MiCA CASP License in Malta

Why Choose Malta for Crypto Licensing?

Malta authorises crypto-asset service providers under a single MiCA-aligned framework administered by the MFSA, an established financial services regulator with seven years of supervisory continuity from the legacy VFA Act. Existing VFA holders had a simplified conversion route under Article 143(6), but that window closed on 1 July 2026 (see the transition section below).

Full MiCA Passporting from a Jurisdiction Off the FATF Grey List

Malta exited the FATF grey list on 17 June 2022, just under a year after the FATF placed it under increased monitoring in June 2021; MONEYVAL’s 2021 follow-up report had re-rated it compliant or largely compliant on all 40 FATF Recommendations.^[1][29] A Malta MiCA CASP authorisation passports to the EEA (the 27 EU states plus Iceland, Liechtenstein and Norway)^[30] under Article 65 of Regulation (EU) 2023/1114. After receiving all Article 65 information, the MFSA must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information.^[2]

Malta’s MFSA had been licensing virtual financial asset service providers since 2018 and carries that operational track record into the MiCA regime.

Tax Treatment Built for Active Trading Businesses

Malta’s full-imputation corporate tax system reduces the effective rate on active trading income to 5% via the 6/7ths shareholder refund mechanism, retained alongside the elective 15% final tax that any company may choose instead under Legal Notice 188 of 2025.^[3][32] A Malta-incorporated CASP routing operating income through a Maltese parent achieves a structurally lower effective rate than competing EU MiCA jurisdictions where the rate is the headline number: Cyprus at 15% from 1 January 2026, Estonia at 22% on distribution, Ireland at 12.5% or 15% under Pillar Two for in-scope groups.^[28]

Under the Tax Treatment of Highly Skilled Individuals Rules (L.N. 20 of 2026), a non-domiciled individual in an eligible office with an undertaking licensed or recognised by the MFSA may elect the 15% rate on qualifying employment income, subject to a €65,000 minimum that rises by €10,000 every five years. The benefit runs for five years and may receive two further five-year extensions, subject to continued eligibility, and the option cannot be exercised before assessment year 2027.^[4]

English-Language Legal System and Anglo-Saxon Counsel Ecosystem

Malta’s legal system is bilingual English-Maltese with English the working language of MFSA, FIAU, the Office of the Arbiter for Financial Services, and the Financial Services Tribunal. Common-law principles supplement the civil-law base, and the MFSA’s MiCA Rulebook, issued on 11 March 2025, is published in English.^[5] This matters operationally because international applicants do not need certified translations for any MFSA submission, and counsel briefings can move at native-language speed. The common mistake is to assume this advantage is purely cosmetic: in practice, it saves four to six weeks across a typical 12-month authorisation file compared with civil-law-only EU jurisdictions.

Operational Track Record

The MFSA’s supervision of virtual financial asset service providers since 2018 supplies an established supervisory foundation for its MiCA regime. Current authorised-provider populations should be checked in the relevant MFSA and ESMA registers at the time of a licensing decision.

MFSA continued to authorise after the ESMA peer review of 10 July 2025 rather than pausing the pipeline. Separately, MFSA accepted the peer review’s findings and tightened its authorisation gating, so applicants filing after that date meet deeper scrutiny than the pre-review cohort.^[7]

Regulatory Framework

The MFSA is Malta’s sole competent authority for MiCA under the Markets in Crypto-Assets Act, Chapter 647 of the Laws of Malta, enacted by Act No. XXXVI of 2024 on 5 November 2024. The MFSA’s MiCA Rulebook was issued on 11 March 2025 and is now at version 3.00 of March 2026: Title 1 sets its scope, Title 2 covers authorisation, crypto-asset white-paper notification, and surrender of a licence, Title 3 the ongoing requirements for CASPs, and Title 4 those for ART issuers.^[5]

