Important: This guide provides general business, tax and regulatory information. The appropriate structure and outcome depend on the complete facts and every connected jurisdiction.
The direct answer
A corporate-service provider needs to understand and verify the customer, beneficial owners, controllers, proposed activity, countries, expected transactions and source of funds before accepting relevant work.
The depth varies by risk. Complex ownership, politically exposed persons, sanctions exposure, regulated sectors, unusual funding or higher-risk countries can require enhanced evidence and senior approval or make acceptance impossible.
Explain the economic purpose
A clear narrative should connect Malta to customers, people, investment, market access or group operations. It should explain funding, revenue and payments in plain language.
Generic descriptions such as “international consultancy” do not help a reviewer understand the business or its risks.
Keep the file current
Due diligence continues after formation. Notify the provider about ownership, directors, activity, countries, banking or transaction changes.
Periodic reviews should reconcile company records, public information and actual account activity.
Core due-diligence areas
| Area | Typical evidence | Risk addressed |
|---|---|---|
| Identity and residence | Verified identity and address | Who the relevant people are |
| Ownership and control | Registers and complete group chart | Who ultimately benefits or directs |
| Funds and wealth | Bank, transaction or commercial evidence | How the company is financed |
| Business activity | Plan, contracts and forecast | What the company will do and where |
Practical scenario
A group with three corporate ownership layers
The applicant supplies registry and constitutional records for each entity and a chart tracing percentages to the individual beneficial owners.
It also explains the purpose of each layer, authority for the investment and source of the Malta company’s funding. Missing links are resolved before an incorporation date is promised.
Evidence and implementation checklist
- Identity and address records
- Full legal ownership chain
- Beneficial owners and controllers
- Source of funds and wealth where requested
- Business model and countries
- Expected transaction profile
- Sanctions and PEP information
- Ongoing-change notification process
Common questions
Why does a provider request personal information?
Regulated providers must identify customers and beneficial owners and assess the proposed relationship and activity.
Can CLA accept every applicant?
No. Acceptance remains subject to due diligence, risk, capacity, regulation and agreed scope.
Is KYC completed once?
No. Information must remain current and relationships are reviewed over time.
Exclusive featured partner
Ask CLA Malta to assess the complete facts
CLA Malta can assess formation, governance, accounting, tax and ongoing compliance requirements, subject to client acceptance, due diligence and an agreed scope.
Official and primary sources
Editorial status: Original VisitMalta.co.uk guidance checked against the sources above on 5 September 2026.