From 10 July 2027, Regulation (EU) 2024/1624 (the AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) will apply directly across all EU member states, including Malta, replacing the existing patchwork of national AML frameworks with a single, uniform rulebook. Businesses operating in Malta – particularly those in financial services, crypto-asset markets, and cross-border investment structures – face a concrete compliance deadline that requires active preparation now, not in 2027. This guide sets out the Malta-specific procedural steps, key documents, realistic timelines, and common pitfalls for international clients navigating this transition.
Why Malta Requires Specific Attention
Malta occupies a distinctive position in the EU AML landscape. The Malta Financial Services Authority (MFSA) is the primary competent authority for financial-sector AML/CFT supervision, and it has historically maintained a close working relationship with European supervisory bodies. Since 1 January 2026, the mandates previously held by the European Banking Authority (EBA) in this area were formally transferred to the newly operational Anti-Money Laundering Authority (AMLA), which has been based in Frankfurt since 1 July 2025. For entities supervised in Malta, this means the MFSA now operates within an increasingly harmonised EU supervisory architecture, with AMLA's Single Programming Document 2026–2028 (published 4 February 2026) shaping the supervisory agenda through the transition period.
Malta is also a significant jurisdiction for crypto-asset service providers. With MiCA now in force, CASP licence holders and applicants must understand that their AML/CFT obligations are directly affected by the AMLR, which applies to crypto-asset service providers as obliged entities. The interplay between the MiCA licensing framework administered by the MFSA and the new AML requirements creates a layered compliance obligation that requires careful co-ordination.
The EU-Level Framework in Brief
The AMLR (Regulation (EU) 2024/1624) is directly applicable without requiring national transposition – it will take effect on 10 July 2027 by operation of EU law. AMLD6 (Directive (EU) 2024/1640), by contrast, governs the structure of national registers and the powers of national supervisors; Malta is required to transpose AMLD6 into national law, and the precise implementing provisions remain subject to Malta's legislative process. Businesses should therefore monitor both the Maltese transposition status and the AMLA regulatory technical standards, the majority of which have a publication deadline of 10 July 2026. From 2028, AMLA will assume direct supervisory authority over selected high-risk obliged entities across the EU.
Step-by-Step Compliance Preparation in Malta
Step 1 – Gap Analysis Against the AMLR
The starting point is a structured gap analysis comparing your existing AML/CFT policies against the requirements of the AMLR. This should cover customer due diligence (CDD) procedures, enhanced due diligence triggers, beneficial owner identification (the AMLR sets the threshold at 25% or more of ownership or control), transaction monitoring, and record-keeping obligations. Entities that relied on national transpositions of earlier directives will find that the AMLR introduces more granular and directly enforceable standards.
Step 2 – Beneficial Ownership Structures and Registry Obligations
Under AMLD6, Malta is required to maintain updated beneficial ownership registers through the Malta Business Registry. International investors and fund structures operating through Maltese vehicles should audit their current filings now. The 25% threshold under the AMLR is the baseline; structures where control is exercised through means other than share ownership require particular attention, as the AMLR addresses indirect control and nominee arrangements explicitly. Any discrepancy between registry records and actual ownership must be resolved before July 2027.
Step 3 – MFSA Engagement and Supervisory Expectations
The MFSA has signalled that it expects supervised entities to be proactive in AMLR readiness. For firms already licensed by the MFSA – including investment firms, payment institutions, e-money institutions, and CASP licence holders – it is advisable to review any existing supervisory correspondence relating to AML/CFT and assess whether current compliance frameworks will satisfy the new standards. Where the MFSA has issued sector-specific guidance, that guidance should be read alongside the forthcoming AMLA RTS/ITS, which are due no later than 10 July 2026.
Step 4 – Policies, Procedures, and Internal Controls
The AMLR introduces detailed requirements for written AML/CFT policies that must be approved at senior management level. For Malta-based entities, this means revisiting governance documentation, ensuring that the compliance officer role is adequately resourced, and that internal audit functions are capable of testing AML controls independently. Groups with a parent entity outside Malta should also review how group-wide policies interact with the direct applicability of the AMLR in Malta.
Step 5 – Training and Culture
Staff training programmes will need to be updated to reflect the new regulatory language and specific requirements of the AMLR. Training records are examinable by supervisors; they should demonstrate that employees dealing with customer onboarding, transaction monitoring, and suspicious transaction reporting understand both the conceptual framework and the practical application specific to the entity's business model.
Step 6 – Suspicious Transaction Reporting and FIU Connectivity
Malta's Financial Intelligence Analysis Unit (FIAU) remains the national financial intelligence unit. The AMLR harmonises the substantive triggers for suspicious transaction reporting across the EU, but reporting channels remain national. Entities should confirm their current reporting arrangements with the FIAU and monitor any guidance the FIAU issues as AMLD6 transposition progresses. The interaction between AMLA's future direct supervisory role (from 2028) and the FIAU's national function is still being defined at EU level.