Recent Regulatory Developments

• 3 July 2026: VFA Act repealed. The transitional right of VFA licence holders ended on 1 July 2026 and the Virtual Financial Assets Act was repealed on 3 July 2026, so crypto-asset services in Malta now need a MiCA authorisation, a passport, or an Article 60 notification.^[31]
• 22 May 2026: DAC8 transposed. Legal Notice 162 of 2026 brings the crypto-asset reporting rules of Directive (EU) 2023/2226 into Maltese law, in force retroactively from 1 January 2026.^[33]
• March 2026: MiCA Rulebook version 3.00. The MFSA added newly issued Level 3 requirements to its MiCA Rulebook.^[5]
• 18 February 2026: ESMA Q&A 2349 on CASP fixed overheads. The European Commission’s answer, published by ESMA, confirms that the Article 67(3) fixed-overheads figure starts from all overhead expenses, fixed and variable, and that only the items in points (a) to (d) may be deducted.^[8]
• January 2026: Highly Skilled Individuals Rules. Legal Notice 20 of 2026 allows a non-domiciled individual in an eligible office with an undertaking licensed or recognised by the MFSA to elect the 15% rate on qualifying employment income, subject to the applicable threshold and eligibility conditions. The option cannot be exercised before assessment year 2027.^[4]
• 10 July 2025: ESMA Peer Review on CASP Authorisation and Supervision in Malta. ESMA42-2004696504-8164. MFSA rated “fully meets expectations” on supervisory settings and resources, “largely meets” on post-authorisation supervision, “partially meets” on one specific authorisation file. MFSA accepted findings.^[7]
• 10 June 2025: EBA Opinion EBA/Op/2025/08. Clarifies the PSD2-MiCA interplay for e-money tokens, with practical implications for CASPs offering EMT transfer or custody services.^[9]
• 4 April 2025: MFSA CASP Return introduced. Template v25-01-a; first cumulative submission deadline 30 April 2025, signed Representations Sheet required.^[10]
• 24 March 2025: MFSA Major ICT-Related Incident Reporting Process v3.00. Implements Commission Delegated Regulations 2024/1772 (classification) and 2025/301 (timeframes): initial notification as early as possible, within 4 hours of classification as major and normally no later than 24 hours after awareness (if classified after that window, within 4 hours of classification), intermediate within 72 hours, final per delegated act.^[11]
• 11 March 2025: MiCA Rulebook issued. The MFSA published its Markets in Crypto-Assets Rulebook together with amendments to Chapter 3 of the Financial Institutions Rulebook (FIR/03), which applies to payment and electronic money institutions, including issuers of e-money tokens.^[5][16]
• 30 December 2024: FIAU revised Implementing Procedures Part II for CASPs. Issued alongside Legal Notice 379 of 2024 amending the PMLFTR. BRA review cadence moved to every six months for CASPs.^[12]
• 5 November 2024: Markets in Crypto-Assets Act enacted. Act No. XXXVI of 2024 implements MiCA in Maltese law and consolidates Maltese implementing measures.^[13]

Regulatory Overlap

Court Treatment of Virtual Assets

Maltese courts have applied the VFA Act and ancillary regulations consistently since 2018, with the OAFS handling consumer-facing complaints and the Financial Services Tribunal handling regulatory appeals. The MFSA penalty regime is under ongoing constitutional appeal (the Chair and CEO have publicly flagged the risk of erosion of dissuasive power), which is a watch-item for 2026 but not a current state.^[14]

Regulatory Transition: Virtual Financial Assets Act to MiCA

The Old Regime: VFA Act 2018

The Virtual Financial Assets Act, Chapter 590 of the Laws of Malta, was enacted in 2018, making Malta one of the first EU member states with a dedicated virtual asset framework. VFA service providers were classified under four service classes: Class 1 (advisory), Class 2 (brokerage and dealer), Class 3 (dealer plus custody), Class 4 (exchange operator).^[26] MFSA accumulated supervisory experience and a body of licensed entities under this regime.

The New Regime: MiCA + MiCAA

MiCA (Regulation (EU) 2023/1114) has applied in full in Malta since 30 December 2024 (its stablecoin titles since 30 June 2024), implemented and supplemented by the Markets in Crypto-Assets Act, Chapter 647, enacted 5 November 2024.^[13] MFSA is the sole competent authority. The ten MiCA Article 3(1)(16) service types are grouped into three MFSA prudential classes: Class 1 (€50,000 floor), Class 2 (€125,000), Class 3 (€150,000) under Annex IV.

Article 143(6) Simplified Conversion

This route is closed and is recorded here because it explains the shape of Malta’s authorised population rather than because it is still available. Entities licensed under the VFA Act on 30 December 2024 qualified as Category A applicants under MFSA’s Circular on the Authorisation Process for MiCA Applicants. The procedure: board resolution committing to MiCA conversion, surrender of the VFA licence subject to MiCA grant, completion of the 2024 MiCA thematic questionnaire (or reliance on prior submission). The Markets in Crypto-Assets Act required the MFSA to apply that simplified procedure only to applications filed between 30 December 2024 and 1 July 2026.^[31]

Application fees were discounted 50% for filings made before 1 July 2026; since that date the full fee applies to everyone.^[15]

Category B: New Applicants

Standard authorisation process applies. Pre-application Statement of Intent, legal opinion from a Maltese warranted lawyer, full programme of operations, governance manual, ICT architecture, AML/CFT manual, business plan with 3-year financials, fit-and-proper packs for all qualifying holders, directors, senior managers, MLRO, and Compliance Officer.

