Forming a Maltese company does not “re-open” EU banking access. Incorporation creates a legal entity; it does not grant a bank account, a financial-services licence or permission to provide regulated services across the European Union. Investigators should separate those stages when a business presents Malta as a route back into European finance.
Identify what “access” actually means
The claim may refer to opening an ordinary corporate account, obtaining payment or electronic-money services, becoming an agent or distributor, securing a payment-institution licence, acquiring a licensed firm, or passporting regulated services into other EEA states. Each route has different legal requirements and evidence.
Record the product, customer type, territory, contracting entity and date. A Maltese holding company with a local IBAN is not necessarily the entity providing the regulated service. Likewise, access to a payment account is not a banking licence.
The MFSA’s consumer explanation of banks and payment service providers notes that a financial institution may accept funds only for providing a payment service and cannot use customer funds to finance its own activities. The distinction should be reflected in any company profile.
Map the legal and operational chain
Start with the Malta Business Registry record, but continue to the MFSA register and any host-state regulator. Identify the licensed entity, licence category, permitted services, passport notifications, branches and agents. Check whether the brand’s website, terms and customer statements name the same legal entity.
Then map the banks, electronic-money institutions, acquirers, processors and settlement accounts used in practice. Our guide to offshore firms using onshore payment rails explains why the visible account provider may be only one layer in the chain.
For payment institutions, MFSA’s current authorisation procedures distinguish a Maltese licence from the passport rights of an institution already authorised in another EU or EEA state. A company registration alone satisfies neither route.
Test whether the Malta operation has substance
Obtain evidence of directors’ decision-making, compliance personnel, premises, payroll, outsourcing, customer support, safeguarding arrangements, transaction monitoring and local financial statements. Verify whether critical functions are performed in Malta, elsewhere in the group or by third parties.
A Malta address and professional directors can be legitimate, but they do not prove that regulated activity is managed there. Compare the claimed operation with the checks used when an existing company enters a higher-risk banking venture. Pay particular attention to a recent change of ownership, objects, directors or business model.
Understand the bank’s separate decision
Banks perform their own customer due diligence and risk assessment. A regulator’s authorisation does not oblige a particular commercial bank to provide an account, correspondent services or settlement capacity. Conversely, a bank account does not confirm that the customer is authorised for every service it markets.
The European Banking Authority’s guidance addressing unwarranted de-risking promotes case-by-case risk management rather than unsupported exclusion. It also recognises that access may be refused where risks cannot be managed. Investigators should therefore look for the bank’s documented reason, remediation efforts and the entity actually assessed.
Evidence of a genuine banking relationship includes dated account agreements, statements, settlement instructions and direct confirmation obtained lawfully. Screenshots, IBAN-checker results and a provider logo can be forged or relate to a different group company.
Check for continuity with the former business
If the narrative involves “re-entry,” compare the Maltese entity with the business that previously lost banking or regulatory access. Test common owners, directors, domains, staff, contracts, customers, IP, funding, payment descriptors and transaction flows. A new company may be an independent purchaser, a legitimate restructuring or a continuation designed to obscure the earlier risk.
Do not infer evasion from common advisers or a shared address alone. Stronger evidence combines control, operational continuity and a misleading presentation to banks, regulators or customers. Our analysis of payment licences as proxies for market access shows why licence scope and actual payment relationships must be verified separately.
Evaluate promotional claims carefully
Malta Business Report’s overview of setting up a business in Malta describes broad single-market and commercial advantages. It is useful background, but it should not be read as evidence that any particular company has banking access, a passportable authorisation or a specific tax outcome. Those questions require official registers, professional advice and transaction-level evidence.
A defensible conclusion should state whether the company is incorporated, banked, authorised, passported and operational—and name the evidence for each. That prevents a Maltese registration from being mistaken for automatic EU financial access while still recognising legitimate, properly authorised cross-border business.