Searching a payment app’s brand name rarely answers a regulatory question. The brand printed on a card or shown in an app store listing is a product name, while the authorisation belongs to a company.
Checking a Papaya Ltd licence therefore means locating that company in registers maintained by financial regulators, rather than reading what the app says about itself. The method runs in six steps, records the fields that matter at each one, and keeps the limits of a register listing in view.
Start from the issuer name, not the brand
A consumer-facing product discloses its issuer somewhere in its own material, usually in a footer, an about page or the agreement, and that disclosure supplies the legal name to search.
In this case the Blackcat issuer information states that the product is issued by Papaya Ltd, describes the company as an electronic money institution authorised and regulated by the Malta Financial Services Authority, and gives the identifier C55146.
Three separate items come out of that single sentence: a legal entity name, a jurisdiction, and a numeric identifier to match against an official record. None of them is yet verified. A company page is the company’s own statement about itself, which is the correct starting point for a search and the wrong finishing point for a conclusion.
C55146 appears on the company’s pages under registration-number wording and in the European register under a national identification number field. Treating it as the serial number of a licence certificate reads something into it that neither source states.
Open the national MFSA register
The authority named in the disclosure is the Malta Financial Services Authority, so the national record is the primary destination. The MFSA publishes a Financial Services Register covering the entities it authorises, searchable by entity name.
The point is to read the record rather than the search result.
A name in a result list establishes only that a similarly named entity exists in the register; the entity-level record is where category, status and record date appear. Reproducing this check means opening the record itself and transcribing those fields verbatim.
During the preparation of this article the national register page returned a service error and no entity-level record was retrieved, on 22 October 2026 and again on 28 October 2026.
That is an access limitation. It does not indicate that an authorisation has lapsed, and it does not entitle anyone to describe a national status as confirmed. Where a present-tense statement about MFSA status is needed, it requires either the live national record or direct confirmation from the authority.
Cross-check the EBA record
The European Banking Authority maintains a register of payment and electronic money institutions that draws its content from national competent authorities.
It is useful as a cross-check because it presents the same entity in a standard structure, with the national identifier, the competent authority and the authorisation date in named fields.
The entity record for PAPAYA LTD, observed in the live register on 22 October 2026, showed the national identification number C55146, Malta as the member state, electronic-money institution as the type, MT — Malta Financial Services Authority as the competent authority, and a status of Authorised from 30 April 2012, marked Current. The same record displayed its own Last Updated Date and Time as 1 January 2021.
Those two dates answer different questions and should never be merged. The authorisation date describes when the entity was first recorded as authorised. The record-update timestamp describes when the register entry was last written to. An observation made in 2026 of a record stamped 2021 is not evidence that anything was updated in 2026.
The supplement runs one way, not both. The EBA’s register disclaimer states that the register reproduces information provided by national authorities and confers no legal rights, and directs users to the national authority for definitive status. A European entry is a strong cross-check on identity and category. It is not a substitute for the national record it was copied from.
Read the activity and country fields
Register records carry an activity list and country information, and both are routinely over-read. An activity field records what the institution is permitted to do under its authorisation.
It does not record what the provider currently sells, which customers are accepted, or which features appear in a given app release.
Country information deserves the same caution. A home-state authorisation and a host-state entry answer separate questions, and neither states that a product is available to residents of a particular country. Note the labels as the register words them, and keep home-state and host-state entries in separate columns.
Resolve missing or conflicting entries
Two discrepancies surface regularly in this kind of check, and both have ordinary explanations.
The first is an unavailable page, covered above: an error is an error.
The second is a mismatch between addresses. The observed European record carries a Birkirkara address alongside a 2021 record-update timestamp, while the current company terms disclose an address at 31 Sliema Road, Gzira. Records written at different times by different bodies can disagree about an address without anybody having done anything wrong.
The reconciliation is to note each value with its source and its date, and to confirm an address against the appropriate source for whatever purpose requires it, such as the companies registry for a registered office or the service agreement for a contractual notice address.
Neither discrepancy supports an inference of misconduct. Neither supports an inference of clean standing. A register check establishes identity, category and recorded status, and leaves questions of conduct and enforcement history to be answered from their own sources.
A dated verification worksheet
The output of the exercise is a short record that someone else can re-run and compare. Six fields are enough.
| Field | What to record | Observed example |
| Legal name | Entity name exactly as the register words it | PAPAYA LTD |
| National identifier | The number and the field label used | C55146, shown as National Identification Number |
| Institution type | The register’s own category wording | Electronic-money institution |
| Authority | Competent authority named in the record | MT — Malta Financial Services Authority |
| Status | Status wording plus any authorisation date | Authorised from 30 April 2012, marked Current |
| Checked date | Date the record was opened, and by which route | Observed 22 October 2026, EBA register |
Verification worksheet with the values observed in the European register. The right-hand column is a dated observation of one record, not a current national-status confirmation. Source: EBA Payment Institutions Register, observed 22 October 2026.
A completed worksheet supports a narrow and defensible statement: on a named date, a named register displayed these values for this entity. Extending it into a judgement about whether an account suits a particular person requires the product terms, the eligibility conditions and the fee schedule, none of which appear in a regulator’s register.
Frequently asked questions
Why should I search Papaya Ltd rather than only Blackcat?
Regulators register legal entities, not consumer brand names. A search for the brand returns marketing material and app listings, while a search for the issuing company returns the authorisation record. The brand’s own disclosure is what connects the two.
Is C55146 automatically a licence certificate number?
No. The European register presents it as a national identification number and the company’s pages present it under registration-number wording. Neither source describes it as the reference of a licence certificate, and treating it as one asserts something the documents do not say.
Does an unavailable register page mean the company is unlicensed?
No. A service error is a failure to retrieve information, not information. It also means no present-tense national status can be stated from that attempt; the check has to be repeated, or confirmation sought from the authority, before anyone writes that status down.
