Malta crypto license 2026 — MFSA CASP authorisation
Malta brings VFA-era supervisory experience to MiCA files and had 23 CASPs on ESMA's register in October 2026. Application fees are fixed by law at EUR 10,000-25,000 by class. ESMA's 2025 peer review asked the MFSA to tighten its authorisation assessments. Best for genuinely Malta-based teams.
Last reviewed by the Crypto Law Index editorial desk
Why Malta matters in EU crypto licensing
Malta pioneered EU crypto regulation through the Virtual Financial Assets (VFA) Act, in force from November 2018 — about five years before MiCA was adopted. The MFSA built crypto-supervisory capacity during the VFA era that translates directly to MiCA CASP review. For operators considering MiCA jurisdictions, Malta offers depth of supervisor experience that many newer-to-crypto member states cannot match.
The record is mixed. Malta authorised the first three MiCA CASPs on 27 January 2025, and 23 Maltese CASPs were on ESMA's register in October 2026. In July 2025 ESMA published a peer review of one MFSA authorisation: it found good resources and expertise, but some material issues not fully resolved when the authorisation was granted and some risk areas not adequately assessed. Expect the MFSA to probe harder after that review. For operators seeking light-touch licensing, Malta is the wrong answer.
Malta hosts a large iGaming licensing population through the Malta Gaming Authority (MGA). Crypto-asset operators with iGaming integration benefit from the combined regulatory ecosystem. For pure-crypto operators without iGaming nexus, the higher Malta cost may not be justified relative to CEE alternatives.
MFSA supervisor approach
The Malta Financial Services Authority is the integrated supervisor for banking, insurance, securities and CASPs; gambling is supervised separately by the MGA, and AML by the Financial Intelligence Analysis Unit (FIAU).
Advisers describe the MFSA as demanding on substance. In practice it expects Malta-resident senior management with documented working presence, registered Malta office (not corporate-services-provider address), Malta-based AML and compliance teams, and Malta operational infrastructure. Pre-filing engagement is encouraged.
VFA-to-MiCA transition requires fresh CASP application — MFSA does not auto-convert VFA permissions. Existing VFA licensees must file under MiCA Article 62/63 framework with substance review running against MiCA standards rather than VFA-era expectations. The VFA transitional period ended on 1 July 2026 and remaining VFA licences were cancelled on 2 July 2026.
Cost and operational profile
First-year Malta CASP operations run EUR 350,000-700,000 typically — materially above CEE budget tier. Components: Malta operating entity formation (EUR 5-10k), Valletta/Sliema office (EUR 30-80k), senior compliance hires including Malta-resident directors, MLRO, and Compliance Officer (EUR 200-350k loaded cost), supporting compliance team (EUR 50-100k), MFSA application work (EUR 50-100k), supporting infrastructure (EUR 25-50k).
Application fees are fixed by the Markets in Crypto-Assets Act (Fees) Regulations (L.N. 295 of 2024): EUR 10,000 for Class 1, EUR 20,000 for Class 2 and EUR 25,000 for Class 3, set by the highest class applied for. Annual supervisory fees are separate and scale with class, number of services and volume. (EUR 8,000 is the fee for an ART issuer, not a CASP.)
Malta corporate tax is 35% nominal, with shareholder refunds that can bring the effective rate down substantially; since 2025 companies can also elect a 15% rate. Either route needs proper tax advice and ongoing Malta substance.
