Malta is the only EU member state the FATF has ever grey-listed — and the country's answer has outlived the listing by years. Placed under increased monitoring in June 2021, with the accuracy of beneficial-ownership information at the centre of its action plan, Malta was off the list by June 2022: the fastest exit of any major financial centre, earned largely by turning the Malta Business Registry into one of the EU's most active enforcers. The result in 2026 is a register with real teeth — annual confirmations on every company's anniversary, changes due within 14 days, penalties reaching €100,000, on-site inspections — and, unusually for post-Sovim Europe, a working legitimate-interest access route: case-by-case, evidenced, €5 per extract. Beneath it sits a public company register that discloses shareholders and directors for one of Europe's densest corporate populations — holding companies, iGaming licensees, funds and fiduciary structures. This guide maps the regime: the test, the clocks, the penalties, who can read what, and how to verify a Maltese UBO from outside.
01The grey-list year, and what it built
The arc is short and consequential. The Malta Business Registry was carved out of the financial regulator in 2018 as a standalone agency; beneficial-ownership filing had begun under the Companies Act (Register of Beneficial Owners) Regulations, in force since the start of 2018; and an annual beneficial-ownership confirmation was bolted on from June 2020. It was not enough to prevent the listing: on 25 June 2021 the FATF placed Malta under increased monitoring — the first and only EU member state on the grey list — citing, among other things, the accuracy of beneficial-ownership information and the enforcement applied to gatekeepers. What followed was a compressed, supervised sprint: MBR compliance inspections, escalating penalties, FIAU enforcement across the obliged sector. On 17 June 2022, the FATF removed Malta from the list, citing significant progress — and the machinery built for the exit kept running. (For the same arc still in motion elsewhere in the Mediterranean, see Monaco.)
02Who is a beneficial owner: the Maltese test
03The clocks: 14 days, and every anniversary
Malta runs its register on two clocks. Any change in beneficial ownership must be filed with the MBR within 14 days — among the tightest change windows in the EU. And since 16 June 2020, every company must submit an annual beneficial-ownership confirmation on each anniversary of its registration, restating or confirming its UBO information whether or not anything changed. Each record carries the owner's name, date of birth, nationality (with the MBR now requiring disclosure of dual and multiple nationalities), country of residence, identity-document details, and the nature and extent of the interest held. The company's officers are personally responsible for the accuracy of what is filed — a design that, combined with the penalties below, explains why Maltese corporate-service providers treat BO filings with unusual seriousness.
04Penalties and the enforcement turn
The sanctions are officer-level and material: administrative penalties for failures around the register run into the tens of thousands of euros, and in the aggravated cases — where the Registrar finds beneficial-ownership information in the register needs correcting — each officer of the company is exposed to a penalty of up to €100,000. The figures were raised as part of the grey-list response, and the enforcement is not theoretical: the MBR runs a compliance unit that conducts on-site inspections, cross-checks filings, restricts non-compliant companies from making other submissions, and strikes defaulters off the register. FIAU administrative penalties across the obliged sector more than tripled into the millions of euros during the listing period — the wider enforcement climate in which BO filings sit. Internationally the same data moves: Malta exchanges financial-account information under the OECD Common Reporting Standard and a FATCA agreement with the United States, and the AMLD6 interconnection will link its registers to the other member states' — closed to you, open state to state.
05Access in 2026: who can read the register
| Who | Access | Basis |
|---|---|---|
| Competent authorities & the FIAU | Full | National authorities, law enforcement and the FIAU — unrestricted and timely |
| Subject persons (obliged entities) | For CDD | Banks, CSPs, lawyers, accountants and other FIAU-supervised businesses, in the context of customer due diligence |
| Legitimate-interest applicants | Case by case | A working route: a written request to the MBR stating the AML/CFT rationale, assessed individually; approved applicants receive an extract for a €5 fee |
| The general public | Suspended | General access suspended following the CJEU's judgment of 22 November 2022 in the Sovim/WM cases |
A €5 extract is not a screening pipeline
Malta's legitimate-interest route is real — and it is one company, one request, one scanned extract at a time. Zavia.ai connects directly to official registries in 100+ countries, structures the Maltese corporate layer — entities, officers, filed shareholders — resolves the chain through the holding, trust and foreign layers where Maltese structures run, and returns an auditable map to the natural person with sanctions and PEP overlays: the benchmark you hold when you request a counterparty's BO confirmation, or petition the MBR for the extract that matters.
