EMI onboarding for VASPs in Malta sits at the intersection of two distinct regulatory regimes. A VASP (virtual asset service provider) operating under Malta's transitioning VFA framework (Virtual Financial Assets) needs more than a licence to receive and disburse client funds – it needs fiat rails, and those rails run through an EMI (electronic money institution) or a bank. In practice, securing that account relationship is frequently harder than obtaining the underlying VASP authorisation from the Malta Financial Services Authority (MFSA). This page addresses the legal requirements, the onboarding process, and the cross-border decisions that determine whether a crypto business can actually operate its payment infrastructure from Malta.
With MiCA (the EU's Markets in Crypto-Assets Regulation) now the governing framework for crypto-asset service providers across the bloc, Malta's earlier VFA regime is transitioning toward full CASP (Crypto-Asset Service Provider) authorisation under MFSA and ESMA oversight. That transition changes how EMIs evaluate inbound VASP clients, and how those VASPs must document their compliance posture to pass onboarding due diligence. The sections below walk through each stage of that process.
Why EMI Onboarding Is the Critical Bottleneck for VASPs in Malta
The single most common reason a Malta-licensed VASP stalls after authorisation is the inability to open and maintain a payment account. MFSA may approve the licence; the EMI may still decline the client. These are separate decisions made by separate institutions under different legal frameworks. The MFSA evaluates regulatory fitness. The EMI evaluates financial crime risk, commercial viability and its own regulatory exposure.
EMIs operating in Malta are themselves regulated by the MFSA under the EU's Payment Services Directive regime. They carry their own anti-money-laundering obligations and answer to MFSA for their customer acceptance policies. When an EMI takes on a VASP client, it inherits a slice of that client's compliance risk. Regulators in the EU have made clear that they expect EMIs to conduct enhanced due diligence on virtual asset business clients – the result is that onboarding timelines are longer, documentation requirements are more extensive, and account closures occur more frequently than in most other sectors.
Operating without stable fiat rails is not merely inconvenient. It risks enforcement action for client-money handling failures, frozen transaction flows, and reputational damage that can unwind a licensing effort entirely. We have seen businesses spend significant sums on VASP authorisation, only to discover that their payment infrastructure question was never resolved. The legal and commercial work must run in parallel.
What the MFSA and MiCA Regime Requires of VASPs Before an EMI Will Engage
An EMI conducting VASP onboarding in Malta will evaluate the applicant's regulatory status, AML programme and governance structure before any account relationship begins. Under the transitional MiCA framework, a VASP that held a valid VFA registration benefits from a transitional recognition period, but that recognition does not automatically satisfy an EMI's risk appetite. The EMI needs evidence of a live compliance function, not a paper licence.
The documentation an EMI will typically require includes: the MFSA authorisation or VFA registration confirmation; a current AML/KYC policy manual; the business's risk assessment; its customer due diligence procedures; a description of the transaction monitoring system; the names and backgrounds of ultimate beneficial owners; and audited financials or a current management accounts pack. Where the VASP operates a custody function, the EMI will also want to understand asset segregation and the treatment of client funds versus own funds.
The Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer, derived from FATF Recommendation 15) has become a specific diligence point. EMIs increasingly require VASPs to demonstrate operational Travel Rule compliance – not as a future plan, but as a live, documented process. A VASP that cannot show this will struggle to onboard, regardless of its MFSA status.
The MiCA regime introduces whitepaper obligations for certain token categories, including asset-referenced tokens (ARTs) and e-money tokens (EMTs). Where a VASP issues or handles these instruments, the EMI will want to understand the reserve structure and the redemption mechanics. These are regulatory questions the EMI's own compliance team must answer internally before it can accept the account.
CTA 1: The documentation review above describes the standard preparation path. Your entity structure, the jurisdictions where your users sit, and the nature of the assets you handle will change which elements carry the most weight.
To understand how your specific compliance posture will read to an MFSA-regulated EMI, contact OBOLUS at info@oboluslaw.com. We map the licence, AML and governance gaps before you enter an onboarding process – not after a rejection. Map your options.
How Does the EMI Onboarding Process Work in Malta?
The EMI onboarding process in Malta typically moves through four stages: pre-screening, formal application, enhanced due diligence review, and account activation. Each stage carries its own timeline and its own failure points.
Pre-screening is informal but consequential. The VASP submits a business description and high-level compliance summary. The EMI determines whether the business falls within its risk appetite before investing compliance resources in a full review. A business that operates across multiple jurisdictions, handles high-volume transactions, or sits in a product category the EMI has no prior experience with may be declined at this stage with no formal explanation. Understanding the EMI's sector policy before approaching is therefore critical intelligence, not a courtesy.
