Most of the attention on Malta's financial services rules goes to licences with a well-known name: banks, payment institutions, e-money institutions, investment firms. Consumer credit sits in the background. That changes on 20 November 2026, when Malta's transposition of the new EU Consumer Credit Directive takes effect.
The legal texts were published together in the Government Gazette on 3 July 2026. They create a new admission regime for credit intermediaries supervised by the Malta Financial Services Authority, and they rewrite the conduct rules for banks and licensed financial institutions that lend to consumers. For fintech founders looking at Malta, the timing matters: anything launched before November has to be ready for the new rules within weeks.
Three legal notices, one directive
The package transposes Directive (EU) 2023/2225 on credit agreements for consumers, which repeals the 2008 directive (Directive 2008/48/EC). Under its Article 48, Member States had to adopt and publish their transposing measures by 20 November 2025 and must apply them from 20 November 2026. Malta's package has three parts:
- Legal Notice 177 of 2026, the Financial Institutions Act (Consumer Credit) Regulations, 2026, for non-bank lenders licensed under article 5 of the Financial Institutions Act;
- Legal Notice 178 of 2026, the Consumer Credit Intermediaries (Admission) Regulations, 2026, made under both the Banking Act and the Financial Institutions Act;
- Legal Notice 179 of 2026, the Banking Act (Consumer Credit) (Amendment) Regulations, 2026, which amends the Banking Act (Consumer Credit) Regulations (S.L. 371.23), published as L.N. 265 of 2025, the consumer credit rules for banks.
All three come into force on 20 November 2026. L.N. 179 provides that the principal banking regulations continue to apply to credit agreements entered into before 21 November 2026 until those agreements end. On the financial institutions side, regulation 39 of L.N. 177 repeals the earlier Financial Institutions Act (Consumer Credit) Regulations (S.L. 376.09, L.N. 266 of 2025), which continue to apply to credit agreements entered into before 20 November 2026 until they end. Both 2025 instruments were made under the 2008 directive.
The competent authority throughout is the MFSA. For how the regulator is organised and what it licenses, the MFSA overview is the starting point; the reform article covers the changes to the authority itself this year.
Credit intermediaries now need MFSA admission
The most visible change is in L.N. 178, which states that it transposes the relevant provisions of Article 37 of the Directive. That article requires creditors and credit intermediaries to be subject to an adequate admission process, registration and supervision by an independent competent authority, with exemptions for credit institutions and certain other regulated creditors. Regulation 3 of L.N. 178 is short: no credit intermediation activities in relation to a consumer credit agreement may be provided in Malta unless they are provided by a person admitted by the MFSA as a credit intermediary.
The definition is broad. A credit intermediary is a person who is not acting as the lender, is not merely introducing a consumer to a lender (directly or indirectly), and who, in the course of a trade, business or profession and for remuneration in money or any other agreed form of financial consideration, does one of three things:
- presents or offers consumer credit agreements to consumers;
- assists consumers with preparatory work or other pre-contractual administration; or
- concludes consumer credit agreements on the lender's behalf.
On its wording, that can catch brokers, comparison platforms that do more than refer, and arrangements where a merchant or platform handles the credit application; L.N. 177 itself refers to suppliers of goods or services acting as credit intermediaries in an ancillary capacity. Licensed lenders are carved out: under the proviso to regulation 3, a creditor does not need admission to carry out credit intermediation activities.
The admission rules are those of a regulated activity:
- anyone intending to carry out credit intermediation in or from Malta must apply to the MFSA, in the form, with the information and under the conditions set in Credit Intermediaries Rules issued by the authority, together with such fee as may be prescribed (regulations 4 and 8);
- an admitted intermediary, and any applicant, must have both its head office and its registered office in Malta (regulation 6);
- the MFSA keeps a public register of admitted intermediaries on its website, with a single information point (regulation 7);
- an admitted intermediary pays an annual admission fee (regulation 9) and must notify changes to the information it provided as soon as it becomes aware of them (regulation 5);
- admission can be withdrawn, among other grounds, if the intermediary has not carried out credit intermediation for the preceding six months, obtained admission through false or misleading statements, or seriously or systematically infringed the rules (regulation 10);
- the MFSA can impose administrative penalties of up to €150,000 per breach, as fixed or daily penalties, with an appeal to the Financial Services Tribunal (regulation 11).
One sentence in regulation 3 deserves attention from anyone planning an EU-wide model. A Maltese admission does not entitle a credit intermediary to provide, or hold itself out as providing, credit intermediation from Malta in territories outside Malta. The admission is a domestic one.
Which loans the new rules cover
L.N. 177 applies to credit agreements granted by licensed creditors to consumers. Two definitions set the scope.
"Consumer". The Maltese text defines a consumer as a natural person acting either in his own personal capacity or for the purposes of carrying out his trade, business or profession. That is wider than the Directive's own definition in Article 3, which covers a natural person acting for purposes outside his or her trade, business or profession. Under the Maltese text, sole traders and self-employed borrowers are inside the protection when they borrow for their business.
"Credit agreement". An agreement in which a creditor grants or promises credit in the form of a deferred payment, loan or similar financial accommodation, other than agreements for services or goods supplied on a continuing basis and paid for in instalments while they are supplied.