06The public layer: the MBR's company register
Beneath the restricted BO register sits a genuinely disclosing company register. The MBR's online system carries, for each of Malta's tens of thousands of companies, the registered details, status, registered office, directors and legal shareholders — filed at incorporation and refreshed through annual returns — with company documents available for download. Two practical frictions matter. First, using the MBR portal requires account registration with identity verification and two-factor authentication — a real barrier to quick anonymous lookups, and to automation. Second, the register shows the legal shareholder: for the holding, fiduciary and licensed-nominee structures that Maltese practice runs on, that name may be a trustee or CSP holding for clients — the gap the BO register exists to close, and the reason a shareholder certificate is a starting point rather than an answer.
Three facts sharpen that picture. First, the fiduciaries are themselves licensed: since the grey-list-era reform of the Company Service Providers Act removed the old exemptions, every person providing company services in or from Malta — formation agents, nominee shareholders, directors-for-hire, registered-office providers — requires MFSA authorisation and is a subject person with full CDD duties on the clients it fronts for. The nominee, in other words, is a regulated party who by law knows the beneficial owner. Second, subject persons who find a discrepancy between an entity's BO register entry and their own due diligence must report it to the MBR — the closed register is policed from inside the perimeter by the gatekeepers who populate it. Third, one question is simply closed: Maltese company law requires registered shares — there are no bearer shares to chase.
07Trusts, foundations and the second register
Malta's trust industry is licensed and supervised by the MFSA, and it carries its own beneficial-ownership register: under the Trusts and Trustees Act BO Regulations, trustees of trusts that generate legal effects in Malta must record the settlor, trustees, protector, beneficiaries and any other natural person exercising control — on the MFSA's Trusts UBO Register, closed on the same lines as the company register. Foundations and associations — creatures of the Second Schedule to the Civil Code — register with the Registrar of Legal Persons within the MBR and carry equivalent BO duties. The practical map: a Maltese trust above a Maltese company is invisible in the company register but recorded, twice, in registers you cannot read — and administered by an MFSA-licensed trustee who is a subject person with full CDD duties. The request routes to the trustee — the same two-register architecture this series has mapped in Italy and Luxembourg, whose registers sit above and below Maltese structures in practice.
One more Maltese speciality bears on how you read an MBR record: redomiciliation. Under Malta's continuation regime, a foreign company can migrate into (or out of) Malta without liquidating — same legal person, new register. The MBR record of a continued company therefore starts mid-life: the "registration" date marks the arrival in Malta, not the company's birth, and its earlier history — owners, charges, disputes — sits in the registry it left, from the BVI to anywhere. Check the continuation documents for the origin jurisdiction and pull the prior record there.
08Where to look: free, paid, and sealed
| Source | What it gives you | Cost | Access notes |
|---|---|---|---|
| MBR online system (mbr.mt) | Company details, status, directors, legal shareholders; documents for download | Free search; modest per-document fees | Account with ID verification and 2FA required — a friction for quick and automated lookups |
| MBR BO register | Beneficial owners at >25% or by control; SMO fallback | €5 per extract where a request succeeds | Authorities and subject persons; others via the case-by-case legitimate-interest route — written AML rationale, one-off approval, extract only |
| MFSA Trusts UBO Register | Settlor, trustees, protector, beneficiaries of Maltese trusts | Not public | Authorities and subject persons on CDD grounds; route via the licensed trustee |
| Registrar of Legal Persons (MBR) | Foundations and associations — existence and administrators | Small fees | BO layer restricted as for companies |
| MFSA registers | Licensed entities: banks, funds, trustees, iGaming-adjacent financial firms | Free | Licence status and permissions — not ownership |
| Malta Stock Exchange / listed disclosures | Listed issuers: major holdings, governance | Free | The glass tier |
| The company's own filings | The BO confirmation and internal register | Via counterparty | The two records must match — ask for both |
09API access and bulk data: what exists, what doesn't
The machine-access position, plainly: the MBR has been modernising — digital filing and API-based initiatives are part of its recent programme — but there is no open public API and no bulk licensing of the register for compliance teams: portal access is individually identity-verified, the BO layer is excluded from any public product, and the legitimate-interest route yields one scanned extract per approved request. Nothing at the trusts register is licensable at all. Zavia.ai's delivery model answers exactly this shape: the same official-registry data, retrieved at source and structured, via API for real-time queries, as licensed bulk data feeds for entity resolution and KYB pipelines, through the online platform, and inside AI agents over MCP — sealed layers staying sealed, the open layer made machine-usable, and cross-border chain resolution on top.
