Malta-based businesses and regulated entities face a tightening AML landscape: the EU's new Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) apply from 10 July 2027, with the newly operational Anti-Money Laundering Authority (AMLA) assuming direct supervisory powers over the highest-risk obliged entities from 2028. Ferraz & Whitmore advises international companies, funds and financial institutions on building compliant, audit-ready frameworks in Malta – from customer due diligence programmes and beneficial ownership mapping to preparing for direct AMLA oversight. Acting now, rather than waiting for national transposition to finalise, is the prudent course.
Why AML Compliance Is Urgent for Malta-Based Entities Right Now
Malta sits at the crossroads of EU regulation and international capital flows, making AML compliance a core operational concern rather than a peripheral legal formality. The MFSA – Malta's primary AML/CFT supervisor for financial and crypto-asset service providers – has consistently increased its supervisory intensity in recent years. Any gap between current internal controls and the requirements coming into force in July 2027 represents a measurable business risk: licence conditions can be varied, passporting rights suspended, and civil liability may follow findings of systemic compliance failure.
Three regulatory milestones define the current planning window:
- July 2025: AMLA became operational. The authority is now issuing regulatory technical standards (RTS) and implementing technical standards (ITS) that will bind obliged entities directly.
- 10 July 2026: Deadline for AMLA's first wave of RTS/ITS, covering areas including customer due diligence methodologies, beneficial ownership verification and transaction monitoring benchmarks. Entities should treat this date as the de facto compliance design deadline.
- 10 July 2027: AMLR and AMLD6 become directly applicable across the EU. National rules that deviate from or fall short of AMLR requirements will be superseded. Maltese implementation of AMLD6 is subject to national transposition, with details pending.
- From 2028: AMLA assumes direct supervision of selected high-risk obliged entities. Malta's cross-border financial services sector places a number of local entities within the population likely to be considered for direct oversight.
Companies that have not begun a gap analysis risk arriving at the July 2027 deadline with legacy procedures that are non-compliant from day one of application.
If you are assessing whether your Malta entity is on track, our team can conduct a structured gap analysis against the AMLR and AMLA's published RTS/ITS pipeline. Write to us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial consultation.
Key Compliance Areas Under the AMLR Framework
The AMLR introduces uniform, directly applicable rules across obliged entities in all EU member states. For Malta, this means that previous flexibility in national AML legislation will narrow considerably. The principal substantive areas requiring attention are:
- Customer due diligence (CDD): The AMLR standardises CDD triggers, content requirements and enhanced due diligence thresholds. Existing CDD policies must be reviewed against the new definitions and, where applicable, updated to reflect AMLA's RTS on CDD methodology before the July 2026 RTS deadline.
- Beneficial ownership: Verification obligations become more prescriptive. Entities must cross-reference disclosures against the Malta Business Registry and other relevant registers. Discrepancies must be documented and, in certain circumstances, reported. Structures involving trusts or complex holding arrangements require particular care.
- Transaction monitoring: AMLR introduces baseline transaction monitoring obligations that are more granular than existing Maltese rules. Automated systems and alert-review procedures must be calibrated to meet the new standards.
- Politically exposed persons (PEPs) and high-risk third countries: The AMLR harmonises PEP classification and mandates enhanced measures for business relationships with persons or entities from high-risk third countries. Existing tiered risk models need to be tested against the new harmonised criteria.
- Record-keeping and reporting: Retention periods and data quality requirements are aligned across the EU. Processes feeding into suspicious transaction reports to the MFSA-supervised framework must be auditable end-to-end.
- Governance and internal controls: The AMLR and AMLD6 reinforce requirements for a designated compliance officer, periodic independent audits and documented escalation procedures at board level.
For entities operating in crypto-assets or holding a MiCA licence, the intersection with AMLR obligations adds an additional layer of complexity. Ferraz & Whitmore's MiCA licensing practice in Malta addresses this interface directly.
How the Preparation Process Works
A structured AMLA-readiness programme typically moves through four stages: baseline assessment, policy design, implementation and testing, and ongoing monitoring. Each stage requires legal, compliance and operational inputs that must be coordinated carefully to avoid duplication or gaps.
Rather than set out the full step-by-step methodology here, we have published a dedicated technical guide covering the process in detail: EU AMLR 2027 Readiness in Malta – a practical guide. That resource walks through each phase with reference to AMLA's published standards and the Maltese supervisory context.
In terms of timelines, entities beginning a readiness programme in the second half of 2025 have adequate time to complete a thorough review before the July 2026 RTS/ITS deadline crystallises compliance obligations in detail. Those that delay until late 2026 risk compressing implementation into a window that leaves little margin for remediation before July 2027.