Regulation 5 then lists what is outside the regime. The main exclusions are:
- agreements entered into before 20 November 2026, except that open-end agreements (such as overdrafts and credit lines) from before that date are brought under specific provisions on borrowing rate changes, overdraft and overrunning information, termination and assignment;
- credit secured on immovable property, or for acquiring or retaining property rights in land or buildings;
- credit of more than €100,000, unless it is unsecured credit for renovating a residential property;
- employer loans to staff at no or below-market interest that are not offered to the public;
- deferred debit cards where the credit must be repaid within 40 days, free of interest and with only limited charges for the payment service;
- court settlements and free deferrals of an existing debt.
Regulation 4(2)(c) keeps three categories inside the regime but with only a small number of provisions applying: credit of less than €200, credit that is free of interest and without any other charges, and credit that must be repaid within three months with only insignificant charges. For these, only a handful of provisions on advertising, pre-contractual information and contract content apply. Regulation 4(2) sets separate reduced lists for overrunning and for repayment arrangements with consumers already in or close to default. Anyone building a short-term or small-ticket product needs to read those lists carefully rather than assume either full coverage or full exemption.
What changes for lenders
For banks and licensed financial institutions, the conduct rules are the bulk of the text. Among the provisions in L.N. 177:
No unsolicited credit. Regulation 17 prohibits granting credit to consumers without their prior request and explicit agreement.
A real creditworthiness assessment. Regulation 18 requires a thorough assessment before any credit agreement, based on relevant and accurate information on the consumer's income, expenses and other financial and economic circumstances, proportionate to the nature, duration, value and risks of the credit. Intermediaries must pass the information they collect accurately to the lender. Special categories of personal data under the GDPR may not be used, and social networks do not count as an external source.
Advertising. Regulation 7 requires advertising to be fair, clear and not misleading, and bans wording that creates false expectations about the availability or cost of credit. Advertising must carry a clear and prominent warning that borrowing costs money, in wording such as "Caution! Borrowing money costs money" or an equivalent, and any advertisement that quotes an interest rate or cost figure must include a representative example. Regulation 7(6) also prohibits advertising that highlights the ease or speed with which credit can be obtained, suggests that credit improves the consumer's financial situation, or offers grace periods of more than three months.
A cap on the cost of credit. Regulation 31 requires a creditor, or a European creditor, offering credit agreements to consumers within Malta to ensure that the annual percentage rate of charge does not exceed 16%, a ceiling the MFSA may revise. Article 31 of the Directive requires Member States to introduce measures against excessively high borrowing rates or costs of credit; this is Malta's choice for licensed financial institutions.
Personalised pricing. The pre-contractual information must state where the price was personalised on the basis of automated processing, including profiling, and regulation 13 requires consumers to be told clearly when they are presented with a personalised offer based on automated processing of personal data.
Tying and bundling. Regulation 14 allows bundling but prohibits tying, with narrow exceptions for payment or savings accounts used only to accumulate capital to repay the credit, service it, pool resources to obtain it, or provide additional security. Where insurance is required, the lender must accept an equivalent policy from another insurer, and consumers have at least three days to compare insurance offers.
Withdrawal. Under regulation 26, consumers may withdraw within 14 days without giving a reason, counted from the conclusion of the agreement or from receipt of the contractual information if later. If that information is never provided, the right expires twelve months and 14 days after the conclusion of the agreement, and that cut-off does not apply at all if the consumer was never informed of the right to withdraw.
Early repayment. Regulation 29 gives consumers a right to repay early at any time with a reduction in the total cost of credit. Compensation to the lender is limited to 1% of the amount repaid where more than a year remains, and 0.5% where a year or less remains, only for periods in which the borrowing rate is fixed, and only where early repayments exceed €10,000 within any twelve months.
Staff competence. Regulation 33 requires creditors and credit intermediaries to ensure their staff keep an appropriate level of knowledge and competence, with minimum requirements in the Fourth Schedule. L.N. 179 adds the same duty, with its own schedule, to the banking rules.
What it means for fintech business models
For founders who looked at Malta mainly for an e-money licence or a payments set-up, the new rules raise practical questions.
Are you a lender, an intermediary or neither? On the wording of the definition, a platform that merely introduces users to a lender, without presenting offers or handling applications, is outside it. One that presents credit offers, carries out preparatory work on applications or concludes agreements for the lender falls within it and needs admission.
Where is the head office? Admission requires both the head office and the registered office in Malta. A Maltese company run from abroad does not meet regulation 6. The general points on forming a Maltese company apply, but substance here is a legal condition, not a tax preference.
Which products sit in the reduced regime? Small-ticket, interest-free and short-term products are partly covered. Map each product to regulation 4(2) and regulation 5 before launch.
Does the pricing fit under the cap? A financial institution lending to consumers within Malta has to keep the annual percentage rate of charge at or below 16% under regulation 31 of L.N. 177.
Are your documents ready? Pre-contractual information, advertising, creditworthiness processes and withdrawal handling all change on 20 November. Agreements signed from that date must comply.
Can you scale across the EU from here? Not on the strength of a Maltese intermediary admission alone, according to regulation 3 of L.N. 178.
Malta's fintech sector has grown on the back of clear licensing categories. Consumer credit intermediation now has one of its own. The application form, the documents and the conditions are matters for the Credit Intermediaries Rules that regulation 8 empowers the MFSA to issue; the obligation to be admitted, and the date it bites, are already fixed in law.
Work with Sebastian
If you are planning a lending, credit intermediation or embedded finance model in Malta and want it mapped against the new consumer credit rules before 20 November 2026, Sebastian can help: book a consultation.
