Malta’s MGA scales back its Recognition Notice crackdown after industry pushback

The arrangement covers a meaningful slice of the market: by 2021, the MGA counted 111 Malta-incorporated companies operating this way, 46 of them B2C operators, and Malta’s 2023 National Risk Assessment rated the setup’s residual risk medium-high, pointing specifically to the regime’s reliance on operators self-reporting their foreign licenses and the weaker oversight that can come with supervision happening somewhere else entirely. That risk assessment fed into the MGA’s National AML/CFT Strategy for 2024 through 2026, which set out plans to tighten authorization checks and ongoing monitoring for Recognition Notice holders.

The original consultation proposed a standardized legal opinion template, a full corporate structure chart for every operator, five years of regulatory history including correspondence with other regulators, exact annual deposit value and volume figures, and precise payment method reporting, all applied uniformly across both B2C and B2B license holders. Industry stakeholders pushed back hard on proportionality and practicality grounds, arguing the proposals duplicated checks foreign regulators already run and asked for commercially sensitive detail with no clear supervisory payoff.

The MGA’s final document walks several of these proposals back substantially. The standardized legal opinion template is gone entirely, replaced by a shorter list of key confirmations the MGA wants legal opinions to address. The full corporate structure chart is replaced by a simpler request for ultimate beneficial owner information alone. Deposit reporting moves from exact value and volume figures to predefined bands, a change specifically justified by how commercially sensitive the precise numbers were considered. Payment method reporting shifts from naming individual methods to reporting them grouped into broader categories. B2B suppliers are exempted from many, though not all, of the obligations that were originally set to apply across the board.

The MGA also narrowed its five-year history requirement to matters touching fitness and licensing specifically, said it will stagger data requests to existing Recognition Notice holders rather than demanding everything at once, and will begin collection this year covering the 2025 period, limited for now to B2C operators. The regulator has acknowledged that some of what stakeholders questioned may need statutory amendments before it can be enforced as planned.