Key Deadlines

License Types and Activities Covered

MFSA authorises CASPs to provide one or more of the ten MiCA crypto-asset services, grouped into three prudential classes by capital floor. Authorisation is service-specific: an exchange operator that wants to add custody files an extension request that updates its original file and is processed on the Article 63 clocks, for 75% of the application fee for that class.^[17][27]

Covered Activities (MiCA Article 3(1)(16) Service Types)

ART and EMT Issuance

MFSA also authorises issuers of asset-referenced tokens (Title III MiCA) and supervises e-money token issuers (Title IV: EMTs may only be issued by electronic money institutions authorised under the Financial Institutions Act, or by credit institutions). ART fees: €3,000 for the MFSA to assess a credit institution’s white paper and €8,000 for any other issuer’s authorisation application; a modified white paper costs €1,000.^[17]

What Does NOT Require CASP Authorisation

• Whitepaper notification only. A white paper for a crypto-asset other than an ART or EMT is notified to the MFSA under MiCA Article 8, for a €2,500 notification fee, without a CASP authorisation. MFSA does not pre-approve content; the offeror bears responsibility.
• Purely peer-to-peer activity without intermediary service. Self-custodied wallet activity, transfers between own wallets, and pure peer-to-peer exchanges where no intermediary provides custody, execution, or matching fall outside the CASP perimeter.
• NFTs that are unique and not fungible. Unique non-fungible tokens (where the value derives from individual, non-fungible attributes) sit outside MiCA per Recital 10. Fractional NFTs and NFTs issued as a fungible series fall back into MiCA scope, while NFTs that function as financial instruments fall under MiFID II rather than MiCA (Article 2(4)(a)).
• DeFi protocols without an identifiable issuer or service provider. MiCA Recital 22 carves out fully decentralised services. What MFSA does not formally cover is the question of when “fully decentralised” stops being decentralised: a foundation, multisig council, or token-issuer entity will typically be in scope.
• Crypto-asset services already in scope of MiFID II / EMI / E-Money frameworks (e.g., security tokens treated as transferable securities). MiCA Article 2(4) sets that boundary.

Tokenised securities and RWA

A MiCA CASP authorisation does not reach tokenised securities or tokenised real-world assets that qualify as financial instruments. MiCA Article 2(4) excludes crypto-assets that are financial instruments, so a security token, a tokenised share, bond, or note, falls under MiFID rather than MiCA. In Malta that token is regulated under the Investment Services Act, outside both MiCA and the now-repealed VFA Act, and the operator needs a MiFID investment-services licence rather than a CASP authorisation. The MFSA’s Financial Instrument Test is the gating mechanism that routes a token to either side of the perimeter, applying ESMA’s operative Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments. We scope the security-token route through the Investment Services Act and pair it with our fund licensing work where a tokenised fund vehicle is the better structure.

Requirements

The make-or-break elements are a Maltese-incorporated company with local key-function presence, MiCA Article 67 prudential safeguards, and a DORA-aligned ICT framework. Generic templates do not pass MFSA’s authorisation gate, and substance is tested directly through post-authorisation supervision.

Requirements Table

Fit-and-Proper Assessment

MFSA assesses individual fitness and propriety using its standard Personal Questionnaire (PQ) forms, applying the ESMA/EBA Joint Guidelines on Suitability of Management Body Members and Shareholders for Entities under MiCA. Dimensions: integrity (criminal record, regulatory history, civil judgments, bankruptcy), competence (qualifications, relevant experience, knowledge of the business), financial soundness, and conflicts of interest. The PQ is required for every beneficial owner, qualifying holder (10% or more direct or indirect), administrator, senior manager, MLRO, and Compliance Officer. Approval must be received before any appointment takes effect.

Experienced applicants build out PQ files before drafting the programme of operations because the PQ approval timeline is the longest serial dependency: an unresolved fit-and-proper concern blocks the whole application, while drafting can be paralleled.

Local Substance

MFSA does not publish a numerical substance test, but the supervisory expectation observed across the authorised cohort is approximately 10 substance staff within six months of authorisation, scaled to business size and complexity. The team mix includes employed personnel (MLRO, Compliance Officer, executive director, key business roles) and qualifying service arrangements for support functions. A registered office in Malta is mandatory; co-working addresses without dedicated space are not accepted. The real constraint on Malta substance is not the cost (€30,000 to €50,000 office rent for 10 people in Sliema or St Julian’s, manageable), but the availability of MiCA-experienced compliance talent: salaries for senior MLRO and Compliance Officer roles run €60,000 to €90,000 fully loaded.^[18]

AML/CFT and Travel Rule

CASPs are Subject Persons under the Prevention of Money Laundering Act (Cap. 373) and the Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01). FIAU supervises AML/CFT compliance. The revised Implementing Procedures Part II for CASPs published on 30 December 2024 aligns terminology with MiCA and the Travel Rule (Regulation (EU) 2023/1113), adds crypto-specific risk factors (immediacy, irrevocability, sectoral velocity, lack of value or volume restrictions), and accelerates the Business Risk Assessment review cadence to every six months for CASPs (vs annual for other Subject Persons).^[12]

Travel Rule requirements apply from 30 December 2024: originator and beneficiary information must accompany every in-scope crypto-asset transfer, whatever the amount, and the originator’s CASP verifies the originator information (existing customer due diligence counts where Article 14(7) applies). The €1,000 threshold applies only to transfers to or from a self-hosted address: above it, the CASP must also assess whether its client owns or controls that address. Sanctions screening is required against UN, EU, and Maltese designations (the EBA Guidelines on internal policies, procedures, and controls (EBA/GL/2024/15) inform MFSA’s supervisory expectations).