The formal application stage requires the full documentation pack described above. EMIs in Malta have wide discretion on the scope of that pack – the MFSA's licensing requirements for EMIs do not prescribe an exact onboarding checklist for their VASP clients. The EMI sets its own standards, subject to its overall AML obligations. In practice, this means documentation requirements vary between institutions, and a pack that satisfies one EMI may be insufficient for another.
Enhanced due diligence at the review stage can involve interviews with senior management, requests for additional financial information, and a review of the VASP's anticipated transaction volumes and counterparty profile. The EMI is assessing not just current compliance but future risk trajectory. A VASP that is growing quickly, entering new markets, or adding new product lines introduces uncertainty that a risk-averse EMI compliance team will price heavily.
Account activation timelines vary. Where the VASP's documentation is complete, its structure is straightforward, and the EMI has prior experience with similar clients, the process can move relatively quickly. In more complex cases – cross-border structures, multiple jurisdictions of operation, novel token products – the process is measured in months rather than weeks. Businesses should plan for a longer runway and maintain contingency access to alternative payment infrastructure during the process.
Cross-Border Interaction: Tax and Banking for Malta VASPs
Malta offers a specific tax environment for digital-asset businesses, but the interaction between that environment and the EMI onboarding question is frequently misunderstood. A VASP that is incorporated and licensed in Malta but whose beneficial owners, operational team and users are primarily located elsewhere creates a more complex risk profile for an EMI than a genuinely Malta-based operation. The EMI will assess substance.
The MFSA has consistently signalled that substance requirements are not merely a tax question – they affect the regulatory standing of the licence itself. An entity with a Malta address but no meaningful local operations may face questions about whether its MFSA authorisation was obtained on an accurate basis. An EMI onboarding that entity accepts a correspondent risk it may not be willing to take.
Banking for VASPs in Malta also has a cross-border dimension in the opposite direction. A Malta-licensed VASP serving users in the EU under MiCA passporting rights must be able to demonstrate that its AML and KYC processes meet the requirements of each jurisdiction where it accepts clients, not just Malta. An EMI that provides fiat rails to a VASP with EU-wide operations becomes part of that compliance chain. EMIs ask these questions explicitly, and a VASP that cannot answer them delays its own onboarding.
Tax structuring around the EMI relationship matters for a different reason. The characterisation of income flowing through the EMI account – whether it is trading revenue, service fees, yield from staking or income from token issuance – affects both the VASP's Maltese tax position and its reporting obligations in other jurisdictions. Where a VASP operates across multiple tax jurisdictions, the way the EMI account is used and documented should be aligned with the group's tax structure from the outset. Retrofitting that alignment after the account is live is significantly more difficult.
Why Does a Prior EMI Rejection Happen, and What Can Be Done?
A prior EMI rejection does not close all options, but it requires a structured diagnosis before any second approach. EMIs are not required to give detailed rejection reasons, and most do not. The rejection may reflect a documentation deficiency, a product-line concern, a volume-risk assessment, a counterparty exposure question, or simply a sector-level policy shift that has nothing to do with the applicant's specific compliance posture.
In our practice, a structured review of the rejection circumstances, followed by a mapped comparison of the applicant's position against the EMI's stated risk appetite (where that is publicly disclosed), will usually identify the dominant factor. A documentation deficiency is remedied by rebuilding the pack. A product-line concern may require a structural adjustment. A sector-level policy decline may point toward a different EMI or a different payment infrastructure model entirely.
A common assumption in this space is that a single offshore or EU licence, once obtained, resolves the payment and banking question automatically. It does not. The licence answers the regulatory-status question. The EMI onboarding answers the operational-access question. These are separate hurdles, and treating the second as a formality after the first is a reliable source of commercial delay.
The VASP Act structures and offshore registration models that worked under earlier FATF evaluation cycles are receiving more scrutiny from EMIs, partly because FATF mutual evaluations have tightened, and partly because EMI compliance teams now have more experience evaluating crypto client risk. A structure that passed muster several years ago may not meet current diligence expectations.
CTA 2: If a prior account application stalled or was declined, a second read of the rejection context and your current compliance posture can identify the structural reason and the realistic path forward.
To run that diagnostic, write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw. We advise on post-rejection strategy across EMI and bank relationships in Malta and across the broader EU. Map your options.
Practical Example: Restructuring for EMI Access
Earlier this year, a crypto exchange operating under an EU jurisdiction's existing VASP registration approached us after its third EMI rejection. The business had solid MFSA-equivalent authorisation, a functioning AML programme, and clean audit history. The rejections shared a common thread: the exchange's customer base included a material proportion of users in jurisdictions that the EMIs categorised as elevated risk under their internal country-risk models. The exchange's compliance programme addressed those users at the transaction level but had not documented a formal geographic risk framework or a written policy for jurisdictions of concern. We restructured the compliance documentation to make that framework explicit and auditable, mapped the cross-border user distribution against the relevant FATF risk classifications, and prepared a counterparty-risk narrative for the EMI submission. On the fourth approach, to a different EMI with clearer prior VASP experience, the account was activated within a commercially reasonable period.
