Operating a virtual asset service in Malta without a properly documented Travel Rule (the obligation, derived from FATF Recommendation 15, to pass originator and beneficiary data with every qualifying transfer) compliance program is not a paperwork gap – it is a licence-threatening exposure. Under the Malta Financial Services Authority's supervision, and now within the accelerating transition to the MiCA (Markets in Crypto-Assets Regulation) CASP (Crypto-Asset Service Provider) authorisation regime, Travel Rule adherence sits at the centre of every AML/CFT review. Firms that have not aligned their programs to the current MFSA expectations are routinely flagged at supervisory examination.
Malta's Travel Rule framework derives from FATF Recommendation 15 as implemented through EU AML instruments and the domestic legal order. The MFSA applies these obligations to VASPs – and will apply them to CASPs under MiCA – requiring firms to collect, verify and transmit originator and beneficiary information for qualifying virtual-asset transfers, to screen against sanctions lists, and to maintain an auditable record of every data transmission. The applicable threshold below which the obligation is reduced is a jurisdiction-specific figure that firms must confirm against current MFSA guidance; writing a qualitative compliance architecture first and calibrating thresholds second is the correct approach. This page sets out what a compliant program looks like, where the common failures arise and how cross-border business complicates the picture.
The Regulatory Basis: MFSA, MiCA and FATF in Malta
Malta's Travel Rule obligations flow directly from the FATF Recommendation 15 standard and its EU-level transposition into the successive AML Directives, which the MFSA enforces as the competent authority for VASPs and the transitioning CASP regime. The prior VFA (Virtual Financial Assets) framework established by the MFSA already embedded AML/CFT expectations including transaction monitoring and counterparty data obligations; MiCA raises the bar further by imposing a single, harmonised CASP authorisation across all EU member states, with passporting rights that carry Malta's AML standards into every market a business serves from Valletta.
The practical consequence is a two-layer obligation. The first layer is the FATF Travel Rule itself – the requirement to attach originator name, account reference and address (or its functional equivalent on-chain) plus beneficiary name and account reference to every transfer at or above the relevant threshold. The second layer is the EU regulatory implementation, which in Malta means the MFSA's specific supervisory expectations, its guidance on acceptable technical solutions, and the VFA agent concept that remains relevant for firms still operating under the legacy framework. Under MiCA, the VFA agent role transitions to a different function, but the compliance architecture obligation does not diminish.
For an inbound business – a non-EU exchange or custodian setting up in Malta to access the EU single market – this means the Travel Rule program must be designed for the full CASP perimeter from day one. The MFSA has made clear that a bare-minimum approach to AML at authorisation will not survive the first supervisory examination.
What Does a Compliant Travel Rule Program Actually Contain?
A Travel Rule compliance program in Malta must, at minimum, cover six operational components: counterparty VASP identification, data collection and transmission, a KYC framework (the documented procedures for identifying and verifying customers and counterparties), transaction monitoring calibrated to the risk profile of the business, sanctions screening, and a record-keeping architecture that survives supervisory review.
Counterparty VASP identification is where most programs underinvest. When funds move between the firm's wallets and an external VASP, the firm must be able to identify that counterparty as a regulated entity, confirm its jurisdictional status and apply enhanced due diligence where the counterparty is in a higher-risk regime. The FATF list of jurisdictions subject to increased monitoring is the baseline reference; the MFSA and ESMA guidance layer EU-specific expectations on top.
Data transmission requires a technical solution. The market has converged around a small number of protocol-level Travel Rule solutions – the OASIS IVMS 101 data standard is broadly adopted – but the firm's choice of solution must be documented, tested against its counterparty network, and capable of handling the edge cases: unhosted wallets, transactions with counterparty VASPs that have not yet adopted a compatible protocol, and legacy transfers where data is incomplete. The MFSA expects a written policy addressing each scenario, not just the easy cases.
