Crypto & Digital Assets · Malta
Crypto license in Malta: MiCA CASP requirements (2026)
Malta shaded by its crypto & digital assets status
Crypto is regulated in Malta.
FrameworkEU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), directly applicable, with the Malta Financial Services Authority (MFSA) as competent authority. Malta's national Virtual Financial Assets Act (Cap. 590, VFA Act) of 2018 remains in force during the transitional/grandfathering period (running to 1 July 2026); a 2024-25 reform aligned the VFA framework with MiCA. AML/CFT for VASPs/CASPs is supervised by the FIAU under the Prevention of Money Laundering Act. Tax treatment of DLT assets follows Commissioner for Revenue Guidelines (November 2018) under the Income Tax Act and Income Tax Management Act.
Crypto is fully legal in Malta and operates under a comprehensive in-force EU framework (MiCA), applied by the MFSA, layered on top of Malta's pioneering 2018 Virtual Financial Assets Act which is being phased out by 1 July 2026 in favour of MiCA's CASP regime. New crypto-asset service providers must apply directly for a MiCA CASP authorisation; pre-existing VFA licensees benefit from a transitional period until 1 July 2026. As of mid-2026 the MFSA had authorised roughly 12 CASPs and two e-money-token (stablecoin) issuers, although a July 2025 ESMA peer review criticised MFSA's authorisation process as not sufficiently thorough.
How to get a crypto license in Malta
To provide crypto-asset services in Malta you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Malta Financial Services Authority (MFSA), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.
- Authority
- the Malta Financial Services Authority (MFSA)
- License required
- a MiCA CASP authorisation (Crypto-Asset Service Provider)
- Framework / law
- the EU Markets in Crypto-Assets Regulation (MiCA), Title V
- Minimum capital
- €50,000–€150,000 minimum, by service class (Class 1/2/3)
- Timeline
- about 40 working days of substantive review; 1–3 months for a well-prepared application
- Cost
- an application fee of roughly €5,000–€25,000, plus ongoing supervisory fees
- Passporting
- Yes — a single MiCA CASP licence passports across all 27 EU member states.
What a crypto license in Malta covers
- Custody and administration of crypto-assets for clients
- Operating a trading platform for crypto-assets
- Exchanging crypto-assets for funds, or for other crypto-assets
- Executing orders for crypto-assets on behalf of clients
- Reception and transmission of orders, and placing of crypto-assets
- Advice and portfolio management on crypto-assets
- Transfer services for crypto-assets on behalf of clients
How to get a crypto license in Malta: step by step
- 1Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU.
- 2Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation.
- 3Submit the application to the national competent authority.
- 4Completeness check: the authority has 25 working days to confirm the file is complete and request anything missing.
- 5Substantive assessment: the authority has 40 working days to grant or refuse the authorisation.
- 6Once authorised, notify the passport to the host member states you intend to serve, then begin operating across the EU.
Documents required in Malta
- Programme of operations describing each crypto-asset service you will provide
- Business plan with three-year financial projections
- Evidence of prudential safeguards (own funds or qualifying insurance)
- Governance arrangements, organisational chart and internal-control description
- AML/CFT policies and the appointment of a compliance officer
- ICT security, business-continuity and DORA-aligned resilience policies
- Custody and client-asset segregation arrangements
- Complaints-handling procedure and conflict-of-interest policy
- Fit-and-proper evidence for directors and qualifying shareholders (CVs, criminal-record certificates)
After authorisation: ongoing obligations in Malta
- Maintain prudential safeguards and own funds at or above the class minimum
- Keep client crypto-assets segregated from the firm's own assets
- Run continuous AML/CFT monitoring, screening and suspicious-activity reporting
- Keep marketing communications fair, clear and not misleading
- Operate complaints handling and manage conflicts of interest
- Meet ICT resilience and incident-reporting duties under DORA
- File periodic reports to the national competent authority
Crypto license in Malta: FAQ
Yes. To provide crypto-asset services in Malta you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Malta Financial Services Authority (MFSA), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.
The Malta Financial Services Authority (MFSA).
An application fee of roughly €5,000–€25,000, plus ongoing supervisory fees.
Typically about 40 working days of substantive review; 1–3 months for a well-prepared application.
The application file centres on programme of operations describing each crypto-asset service you will provide; business plan with three-year financial projections; evidence of prudential safeguards (own funds or qualifying insurance); governance arrangements, organisational chart and internal-control description; plus fit-and-proper evidence for directors and qualifying shareholders.
Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU. Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation. The authority then assesses the file and, once authorised, you can begin operating.
Yes — a single MiCA CASP licence passports across all 27 EU member states.
Key points
MiCA's CASP regime entered into application on 30 December 2024 and is directly binding in Malta; the MFSA grants CASP authorisations, EMT/ART issuer approvals, and exercises ongoing supervision. Maltese authorisations passport across the EU/EEA.
Entities licensed under the VFA Act (Cap. 590) before 30 December 2024 may continue services until 1 July 2026 or until they are granted/refused CASP authorisation; new applicants must apply under MiCA. After 1 July 2026 the VFA service-provider regime ceases for in-scope crypto-asset services.
On 10 July 2025 ESMA published a peer review concluding that MFSA's CASP authorisation process only 'partially met expectations', material issues including pending enforcement matters were not adequately resolved before authorisations were granted, though supervisory resources and expertise were rated favourably.
VFA/CASP firms are 'subject persons' under the Prevention of Money Laundering Act and PMLFTR, supervised by the FIAU; they must comply with the EU AML directives transposed in Malta, including KYC, transaction monitoring and STR filing, and apply the Travel Rule under Regulation (EU) 2023/1113.
The Commissioner for Revenue's November 2018 guidelines split DLT assets into coins (treated like fiat, outside capital-gains tax), financial tokens (returns taxed as income; CGT possible if a 'security' under Article 5 ITA), and utility/hybrid tokens (generally outside the capital-assets list). Business income from trading is taxed at standard 15-35% income-tax rates.
EMTs may only be issued by an EU-authorised credit institution or e-money institution; ARTs require a dedicated MiCA authorisation from MFSA. MFSA had authorised at least two EMT issuers by mid-2026, including Malta-based StablR (EURR); offerors must notify MFSA at least 40 working days before public offering or trading admission.
Timeline - major decisions & events
Malta - other topics
Crypto & Digital Assets in other countries
Last verified 6/13/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →