Regulatory expectations across Malta and the EU are entering a new phase. As we move through 2026 and beyond, supervisors are placing increasing emphasis on how governance, risk, and control frameworks operate in practice, not just how they are designed or documented.
This three-part series brings together key regulatory insights across governance, financial crime, digital resilience, payments, digital assets, and fund structures. Each piece groups related developments into a clear theme, providing a practical view of where supervisory focus is heading and how firms can stay aligned, responsive, and prepared for ongoing change.
This series is intended for general informational purposes only. It does not constitute legal, regulatory, tax or other professional advice, and should not be relied upon as a substitute for reviewing the relevant legislation, regulatory publications or seeking advice from appropriately qualified advisers.
In part 1, we covered the evolving governance, assurance, and supervisory expectations, and in part 2, we examined financial crime, tax transparency and digital resilience.
Part 3: Sector-Specific Regulatory Change: Payments, Digital Assets and Funds
Alongside broader supervisory expectations, regulators are also advancing targeted reforms affecting specific business models and structures. This final piece looks at developments in payments, crypto-assets, and fund or family office arrangements, where firms may need to track new requirements, assess their operational impact and demonstrate readiness for change.
Parts 1 and 2 considered the broader supervisory shift towards embedded governance, effective assurance, defensible control frameworks and evidence-based oversight. This final piece applies those themes to more targeted regulatory developments, including safeguarding, PSD3 readiness, MiCA transition arrangements and recent changes affecting NPIF and family office structures.
What changes are coming for payment institutions and EMIs?
Safeguarding frameworks under increased scrutiny
MFSA guidance on safeguarding highlights increasing expectations for institutions using investment-based safeguarding models. Supervisors are focusing not only on asset selection, but also on governance, liquidity, monitoring, and auditability.
Safeguarding is increasingly being treated as a risk and governance issue rather than a purely operational one. Firms using these models are expected to be able to demonstrate that safeguarding arrangements are robust, transparent, and capable of withstanding regulatory scrutiny.
This represents a shift towards more holistic oversight of client asset protection.
PSD3 readiness: moving from awareness to action
With PSD3 approaching, the MFSA has signalled that firms are expected to move beyond high-level awareness and begin active preparation. This may include conducting gap analyses, engaging boards, and developing structured implementation plans, depending on the nature and scope of the firm’s activities.
The new framework introduces changes in safeguarding expectations, concentration risk, and integration with DORA requirements. Combined with upcoming reauthorisation requirements, PSD3 represents a significant regulatory shift for EMIs and PSPs.
The challenge lies in demonstrating that governance, controls, and processes are not only understood, but effectively implemented and operational.
How is regulation evolving in crypto and digital assets?
MiCA transition: controlled exit and operational resilience
As the MiCA transitional period ends, regulators are focusing on how unauthorised crypto-asset service providers exit the market. ESMA has emphasised the need for orderly wind-down processes, including ceasing onboarding, managing existing client activity, and maintaining clear communication.
Importantly, AML/CFT standards must remain fully operational throughout the exit process. This highlights that regulatory expectations apply not only during business-as-usual operations but also in transitional scenarios.
The broader message is that firms should be able to demonstrate robust governance and control frameworks that remain effective under changing or stressed conditions.
What developments are affecting funds and family office structures?
NPIF updates and family office structures
Recent updates to the NPIF framework introduce greater flexibility for family office structures, including the ability for certain funds to exceed standard size thresholds.
Additional amendments clarify definitions and introduce targeted exemptions, enhancing the attractiveness of Malta for family office arrangements.
These developments reflect a broader effort to support private wealth structures while maintaining appropriate governance and oversight.
These sector-specific developments show how regulatory change is becoming more targeted, but no less connected to broader expectations around governance, resilience and control effectiveness. Firms operating in these areas may wish to move from awareness to structured implementation, ensuring that relevant obligations are considered in governance arrangements, risk assessments and operational processes.
Series closing
Across all areas of regulation, a consistent message is emerging. Supervisors are no longer focused solely on whether frameworks exist, but on whether they are effective, integrated, and demonstrably operating in practice.
For regulated entities, importance is being placed on moving beyond documentation to implementation, ensuring that governance, risk management, and control functions are aligned, evidence-based, and capable of supporting resilient and compliant operations in light of their specific regulatory obligations.
Firms that take a structured, forward-looking approach to embedding relevant expectations into their day-to-day activities may be better positioned to respond to ongoing regulatory change and increasing supervisory scrutiny. Readers should review the underlying authority publications and seek specialist advice where needed before making decisions or taking action.
Further reading
MFSA Circular to Payment Institutions and Electronic Money Institutions about the Safeguarding of Clients’ Funds through the Investment in Secure Liquid Low-Risk Assets
MFSA Dear CEO Letter – The Malta Financial Services Authority’s Minimum Expectations on the Authorised Person’s Preparedness for Payment Services Directive 3
ESMA Statement on the End of Transitional Periods under MiCA
MFSA Amendments to the NPIF Rulebook to Enhance Malta’s Offering for Single-Family Offices
MFSA Guidance Note on Family Offices – FAQs