Transaction monitoring is distinct from Travel Rule data transmission. Monitoring covers the on-chain and off-chain behavioural signals – velocity, address clustering, interaction with flagged wallets, structuring patterns – that trigger a suspicious transaction report to the MFSA's Financial Intelligence Analysis Unit (FIAU). A Travel Rule program that collects and transmits data but fails to feed that data into a monitoring system leaves the firm exposed at examination.
In our practice, we regularly advise firms that have correctly documented the data-collection layer but have treated transaction monitoring as a second-priority build. That sequencing error is visible to the MFSA within the first review cycle.
For an assessment of where your current program stands against MFSA expectations, contact OBOLUS at info@oboluslaw.com. The process above describes the standard architecture. Your specific licence category, your user base and your counterparty network change the risk calibration significantly. Map your options
Who Carries the Compliance Obligation? The MLRO in Malta
Every regulated entity in Malta must appoint a Money Laundering Reporting Officer (MLRO) – a named, senior individual who is responsible to the MFSA and the FIAU for the integrity of the AML/CFT program, including the Travel Rule architecture. The MLRO is not a nominal role; the MFSA has taken enforcement action against firms where the MLRO lacked adequate seniority, adequate access to management information or adequate independence from the business line generating the revenue.
The MLRO function requires documented authority: board-level approval of AML policies, a direct reporting line to the board or audit committee, the ability to escalate suspicious transaction reports without commercial interference, and a documented record of the officer's training and ongoing competency development. Under MiCA transition, the CASP authorisation application itself requires the MFSA to approve key function holders, meaning the MLRO designation is subject to regulatory vetting.
For firms operating cross-border – a Malta CASP passport-servicing clients in Germany, France and the Netherlands, for example – the MLRO must understand not only Malta's domestic implementation but the nuances of AML supervision in each passport destination. A single Malta-based MLRO can cover the legal responsibility, but the program documentation must address local risk factors in each market. We have seen firms approved in Malta on the basis of a thin AML program and then face supervisory letters from NCAs in the destination member states within months of commencing passported operations.
How Does Malta Handle Unhosted Wallets and Protocol Edge Cases?
The unhosted-wallet question is among the most contested in Travel Rule practice across the EU, and Malta is no exception. The firm receiving a transfer from an unhosted wallet must apply the applicable FATF and MFSA guidance: at or above the relevant threshold, enhanced due diligence is expected, including verification that the wallet is beneficially owned by the customer who claims it. The technical method – signed message, micro-transaction proof of ownership, third-party attestation – is not prescribed by the MFSA, but the chosen method must be documented and consistently applied.
The "sunrise problem" – the disparity between jurisdictions that have implemented the Travel Rule and those that have not – creates a direct operational challenge. If a Malta VASP receives a transfer from a counterparty VASP in a jurisdiction that has not yet implemented the Travel Rule, the incoming data may be absent or incomplete. The MFSA and the EU AML framework expect a documented risk-based approach to these situations: the firm must decide whether to apply a delay, to request the missing data separately or to decline the transaction, and that decision framework must be in writing before the situation arises, not drafted in response to an MFSA query.
Decentralised protocol interactions add a further layer. A CASP that routes transactions through or interacts with DeFi protocols must assess whether the interaction falls within the regulated perimeter and, if it does, how the Travel Rule data obligation is satisfied. The MFSA has not published specific DeFi guidance, but the general principle – that substance governs and that a regulated firm cannot use a DeFi intermediary to avoid its AML obligations – is well established in the FATF and ESMA commentary.
Cross-Border Interaction: Tax, Banking and the Compliance Stack
Malta's Travel Rule compliance program does not exist in isolation from the firm's banking and tax architecture, and operators who design these layers separately create structural risk. A Malta CASP that holds customer funds in a correspondent bank account is subject not only to the MFSA's AML expectations but to the bank's own transaction monitoring – and crypto-related flows trigger enhanced scrutiny at most European correspondent banks. The practical consequence is that a Travel Rule program that satisfies the MFSA on paper but cannot produce clean, auditable data trails for correspondent bank requests will face account closure.