What Malta crypto licensing counsel typically deliver
- Malta MiCA CASP application preparation and MFSA pre-clearance engagement
- Post-VFA licensing support (the Article 143 transition closed on 1 July 2026)
- Malta operating entity formation and corporate governance
- MFSA-required substance preparation — directors, MLRO, Compliance Officer
- AML programme aligned with the Prevention of Money Laundering Act and FIAU Implementing Procedures
- DORA ICT framework and operational resilience documentation
- Malta banking onboarding strategy through major Malta banks
- MGA iGaming licensing integration for combined operations
- Cross-EU passport notification under MiCA Article 65
How Malta compares to adjacent jurisdictions
| Jurisdiction | Material difference vs Malta |
|---|---|
| Cyprus | Cyprus CySEC at €250-500k year one vs Malta €350-700k. Both Mediterranean EU; Cyprus more financial-services-focused, Malta more iGaming-adjacent. Choose by ecosystem fit. |
| Lithuania | Lithuania €150-300k year one and 4-6 month timeline; Malta €350-700k and 7-10 months. Lithuania for cost-led approach; Malta for ecosystem and iGaming positioning. |
| Ireland | Ireland CBI at €500-1.2m year one — premier Western EU positioning. Malta is materially cheaper but with smaller institutional reputational signal. |
| Gibraltar | Gibraltar GFSC DLT framework but no EU passport (post-Brexit). Malta produces EU passport on authorisation; choose Malta for EU access. |
Malta is the EU jurisdiction supervised by the Malta Financial Services Authority (MFSA) where MiCA CASP authorisation is granted under the Markets in Crypto-Assets Act (Cap. 647), building on supervisory experience from the 2018 Virtual Financial Assets Act; an ESMA peer review in July 2025 found gaps in one early MFSA authorisation.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Malta Financial Services Authority (MFSA) |
| Authorisation timeline | 7-10 months end-to-end (practitioner estimate); statutory decision period 40 working days from a complete file |
| Initial capital | €50,000 (Class 1) — €150,000 (Class 3), MiCA Annex IV |
| Application fee | €10,000 / €20,000 / €25,000 by highest class (L.N. 295 of 2024, reg. 6) |
| Local substance | Registered office in Malta, effective management in the EU, one EU-resident director (MiCA Article 59(2)); local MLRO and Compliance Officer expected in practice |
| VFA-to-MiCA transition | Ended 1 July 2026; VFA licences were cancelled on 2 July 2026 |
| Authorised CASPs | 23 Maltese CASPs on ESMA's interim register (25 October 2026); first three authorised 27 January 2025 |
| Best for | iGaming-adjacent operations, Malta-based teams |
Top counsel for Malta CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Malta engagement, regardless of where they are headquartered.
Frequently asked questions about Malta CASP authorisation
What did ESMA's peer review of the MFSA find?
ESMA's July 2025 peer review of one MFSA CASP authorisation found a good level of resources and expertise, but some material issues not fully resolved at authorisation and some risk areas not adequately assessed.
Can a Maltese VFA licence convert directly to a MiCA CASP authorisation?
Existing VFA licensees had to file a separate CASP application before the transitional route closed on 1 July 2026 — the MFSA does not auto-convert VFA permissions even where the operating model overlaps.
Is Malta the right jurisdiction for an EU-only crypto-asset firm?
Only if speed and cost are not binding constraints. Malta's statutory application fee is EUR 10,000-25,000 by class, annual supervisory fees come on top, and practitioners report longer timelines than in Lithuania or Cyprus.
Pitfalls and nuances in Malta
1 Treating VFA experience as sufficient for CASP
VFA licensing was a precursor to MiCA but uses different documentation. Files that lift VFA paperwork without re-drafting under MiCA Article 62 typically receive substantive deficiency notices.
2 Compliance Officer who is also the MLRO
Advisers report that the MFSA expects separate Compliance Officer and MLRO functions in all but the smallest firms. Check the current MFSA guidance before combining the roles.
3 Substance arrangements set up just before filing
Substance put in place just before filing is hard to demonstrate. ESMA's 2025 peer review pushed the MFSA to resolve material issues before authorising, so directors and senior staff should be in place long enough to show genuine engagement with the operating model.
Practitioners in Malta
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Malta. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Malta is Malta Financial Services Authority (MFSA). The legal basis is MiCA Regulation (EU) 2023/1114 + Markets in Crypto-Assets Act (Cap. 647, Act XXXVI of 2024). Visit www.mfsa.mt for the regulator's official guidance, application forms, and supervisory expectations.
For where every EU and EEA state stands — its authority, its national act and when its transitional period ended — see the MiCA implementation tracker.