Self-Assessment Checklist for VASP EMI Onboarding in Malta
Before approaching an EMI in Malta, a VASP should be able to answer affirmatively to the following:
- Is the MFSA authorisation (or VFA transitional registration) current and in good standing?
- Is the AML/KYC policy documented, board-approved, and up to date with the latest FATF guidance?
- Does the business have a live transaction monitoring system with documented alert thresholds?
- Is Travel Rule compliance operational, not merely planned?
- Are ultimate beneficial owners documented to the standard required by the applicable AML regime?
- Is client money segregated from operating funds, with documented safeguarding procedures?
- Does the compliance programme address geographic risk explicitly, not just at the transaction level?
- Is the Maltese substance position consistent with the entity's regulatory and tax profile?
- Has the business mapped its anticipated transaction volumes and counterparty types for the EMI's review?
- Does the business have a response prepared for questions about cross-border user exposure?
A "no" on any of these points is a predictable rejection reason. Identifying and addressing the gap before the application saves time and protects the entity's relationship with the target EMI.
Decision Point: Which VASP Profile Should Prioritise Malta EMI Access?
Not every VASP should approach the Malta EMI market as its primary fiat-rail solution. The decision depends on the entity's operational profile and its broader jurisdictional strategy.
A VASP that is already MFSA-authorised or in the MiCA CASP application pipeline, whose primary user base is EU-resident, and whose product set is limited to exchange and custody services sits in the best position for Malta EMI onboarding. The regulatory familiarity works in its favour. The EMI's diligence team is assessing a known structure under a known regime, and the passporting logic supports the client-base profile.
A VASP that is domiciled in Malta primarily for structural reasons, whose operational team sits elsewhere, and whose user base is global rather than EU-focused faces a harder path. The substance question arises early, the geographic risk questions multiply, and the EMI's comfort with the overall structure diminishes. For this profile, the right answer may be a Malta EMI for EU-segment activity combined with alternative payment infrastructure for non-EU segments – a split-rail approach that reflects the actual geographic distribution of the business.
A VASP that issues or plans to issue ARTs or EMTs under MiCA faces the most complex onboarding requirement, because the EMI must understand the token's reserve and redemption mechanics before it can price its own risk exposure. Early legal preparation of the token's regulatory characterisation document – separate from the whitepaper itself – accelerates that part of the diligence significantly.
In all three profiles, the licensing, banking and tax questions should be addressed as a single mandate. A licence that works for the regulatory regime but creates an unworkable tax position, or a banking relationship that satisfies the EMI but creates undisclosed reporting obligations elsewhere, produces commercial problems at a later stage. We structure these as one engagement rather than three separate workstreams.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital-Asset Businesses – Our practice overview for fiat-rail access across 70+ jurisdictions.
- Client Funds Safeguarding in Estonia – How safeguarding obligations apply to EMI and VASP structures in a leading EU licensing hub.
- Smart Contract Legal Review in South Africa – Structuring and legal review for on-chain arrangements with cross-border enforcement considerations.
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because of perceived financial crime risk and internal sector-level policies that treat digital-asset businesses as high-risk categories. The closure is rarely specific to a compliance failure by the individual business. It more often reflects the bank's own regulatory capital concerns, correspondent-banking pressure, or a board-level decision to exit the sector. Demonstrating a strong, documented AML programme and clear product scope reduces the risk of closure, but does not eliminate it entirely. Maintaining relationships with multiple EMI and banking counterparties is the operational safeguard.
How can a VASP onboard with an EMI?
A VASP seeking EMI onboarding in Malta should begin by confirming its regulatory status with the MFSA is current, then assemble a complete compliance documentation pack – covering AML policy, KYC procedures, transaction monitoring, Travel Rule compliance, UBO documentation and audited financials. The VASP should research the target EMI's sector appetite before formal submission. Where a prior approach failed, the reasons should be diagnosed structurally before any second submission is made. Legal counsel familiar with both the MFSA regime and the EMI's compliance expectations significantly accelerates the process.
What does client-money safeguarding require?
Under the EU payment services regime applicable in Malta, an EMI must segregate client funds from its own funds and hold them in a designated account or invest them in specified low-risk assets. For a VASP receiving client fiat through an EMI, the practical requirement is that the flow of funds between the VASP and the EMI must be structured so that client money is clearly identifiable at all times. Mixed holding of client and operational funds is a compliance failure under the applicable regime and a common trigger for both EMI account termination and MFSA supervisory action.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory and Compliance Analyst – specialising in MFSA and MiCA licensing requirements, EMI onboarding due diligence, and cross-border VASP compliance structuring.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.