Tax plays a different but overlapping role. Where the firm is structured as a Malta entity passporting across the EU, the tax residency analysis – whether the effective management and control of the business is in Malta or is effectively exercised from another jurisdiction – will determine whether Malta's corporate tax regime applies. A Malta CASP with a nominal presence and an MLRO who is effectively managed from another jurisdiction faces both a tax challenge and an MFSA corporate-governance question simultaneously. We map the licence, management-presence and tax stack as a single integrated analysis, not as sequential workstreams.
For firms with non-EU shareholders or with payment rails running through Switzerland, the UK or the Gulf, the compliance program must also address the FATF Travel Rule as implemented in those jurisdictions. FINMA in Switzerland and the FCA in the UK have their own Travel Rule implementation timelines and technical requirements; a Malta CASP transacting with Swiss or UK counterparts must ensure its technical solution handles the data exchange correctly in both directions. Allied counsel in those jurisdictions are engaged where local sign-off is required.
A micro-matter illustrates the integration risk. In a recent compliance-restructuring engagement, a payments operator licensed in Malta had built a technically sound Travel Rule data-transmission layer but had not coordinated with its correspondent banking relationship. The bank's own AML system was flagging unstructured data fields in the transaction records that the Travel Rule solution was appending. We restructured the data-mapping between the Travel Rule solution and the bank's reporting format, produced an updated AML policy for MFSA review, and the account was retained. The fix took a matter of weeks; the risk, had the account been closed, would have been materially more disruptive.
If a prior AML review stalled your programme build or your banking relationship is under pressure, a structured second review can identify the root cause. Write to OBOLUS at info@oboluslaw.com for a scoped assessment. Map your options
How Does the MFSA Audit a Crypto AML Program?
The MFSA's supervisory approach to AML/CFT for VASPs and transitioning CASPs follows a risk-based examination cycle that can take the form of a desk-based review, an on-site inspection or a targeted thematic review prompted by a suspicious transaction report to the FIAU or a complaint. The firm receives a request for documentation – typically the AML/CFT policy suite, the MLRO's annual report, a sample of transaction monitoring alerts and their disposals, and evidence of Travel Rule data transmissions – and is given a response window.
The MFSA's primary focus in Travel Rule examinations is the completeness of the data transmitted. Examiners will take a sample of transfers at or above the relevant threshold and verify that originator and beneficiary data was correctly collected, transmitted and recorded. Gaps in the data sample – even a small percentage of transactions with missing fields – are treated as a program failure rather than an isolated error. The firm is then required to produce a remediation plan with a binding timeline.
A secondary focus is the firm's response to incoming transfers with incomplete or absent Travel Rule data. The examiner will ask to see the decision log: what did the firm do when it received a transfer without complete beneficiary data? Was the transaction halted, delayed or completed? Was the risk decision documented? A firm that completed transactions without adequate data and without a documented risk-based reason for doing so faces a significantly more adverse examination outcome than one that can point to a written policy and a consistent record of its application.
The FIAU conducts parallel inspections focused on the suspicious transaction reporting culture of the firm. The number of STRs filed, their quality and their timeliness are all indicators the FIAU uses to assess whether the firm's compliance function is genuinely embedded or is a documentation exercise. In our cross-border practice, we prepare firms for MFSA and FIAU examinations as an integrated exercise, not as two separate compliance reviews.
Which Firms Most Urgently Need a Program Build?
The decision to invest in a full Travel Rule compliance build rather than a lightweight documentation exercise turns on four variables: licence category, transfer volumes, counterparty network composition and the proximity of an MFSA review cycle.
A Malta VASP transitioning to a MiCA CASP authorisation faces the most acute timeline. The MFSA requires a CASP authorisation application that includes a complete AML/CFT policy suite; a Travel Rule program that was adequate under the VFA framework may not satisfy the CASP authorisation standard. The transition window is not indefinite. Firms in this position should treat the program build as a precondition of the authorisation application, not an afterthought.