| Dimension | MBR company register | MBR Register of Beneficial Owners | Zavia.ai |
|---|---|---|---|
| Operated by | Malta Business Registry, standalone agency since 2018 | The same agency, as a separate restricted register | Zavia.ai — sourced directly from official registries, not third-party aggregation |
| Who can use it | Anyone with an ID-verified, 2FA account | Authorities; subject persons for CDD; legitimate-interest applicants case by case at €5 | Any compliance, data or product team, anywhere |
| Entity existence & status | Yes | Not its purpose | Yes — the same official record, structured |
| Directors | Yes — filed and refreshed via annual returns | SMO recorded only as the fallback | Yes — structured and cross-linked across entities |
| Legal shareholders | Yes — on the record; fiduciary/nominee status not always apparent | Not its purpose | Yes — with fiduciary-pattern flags and chains resolved through corporate holders |
| Beneficial owners | No | Yes at >25% or by control — restricted; €5 extract on an approved request | Ownership chain mapped from official registry data through holding, trust and foreign layers to the natural person; the entity's filing benchmarked, not replaced |
| Threshold logic | None | Fixed: more than 25%; moving to "25% or more" under the AMLR | Configurable to your policy across every jurisdiction |
| Cross-border resolution | Maltese entities only | Maltese entities only | 100+ countries in one query — the holding and trust layers above Maltese companies included |
| Freshness | Annual returns; filings as submitted | 14-day change window; anniversary confirmations | Real-time updates from official registries, with change monitoring |
| Screening | None | None | Sanctions and PEP overlays on resolved individuals |
| Cost | Free search; per-document fees | €5 per extract, if approved; otherwise unavailable | Subscription — self-serve from $49/month; enterprise licensing for API and bulk |
| Delivery | ID-verified portal, one entity at a time | One request, one extract | API, bulk data feeds, online platform, MCP integration for AI agents |
10The entity landscape
| Vehicle | Form | Where ownership sits |
|---|---|---|
| Private limited company | Ltd | The workhorse — shareholders on the MBR record, often fiduciary-held; UBOs on the restricted register |
| Public company / listed | plc / MSE-listed | Listed issuers exempt from BO filing; major holdings disclosed under securities rules |
| Partnership | En nom collectif / en commandite | Partners registered with the MBR; in scope of the BO regime |
| Trust | MFSA-licensed trustee | Not a legal person; parties on the MFSA Trusts UBO Register — closed; route via the trustee |
| Foundation / association | Second Schedule, Civil Code | Registered with the Registrar of Legal Persons at the MBR; equivalent BO duties |
| Cell company | PCC / ICC | Malta's speciality in insurance and securitisation — ownership can sit at the core and per cell; verify both levels |
11A worked example
Take a Maltese iGaming holding structure: an operating Ltd with a Malta Gaming Authority licence, held by a Maltese holding Ltd, held in turn by a licensed fiduciary for a family trust with an MFSA-licensed trustee. The MBR record gives you both companies, their directors, and the fiduciary as registered shareholder of the holding company.
Run the regime. The fiduciary's name on the shareholder record tells you a client sits behind it — but not who. Both companies filed their beneficial owners within their deadlines and confirm them on each anniversary; the trust's parties sit on the MFSA register; all of it is closed to you. So: pull both MBR records and the document trail; read the fiduciary pattern; check the gaming licence — the Malta Gaming Authority publishes licensee details and itself vets the beneficial owners of licensees, a second state file on the same people; request the BO confirmations and the internal register through the counterparty; route the trust question to the licensed trustee; consider a legitimate-interest request to the MBR for the extract if your AML rationale supports one; and resolve any foreign layer in its own jurisdiction. Two closed registers and a licence vetting file exist on this structure — your job is to make the open layer agree with what they should contain.
