Boardroom Brief | Dr Christopher Aquilina on MiCA, AI Regulation and Malta's FinTech Future

As Head of FinTech at the Malta Financial Services Authority (MFSA), Dr Christopher Aquilina oversees the supervision and authorisation of crypto-asset service providers and issuers, drawing on a background that spans ICT, cybersecurity and law.

In this edition of The Boardroom Brief, Christopher discusses how firms applying for authorisation in Malta are evolving now that MiCA is fully in force, how the MFSA is approaching supervision under the EU AI Act, and his vision for Malta's digital-finance ecosystem in the years ahead.

1. How does your background in ICT risk and cybersecurity shape the way you approach your new role as Head of FinTech?

My approach is shaped by the combination of technology, risk management and law. I have worked in technology for around 20 years, which has given me practical insight into how systems are designed, how technological change is implemented and where operational vulnerabilities can arise. I am also a qualified lawyer in Malta, with a keen focus on ICT law. This allows me to consider innovation not only from a technical perspective, but also through the lenses of governance, accountability and legal compliance.

In FinTech, technology risk and regulatory risk are increasingly interconnected. A weakness in cybersecurity, outsourcing arrangements, data governance or system resilience can quickly become a consumer-protection, compliance and reputational issue. My background helps me ask detailed questions about a firm’s technology while keeping sight of its business model and regulatory obligations. I therefore approach the role with a balanced mindset. Innovation will always be encouraged, but it must be supported by sound governance, effective controls and operational resilience. The objective is not to slow technological progress, but to help ensure that innovation is sustainable, trustworthy and capable of operating safely at scale.

2. With MiCA now fully in force, what is the biggest shift you are seeing in the types of firms applying to set up in Malta?

One of the most significant shifts is the increasing maturity and ambition of applicants. We are seeing businesses that are highly agile, internationally focused and particularly conscious of time to market. Many are not simply seeking authorisation for a traditional service. They are developing innovative product offerings that combine different technologies, services and distribution models. In some cases, these products test the boundaries established by the law. This makes early and constructive regulatory engagement especially important. Firms need to understand whether their proposed activities fall within the peripheries of the law, another financial-services framework, or potentially more than one regulatory regime.

MiCA has created greater regulatory clarity across the European Union, but authorisation is not simply a market-entry exercise. Firms must demonstrate that they have appropriate governance, substance, risk-management capabilities and safeguards for clients. The MFSA 

applies a risk-based and data-driven approach towards supervising crypto-asset operators, including CASPs and relevant issuers. Malta’s early experience with the Virtual Financial Assets framework gives us a strong foundation. The jurisdiction can offer regulatory experience while remaining responsive to innovative business models and the commercial importance of an efficient authorisation process.

3. How is the MFSA approaching supervision under the EU AI Act for firms already regulated under MiCA?

The key principle is that compliance with MiCA does not remove a firm’s responsibilities under the AI Act or other applicable legislation. The frameworks are complementary. MiCA addresses the provision of crypto-asset services, while the AI Act focuses on the risks created by the development and use of AI systems. From a supervisory perspective, this calls for a coordinated, proportionate and risk-based approach. We need to understand where and how AI is being used, whether in customer onboarding, fraud monitoring, transaction analysis, trading, risk modelling or customer communications. The level of scrutiny should reflect the role of the AI system, its potential impact and the firm’s responsibilities as a provider or deployer.

Firms should be able to demonstrate clear governance, reliable data, appropriate documentation, human oversight and effective controls over third-party systems. They must also consider cybersecurity, data protection, explainability, outsourcing and operational resilience. The AI Act applies alongside existing financial legislation, rather than replacing sector-specific obligations, so cooperation between relevant authorities will be essential to avoid gaps or unnecessary duplication. Our aim should be to provide regulatory clarity while ensuring that AI is used responsibly and does not undermine consumer protection, market integrity or financial stability.

4. What part of your new role are you enjoying the most so far?

What I enjoy most is being in a position to guide the sector as it seeks to leverage technology to their advantage while remaining compliant. The most rewarding discussions are those in which regulatory engagement helps a firm refine its model, identify risks early and build stronger foundations. Regulation and innovation should not be viewed as opposing forces. When designed into a product from the outset, compliance can improve resilience, strengthen consumer confidence and support long-term growth. I also value the opportunity to work with colleagues from different disciplines. FinTech requires collaboration between legal, supervisory, cybersecurity, technology and policy specialists. Bringing those perspectives together is both challenging and professionally rewarding.

5. What is your vision for Malta’s digital-finance ecosystem over the next few years?

My vision is for Malta to consolidate its position as a European hub of financial-services excellence, recognised for regulatory quality, technological expertise and responsible 

innovation. Success should not be measured only by the number of firms established here. It should also be assessed through their quality, substance, sustainability and contribution to the wider economy. Malta should attract businesses that invest in people, build meaningful operations and view effective regulation as a competitive advantage. By combining regulatory experience, legal certainty, skilled professionals and constructive engagement, Malta can build a digital-finance ecosystem that is innovative, resilient and trusted across Europe.