Application Process

MFSA targets the MiCA Article 63 statutory clock: 25 working days for the completeness check and 40 working days for the decision from receipt of the complete application, suspended once, for up to 20 working days, while the applicant answers a written request made by the 20th working day. In practice, the realistic end-to-end Malta timeline is 9 to 18 months, driven by pre-application preparation (4–7 months) plus the substantive review (4–8 months including iteration on RFIs), with entity formation, banking and the decision itself accounting for the balance.

Application language: English. Maltese-language documents are not required, and MFSA submissions need no certified translation.

The independent specialist’s compliance team drafts Malta-specific AML/CFT policy suites, the Enterprise-Wide Risk Assessment, Travel Rule implementation procedures, and the DORA ICT risk management framework under its own engagement with the client. The compliance documentation is the most time-intensive component of any Malta CASP application: 10 to 14 weeks of specialist work that cannot be shortcut with generic templates. MFSA explicitly screens for adapted-from-elsewhere policies and issues RFIs against them. Book a Licensing Assessment →

Required Documents

MFSA’s Circular on the Authorisation Process for MiCA Applicants sets the document inventory MFSA expects to see in a complete file.^[15] The list below reflects the expectation since the ESMA peer review tightening.

Corporate Documents

Memorandum and Articles of Association; certificate of incorporation; register of members; certified copy of the share register; registered office confirmation; UBO declaration filed with the Malta Business Registry; organisational chart showing legal entities and individuals; corporate governance manual.

Personal Documents (Directors, Officers, MLRO, Compliance Officer, Beneficial Owners, and Qualifying Holders)

MFSA Personal Questionnaire; valid passport and proof of address; CV with verifiable employment history; certificates of qualifications and professional memberships; criminal record certificate from country of residence and any country of residence in the past 10 years; financial standing declaration; declaration of conflicts of interest; details of any prior regulatory engagements, sanctions, or proceedings.

Compliance Documentation

The compliance documentation is the most heavily scrutinised component of any Malta CASP application. The independent specialist’s compliance team drafts each of these documents under its own engagement with the client: bespoke and Malta-specific, not templates adapted from other jurisdictions. Each document must reflect the applicant’s specific business model, risk profile, and operational structure.

Business Plan and Financial Projections

3-year financial projections with revenue model, cost base, sensitivity analysis; market analysis (target geographies, client profiles, competitive positioning); funding plan and capital runway analysis; operational scaling plan tied to substance commitments.

Technology and Operational Documentation

ICT architecture diagram; data flow diagrams; key management system design; business continuity and disaster recovery plans; cybersecurity policy; cloud governance; third-party vendor inventory with DORA Article 30 contracts; outsourcing register; threat-led penetration testing schedule (if a significant CASP).

Costs and Pricing

MFSA fees are set under the Markets in Crypto-Assets Act (Fees) Regulations, Legal Notice 295 of 2024.^[17] For a new applicant, the application fee is €20,000 for Class 2 or €25,000 for Class 3. The first supervisory fee is prorated and comprises the applicable class fee plus €2,000 for each authorised service; subsequent annual fees also include 0.05% of transaction volume, capped at €250,000. The typical build of €490,000 to €1,075,000 is an estimate priced per case rather than a list price. Article 67 safeguards sit outside both figures: the higher of the Class 2/3 floor (€125,000 or €150,000) and 25% of previous-year fixed overheads, using projected first-12-month overheads for a new firm. They may be met with own funds, qualifying insurance or a comparable guarantee, or a combination; own funds remain on balance sheet rather than being spent.

Government / MFSA Fees

ART fees: €3,000 to assess a credit institution’s white paper, €8,000 for any other issuer’s authorisation application; white papers for crypto-assets other than ARTs and EMTs carry a €2,500 notification fee, and an EMT white paper €3,000.^[17] FIAU supervisory contribution: annual, scaled by Subject Person profile (figure published in FIAU annual fee circular).^[12]

Statutory Cost, Year 1

Both lines are set by the Markets in Crypto-Assets Act (Fees) Regulations, Legal Notice 295 of 2024, and can be checked against the published schedule.^[17] From Year 2 the statutory charge is the supervisory fee alone, due on 30 July each year: €25,000 to €50,000 by class, plus €2,000 per authorised service and 0.05% of the previous year’s transaction volume, capped at €250,000. The FIAU contribution is set by a separate authority in its own annual circular and sits in the build table below.

