A Malta CASP license is authorization as a crypto-asset service provider under the EU Markets in Crypto-Assets Regulation (MiCA), granted by the Malta Financial Services Authority (MFSA) and passported to every other EU member state. Malta implements MiCA through the Markets in Crypto-Assets Act (Cap. 647), and on 26 September 2026 ESMA’s interim MiCA register listed 22 CASPs with Malta as their home member state. The capital, the services and the statutory deadlines are the same as anywhere in the EU. The difference is how the MFSA reviews a file, and that changed in 2025, when ESMA’s peer review criticized the MFSA for granting an authorization while material issues were still open.
The MiCA framework itself, including the ten crypto-asset services and the Article 63 deadlines, is covered in our guide to the crypto license in Europe. This article is about Malta: what the MFSA requires from an applicant in 2026, what the license costs in regulatory fees, where Malta applications stall after the peer review, and which businesses Malta does not fit.
The ESMA Peer Review and Its Effect on the MFSA
Malta licensed crypto businesses before MiCA existed. The Virtual Financial Assets Act came into force in 2018, and Malta built a supervisory team for crypto long before most EU regulators had one. Exchanges preparing for MiCA turned to the MFSA early because of that history, and in April 2025 ESMA’s Board of Supervisors opened a fast-track peer review of how the MFSA had authorized one of them.
ESMA published the results on 10 July 2025. Its peer review committee examined how the MFSA had authorized one CASP and found that the MFSA had only partially met expectations on authorization. Several material issues were still unresolved when the MFSA granted the license, covering the business plan, conflicts of interest, governance, ICT, custody and AML/CFT controls, and the committee said the process should have been more thorough. It credited the MFSA for hiring crypto-skilled supervisors and engaging with the industry early.
In August 2025 the MFSA said it had set an internal deadline of the end of September 2025 to implement all of ESMA’s recommendations and had engaged its Internal Audit function to confirm completion. For applicants, the practical result is one rule: issues the MFSA would once have accepted with a remediation plan now have to be closed before authorization. A file the MFSA would have approved with open points in early 2025 now comes back with questions.
The transition for older Maltese licensees has ended. Firms licensed under the VFA Act could keep operating until 30 June 2026 or until the MFSA decided on their MiCA application. In a letter dated 25 June 2026, the MFSA and the FIAU told operational VFA licensees still without a CASP license to stop onboarding new clients immediately, limit activity to closing and transferring client positions, and wind down. Applicants with a pending file and no clients could continue their application after confirming in writing that they would not onboard anyone until licensed. Every Malta applicant now goes through the full MiCA process.
MFSA Requirements for a Malta CASP
MiCA sets the common floor. The MFSA adds its own expectations on people and presence, and those are what an applicant from outside Malta has to plan for.
A Maltese company with a registered office in Malta. The applicant is a Maltese legal entity. A non-EU group can own it in full, and there are no residency requirements for shareholders, but the board takes its decisions in Malta.
At least two directors, one of them an executive director resident in Malta. The resident executive director runs the business day to day and is the person the MFSA expects to answer for it. A director appointed only to satisfy the residency rule, who cannot explain the order flow, the custody model or the group arrangements, does not meet that expectation.
A compliance officer, an MLRO and a risk management function. The MFSA approves the MLRO in advance. The same person can act as compliance officer and MLRO, with the MFSA’s prior approval. Staff can be foreign nationals, and the MFSA has discretion over how much of the team must sit in Malta.
Prior approval of every key person. The MFSA approves qualifying shareholders, directors and key function holders before they start in their roles. Each files a personal questionnaire with supporting evidence, and a change of any of them after authorization goes through the same approval.
A statement of intent before the application. A new applicant starts with a signed statement of intent from a prospective director. The MFSA then sends its MiCA thematic questionnaire, and the full application follows. The statutory clock under Article 63 of MiCA starts only once the MFSA declares that full application complete.
Capital and MFSA Fees by Class
MiCA sets minimum capital by the highest class of service applied for. Malta’s Markets in Crypto-Assets Act (Fees) Regulations 2024 set the application fee and the annual supervisory fee on the same classes.
| Class | Services | Minimum Capital | MFSA application fee | Annual supervisory fee (base) |
|---|---|---|---|---|
| 1 | Reception and transmission of orders, advice, execution of orders, placing, transfer services, portfolio management | EUR 50,000 | EUR 10,000 | EUR 10,000 |
| 2 | Class 1 plus custody, exchange for funds, exchange for other crypto-assets | EUR 125,000 | EUR 20,000 | EUR 25,000 |
| 3 | Class 2 plus operating a trading platform | EUR 150,000 | EUR 25,000 | EUR 50,000 |
The annual supervisory fee has two further parts on top of the base: EUR 2,000 for each authorized service and 0.05% of transaction volume, capped at EUR 250,000. A Class 2 exchange authorized for custody, exchange for funds and exchange for other crypto-assets pays EUR 31,000 a year before the volume component. The volume component separates a small broker from a large exchange: at EUR 100 million of annual volume it adds EUR 50,000.
The applicant holds the capital in own funds or covers it by insurance, and the requirement rises to one quarter of the previous year’s fixed overheads once that figure exceeds the minimum.
