AMLR LEI Rules in Malta: Customer Checks From 2027

The AMLR LEI rule will require banks and other obliged entities in Malta to obtain a legal entity customer’s Legal Entity Identifier where available from 10 July 2027; it will not require a company to obtain one. Malta’s existing AML framework remains relevant, while AMLA’s recently submitted customer due diligence standards remain a draft rather than binding rules.

What this means in Malta

Malta’s main AML rules are the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR, S.L. 373.01). The Financial Intelligence Analysis Unit (FIAU) supervises subject persons’ AML/CFT compliance. These are the national rules and supervisor to keep in view when assessing a Malta-specific customer due diligence question.

From 10 July 2027, Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 (AMLR) will apply directly in Malta. Its Article 22 identification list for legal entities includes the tax identification number and the LEI where available. Because the AMLR is directly applicable, its rules do not require national transposition.

Consider a Ltd opening a business account with a bank in Malta. If the company already has an LEI, it can have that identifier ready when the bank requests customer information under the applicable checks. The same practical point arises for a Ltd reviewed in its bank’s periodic KYC update: identify the existing code rather than assume the AMLR requires a new registration. If there is no LEI, Article 22 does not tell the customer to obtain one.

Beneficial owners of Maltese companies are registered with the Malta Business Registry (MBR). That register and an LEI concern different information in a customer review. Whether a particular request calls for further information depends on the circumstances; a company should check a case-specific question with its regulator or adviser.

Key points on AMLR LEI checks

• The AMLR was published in the Official Journal on 19 June 2024. It is binding in its entirety, but most obliged entities will apply it from 10 July 2027.
• Article 22 says to obtain a legal entity customer’s LEI where available; it does not instruct a customer without an LEI to acquire one.
• AMLA’s report dated 30 September 2026 retains the LEI in draft customer due diligence standards. AMLA announced their submission to the European Commission on 1 October 2026, but they are not yet binding.
• A company with an existing LEI can prepare for customer checks by knowing the code and checking whether its recorded details are current.

Which customers and obliged entities are covered?

Under AMLR Article 2(1), point (27), a Legal Entity Identifier is a unique alphanumeric reference code based on ISO 17442 and assigned to a legal entity. Article 22(1), point (b), specifies information an obliged entity must obtain to identify a legal entity customer: its legal form and name, registered or official office address, any different principal place of business, country of creation and names of legal representatives. It also lists the registration number, tax identification number and LEI where available, as well as the names and nominee status of nominee shareholders and directors.

The phrase where available sets the limit of the LEI request. An obliged entity must obtain an available identifier as part of these checks, but this provision does not require a legal entity that has no LEI to apply for one. It is worth separating that legal wording from a bank’s request for information about an identifier the customer already holds.

Article 22(1), point (c), also addresses trustees of express trusts and equivalent positions in similar arrangements; its information list includes the tax identification number and LEI where available. Point (d) covers other organisations with legal capacity under national law and includes an LEI where applicable. The right category for a particular customer depends on its circumstances.

Under Article 3, obliged entities include credit institutions, financial institutions, auditors, external accountants, tax advisers, trust or company service providers and estate agents. Notaries, lawyers and other independent legal professionals are included for certain transactions. LEI questions can therefore arise outside the opening of a bank account.

What remains in AMLA’s draft standards?

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) final report on draft regulatory technical standards under AMLR Article 28(1) is dated 30 September 2026. AMLA’s press release of 1 October 2026 says the final draft was submitted to the European Commission. Submission does not make the standards binding: they remain subject to review and possible amendment.

Draft Article 18 sets out minimum information for low-risk situations. For a legal entity, the list includes its legal form, legal name, a different trade name where applicable, registered or official office address and, where available, a registration number or tax identification number, or the LEI. Draft Annex I also includes the LEI where available in its mapping of data points to attributes for electronic identification means and qualified trust services.

Draft Article 28 deals with business relationships already in place before the standards enter into force. It proposes bringing customer documents, data and information into line on a risk-sensitive basis within the periods in AMLR Article 26(2). That AMLR provision limits the interval between customer-information updates to one year for higher-risk customers and five years for all other customers.

AMLA proposes that the standards apply six months after they enter into force, once adopted and published in the Official Journal. This is a proposed interval, not a current application date for binding standards.

Do payment-message LEI rules change the answer?

A separate EU rule already addresses identifiers accompanying transfers of funds. Regulation (EU) 2023/1113, Article 4(1)(d) and 4(2)(c), applies from 30 December 2024. It concerns transfer information, rather than the AMLR list used to identify customers.

Under the stated conditions, the payer’s payment service provider must ensure a transfer carries the current LEI of the payer and payee, or an available equivalent official identifier if there is no LEI. This depends on the relevant field existing in the payment message format and the payer providing the identifier to its payment service provider. It does not alter Article 22’s where available wording for customer checks.

What should a company prepare?

1. Establish whether it already has an LEI. Keep the code accessible for requests from a bank or another obliged entity.
2. Review an existing identifier’s details. If they need updating, consider renewing an LEI so the information available during a customer check reflects the company’s current details.
3. Distinguish an available code from an obligation to obtain one. The AMLR does not require a customer without an LEI to acquire one. A company that wants a standard, verifiable identifier for these checks can consider applying for an LEI.
4. Resolve questions specific to the entity. Check with your regulator or adviser if its status, a trust arrangement or a transaction affects which information is requested.

Timeline: applicable rules and future dates

Date	Event	Status as of 17 October 2026
30 December 2024	Regulation (EU) 2023/1113 begins to apply to information accompanying transfers of funds.	In force
30 September 2026	AMLA’s final report on the draft customer due diligence standards is dated.	Final draft, not binding
1 October 2026	AMLA announces submission of the final draft to the European Commission.	Subject to review and possible amendment
10 July 2027	The AMLR applies, including Article 22’s LEI wording.	Future application date
10 July 2029	The AMLR applies to football agents and professional football clubs.	Future application date

LEIs also feature in two related EU rules: a payer’s bank can offer Verification of Payee checks using an LEI as an alternative to checking the payee’s name, while under DORA banks and insurers identify ICT suppliers in their register of information using a valid LEI or EUID, as explained in our guide to DORA LEI requirements for ICT suppliers.

For subsequent developments, see the LEI regulation updates. For now, check whether the entity already has an LEI and keep any existing code ready for customer-identification requests.