Typical Build, Year 1 (Quoted Per Case)

The build band follows the rows above it, own funds excluded, rounded outward from their sum of €494,000 to €1,073,000: the floor is a Class 2 CASP with every line at its minimum, and the ceiling is a full-scope Class 3 operation running the whole tooling stack.

First-year prudential safeguards are the higher of the class floor (€125,000 for Class 2 or €150,000 for Class 3) and 25% of projected first-12-month fixed overheads. The upper scenario has €765,000 in explicitly annual items alone, so its safeguard is at least €191,250 before any other includible expenses. None of those stated annual items identifies an eligible Article 67(3) deduction: profit-dependent or fully discretionary remuneration, profit allocations, or non-recurring expenses from non-ordinary activities. A one-off label alone does not establish a deduction.^[27]

If met with own funds, the safeguard is held rather than spent. Article 67 also permits qualifying insurance or a comparable guarantee, or a combination.

Several rows (blockchain analytics, Travel Rule tooling, a ten-person office) scale with the services actually taken, so a Class 1 advisory or portfolio-management model, with a smaller team and no trading-platform obligations, sits below the band rather than at its floor.

MiCA CASP authorisations are indefinite rather than time-limited. Because the first supervisory fee is prorated by the authorisation date and increases with the services authorised, there is no single statutory amount to add to the typical build as an exact Year-1 total.

Timeline

The realistic Malta CASP timeline is 9 to 18 months end-to-end, of which pre-application preparation absorbs 4 to 7 months and the substantive review, including RFI iteration, runs 4 to 8 months; entity formation, banking and the decision itself account for the balance. On a typical file, plan against 14 to 18 months.

MFSA works to the MiCA Article 63 clocks (completeness within 25 working days; decision within 40 working days of receipt of the complete file, suspended at most once for up to 20 working days), but completing the file and answering RFIs mean calendar time runs well beyond them.^[27]

The pace of authorisations to date suggests adequate MFSA capacity, so speed in practice is determined by the applicant’s pre-application preparation, not by MFSA throughput. The 9-month end assumes a complete file at first submission and a single short RFI round; on our planning estimate, a typical file needs 14 to 18 months.

Taxation

Malta’s ordinary company tax rate is 35%. A qualifying 6/7 shareholder refund after distribution of active trading profits can produce a combined effective burden of 5%; that result is not an unconditional company tax rate.

All rates as of September 2026.^[35]

Highly Skilled Individuals Rules (Legal Notice 20 of 2026)

Under the HSI Rules (Legal Notice 20 of 2026), a non-domiciled individual in an eligible office with an undertaking licensed or recognised by the MFSA may elect the 15% rate on qualifying employment income, subject to a €65,000 minimum that rises by €10,000 every five years. The benefit runs for five years and may receive two further five-year extensions, subject to continued eligibility, and the option cannot be exercised before assessment year 2027.^[4]

DAC8 / CARF Reporting

Malta transposed DAC8 (Directive (EU) 2023/2226), which extends EU tax cooperation to crypto-assets on the model of the OECD Crypto-Asset Reporting Framework, by Legal Notice 162 of 2026, published on 22 May 2026 and in force retroactively from 1 January 2026. Reporting CASPs collect data on 2026 transactions and file the first reports in 2027.^[19][33]

Pillar Two (Global Minimum Tax)

Malta has elected the deferral available under Article 50 of Council Directive (EU) 2022/2523, which lets it not apply the Income Inclusion Rule and the Undertaxed Profits Rule for six fiscal years from 31 December 2023; by March 2026 it had introduced neither rule nor a qualified domestic top-up tax, while it has transposed the Directive’s administrative provisions and, by Legal Notice 162 of 2026, the DAC9 reporting framework.^[25][33]

Since September 2025 any company may instead elect a 15% final tax without imputation (Legal Notice 188 of 2025), which lets an in-scope group have the minimum tax paid in Malta. That election is a domestic income-tax charge, not a qualified domestic top-up tax within the meaning of the Directive, which is why it coexists with the Article 50 deferral.^[32]

Standalone Maltese-domiciled CASPs below the €750 million consolidated revenue threshold are out of scope. A group with consolidated revenue of €750 million or more should assess the Income Inclusion Rule of its parent jurisdiction and, where the ultimate parent is in Malta, the Undertaxed Profits Rule that other Member States apply to its entities under Article 50(2) of the Directive.^[25]

Ongoing Compliance & Post-Registration

MFSA authorisations are indefinite. CASPs operate under continuous prudential, conduct, AML/CFT, and DORA obligations, with the supervisory cycle anchored by quarterly CASP Returns, annual audited financial statements, the DORA Register of Information, and an extensive notification regime for material changes.