12Common failure modes
| The mistake | Why it fails |
|---|---|
| Believing the BO register is public | General access was suspended after the November 2022 CJEU judgment; the routes are authority, subject-person and case-by-case legitimate interest |
| Ignoring the legitimate-interest route | Malta actually operates one — written AML rationale, €5, one extract; most EU states offer less |
| Reading the registered shareholder as the owner | Maltese practice runs on licensed fiduciaries and trustees holding for clients |
| Treating the anniversary confirmation as optional | It is due every year on the registration date; failure exposes officers personally |
| Missing the trusts register | Maltese trusts are recorded on the MFSA's separate UBO register — closed, but held by a licensed trustee who must know |
| Forgetting the sector regulators | The MGA and MFSA vet beneficial owners of licensees independently — a licence is itself evidence of a state-checked UBO file |
| Reading the registration date as the company's age | Redomiciled companies arrive mid-life — the origin registry holds the earlier history |
| Treating the grey-list exit as the end of enforcement | June 2022 removed the monitoring; the inspections, penalties and strike-offs continue |
13How to verify a Maltese UBO: workflow
- Establish the entities. MBR search for each company in the stack: status, registered office, directors, legal shareholders, documents.
- Read for fiduciaries. Licensed CSPs, trustees and nominee companies as shareholders mean a client behind the record — treat as unresolved.
- Check the licences. MGA and MFSA registers for regulated entities — licence status implies a vetted UBO file exists.
- Apply the Maltese test. More than 25% of shares, votes or interest; control by other means; SMO only where the cascade is exhausted.
- Request the filings. The BO confirmation, the internal register and the latest anniversary receipt through the counterparty — the two records must match.
- Consider the keyhole. Where your AML rationale supports it, a legitimate-interest request to the MBR for the €5 extract.
- Resolve the layers above and screen. Trusts via the licensed trustee; foreign parents in their own registers; sanctions, PEP and adverse-media checks with an auditable trail.
14Practical takeaways
| Scenario | What you can rely on | What you must supplement |
|---|---|---|
| Any Maltese company | MBR record: existence, directors, legal shareholders; an anniversary-confirmed BO filing exists | The beneficial layer — via the counterparty or the €5 keyhole |
| Fiduciary-held company | The fiduciary pattern on the record | The client behind it — BO filings and the chain above |
| Licensed operator (iGaming, financial) | MGA/MFSA licence status — a vetted UBO file exists | The file itself is not public; use the licence as corroboration, not disclosure |
| Trust in the chain | An MFSA-licensed trustee with full CDD duties | The trusts register is closed — route the request through the trustee |
Malta rewards the verifier who uses all three of its layers. The open company register is one of the more generous in the EU — shareholders and directors on the record — provided you clear the ID-verified portal and read fiduciary names for what they are. The restricted BO register has the rarest thing in post-Sovim Europe: a working keyhole, one evidenced request at a time. And the licensing regimes — MGA, MFSA — mean that for much of the economy a state-vetted UBO file already exists. Build the workflow on the MBR record, the fiduciary pattern, the counterparty's confirmations, the licence corroboration and the chain above — and read the grey-list year for what it proved: the register is enforced, the filings are fresh, and the data exists whether or not you can see it.
Malta & cross-border ownership data — however you build
Skip the request-by-request unwinding. Get Maltese corporate data — entities, officers, filed shareholders — and cross-border ownership resolution sourced directly from official registries, mapped through the fiduciary, trust and foreign layers to the natural person at the top.
15Frequently asked questions
Does Malta have a beneficial ownership register?
Yes — two. The Register of Beneficial Owners for companies and commercial partnerships is maintained by the Malta Business Registry under the Companies Act BO Regulations, in force since the start of 2018: companies must identify their beneficial owners, keep an internal BO register at the registered office, file the same information with the MBR, update changes within 14 days and confirm the information annually on each anniversary of registration. Separately, the MFSA maintains a Trusts UBO Register for trusts under the Trusts and Trustees Act. Neither register is open to the general public; access runs to authorities, subject persons, and case-by-case legitimate-interest applicants.
What is the beneficial ownership threshold in Malta?
More than 25%. A beneficial owner is any natural person who ultimately owns or controls the entity through direct or indirect ownership of more than 25% of the shares, voting rights or ownership interest — in practice described as 25% plus one share — or who exercises control by other means, such as the power to appoint or remove a majority of the board, at any percentage. Where no natural person can be identified after exhausting all possible means, the company records its senior managing official or officials. The EU's AML Regulation will move the formula to "25% or more" at transposition.
Is the Malta BO register public?
