The European Union has formally adopted sweeping new foreign investment rules requiring Malta and all 27 member states to establish mandatory screening mechanisms for acquisitions in sensitive sectors, fundamentally reshaping how non-EU capital flows into the bloc's most strategic industries. The regulation, approved by the European Parliament on May 19, takes effect in late 2027 or early 2028, and will force Maltese regulators to scrutinize deals involving artificial intelligence, semiconductors, critical raw materials, and dual-use technologies—even when routed through EU-based shell companies.
Why This Matters:
• Mandatory compliance: Malta must implement a national screening mechanism by 2028, covering at least 10 defined critical sectors.
• Indirect ownership captured: Foreign investors can no longer circumvent review by using Malta-registered subsidiaries if ultimately controlled by non-EU entities.
• Greenfield projects included: New facilities built from scratch—previously exempt—now face the same scrutiny as acquisitions.
• Retroactive review power: Authorities can claw back unnotified transactions for up to 15 months after completion.
A Mandatory Framework Replaces Voluntary Patchwork
Until now, Malta and most EU states operated screening regimes on a voluntary or sector-specific basis. The revised Foreign Direct Investment Screening Regulation eliminates that discretion. All member states must establish two-phase review processes with a 45-calendar-day baseline for initial assessment, harmonized timelines, and strict transparency requirements. Malta is moving from no formal FDI screening mechanism to a comprehensive mandatory system, aligning with emerging EU standards.
The shift follows a provisional political agreement reached in December 2025 between the Council of the European Union and European Parliament representatives. While the regulation awaits final Council adoption, implementation is already underway. Malta's Commerce Ministry will need to designate a competent authority, establish appeal procedures, and ensure confidentiality protections for investors—all within the next 18 months.
Ten Critical Sectors Now Under the Microscope
The regulation defines a minimum common list of industries subject to mandatory screening across the EU. These sectors were chosen for their dual-use potential, national security significance, or role in economic resilience:
• Dual-use items and military equipment
• Hyper-critical technologies: AI models (especially general-purpose systems with defense or space applications), quantum computing and sensing, and the full semiconductor supply chain
• Critical raw materials: Bauxite, cobalt, copper, battery-grade lithium, nickel, and others listed in the Critical Raw Materials Act
• Critical infrastructure: Energy grids, transport networks, digital communication systems, and electoral infrastructure
• Financial entities: Certain banking and payment service providers
• Sensitive data infrastructure
• Food security and public health entities
• Media freedom assets
• Intellectual property rights where foreign control could undermine strategic autonomy
• Battery value chains, electric vehicles, and photovoltaics under the proposed Industrial Accelerator Act
Member states retain the right to impose stricter national rules or expand the list further. Malta, with its substantial digital finance and gaming sectors, may choose to add industries like blockchain infrastructure, fintech platforms, or gaming technology to its national framework.
Closing the Loophole on Intra-EU Deals
One of the regulation's most consequential provisions targets indirect foreign control. Previously, a Chinese or Russian investor could acquire a Malta-based holding company and use it to buy assets in Germany or France without triggering EU-level scrutiny. The new rules mandate screening whenever the ultimate beneficial owner is a non-EU entity, even if the immediate investor is Malta-registered.
This provision has immediate implications for Malta's corporate services industry, which manages thousands of EU subsidiaries for international clients. Law firms and fiduciaries will need to conduct enhanced due diligence on beneficial ownership structures, and transactions involving non-EU ultimate owners will face review periods of several months while regulators assess national security risks.
Geopolitical Context: How Capital Flows Are Shifting
The regulation does not name specific countries, but its drafting was influenced by concerns over Chinese investments in semiconductors and electric vehicles, Russian attempts to acquire critical infrastructure, and the potential for foreign governments to leverage acquisitions for strategic advantage.
Chinese greenfield investments in critical technology sectors have expanded across the EU since 2016 as acquisitions faced greater scrutiny. The new rules explicitly include greenfield projects in the definition of foreign investment, removing a major loophole. For Malta, this means foreign investment in digital infrastructure, data centers, or strategic technology assets will now require pre-notification and review.
For Russian and Belarusian investors, the European Commission has issued separate guidance urging member states to systematically block acquisitions in critical assets on security and public order grounds. Close cooperation between Malta's sanctions enforcement unit and FDI authorities is now mandatory, with anti-money laundering checks embedded in the review process.