Annual Reporting Obligations

Supervision Fees and Recurring Costs

The MFSA annual supervisory fee is the applicable class base plus €2,000 for each authorised service and 0.05% of transaction volume capped at €250,000; the first supervisory fee is prorated. FIAU contribution is separate. Recurring operational costs (office, MLRO and Compliance Officer headcount, audit, Travel Rule subscription, blockchain analytics, KYC tooling) sit in the €365,000 to €765,000 build band excluding capital.

Regulatory Inspections

MFSA conducts scheduled supervisory engagements (annual or biennial depending on risk rating) and thematic reviews. In 2025 the MFSA handled 943 potential enforcement cases and imposed 91 enforcement actions and administrative penalties totalling €570,673, 63 of them for late or missing statutory filings, against 134 actions and €926,485 in penalties in 2024.^[34][14] CASPs sit in the elevated-attention cohort following the ESMA peer review.

Marketing and Promotion Rules

Marketing communications must be fair, clear, not misleading; identifiable as marketing; consistent with any whitepaper; and accompanied by risk warnings per MiCA Article 7. ESMA’s 2025 guidance cautions against misleading “regulated under MiCA” language, particularly when promoting unregulated products alongside regulated ones. Cross-border promotion is subject to host-state language and conduct rules even where the EU passport applies.

Enforcement

MFSA has the power to revoke authorisation, impose administrative penalties, and require specific remedial action. The FIAU operates a separate AML/CFT penalty regime. The most prominent recent CASP-related enforcement was a €1,054,269 FIAU penalty imposed on 1 April 2025, and published two days later, against an authorised Malta CASP for AML breaches found in an April 2023 examination, before its MiCA authorisation, signalling that historical compliance failings travel with the entity.^[20]

ICT Risk Management & Operational Resilience

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies in full to Malta CASPs from 17 January 2025. CASPs are “financial entities” within DORA Article 2 scope, with no exemption for size or activity profile.

ICT Risk Management Framework

The framework must cover governance (board ownership), risk identification and classification, business continuity policy, disaster recovery, and the proportionality principle (DORA Article 4) for smaller CASPs. MFSA’s Supervisory ICT Risk and Cybersecurity (SIRC) Function publishes guidance via “The Nature and Art of Financial Supervision Volume XI: ICT Risk and Cybersecurity” (3 September 2024).^[21]

Incident Reporting (4 / 72 Hour Cadence)

The MFSA Major ICT-Related Incident Reporting Process v3.00 implements Commission Delegated Regulation (EU) 2024/1772 (classification thresholds) and Commission Delegated Regulation (EU) 2025/301 (reporting timeframes):^[11]

• Initial Report: as early as possible, within 4 hours of classification as major and normally no later than 24 hours after awareness (if classified after that window, within 4 hours of classification)
• Intermediate Report: within 72 hours
• Final Report: per delegated act timeframe

Submission via the Cyber Reporting Management System (CRMS) on the MFSA LH Portal. The Significant Cyber Threat Notification Process (17 January 2025) provides a voluntary parallel channel for non-incident threat intelligence.

Digital Operational Resilience Testing

All financial entities must run a programme of digital operational resilience testing proportionate to size and risk. “Significant” CASPs (criteria set by ESMA RTS) are subject to threat-led penetration testing (TLPT) at least every three years, scoped to critical functions and conducted by accredited testers.

Third-Party ICT Risk and the Register of Information

DORA Article 28 requires a Register of Information (RoI) covering all ICT third-party arrangements, with annual submission to MFSA. The Maltese submission window is 1 January to 21 March from 2026, with each endpoint shifted to the next working day if necessary; the reference date is 31 December of the prior year. The first MFSA exercise ran from 1 to 8 April 2025 for entities authorised by 31 March 2025. Significant credit institutions follow ECB submission instructions. Only “Accepted” status is DORA-compliant.^[22]

DORA Article 30 sets out contractual provisions: written contracts with audit rights, exit strategies, sub-outsourcing controls, location of data processing, and termination triggers. Cloud and blockchain analytics vendors are typically the highest-risk arrangements. Critical third-party providers may be designated by the ESAs and subject to oversight directly.

Wallet Management and Key Custody

MFSA expects a documented cold-storage majority for client crypto-assets, multi-signature controls, HSM-backed key material for production keys, and recorded key ceremonies. Hot wallet operational floats must be sized to documented operational needs with quantitative limits in the Risk Appetite Statement.

Banking

Banking is the single largest operational friction for Malta-based CASPs. Even fully authorised CASPs face enhanced due diligence at every Maltese credit institution and at most EU banks. Realistic timelines for operational account opening run 4 to 8 months in parallel with the authorisation process, longer if pursued sequentially.

