Licensing a Malta Payment Institution

What is a Payment Service Provider?

It is important to establish the basic terminology before we move on to discuss in detail what PSPs are used for and how they can help you and your business.

A Payment Service Provider (PSP) is a payment service that allows online enterprises to accept electronic transactions through a variety of methods such as credit cards, bank transfers, direct debit, real-time transfers on online banking, e-wallets and even cryptocurrencies.

With a growing number of users relying on virtual shopping for their needs, a PSP is certainly an interesting feature to be considered for any endeavour with an online presence.

The Malta Payment Services Directive

Following the transposition of the Payment Services Directive (Directive 2007/64/EC) into local legislation, standalone payment service providers (“PSPs”) or “Payment Institutions” are regulated in Malta by the Financial Institutions Act (Chapter 376, Laws of Malta), which also regulates Electronic Money Institutions (since the 1st July 2011) and other financial services.

Malta-Licensed Payment Institutions – Permitted Activities

A payment institution licensed in Malta may undertake the following activities:

1. Services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account;
2. Services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account;
3. Execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider among which:
   
   1. execution of direct debits, including one-off direct debits;
   2. execution of payment transactions through a payment card or a similar device;
   3. execution of credit transfers, including standing orders;
4. Execution of payment transactions where the funds are covered by a credit line for a payment service user among which:
   
   1. execution of direct debits, including one-off direct debits;
   2. execution of payment transactions through a payment card or a similar device;
   3. execution of credit transfers, including standing orders;
5. Issuing and/or acquiring of payment instruments;
6. Money remittance;
7. Execution of payment transactions where the consent of the payer to a payment transaction is transmitted by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, acting solely as an intermediary on behalf of the payment service user and the supplier of the goods and services.

Malta-Licensed Payment Institutions – Additional Permitted Activities

Licensed payment institutions may also carry out the following additional activities:

Payment institutions may grant credit related to payment services referred to in paragraphs (D), (E) or (G) above only if the following requirements are met:

Malta-Licensed Payment Institutions – Non-Permitted Activities

PSPs are only allowed to provide the services the payer decides to make use of and will not have full access to the bank account of the payer. The only information retrieved from the payer's bank is that of the availability of funds (a yes/no answer) on the account before initiating the payment (with the explicit consent of the payer).

PSPs are not allowed to make any changes to the payer’s account directly, and do not request sensitive information or any other outside that pertaining the transaction in process.

The security credentials of the payment service user shall not be accessible to other third parties and will have to be transmitted through safe and efficient channels to the bank servicing the account. A dynamically generated code issued on a one-time-basis and only valid for that specific transaction (linked to the amount and recipient) will have to be used in the authentication process.

Minimum Initial Capital Requirement

In terms of the provisions of FIR 01/2010, the minimum initial capital requirement is dependent on the specific activities to be carried out by the applicant. Accordingly, where the institution provides any of the payment services listed in paragraphs (A) – (E) of the permissible activities listed above, its minimum capital requirement will be of €125,000. Where the institution provides only the payment service listed in paragraph (F) above, its minimum capital requirement will be of €20,000 and where the institution provides the payment service listed in paragraph (G), its minimum capital requirement will be of €50,000.

The link between Payment Service Providers and iGaming

iGaming is a high-risk and fast-moving industry which has been booming in Malta over the past decade. Providers offer online entertainment where players often place bets and withdraw money in a virtual manner.

Due to the above, gambling companies must adhere to strict compliance rules and regulations. Technological challenges are also present as iGaming companies need to adapt their payments methods by tailoring them to the market within which they operate.

Differing currencies and compliance regulations are not second to the need to make deposits and withdrawals, hence the need for secure payment gateways.

PSPs offer a safe solution to both operators and players by providing an integrated service where security is paramount and various methods of payment - such as e-wallets and bank transfers - are offered.