Middle Eastern sovereign wealth funds, which have historically invested in Malta-based logistics, shipping services, and financial infrastructure, will face heightened scrutiny if their portfolios touch energy networks, ports, or digital infrastructure. While the regulation does not single out Gulf capital, the mandatory screening thresholds apply uniformly to all non-EU investors.
Impact on Investors and Compliance Costs
For foreign investors, the regulation introduces three immediate costs: time, transparency, and legal risk. Transactions that previously closed in 60-90 days may now require four to six months for review and clearance if the Malta screening authority refers the case to the European Commission for inter-member-state consultation. Investors must disclose beneficial ownership structures, funding sources, and strategic rationales in granular detail.
The 15-month retroactive review power creates legal uncertainty. If an investor closes a deal without notifying Malta's competent authority, regulators can unwind the transaction or impose fines up to 15 months later. This will likely drive more voluntary filings, even for deals below mandatory thresholds, as investors seek legal certainty.
Penalties for non-compliance vary by member state, but typically include fines up to 10% of global turnover, forced divestment, and criminal liability for officers in extreme cases. Malta has not yet published its penalty framework, but it is expected to align with EU norms.
How Malta Compares to Global Screening Regimes
The EU's new framework brings it closer to the United States' CFIUS (Committee on Foreign Investment in the United States), which has operated mandatory filing requirements for critical technology investments since 2018. CFIUS can retroactively review unnotified transactions years after closure, a power the EU now partially replicates with its 15-month window.
The United Kingdom's National Security and Investment Act (2021) goes further, allowing the UK government to call in transactions up to five years after completion, even if voluntarily notified. It applies to UK investors, not just foreign ones—a feature the EU regulation does not include.
Germany, which already had one of the EU's strictest regimes, is consolidating its Foreign Trade and Payments Act (AWG) and AWV Ordinance into a single FDI Screening Act by mid-2026. German rules set a 10% voting rights threshold for mandatory notification in defense and IT security—lower than the EU's typical 25% control standard.
Australia introduced a national security test in 2021 and requires approval for any direct interest (10% or more) by foreign government investors, regardless of sector. Canada is rolling out pre-closing filing requirements for sensitive sectors in 2026, similar to the EU's mandatory notification.
The common thread: developed economies are converging on a model where national security trumps free capital flows, and screening mechanisms are becoming faster, broader, and more intrusive.
What This Means for Malta-Based Businesses and Investors
Malta's economy, which derives significant value from foreign-owned enterprises in gaming, financial services, and digital sectors, will face both challenges and opportunities under the new regime.
Maltese firms with foreign (non-EU) capital will face scrutiny when acquiring assets elsewhere in the EU—even if they are locally incorporated. Malta's financial services sector, which structures cross-border deals and manages international portfolios, must adapt compliance protocols to account for ultimate beneficial ownership checks and verify that transactions don't trigger EU-level review requirements.
For inbound investors, the timeline for closing transactions in Malta lengthens significantly. Deals involving AI infrastructure, data centers, fintech platforms, gaming technology infrastructure, or port-related assets will require pre-notification to Malta's screening authority once established. Investors should budget four to six months for the standard review process, with potential for further delay if the European Commission requests additional review or member states raise concerns.
Malta's financial services and gaming sectors, which attract international venture capital and private equity, may face extended timelines for investment completion. The regulation does not set a clear ownership threshold for non-controlling minority investments, leaving it to national discretion. Malta could adopt a 10% or 15% threshold similar to Germany, or a higher 25% standard, which will determine how much procedural friction foreign investors face when acquiring stakes in Malta-based technology and digital companies.
What Comes Next
The Council of the European Union is expected to formally adopt the regulation by June 2026, triggering an 18-month implementation period. Malta's government must draft enabling legislation, designate a screening authority (likely within the Malta Commerce Ministry or Financial Intelligence Analysis Unit), and establish procedural rules for notification, appeal, and confidentiality.
Investors operating in Malta should begin mapping their portfolios against the 10 critical sectors, conducting beneficial ownership audits, and engaging local counsel to navigate the new regime. The regulation is not retroactive, but deals signed before 2028 that close afterward may still fall within scope, creating a narrow window of uncertainty.
For Malta, the regulation represents both a compliance burden and an opportunity. Stricter screening may deter some foreign capital that previously faced minimal review, but it also signals to Brussels that the island is serious about economic security and financial integrity—an increasingly important credential as the EU tightens controls over financial centers. How Malta calibrates its threshold requirements and sectoral scope in the coming months will significantly influence the island's competitiveness as an FDI destination versus its standing as a financially responsible EU member state.
