Who Needs an LEI in Malta? A Company Checklist

Who needs an LEI in Malta? A company generally needs one when it trades reportable financial instruments through a bank or broker, is identified in derivatives or securities-financing reports, or must provide one for a financial client’s DORA records. Other rules use an LEI only where one is available; there is no blanket requirement for every Maltese company to obtain one.

What this means in Malta

A Maltese limited company planning to invest surplus cash in bonds through its bank should check whether it already has an LEI before asking the bank to trade. The LEI identifies the company in the investment firm’s transaction report. A trading company hedging currency risk with FX forwards should likewise establish how its LEI will be used in derivatives reporting.

The local reference point for company details is the Malta Business Registry (MBR). Maltese companies are registered there, and the LEI issuer validates reference data against the MBR using the company registration number. An LEI is not a substitute for that registration number: it is a separate identifier linked to reference data.

For digital operational resilience, a software company may be asked for an LEI by a bank client preparing its register of information. The MFSA – RoI Reporting Timelines for the Year 2026 and Onwards state that, from 2026 onwards, Authorised Persons within DORA’s scope submit that register through the MFSA LH Portal by 21 March of each Reporting Year, or the next working day. Its reference date is 31 December of the previous year; for Reporting Year 2026, that is 31 December 2025. The MFSA reports to the ESAs by the end of March. These are reporting arrangements for the Authorised Persons, not a separate filing deadline for every software supplier.

LEIFast is a Registration Agent of WM Datenservice, a GLEIF-accredited issuer; LEIFast does not issue LEIs itself. Its Malta pricing, checked on 5 November 2026, lists €49 for 1 year, €135 for 3 years and €195 for 5 years. The GLEIF fee is included; tax is added where required.

Key points: when is an LEI mandatory?

• For a reportable investment transaction on behalf of an eligible company, the investment firm must obtain that client’s LEI before providing the service.
• Derivatives and securities-financing reporting can require legal entities to be identified by LEI.
• Under DORA’s register rules, a financial entity identifies a legal-person ICT provider by an active LEI or an EUID, using both where available. For a legal person established outside the Union, only an LEI may be used.
• A rule saying “where available” does not, by itself, require a company to obtain an LEI.

According to GLEIF – The Legal Entity Identifier (LEI), an LEI is a unique 20-character alphanumeric code based on ISO 17442. Each code represents one entity, links to reference data from authoritative local sources and is freely accessible.

LEI requirement checklist by activity

Situation	Rule	Who needs the identifier?
A company buys or sells reportable shares, bonds or ETFs through a bank or broker.	Regulation (EU) No 600/2014 (MiFIR), Article 26(6), requires investment firms to identify legal-person clients by LEI in transaction reports. Delegated Regulation (EU) 2017/590 (RTS 22), Article 13(2), requires the firm to obtain an eligible client’s LEI before the reportable service. Under Article 13(3), it also checks the code against ISO 17442, the Global LEI database and the client.	The legal-person client gives its LEI to the investment firm before the reportable trade.
A company enters into an FX forward or interest rate swap.	Regulation (EU) No 648/2012 (EMIR), Article 9(1), requires financial and non-financial counterparties, and CCPs, to ensure derivatives are reported by the following working day. Reporting may be delegated. Implementing Regulation (EU) 2022/1860 (EMIR reporting), Article 3(1), requires an LEI to identify legal-entity counterparties and other specified entities in the report.	The reporting process uses the legal-entity counterparty’s LEI. Article 3(2) also requires counterparty 1 and the entity responsible for reporting to ensure their LEI reference data is renewed under the accredited LOU’s terms when reporting.
A counterparty enters into a securities-financing transaction, such as a repo or securities loan.	Regulation (EU) 2015/2365 (SFTR), Article 4(1), requires reporting by the next working day; Article 4(10) includes global LEIs in the reporting format.	The counterparty’s reporting arrangements must account for the LEI.
An ICT provider serves a financial entity subject to DORA.	Implementing Regulation (EU) 2024/2956 (DORA register of information), Article 3(5), provides for identification by a valid, active LEI or EUID, and both where available. Only an LEI may be used for a legal person established outside the Union. Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025.	The financial-entity client records the provider’s identifier. An EU-established provider should confirm which available identifier its client needs.

For a Maltese company buying bonds through its bank, the MiFIR and RTS 22 position is the practical “no LEI, no trade” case: the firm cannot provide the reportable service before obtaining the eligible client’s LEI. A company supplying software to a bank faces a different question: which identifier the bank can record under DORA. See the related article on DORA and LEIs for ICT suppliers in Malta.

When an LEI is used only where available

Not every reference to an LEI creates a duty to obtain one. Under Regulation (EU) 2023/1113 (transfers of funds and crypto-assets), Article 4, a transfer carries the payer’s and payee’s current LEI where it exists, or an available equivalent official identifier in its absence. That provision does not oblige a company to obtain an LEI.

For verification of payee, Regulation (EU) 2024/886 (instant payments), Article 5c(1)(b), allows the payer’s bank to offer a check of a legal-person payee using the IBAN together with an identifier such as an LEI, EUID or fiscal number. This is optional, not an LEI-holding duty. The distinction is explained further in the article on verification of payee and LEIs in Malta.

Regulation (EU) 2024/1624 (AMLR) has been adopted but will apply from 10 July 2027. Its Article 22(1) says obliged entities collect a legal-entity customer’s LEI “where available”. It does not require that customer to obtain one.

Who usually does not need one?

A Maltese company that does not undertake the activities above is not required to obtain an LEI merely because it is registered with the MBR. A private limited company without securities trading does not need one automatically. Its position may change if it enters into a derivative contract or a financial-entity client asks for an identifier for DORA records. If the requirement is unclear, check the transaction and the counterparty’s request with the relevant regulator or an adviser.

How to check and obtain an LEI

1. Search before applying. Use the free GLEIF LEI Search to see whether the entity already has a record and whether its status is ISSUED or LAPSED.
2. Match the entity details. For a Maltese company, check its name and company registration number against the MBR details used to validate the LEI reference data.
3. Identify the activity and recipient. Ask the bank, broker or financial-entity client whether it needs the LEI for transaction reporting, derivatives reporting or its DORA register.
4. Apply if needed. GLEIF says a legal entity may use any issuer accredited for its jurisdiction, not only one based in its own country. Its guide to finding LEI issuing organisations explains that choice. To register a new code through LEIFast, use the Malta LEI order form.

If a record already exists, establish its status and the applicable renewal requirements before requesting a new code. If you need to move an existing LEI to LEIFast, see the Malta LEI transfer page. If a bank or client has asked for an LEI, confirm which legal entity it needs identified, then check GLEIF LEI Search before submitting an order.