If you would like to discuss how these steps apply to your specific structure in Malta, the team at Ferraz & Whitmore is available to assist. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Key Documents and Information to Prepare
- Corporate structure charts showing all entities in the ownership chain, with percentage interests at each level
- Current beneficial ownership filings at the Malta Business Registry, verified against actual ownership
- Existing AML/CFT policy documents, CDD procedures, and risk appetite statements
- MFSA licence conditions and any supervisory letters referencing AML obligations
- For CASP licence holders: MiCA authorisation documentation and any AML-related conditions attached to it
- Records of staff AML/CFT training completed in the past two years
- Prior suspicious transaction reports and related internal documentation
- Any group-wide AML policies issued by a parent entity, together with evidence of their application in Malta
Realistic Timelines
The period between now and 10 July 2027 is shorter than it appears once implementation work is properly scoped. The AMLA RTS/ITS are expected by 10 July 2026, meaning that a significant body of detailed technical standards will only crystallise approximately twelve months before the application date. Malta's transposition of AMLD6 adds a further layer of timing uncertainty. A workable schedule for most obliged entities would allocate the current period to gap analysis and governance review, the first half of 2026 to policy drafting informed by AMLA standards as they are published, and the second half of 2026 through mid-2027 to implementation, testing, and staff training. Entities with complex group structures or significant beneficial ownership arrangements should front-load the registry and governance work, as these elements take the longest to resolve in practice.
Cost Drivers
Compliance costs will vary considerably depending on the size of the entity, the complexity of its customer base, and the state of its existing AML infrastructure. The principal cost drivers in Malta tend to be: legal and advisory fees for gap analysis and policy drafting; technology costs for transaction monitoring and CDD platform upgrades; staff time for training and procedure implementation; and registry fees associated with updating beneficial ownership filings at the Malta Business Registry. Entities seeking a CASP licence under MiCA that also fall within the AMLR's scope face an overlapping compliance burden, and the cost of addressing both frameworks simultaneously should be assessed as a single project rather than two separate workstreams.
Common Errors by Foreign Clients in Malta
- Treating the AMLR as a directive: The AMLR is a regulation – it applies directly without Maltese implementing legislation. Clients who wait for Malta to "transpose" it will miss the deadline.
- Underestimating beneficial ownership complexity: Multi-layered holding structures that satisfied previous Maltese national standards may not meet the AMLR's more granular beneficial ownership identification requirements. The 25% threshold is a floor, not a ceiling for enquiry.
- Assuming existing MFSA-approved policies are sufficient: MFSA approval of an AML policy under the current framework does not guarantee compliance with the AMLR. A specific review against the new regulation is necessary.
- Ignoring the CASP/MiCA overlap: Foreign investors establishing a crypto-asset service provider in Malta must address both the MFSA's MiCA licensing conditions and the AMLR's AML/CFT obligations as a single integrated exercise.
- Late engagement with advisers: The window for meaningful preparation closes progressively as technical standards are finalised. Entities that begin the process in 2026 face compressed timelines and higher advisory costs.
- Failing to update Malta Business Registry records: Beneficial ownership data that is stale or inaccurate creates regulatory exposure under both current Maltese law and AMLD6 once transposed.
Decision Checklist Before July 2027
- Has a formal gap analysis been conducted against the AMLR as published?
- Are all beneficial ownership records at the Malta Business Registry current and accurate?
- Has the governance structure for AML/CFT (compliance officer, senior management sign-off) been reviewed?
- Are written AML/CFT policies being updated to reflect AMLR requirements?
- Has the entity reviewed AMLA RTS/ITS relevant to its sector as they are published?
- For CASP licence holders: have MiCA and AMLR obligations been addressed in a co-ordinated compliance programme?
- Has staff training been scheduled for 2026 and 2027?
- Are suspicious transaction reporting arrangements with the FIAU confirmed and current?
- Has legal counsel with Malta AML expertise been engaged to advise on AMLD6 transposition developments?
For detailed guidance on AML/CFT compliance in Malta, including the specific implications of the AMLR for your business model, please refer to our AML compliance services for Malta. We also recommend reviewing our EU AMLR 2027 readiness guide for the broader EU-level context.
Tax and Structural Considerations
The AMLR's enhanced beneficial ownership requirements will, in practice, prompt many international clients to review the overall structure of their Malta operations. Changes to ownership chains or the introduction of new holding entities to meet transparency standards can have tax consequences that require separate analysis. Entities considering structural adjustments should ensure that AML compliance and tax planning are co-ordinated rather than addressed in sequence. Our tax law services in Malta cover the interaction between structural reorganisation and Malta's tax framework.
How Ferraz & Whitmore Can Assist
Our Malta practice advises international businesses, investment funds, and crypto-asset service providers on AML/CFT regulatory compliance, MFSA licensing, and cross-border legal matters. We work alongside clients at each stage of AMLR preparation: from initial gap analysis and policy drafting through to MFSA engagement and beneficial ownership registry work. We do not offer guarantees of regulatory outcomes, but we do provide structured, technically grounded advice that reduces the risk of errors and missed deadlines.
To discuss your AMLR readiness or any related compliance matter in Malta, please contact our team at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.