Payments through reputable PSPs add another layer of trust to the operator as players are confident that their money is handled with care, and AML and Anti-Fraud laws are diligently followed.

How to obtain a PSP Licence

A Payment Service Provider may be licensed if an Application Form is submitted to the Malta Financial Services Authority (“Authority”), and the applicant company satisfies the following criteria:

1. its own funds are equal to such amount established by the Authority as appropriate for the activities to be undertaken by the applicant; this will be set on a case-by-case basis and will be commensurate to the business plan submitted by prospective applicants;
2. there are at least two individuals who will effectively direct the financial institution in Malta;
3. all qualifying shareholders, controllers and all persons who will effectively direct the business of the financial institution are suitable persons to ensure its prudent management;
4. the Authority is satisfied that the financial institution has sound and prudent management and a clear organisational structure;
5. the Authority is satisfied that there are no close links between that company and another person(s) which through any law, regulation, administrative provision or in any manner prevent the company from exercising effective supervision of that company under the provisions of the Financial Institutions Act;

An application form should be submitted in writing to the Authority and accompanied by the following documents:

1. A copy of the Memorandum and Articles of Association of the institution or the Deed of Partnership;
2. Proposed level of initial capital;
3. A programme of operations;
4. A description of the internal control mechanisms which the applicant will establish in order to comply with obligations in relation to money laundering and terrorist financing;
5. Audited financial statements for the last three years and the identity of statutory auditors and audit firms where applicable;
6. A business plan including the structure, organisation and management systems of the institution;
7. Identity of all officers and controllers of the institution; of all shareholders with qualifying shareholding or partners as appropriate; of the individuals who will be effectively directing the business of the prospective institution; and the applicant’s legal status and the address of his head office.

Notwithstanding the above list, the Authority may also require the applicants to submit additional information as it may deem appropriate to determine an application for a licence or to determine whether to restrict or revoke a licence.

Passporting of Payment Institution Licence

Once the Malta licence is obtained, it would then be possible to passport such licence into the EU/EEA Member State countries by following some basic procedures of notification. This would enable the Maltese Company to provide its services within the relevant member state/s either through the establishment of a branch or remotely.

PSD2: The Revised Payment Services Directive

In the year 2019 the European Commission issued the Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC, simply known as the Payment Services Directive or PSD2.

Its new directives seamlessly built upon the original PSD1 issued in 2009, and overall aimed at making payments safer, foster innovation and competition, and increase consumer protection.

The PSD2 commenced regulating Third Party Providers (“TTPs”), identified in one of two manners:

1. Account Information Service Providers (AISPs); and
2. Payment Initiation Service Providers (PISPs).

The former enables the consenting user to check their payments accounts held with different banks in a single overview.

The latter can initiate transactions on behalf of the consenting user from their payment account held with a particular bank.

In addition, the PSD2 enforced stronger customer protection by no longer permitting simple magnetic stripe bank card but only EMVs, also known as Chip & Pin cards.

Moreover, bank transfers where both the payer and the payee’s banks are located in an EEA country each will pay their respective charged fees.

Further benefits to the consumers took shape in the protections issued by the Directive regarding lost or stolen cards and fraudulent transactions effected with it whereby the client is only liable to pay a maximum of €50 (unless the client acted fraudulently or with gross negligence him/herself).

Consumers are also protected by possible surchargers applied by the merchants when payments are made with an electronic instrument.

Transparency was also the main subject of the new directions given to banks in regard to information on individual debit and credit transactions which must be given to their clients.

Overall, the PSD2’s goal of enhancing consumer protection across the EU comes as an additional reason for players to trust their online transactions are safe and secure.

How can CSB Group help you?

CSB Group has been in the Financial Regulation sector for many years, and in the iGaming industry since its inception.

Over 30 years of experience have granted in-depth knowledge and understanding of both, making CSB Group’s team a leader in its field.

Should you require aid or clarification on the above, please do not hesitate to contact us at [email protected] where our consultants will be glad to assist you further.