Malta: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), directly applicable, with the Malta Financial Services Authority (MFSA) as competent authority. Malta's national Virtual Financial Assets Act (Cap. 590, VFA Act) of 2018 remains in force during the transitional/grandfathering period (running to 1 July 2026); a 2024-25 reform aligned the VFA framework with MiCA. AML/CFT for VASPs/CASPs is supervised by the FIAU under the Prevention of Money Laundering Act. Tax treatment of DLT assets follows Commissioner for Revenue Guidelines (November 2018) under the Income Tax Act and Income Tax Management Act.

Crypto is fully legal in Malta and operates under a comprehensive in-force EU framework (MiCA), applied by the MFSA, layered on top of Malta's pioneering 2018 Virtual Financial Assets Act which is being phased out by 1 July 2026 in favour of MiCA's CASP regime. New crypto-asset service providers must apply directly for a MiCA CASP authorisation; pre-existing VFA licensees benefit from a transitional period until 1 July 2026. As of mid-2026 the MFSA had authorised roughly 12 CASPs and two e-money-token (stablecoin) issuers, although a July 2025 ESMA peer review criticised MFSA's authorisation process as not sufficiently thorough.

Framework: EU AI Act (Regulation (EU) 2024/1689, directly applicable) + Malta Legal Notice 226 of 2025 (Artificial Intelligence Regulations, S.L. 591.05); lead authority: Malta Digital Innovation Authority (MDIA)

Malta applies the EU AI Act (Regulation (EU) 2024/1689) directly as a comprehensive, risk-based AI framework. National implementing instrument Legal Notice 226 of 2025, in force from 10 October 2025, designates the Malta Digital Innovation Authority (MDIA) as the lead market surveillance authority, single point of contact, and operator of the national AI regulatory sandbox. Full enforcement of high-risk AI system requirements is scheduled to apply from 2 August 2026.

Framework: GDPR (EU) 2016/679 directly applicable; Malta Data Protection Act 2018 (Chapter 586, Laws of Malta); supervised by the Information and Data Protection Commissioner (IDPC)

Malta applies the EU General Data Protection Regulation directly as its primary data-protection instrument, supplemented by the national Data Protection Act 2018 (Chapter 586) and eleven pieces of subsidiary legislation that exercise permitted GDPR derogations. The Information and Data Protection Commissioner (IDPC) is the independent supervisory authority; Dr Reno Borg assumed a new five-year term as Commissioner on 22 April 2026. Malta also participates fully in the EU AI Act framework, with the IDPC designated as market surveillance authority for high-risk AI systems from 2 August 2026.

Framework: Financial Institutions Act (Cap. 376 of the Laws of Malta) implementing PSD2 (Directive 2015/2366), supervised by the Malta Financial Services Authority (MFSA); EU Instant Payments Regulation (EU) 2024/886 and MiCA (EU) 2023/1114 also in force

Malta operates a fully articulated licensing regime for payment institutions (PIs) and electronic money institutions (EMIs) under the Financial Institutions Act (Cap. 376), administered by the MFSA. PSD2 was transposed into Maltese law in August 2019 via the Various Financial Services Laws (Amendment) Act 2019, covering AISP/PISP open-banking frameworks. The Financial Institutions Rulebook was substantially updated in 2025 to align with the EU Instant Payments Regulation and DORA, cementing Malta's position as a fully compliant EU payments jurisdiction with active passporting activity.

Framework: Malta Nomad Residence Permit (administered by Residency Malta Agency under the Immigration Act, Cap. 217); supplemented by Malta Permanent Residence Programme (MPRP, S.L. 217.26) and Global Residence Programme (GRP, administered by the Malta Commissioner for Revenue)

Malta operates a fully dedicated Nomad Residence Permit, open to third-country nationals (non-EU/EEA/Swiss) who work remotely for foreign employers or clients. The permit is issued for one year and renewable up to three times (four years total), provided the holder spends at least five cumulative months per year in Malta. Separate investment-based pathways (MPRP, GRP) exist for longer-term or tax-residency purposes.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) as directly applicable law; implemented nationally by the Digital Services (Designation and Enforcement) Order (Subsidiary Legislation 418.05, in force 12 March 2024); enforced by the Malta Communications Authority (MCA) as Malta's designated Digital Services Coordinator (DSC).

Malta applies the EU Digital Services Act in full, with the Malta Communications Authority designated as the national Digital Services Coordinator responsible for supervising intermediary-service providers established in Malta, handling complaints, and participating in the European Digital Services Board. Nationally, Malta enacted specific cyberstalking and cyberbullying criminal offences in 2025 and ratified the Budapest Convention's First Additional Protocol on online hate speech. A government green paper launched in late 2025 opened public consultation on mandatory age-verification for social media and broader children's online-safety reforms, but no national age-verification statute has yet been enacted.

Framework: Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41 / Legal Notice 71 of 2025), transposing EU Directive 2022/2555 (NIS2); supervised by the CIP Department (Malta Critical Infrastructure Protection) as national competent authority and CSIRT; MDIA as National Cybersecurity Certification Authority under the EU Cybersecurity Act

Malta transposed the NIS2 Directive into national law via Legal Notice 71 of 2025 (S.L. 460.41), published on 8 April 2025. The Order was brought fully into force on 23 January 2026 by Legal Notice 22 of 2026, establishing binding risk-management and incident-reporting obligations for essential and important entities across critical and high-impact sectors. The CIP Department serves as the single national supervisory authority and hosts CSIRT-Malta, while the Malta Digital Innovation Authority (MDIA) acts as the National Cybersecurity Certification Authority under the EU Cybersecurity Act.

Framework: Companies Act (Cap. 386, Laws of Malta); Malta Business Registry (MBR) as registrar; Malta Financial Services Authority (MFSA) for regulated-activity licensing

Malta imposes no nationality or residency restrictions on company shareholders or directors, permitting 100% foreign ownership of private limited companies with a minimum authorised share capital of €1,165 (only 20% paid-up at incorporation). Since 1 March 2025, all incorporations must be filed digitally through the MBR's online portal via an MFSA-licensed Corporate Service Provider, with registration achievable in as little as 24 hours once documentation is complete.