Regulated is a word that carries more weight in ordinary use than it does in law. Applied to an electronic money institution it means the entity is authorised and supervised, and that specified duties bind how it handles money received from customers. It does not mean that a balance is a bank deposit or that any particular sum is guaranteed back.
Papaya Ltd safeguarding is one such duty, with a defined mechanism and defined boundaries, and both halves of that sentence matter to anyone holding a euro balance.
A duty of conduct, not a promise of outcome
Financial regulation works mainly by imposing obligations on how a firm behaves: how it is capitalised, who runs it, what it reports, and how it holds money belonging to customers. Compliance with those obligations is supervised, and breaches can be penalised.
What this structure does not do is guarantee a result. An obligation to hold customer funds in a particular way reduces certain risks and leaves others untouched, and that difference is the part worth understanding before comparing a payment account with anything else.
What the Maltese safeguarding framework requires
Malta’s rules sit in the Safeguarding of Funds Regulations, subsidiary legislation under the Financial Institutions Act, which separate customer money from the institution’s own money as a matter of law rather than bookkeeping.
Funds received from payment service users or electronic money holders are deemed to constitute a distinct patrimony, separate from that belonging to the financial institution.
They may not be commingled with the funds of any person other than the users on whose behalf they are held, and where a common account is used each user’s share must be identifiable at all times. The institution must either place the funds in a separate account with a credit institution or a central bank, or invest them in secure, liquid, low-risk assets, or cover them with an insurance policy or comparable guarantee from a provider outside its own group.
The regulations then address failure directly. The institution’s creditors have no claim against safeguarded funds, which are not affected by insolvency or bankruptcy law, and an administrator or receiver must on demand transfer control, possession and title to another financial institution or to a person instructed by the user or the competent authority.
Company disclosure and independent verification
A provider’s description of its arrangements is a useful statement of intent and a poor substitute for evidence. Blackcat’s client-fund protection disclosures state that client funds are held in segregated accounts in accordance with applicable safeguarding legislation, and that funds held in e-money accounts are not covered by the Depositor Compensation Scheme.
Its general terms, updated 13 October 2026, reference the safeguarding and redemption provisions of the Electronic Money Directive.
Those are company disclosures: they record what the firm says it does, and they align with what the regulations require. They are not an audit opinion, a supervisory finding or a certificate, and no company page can be. A reader can confirm that the legal duty exists and that the firm states it complies; confirming compliance itself is beyond what public sources support.
Why e-money sits outside the Depositor Compensation Scheme
The MFSA describes the Depositor Compensation Scheme as a rescue fund for depositors of failed banks licensed under the Banking Act, paying up to €100,000 per depositor per bank, with temporary high balances linked to defined life events potentially eligible for more.
Two features of that description exclude electronic money. The scheme attaches to deposits, and electronic money is a different legal product, redeemable at par.
And it attaches to banks licensed under the Banking Act, whereas an electronic money institution is licensed under the Financial Institutions Act. Neither limb is an oversight; the two products were built with different protection mechanisms.
The practical reading is a trade of one kind of protection for another: deposit cover pays a capped amount from a fund after a bank fails, while safeguarding keeps the money legally separate so that it is not available to the institution’s creditors in the first place. Which is preferable depends on the failure imagined, and neither covers every case.
What safeguarding does not promise
Four limits deserve stating plainly, because the word protection invites all four to be assumed away.
Safeguarding does not promise immediate access: the regulations govern where money sits and who may claim it, not how quickly an administrator completes a transfer. It does not promise a fixed payout timetable or a defined claim date, which belongs to compensation schemes rather than segregation duties.
It does not cover losses from fraud or from a payment the customer was deceived into authorising, which fall under different rules. And it does not extend to assets held by another provider: a balance outside the institution is outside its safeguarding arrangements.
The boundary in one table
| Scenario | What the safeguarding framework is designed to do | What cannot be promised from it |
| Provider insolvency | Keep customer funds as a distinct patrimony beyond the reach of the institution’s creditors, with transfer on demand to another institution | A guaranteed recovery amount, or a payout equivalent to deposit compensation |
| Fraud or unauthorised transactions | Nothing: a separate body of rules on authorisation and liability applies | Reimbursement of a loss, which depends on those rules and the facts |
| Delays in access | Preserve legal title to the funds while arrangements are resolved | Immediate availability, or a fixed date by which funds are released |
| Crypto and other linked assets | Nothing: these are not e-money held by the institution | Any extension of e-money safeguarding to a third-party provider’s balance |
The boundary of e-money safeguarding, by scenario. Source: Safeguarding of Funds Regulations, S.L. 376.04, consulted 28 October 2026.
On the final row, the Blackcat terms state that linked wallets are held with third parties outside Papaya’s control. An integrated crypto exchange and custodial crypto wallets are provided by our partner MANERIO Sp. z o.o. You can find more information at https://maner.io/
Documents to read for a specific balance
Four documents answer the protection question for an actual account: the service agreement in force for that balance, which names the provider and the basis on which funds are held; the safeguarding or security statement published by that provider; the regulator’s record confirming the institution’s category; and, for any balance shown in the same interface but supplied by someone else, the separate terms covering it.
Where a balance is held by a third party, the first three documents say nothing about it, which is the most common misreading in this area and the one with the most at stake.
Frequently asked questionsDoes EMI regulation mean the balance is a guaranteed bank deposit?
No. Authorisation as an electronic money institution brings duties including safeguarding, but electronic money is not a deposit and carries no guaranteed repayment figure.
Is safeguarding the same as deposit insurance?
No. Safeguarding is a continuing obligation about how customer funds are held and kept separate from the firm’s own assets. Deposit insurance is a compensation fund that pays a capped amount after a covered institution fails. The two work at different points and by different means.
Does e-money safeguarding automatically extend to a linked crypto wallet?
No. Safeguarding applies to funds received by the institution against electronic money. A balance held by a different provider falls under that provider’s arrangements, which must be checked in the terms covering that service.