Common Reasons Applications Stall in 2026
After the peer review, the MFSA’s questions follow the areas ESMA named. These are the points where applications are sent back.
A business plan that only describes year one. ESMA told regulators to assess business plans as forward-looking documents, including expected growth and the risks that come with it. A plan that projects tenfold volume growth without a matching increase in compliance staff, ICT capacity or capital is challenged on exactly that gap.
Conflicts of interest across services. An applicant that wants to run an exchange, hold client assets and trade on its own account under one license has to show how those activities are separated, who sets prices and how clients are told. The peer review singled out conflicts arising from combining several CASP services.
Custody or technology outsourced inside a non-EU group. Many applicants rely on a parent company for the matching engine, wallet infrastructure or key management. ESMA told regulators to apply the same third-party risk principles to intragroup arrangements, and in June 2026 both ESMA and the MFSA reminded CASPs that MiCA prohibits outsourcing or delegating certain services, custody in particular, to entities that are not authorized CASPs. A Maltese entity whose client assets sit with an unauthorized group company does not pass.
ICT and DORA readiness on paper only. ESMA told regulators to check that an applicant can respond to a hack and block malicious transactions while it is under way, with custody first among the critical functions. A business continuity plan that has never been tested is the weak point here.
Unregulated products next to regulated ones. A CASP that also promotes DeFi yield, staking programs or tokens outside MiCA’s scope has to show that clients cannot mistake those products for regulated services. ESMA listed this as a focus point, together with clear risk warnings in the customer journey, so the MFSA reviews the onboarding flow and the app as a client sees them.
Timeline
Under Article 63 of MiCA, the MFSA has 25 working days to check completeness and 40 working days to decide on a complete file, with a possible suspension of up to 20 working days for further questions. The date the file is declared complete depends on the applicant: incorporation, the resident executive director, the key function holders, the capital and the policy set all have to be in place first. Equilex plans a Malta authorization from six months end to end, and most of that time goes into preparation and the MFSA’s questions before the 40-day clock starts.
Malta or Another EU Home State
A MiCA license from any member state passports across the EU, so the choice of home state comes down to the regulator and the cost of being there.
| Factor | Malta | What to compare elsewhere |
|---|---|---|
| Working language | English | Cyprus also works in English; most other regulators accept English filings but supervise in their own language |
| Regulator’s crypto experience | Supervising crypto since the VFA Act of 2018 | Germany, France and the Netherlands have the largest registers; in Germany much of it is banks adding crypto through Article 60 notifications |
| Scrutiny since 2025 | Higher: the MFSA’s CASP authorization was peer-reviewed by ESMA in 2025 | Every national regulator received the same ESMA recommendations, so the standard is tightening across the EU |
| Local substance | Resident executive director, compliance officer, MLRO, risk function | Every home state applies MiCA’s EU-resident director rule and adds its own staffing expectations |
Malta fits a crypto-native exchange, broker or custodian that wants an English-language regulator with long crypto experience, can hire a resident executive director who runs the business, and keeps its custody and technology inside the authorized entity or with authorized providers.
When Malta Is the Wrong Choice
A business that needs to be live in weeks. A Malta authorization takes from six months. A business that needs EU coverage sooner can launch under a partner’s MiCA license through CASP as a Service in about a month, while its own application runs.
Custody and technology that stay with a non-EU parent rule out Malta under the current MFSA approach. Unless the arrangement moves into the Maltese entity or to an authorized CASP, the MFSA will not approve it, and restructuring after filing adds months.
A business with no EU clients. MiCA authorization means EU capital, substance, DORA and supervisory fees without EU market access the business would use.
FAQ
What is a Malta CASP license?
It is authorized as a crypto-asset service provider under MiCA, granted by the MFSA under Malta’s Markets in Crypto-Assets Act. It allows the holder to provide its authorized crypto-asset services in Malta and, after notification, in every other EU member state.
How much does a Malta CASP license cost in regulatory fees?
The MFSA application fee is EUR 10,000 for Class 1, EUR 20,000 for Class 2 and EUR 25,000 for Class 3. The annual supervisory fee starts at EUR 10,000, EUR 25,000 or EUR 50,000 by class, plus EUR 2,000 per authorized service and 0.05% of transaction volume, capped at EUR 250,000. Minimum capital is EUR 50,000, EUR 125,000 or EUR 150,000 depending on the class.
Does a Malta CASP need a resident director?
Yes. The MFSA expects at least two directors, one of them an executive director resident in Malta, together with a compliance officer, an MLRO and a risk management function. The MFSA approves all of them before they take up their roles.
Can a VFA license still be used in Malta?
No. The transitional period for VFA Act licensees ended on 30 June 2026. On 25 June 2026 the MFSA told licensees without a CASP license to stop onboarding new clients immediately and wind down, with only the steps needed for an orderly exit allowed after that date.
How long does the MFSA take to grant a CASP license?
The MFSA has 40 working days to decide once it declares the application complete. Preparing a complete file, appointing the resident executive director and answering the MFSA’s questions take longer than the decision itself, and a realistic plan is six months from the start of work.
Equilex prepares and files CASP applications in Malta, from the statement of intent through the MFSA’s questions to authorization and bank onboarding. To see whether Malta fits your business model, see CASP authorization in Malta.
