Malta launches the ‘Malta Business Wallet’ app to streamline corporate due diligence

The Maltese government introduced the Malta Business Wallet on 14 May, a new platform designed to improve the ease of doing business in Malta by enabling business owners to users to manage and selectively share their personal and corporate data with competent authorities and subject persons through a secure digital repository.

Available as an application on the Apple Store and Play Store, the Malta Business Wallet will introduce the ‘once only’ principle in relation to due diligence. It is intended to lead to a more standardised system, reduce unnecessary delays and increase efficiency.

The legal and operational framework under which the system operates was established by the Companies Act (Central Data Repository) Regulations 2026, issued as Legal Notice 151 of 2026 on 15 May, which provide for:

• The creation of a secure digital central data repository managed by the Registrar of Companies that allows company officers and legal representatives to manage personal and corporate data in a single location.
• Assistance to subject persons and competent authorities in discharging their duties under anti-money laundering and counter-funding of terrorism laws.
• The use of advanced technological standards, such as Application Programme Interfaces (APIs) and biometric data, to verify the identity of users and ensure the authenticity of uploaded documents.
• The implementation of the principle of “selective disclosure”, ensuring that users retain total control over which specific relying parties can access their information and that the repository remains a tool for convenience rather than a mandatory burden for involved parties.
• Assurance that verified electronic data within the repository is deemed a valid copy for all legal purposes and cannot be denied legal effect due to its digital form.
• The elimination of bottlenecks and decreased operational costs by providing a seamless data-sharing mechanism that remains strictly voluntary for all parties.
• Positioning the Malta Business Registry as a supervisory authority that ensures all data processing aligns with the Data Protection Act (Chapter 586 of the Laws of Malta) and the EU’s General Data Protection Regulation (GDPR) (EU Regulation 2016/679).

The Regulations define the Registrar’s duties as being to establish, manage, operate and maintain the repository and establish a five-year data retention period, which is extendable to a maximum period of 10 years if the data is required for investigating serious crimes, such as money laundering or terrorism financing.

Authorised users of the repository, include company officers, partners, and representatives of bodies corporate. Relying parties who may be authorised to access and use the repository include competent authorities and subject persons conducting due diligence. Relying parties making use of the repository are required to inform the Registrar of any unauthorised or unjustified access to the repository promptly.

The Registrar is empowered to terminate or suspend access to the repository and to any data and information it contains to any relying party that fails to implement the necessary security safeguards and to only reinstate it once the necessary measures have been implemented to prevent the same from occurring again.

The specific data and information that users can upload, submit, store, retrieve, rectify, erase and submit on the repository, include identity documents, evidence of registered addresses, and documentation of subject person engagement.

The Regulations clarify that using the repository does not exempt users or subject persons from their existing legal obligations to provide or collect information for customer due diligence purposes in accordance with applicable laws and regulations.

Competent authorities are required to designate specific officers or employees to access the repository, and to implement safeguards for data used in investigating financial crimes.

The Registrar is required to verify all data and user identities using secure electronic systems, ensuring third-party providers meet strict data protection standards. Biometric data is permitted only when strictly necessary to prevent identity fraud, and the Registrar may access information from other public authorities to ensure the repository remains accurate and functional.

Importantly, users have the right to choose which relying parties see their data, information and reports stored in the repository and the right to vary or revoke such access to any one or more relying parties following the procedures established by the Registrar.

The Registrar is authorised to charge fees for access to and use of the repository, including fees relating to registration, maintenance, access and verification services. The Regulations establish criminal penalties for providing false or misleading information through the repository, or for making fraudulent use of the repository, including a fine of up to €50,000 and, or up to three years imprisonment.

“The Malta Business Wallet will represent an important transformation for our country’s business ecosystem,” said Dr Geraldine Spiteri Luca, Chief Executive Officer and Registrar of the Malta Business Registry. “As the Malta Business Registry, we remain committed to delivering efficient and effective services.”