The Maltese Banking Landscape

The Maltese banking landscape comprises two large domestic credit institutions plus a small number of fintech-oriented Maltese banks, all of which apply enhanced due diligence to crypto-asset service providers. Detailed transaction-flow analysis, source-of-funds evidence, beneficial ownership traceability, and demonstrated AML maturity are universal entry conditions. EU electronic money institutions licensed in MiCA-friendly jurisdictions are typically more accessible for fiat on-ramps and operational SEPA flows. Unless the CASP is itself a credit, e-money, or payment institution, client funds other than e-money tokens must be placed with a credit institution or a central bank by the end of the next business day, in an account separate from the CASP’s own, and the MFSA typically asks for the engagement letter with that credit institution before business starts.^[27][5]

Banking Access by Business Profile

Banking access remains hardest for Class 3 trading platforms with high transaction velocity, easier for Class 1 advisory and portfolio management businesses. Operators planning to serve institutional counterparties will find that the historical Malta grey-listing (now lifted) still surfaces in correspondent banking conversations: the post-grey-listing recovery is the dominant narrative, but enhanced due diligence at the correspondent level persists.

Jagelski & Partners’ Banking Service

A licence without banking access is a certificate on the wall. Jagelski & Partners’ banking partner network covers more than 90 institutions across the EU, EEA, and offshore corridors, and businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Pre-qualification across the network surfaces the institutions whose risk appetite matches the applicant’s business profile before formal application. Learn about the Banking service →

FATF Status & International Standing

Malta exited the FATF grey list on 17 June 2022, just under a year after the FATF placed it under increased monitoring in June 2021, and MONEYVAL’s 2021 follow-up report re-rated it compliant or largely compliant on all 40 FATF Recommendations (12 compliant, 28 largely compliant).^[1][29]

Money laundering prosecutions in Maltese courts dropped from 57 in 2021 to 16 in 2023, a pattern read by some commentators as enforcement softening and by Maltese authorities as normalisation of the post-grey-listing baseline.^[23] The realistic operator assessment: Malta’s exit from the FATF grey list is a credible banking and counterparty narrative, but historical scrutiny still surfaces in correspondent banking conversations and US counterparty due diligence.

MiCA Passporting and EU Market Access

A Malta MiCA CASP authorisation passports to the EEA under Article 65 of Regulation (EU) 2023/1114. The procedure: home CASP notifies MFSA of the host states targeted, the services it will provide cross-border, the planned start date, and its other activities not covered by MiCA. After receiving all Article 65 information, the MFSA must communicate it to the host competent authorities, ESMA and EBA within 10 working days and notify the CASP. The CASP may start when it receives that notification or, at the latest, 15 calendar days after it supplied the Article 65 information.^[2]

Host competent authorities are informed rather than asked: they cannot block authorised cross-border activity but retain supervisory powers over local conduct, marketing, and consumer protection. Article 65 sets no separate branch file: a branch is notified through the same procedure, and the host state’s company-law registration of the branch applies separately. The current authorised-provider population should be checked in the ESMA Interim MiCA Register at the time of a licensing decision.^[6]

Advantages and Limitations

Malta is a high-value jurisdiction for the right CASP profile and a poor fit for several others. The advantages cluster around tax efficiency, EU market access, supervisory continuity, and English-language operations. The limitations cluster around banking friction, substance cost, and the reputational overhang from the July 2025 ESMA peer review.

• ✓ 5% effective corporate tax. Full-imputation system with 6/7ths shareholder refund on active trading income gives a 5% effective rate on distributed trading profits, among the lowest in the EU MiCA cluster.
• ✓ Full MiCA passport. Authorisation passports to the EEA under Article 65: MFSA forwards the notification to host NCAs within 10 working days, and services may start on receipt of MFSA’s communication or at the latest from the 15th calendar day after notifying.
• ✓ English-language legal system. Bilingual common-law overlay reduces friction for international applicants; no certified translation required for MFSA submissions.
• ✓ Established supervisory track record. MFSA’s seven years of VFA supervisory continuity inform the current MiCA framework.
• ✓ A converted incumbent cohort. The simplified Article 143(6) route, open to VFA holders until 1 July 2026, moved an established set of operators onto MiCA early. The route itself is closed, but it is why Malta has supervised CASPs with real operating history rather than only new grants.
• ✓ Off the FATF grey list since 2022. Malta exited the FATF grey list on 17 June 2022, after MONEYVAL’s 2021 follow-up rated it compliant or largely compliant on all 40 FATF Recommendations.
• × Banking friction. Maltese credit institutions apply enhanced due diligence to CASPs; operational account opening runs 4 to 8 months. Mitigation: pursue banking in parallel with MFSA authorisation; pre-qualify across a multi-institution EU and offshore EMI and bank network before any formal application.
• × The Year-1 build starts at €490,000, before statutory fees and prudential safeguards in a permitted form. Own funds are held rather than spent only if that form is chosen (MiCA Article 67(4)). MFSA fees plus substance plus compliance documentation plus DORA tooling makes Malta materially more expensive than the cost-leader EU MiCA jurisdictions. Mitigation: Class 1 advisory or portfolio management models carry a smaller team and no trading-platform tooling, and sit below this band.
• × ESMA peer review (July 2025) tightened MFSA gating. New applicants face deeper authorisation scrutiny than the pre-July 2025 cohort, particularly on Web3 and DeFi exposure controls, custody booking models, and the resolution of any prior enforcement history. Mitigation: prepare a robust pre-application file with named precedent for any non-standard activity; assume MFSA will test every governance, ICT, and AML claim in the application.
• × Substance cost. Local team of ~10 within six months of authorisation, MLRO and Compliance Officer salaries €60,000 to €90,000 fully loaded, plus office. Mitigation: scale substance to business size; service arrangements are permitted for support functions while keeping board, MLRO, and Compliance in-house.
• × Talent pool depth. MiCA-experienced lawyers and compliance officers are available in Malta but the pool is shallower than Lithuania or Ireland; competition for senior compliance hires drives salary inflation. Mitigation: combine local hires with experienced expatriate appointments under the Highly Skilled Individuals Rules (Legal Notice 20 of 2026, flat 15% personal tax from €65,000 qualifying income).