A new market entrant seeking a Malta CASP authorisation as an EU passporting base starts from a clean sheet. This is operationally simpler – there is no legacy documentation to reconcile – but the MFSA scrutinises new applicants' AML programs closely, particularly where the business model involves high transfer volumes or cross-border counterparty networks. A thin program will not survive the initial review.
A non-EU operator passporting into Malta from another member state under MiCA must notify the MFSA under the passporting procedure and demonstrate that its home-state AML program meets the MFSA's expectations. Where the home-state program was designed for a single-jurisdiction operation, it will typically need to be adapted. The Travel Rule data-transmission layer must support the Malta operational footprint.
An exchange or custodian with a large unhosted-wallet client base faces the highest operational complexity regardless of licence vintage. The unhosted-wallet enhanced due diligence requirement consumes significant compliance resource; firms that have not built that capacity into their operations will face either a customer-experience problem (delays and friction) or a compliance program gap (completing transactions without adequate documentation). Neither outcome is acceptable to the MFSA.
A Common Assumption About Malta Compliance
A common assumption among operators entering Malta is that the prior VFA framework's relatively light-touch AML supervision will continue under MiCA, and that a basic AML policy document filed at authorisation will carry the firm through its first regulatory cycle. That assumption is incorrect on both counts.
First, the MFSA has significantly intensified its supervisory engagement with the VASP population in advance of MiCA transition. Firms that were registered under the legacy regime and have not invested in program upgrades are being reviewed, not grandfathered. Second, MiCA's CASP authorisation standard is materially higher than the prior VFA registration standard; the authorisation process itself is a substantive regulatory examination, not an administrative formality. A compliance program that would have passed a 2021 MFSA review will not necessarily pass a 2025 CASP authorisation assessment.
The cross-border dimension amplifies this. An operator who assumes that a single Malta authorisation is sufficient to serve clients globally – without addressing the AML expectations in each jurisdiction where those clients are located, or where the correspondent banks are domiciled – is operating on a legal fiction. The FATF Travel Rule applies at both ends of every transfer; if the counterparty jurisdiction has implemented the Rule and the firm has not addressed the bilateral data exchange, the program has a structural gap that the MFSA will identify.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – the full practice overview across licensing, monitoring and cross-border AML obligations.
- MLRO and compliance officer function for established operators – building and documenting the MLRO role for MFSA and MiCA CASP authorisation.
- Digital asset custody authorisation in Switzerland – FINMA's custody and AML framework for operators with Swiss counterparty exposure.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule, derived from FATF Recommendation 15, requires a VASP to collect, verify and transmit originator and beneficiary information with every qualifying virtual-asset transfer at or above the applicable threshold. In Malta, the MFSA enforces this obligation through the EU AML framework and its own supervisory guidance. The data must be transmitted to the receiving VASP before or simultaneously with the transfer, and a record must be retained for the supervisory period specified under applicable law.
Who must act as MLRO for a crypto firm?
A regulated firm in Malta – whether operating under the legacy VFA framework or under a MiCA CASP authorisation – must appoint a named MLRO who is a senior employee with sufficient seniority, independence and documented competence to carry the role. The MFSA reviews the MLRO designation as part of the authorisation process and may reject an appointment where the officer lacks adequate seniority or demonstrable AML expertise. The role carries personal responsibility for the firm's suspicious transaction reporting and AML program integrity.
How do regulators audit crypto AML programs?
The MFSA and the FIAU conduct risk-based examinations that combine desk-based document reviews with on-site or targeted thematic inspections. Examiners sample Travel Rule data transmissions for completeness, review the MLRO's annual report, assess the transaction monitoring alert log and examine the firm's response to transfers with incomplete counterparty data. A consistent, documented decision framework – not simply a policy document – is the differentiator between firms that pass examination and those that receive a remediation requirement.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and where a compliance program needs rebuilding under regulatory pressure, we have done that work. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in VASP and CASP compliance architecture, MFSA supervisory preparation and Travel Rule program design for operators across the EU and AIFC regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.