Malta published new rules for its register of trust beneficial owners on 22 September 2026. Legal Notice 252 of 2026, the Trusts and Trustees Act (Register of Beneficial Owners) (Amendment) Regulations, 2026, was published in the Government Gazette that day. It amends the regulations that govern the trust register, S.L. 331.10.
The headline is not a new list of fields for trustees to fill in. The information a trustee files about each beneficial owner stays essentially as it was. What changes is who is treated as a beneficial owner, who may look at the register, whether anyone tells you they looked, and what it costs to get it wrong.
Only trusts are affected. The Legal Notice amends the trust register regulations and nothing else. Maltese foundations, which are a different legal creature with their own framework, are not touched by it; the foundation guide explains how that structure works.
Why now: the EU's sixth anti-money laundering directive
Regulation 1(2) states the purpose plainly. The Legal Notice transposes Articles 11, 12, 13 and 15 of Directive (EU) 2024/1640, the sixth anti-money laundering directive, in so far as it relates to trusts and trustees.
Those four articles deal with access to beneficial ownership registers: general access for authorities and obliged entities (Article 11), access for people with a legitimate interest (Article 12), the procedure for verifying and mutually recognising that interest (Article 13), and exceptions to access (Article 15). Article 78 of the directive gave member states until 10 July 2026 to bring those four articles into force, a year ahead of the directive's general deadline of 10 July 2027. Malta's trust rules arrive a little over ten weeks after that date.
The Legal Notice also brings in the vocabulary of the new EU framework. It adds definitions of AMLA, the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism established by Regulation (EU) 2024/1620, and of "obliged entity", "competent authority", "self-regulatory body" and "third country" by reference to Regulation (EU) 2024/1624.
What trustees file: largely unchanged
It is worth being precise here, because the change is easy to overstate. Under regulation 3 of the existing rules, a trustee must file a declaration of beneficial ownership within 14 days of being appointed to an express trust. For each beneficial owner it contains the full name, the full date of birth, nationality or nationalities, country of residence, an official identification document number, the person's role in the trust and, for beneficiaries, the nature and extent of the benefit.
Changes must be notified within 14 days of being recorded (regulation 5(1)), and every trustee must file an annual confirmation by 31 January that nothing else changed in the previous year (regulation 5(2)). Corporate trustees sign through two directors. Trustees resident outside the EU who enter into a business relationship in Malta, or acquire Maltese real estate, have the same 14-day duty under regulation 3A. Since L.N. 133 of 2025, private trustees are covered too.
L.N. 252 of 2026 does not rewrite those filing duties. It does, however, restate the definition that decides who goes into the declaration.
Who counts as a beneficial owner
The new definition in regulation 2 refers to the meaning in Malta's Prevention of Money Laundering and Funding of Terrorism Regulations, as applied to trusts, and lists:
- the settlor or settlors;
- the trustee or trustees;
- the protector or protectors, where applicable;
- the beneficiaries or the class of beneficiaries;
- any other natural person exercising ultimate control over the trust, whether by direct or indirect ownership or by other means.
The last category is the one to read slowly. It expressly includes, without prejudice to guidance from the Financial Intelligence Analysis Unit, any natural person whose consent is needed, or whose direction is binding, for "material actions" by the trustee. The definition then lists those actions: amending the trust instrument; adding or removing beneficiaries or affecting their entitlement; appointing or removing trustees or protectors, or giving another individual control; accepting an additional settlor; changing the proper law; transferring all or most of the trust assets; and terminating or revoking the trust.
The old rules had a similar concept in a separate definition. The new text folds it into the beneficial owner definition itself and ties it to the anti-money laundering regulations. For trustees, the practical consequence is straightforward: anyone with a veto or a binding direction over those decisions belongs in the declaration, whatever their title in the trust deed.
Who can now see the register
This is where the real change lies.
Authorities: immediate, unfiltered and silent
The substituted regulation 6(1) gives a defined list of bodies access that is immediate, unfiltered, direct and free of charge, and without alerting the trust, its trustees or any other beneficial owner. The list in regulation 6(1a) covers competent authorities, self-regulatory bodies, tax authorities in Malta and in other EU member states, authorities that implement EU sanctions, AMLA for joint analyses, the European Public Prosecutor's Office, OLAF, and Europol and Eurojust when supporting national authorities.
Obliged entities, meaning banks, other financial institutions and the professionals covered by anti-money laundering law, get timely access when carrying out customer due diligence (regulation 6(1b)).
Legitimate interest: wider, faster, and without notice to the trustee
The old regulation 6(1)(c) allowed access to anyone who could prove a legitimate interest backed by a track record in fighting money laundering. Before granting it, the MFSA had to notify the trustee and give at least ten working days for written submissions.