How Malta Compares

Malta sits in the established European crypto centre tier alongside Cyprus and Gibraltar, with Estonia as the cost-leader alternative for applicants prioritising lower entry cost over institutional prestige. The four jurisdictions differ on capital floor, timeline, Year-1 cost basis, effective tax, and FATF posture.

Malta leads on tax efficiency and supervisory track record; Estonia leads on cost; Cyprus is broadly comparable to Malta, with a slightly larger cohort on ESMA’s register (24 entities against 22); Gibraltar is non-EU post-Brexit and follows its own pre-MiCA DLT framework.

Compare every crypto jurisdiction side by side →

When Malta Is the Right Choice

Choose Malta if:

• You already converted a VFA licence to MiCA, or you are buying an authorised Maltese CASP rather than applying for a new grant
• Active CASP trading income volume is large enough to make the 6/7ths refund materially valuable (the cost of the imputation structure is amortised against tax saved)
• EU passporting and English-language counsel ecosystem are decision-critical
• The applicant has at least €490,000 in Class 2/3 Year-1 build budget, plus the statutory fee formula, prudential safeguards in a permitted form, and 4–7 months of pre-application capacity

Consider alternatives if:

• Year 1 budget is the binding constraint: see Estonia or Lithuania for materially lower entry costs
• The target market is German or French institutional: see Germany BaFin authorisation or France AMF authorisation: host-state familiarity matters
• The applicant has unresolved regulatory history elsewhere: post-July 2025, MFSA scrutinises this aggressively
• Speed is the priority over institutional positioning: see Estonia (6–12 months) or Lithuania (4–8 months) for shorter planning ranges than Malta’s

Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.

Common Mistakes in Malta Applications

MFSA’s Circular on the Authorisation Process for MiCA Applicants and the ESMA peer review report together signal the patterns that delay or block Malta CASP authorisations. Five recur across the applicant cohort.

• Generic programme of operations templates. MFSA’s authorisations team flags adapted-from-elsewhere business plans within the first 25-working-day completeness check. The programme must reflect the applicant’s specific business model, jurisdiction-specific compliance procedures, and Malta-anchored governance, not a translated Estonia or Lithuania file.
• Combined MLRO and Compliance Officer functions without conflict mitigation. MFSA accepts function combination only with documented conflict procedures, demonstrated capacity, and proportionality justification. Applicants who file the combination without addressing the conflict receive RFIs that delay the file by 2 to 4 months. The common mistake is to treat function combination as an efficiency choice rather than a governance question.
• Weak Web3 and DeFi exposure controls. The ESMA peer review specifically flagged this. CASPs offering staking, lending, structured crypto products, or DeFi integrations must document the protocol-level risk, smart contract audit history, and custody booking model in detail. MFSA expects evidence of legal and technical analysis, not vendor marketing.
• Prudential safeguards not evidenced at the pre-licensing stage. MiCA Article 67 can be met with CET1 own funds, an insurance policy or comparable guarantee, or a combination, and the MFSA’s pre-licensing conditions ask for an audited account statement or public register entry certifying the applicant’s capital. A file that cannot evidence the chosen form within the six months normally allowed after in-principle approval does not reach the licence.
• Outsourcing contracts that do not meet DORA Article 30. Pre-DORA outsourcing contracts (especially for cloud, custody technology, blockchain analytics) typically lack audit rights, exit strategies, sub-outsourcing controls, or location-of-processing terms. MFSA will not accept these as satisfying the DORA framework; renegotiation with vendors is the only remedy and can take 3 to 6 months.

Frequently Asked Questions

References