Not generally — but Malta operates something most EU states do not. General public access was suspended after the CJEU's judgment of 22 November 2022 in the Sovim and WM cases. Competent authorities and the FIAU have full access; subject persons access the register in the context of customer due diligence; and anyone else may apply under a case-by-case legitimate-interest route: a written request to the MBR setting out the AML/CFT rationale, assessed individually, with approved applicants receiving an extract for a fee of €5. Approvals are one-off and yield a scanned extract for the named company — not database access.
What are the filing deadlines for Maltese UBO information?
Two clocks. Any change in a company's beneficial ownership must be filed with the Malta Business Registry within 14 days — one of the tightest change windows in the EU. And since 16 June 2020, every company must submit an annual beneficial-ownership confirmation on each anniversary of its registration, restating or confirming the recorded information whether or not anything has changed. The company must also keep its internal BO register at the registered office aligned with the MBR filing at all times, and officers are personally responsible for the accuracy of both.
What are the penalties for UBO non-compliance in Malta?
Officer-level and substantial. Administrative penalties for beneficial-ownership failures were increased as part of Malta's grey-list response, and in the aggravated cases — where the Registrar considers that beneficial-ownership information in the register requires correction — each officer of the company is exposed to a penalty of up to €100,000. Beyond the fines, the MBR's compliance unit conducts on-site inspections, blocks non-compliant companies from making other filings, and pursues strike-offs. During the grey-list period the FIAU's administrative penalties across the obliged sector ran into the millions of euros annually.
Why was Malta on the FATF grey list?
Malta was placed under FATF increased monitoring on 25 June 2021 — the first and only EU member state ever grey-listed — over deficiencies including the accuracy of beneficial-ownership information held on Maltese companies, the sanctions applied to gatekeepers who failed on BO duties, and the use of financial intelligence in tax-related money-laundering cases. The action plan drove a compressed enforcement campaign across the MBR and the FIAU, and on 17 June 2022 the FATF removed Malta from the list, citing significant progress. The register machinery built during that year — confirmations, inspections, penalties — remains in force.
Can I see the shareholders of a Maltese company?
Yes — the legal shareholders. The Malta Business Registry's online system discloses each company's directors and registered shareholders, filed at incorporation and refreshed through annual returns, with documents available for download. Two caveats: the portal requires an account with identity verification and two-factor authentication, which slows quick and automated lookups; and the registered shareholder in Maltese practice is frequently a licensed fiduciary, trustee or corporate-service provider holding for clients, whose beneficial owners appear only on the restricted BO register. The shareholder record is a starting point, not an answer.
How are trusts and foundations treated in Malta?
Through their own registers and gatekeepers. Trusts administered by MFSA-licensed trustees are recorded on the MFSA's Trusts UBO Register — settlor, trustees, protector, beneficiaries and any controller — which is closed to the public; the licensed trustee is a subject person with full customer-due-diligence duties, and verification routes through them. Foundations and associations, established under the Second Schedule to the Civil Code, register with the Registrar of Legal Persons within the MBR and carry equivalent beneficial-ownership obligations. A Maltese trust above a company is therefore invisible in the company register but recorded on a state register you cannot read.
Do Malta's regulators check beneficial owners independently?
Yes — and it is useful corroboration. The Malta Gaming Authority vets the qualifying shareholders and beneficial owners of gaming licensees as part of licensing and ongoing supervision, and the MFSA does the equivalent for banks, investment firms, fund managers, trustees and other licence holders. A current licence is therefore evidence that a state authority has examined the very individuals you are trying to verify — a second file on the same people, held by the sector regulator alongside the MBR's register. The files themselves are not public: use the licence as corroboration of a vetted structure, not as disclosure.
How do you verify the ownership of a Maltese company?
Pull the MBR record for each company in the stack — status, directors, legal shareholders, documents — through the ID-verified portal. Read shareholder names for fiduciary patterns: licensed trustees and CSPs mean a client behind the record. Check MGA and MFSA registers where the business is licensed. Apply the Maltese test — more than 25%, control by other means, senior managing official only where the cascade is exhausted — and request the BO confirmation, internal register and anniversary receipt through the counterparty. Where your AML rationale supports it, petition the MBR under the legitimate-interest route for the €5 extract. Resolve trusts via the licensed trustee and foreign layers in their own registers, and screen every individual identified.
