CSP Regulation in Malta: New Categories and Notification Duties under Act X of 2025

The regulatory landscape for company service providers (“CSPs”) in Malta has been reshaped by Act X of 2025, which came into force last May. The amendments have broadened the scope of the Company Service Providers Act, bringing within its remit individuals who were previously outside its reach. These changes introduce three distinct CSP categories and impose a new notification requirement for certain roles, reflecting the Malta Financial Services Authority’s (“MFSA”) aim to strengthen oversight and transparency.

The updated framework introduces three clear categories under which individuals acting as directors or company secretaries may fall:

• Authorised CSPs: Those offering CSP services by way of business in a substantial manner and licensed under the MFSA.
• Limited CSPs: Individuals providing directorship and/or company secretarial services by way of business, but limited to no more than ten involvements at a time.
• Restricted CSPs: Individuals not acting by way of business yet holding up to five involvements across no more than two groups of companies.

The amendments also introduce a key compliance obligation. Persons qualifying as Restricted CSPs must notify the MFSA of their involvements via the Authority’s online portal. Those already holding such roles when the Act entered into force were required to notify the MFSA via its online designated portal by 16^th July 2025. Any subsequent appointments must be reported to the MFSA via the online portal within fourteen days of appointment. Some exemptions to the rule, amongst others, apply where the role is held due to an employment agreement, direct/indirect beneficial interest in the company, family relations, or where services are rendered to entities listed on regulated markets or licensed by overseas regulators.

Given the expanded regulatory scope, individuals serving as directors or company secretaries should promptly determine their correct classification and ensure full compliance. Where uncertainty arises, Article 3(4) empowers the MFSA to determine the appropriate category.