That notice step is gone. Under the new regulation 6(1c), people with a legitimate interest are granted access without alerting the trust, its trustees or any of its other beneficial owners. The Legal Notice also lists categories deemed to have a legitimate interest, including:
- persons acting for the purpose of journalism connected with preventing or combating money laundering;
- civil society organisations, including NGOs and academia, working in that field;
- persons likely to enter into a transaction with the trust or its trustees;
- entities in third countries subject to anti-money laundering rules, where access is needed for customer due diligence;
- third-country counterparts of EU competent authorities, in a specific case;
- EU authorities dealing with company registration, cross-border conversions and mergers, EU funds, the Recovery and Resilience Facility and public procurement;
- providers of anti-money laundering products serving obliged entities or competent authorities.
A catch-all allows access to anyone else who demonstrates a legitimate interest on a case-by-case basis.
What these users see is limited. For each beneficial owner: name and surname, month and year of birth, nationality or nationalities, country of residence, and the nature of the beneficial interest. Journalists, civil society organisations and third-country authorities also receive historical information, including on trusts that ceased to exist in the preceding five years, and a description of the control or ownership structure.
The procedure is now tightly timed. The MFSA must decide a request within 12 working days, extendable twice by 12 working days if requests surge. A successful applicant receives a certificate of access valid for three years, and later requests must be answered within seven working days. Proof of legitimate interest issued by another EU member state's register can be relied on, subject to verification.
What protects beneficial owners
The protections have been restated rather than removed.
Exemptions. Under the substituted regulation 6(2), the MFSA may exempt a beneficial owner's information from access by obliged entities and legitimate-interest users, in full or in part. It must be satisfied, case by case and on documentary evidence, that access would expose the beneficial owner to a disproportionate risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation, or that the beneficial owner is a minor or otherwise legally incapable. The exemption cannot be used against obliged entities that are public officials, and the MFSA must publish annual statistics on exemptions granted.
Refusal and revocation. New regulation 6AA limits the grounds on which access may be refused and, for most of those grounds, requires the MFSA to consider asking for more information before refusing. Access already granted must be revoked if a refusal ground later arises. Refusals and revocations can be appealed.
Knowing who looked. New regulation 7(2) requires the MFSA to keep records of who accessed a trust's beneficial ownership information and to be able to disclose them to a beneficial owner who asks under the GDPR. There is a limit: the identity of journalists and civil society organisations is withheld, and only their occupation or function is disclosed. Third-country authorities can ask for non-disclosure for up to five years.
Discrepancies and penalties
Two further changes will be felt by trustees in practice.
Discrepancy reporting. Under the substituted regulation 6C, competent authorities and obliged entities that notice a difference between the register and the information they hold must report it to the MFSA. The MFSA may then make enquiries with the trustee to establish the current position. Expect banks and service providers to cross-check more actively.
Penalties. The cap of €150,000 already existed. The new regulation 9 applies it for each breach or failure to comply. It adds a separate penalty of up to €100,000 where the MFSA has to update the register itself after a reported discrepancy, and a penalty of up to €150,000 for anyone who gives false or misleading information to obtain access. Trustees keep a due diligence defence. Penalties can be appealed to the Financial Services Tribunal.
A new regulation 9A creates a criminal offence for knowingly or recklessly furnishing false or misleading information under the regulations, punishable on conviction by a fine of up to €466,000, imprisonment of up to four years, or both.
What to do now
If you are a trustee, review every declaration against the restated definition, especially protectors and anyone whose consent or direction is required for the material actions listed above. Make sure the annual confirmation due by 31 January is supported by an actual review. With penalties now per breach, a single outdated declaration across several trusts multiplies quickly.
If you are a settlor or beneficiary, assume that the listed authorities, in Malta and elsewhere in the EU, can see the register entry, that your bank can see it when it carries out due diligence, and that a defined group of legitimate-interest users can see your name, month and year of birth, nationality, country of residence and the nature of your interest. For the authorities and the legitimate-interest users, the rules say this happens without alerting the trust, its trustees or its beneficial owners. If there is a real security risk, the exemption route exists, but it depends on documentary evidence.
If you are choosing a structure, weigh this alongside everything else. The MFSA's role as supervisor and registrar, the way trusts interact with holding structures, and the banking reality for residents and companies all sit in the same picture. A Maltese trust remains a legitimate, well-regulated arrangement. It is simply no longer a private one in the sense that many older deeds assumed.
Work with Sebastian
If you want to work out how these rules apply to your own company, trust or personal position in Malta before the next deadline, book a consultation.
