategic Implications

This comprehensive revision reflects the MFSA's commitment to maintaining Malta's competitive position while ensuring robust regulatory standards. The changes demonstrate several strategic

priorities:

• Enhanced Market Integrity: The focus on substance requirements and governance frameworks aims to attract high-quality financial institutions while deterring shell companies.
• Digital Readiness: Explicit DORA requirements position Malta at the forefront of digital operational resilience in financial services.
• Risk-Based Approach: Flexible capital requirements and case-by-case assessments allow for innovation while maintaining appropriate risk management.
• International Alignment: The rules incorporate EBA guidelines and EU regulatory developments, ensuring Malta remains aligned with broader European standards.

Side-by-Side Comparison: Current FIR/01 vs New FIR/01 (Consultation Version)

Call to Action: Your Voice Matters

The MFSA's consultation represents a critical opportunity for industry participants to shape the future regulatory landscape. Whether you are a current license holder, prospectuve applicant, or professional service provider, your insights can help ensure the final rules are practical, proportionate, and effective.

The consultation period runs until September 26, 2025, providing approximately six weeks for thorough review and response preparation. Given the comprehensive nature of the changes, early engagement with the consultaƟon document is strongly recommended.

As Malta continues to position itself as a leading financial services jurisdiction, the outcome of this consultation will significantly influence the sector's development trajectory. The proposed changes represent both challenges and opportunities – ensuring that stakeholder voices are heard will be crucial in shaping a framework that supports innovation while maintaining the highest regulatory standards.

We encourage all stakeholders to engage actively with this consultation process and contribute to Malta's continued success in financial services regulation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.