Common Pitfalls in Malta's AML Environment
Drawing on our experience advising regulated entities before the MFSA and in contentious compliance matters before the Civil Court Malta, several recurring issues stand out:
- Treating AML as a one-time exercise: Policies drafted on incorporation are often never substantively updated. The AMLR's annual review expectations and dynamic risk-scoring requirements demand a living compliance programme, not a static document.
- Inadequate beneficial ownership documentation: Registers are checked but discrepancies are not investigated or reported. Under AMLR, passive acceptance of stated ownership without verification steps creates direct liability exposure.
- Technology gaps in transaction monitoring: Rules-based systems configured at launch are rarely recalibrated as the business grows or the product mix changes. The AMLR's monitoring standards will expose entities running under-tuned systems.
- Conflating EU passporting compliance with AML compliance: An entity that is passported or licensed across multiple jurisdictions may face simultaneous supervisory scrutiny in each. The shift to AMLA direct supervision from 2028 creates a single point of regulatory accountability that amplifies the consequences of systemic failures.
- Underestimating AMLD6 transposition uncertainty: Because AMLD6 requires national implementation, and Maltese transposition details remain pending, some entities assume they can defer compliance planning. In practice, AMLR's directly applicable provisions create obligations regardless of where national law stands.
Cross-Border Dimension and Group Compliance
Many clients approaching Ferraz & Whitmore on AML matters in Malta operate as part of a wider group spanning multiple EU and non-EU jurisdictions. The AMLR introduces group-wide AML policies as a baseline requirement, meaning that a Maltese subsidiary or branch cannot simply rely on a parent's compliance programme without ensuring that it has been adapted to Maltese and EU-specific requirements.
Key cross-border considerations include: the allocation of compliance officer responsibilities across entities; information-sharing protocols that comply with both AML obligations and data protection requirements; and the risk that a supervisory finding in one jurisdiction triggers enhanced scrutiny in others. Where a group includes entities subject to AMLA direct supervision from 2028, the group-level compliance architecture will need to accommodate AMLA's reporting and audit rights directly.
Our corporate law practice in Malta works closely with colleagues in other F&W offices to support group-level compliance structuring. More information on our broader corporate advisory work in Malta is available at our Malta corporate law practice page.
How Ferraz & Whitmore Supports AML Readiness in Malta
Our approach to AML mandates in Malta is document-led and risk-calibrated. We do not offer generic compliance templates; instead, we map your specific business model, ownership structure, client base and product set against the applicable regulatory requirements before drafting or revising any policy.
The core services we provide in this area include:
- Gap analysis against AMLR, AMLD6 and AMLA's published and forthcoming RTS/ITS
- Drafting and revision of AML/CFT policies, CDD procedures and transaction monitoring frameworks
- Beneficial ownership mapping and registry compliance reviews in coordination with the Malta Business Registry
- Compliance officer support and board-level briefings on regulatory obligations
- Representation before the MFSA in supervisory reviews and remediation processes
- Advice on group-level AML structures for cross-border operations
- Litigation support in AML-related civil proceedings before the Civil Court Malta
We operate under a strict standard of professional confidentiality and provide advice that is specific to the facts presented, not generic guidance that leaves interpretation to the client.
Self-Assessment Checklist: Is Your Malta Entity Ready?
The following questions are intended to help you identify where preparation work may be required. They do not constitute a legal opinion and are not exhaustive, but a "no" or "uncertain" answer to any of them warrants prompt attention:
- Has your CDD policy been reviewed against the AMLR's requirements and AMLA's published RTS/ITS since July 2025?
- Do you have a documented methodology for verifying beneficial ownership that goes beyond registry checks alone?
- Are your transaction monitoring alert thresholds and typologies current, and reviewed at least annually?
- Does your compliance officer have a clear mandate, adequate resources and direct board access?
- Have you assessed whether your entity is a candidate for AMLA direct supervision from 2028?
- If you operate as part of a group, is there a documented group-wide AML policy that has been adapted for Maltese requirements?
- Are your record-keeping and data retention processes aligned with AMLR standards?
- Has legal counsel reviewed your current AML framework in the context of AMLD6 transposition developments in Malta?
If any of the above areas give you pause, the most effective next step is a structured conversation with a lawyer who understands both the EU-level framework and Malta's supervisory environment. Contact our team at info@ferrazwhitmore.com or through our contacts page to discuss your situation in confidence.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.