Malta • MiCA CASP • MFSA supervision

Malta | MiCA CASP License 2025

Full country note • MFSA-supervised • Styled for CryptoWisely

Overview

Malta’s legacy VFA/VASP framework is now being replaced in practice by the EU-wide MiCA regime for crypto-asset services. As MiCA becomes fully applicable across the EU, Malta licenses eligible firms as CASPs (Crypto-Asset Service Providers) through the Malta Financial Services Authority (MFSA). The shift consolidates Malta’s positioning from “national framework” into a standardized EU authorization with passporting potential.

Regulatory Snapshot

  • Regulator: Malta Financial Services Authority (MFSA)
  • License type: CASP authorization under MiCA
  • Replaces: Former VFA/VASP classes (national framework)
  • Scope: MiCA-defined crypto-asset services (custody, exchange, platform operation, etc.)
  • Supervision: MFSA acts as National Competent Authority (NCA) for MiCA in Malta
  • Grandfathering concept: Transitional operation for legacy-authorized entities (time-limited, application window dependent)

CASP Classes & Minimum Capital (MiCA)

MiCA introduces minimum own-funds requirements tied to the service class. The practical class selection should be mapped to the exact services delivered (and the operating model).

Class Typical scope Minimum capital
Class 1 Order execution (where applicable), transfer services, advisory, portfolio management €50,000
Class 2 Custody/safekeeping, crypto↔fiat exchange, crypto↔crypto exchange €125,000
Class 3 Operation of a trading platform (plus Class 2 permissions) €150,000

Own funds must be fully paid and maintained, and may also be linked to fixed-overhead requirements depending on the business profile.

Regulator & Scope

  • Regulator: MFSA (MiCA National Competent Authority in Malta)
  • Submission channel: MFSA’s digital portals and filing processes (as specified by MFSA)
  • Legacy note: MiCA applications focus on governance, client protection, ICT resilience, and compliance evidence rather than legacy VFA-era terminology

Minimum Requirements (Practical Checklist)

  • Entity & substance: Maltese company with registered address; operational substance aligned to scope
  • Capital: Paid-up minimum own funds aligned to CASP class
  • Governance: Fit & proper leadership; clear functional role separation and decision accountability
  • Key functions: Compliance, MLRO, risk, ICT/security (with authority, tooling access, and escalation power)
  • Policies & controls: AML/CFT, KYC/KYB, client-asset safeguards, conflicts/complaints, outsourcing, BCP, incident response
  • Documentation pack: Programme of operations, business plan, control structure, recordkeeping, disclosures
  • Evidence of readiness: Monitoring tooling, audit trails, training program, reporting workflows
  • Insurance: Professional indemnity coverage where required by the service set

Licensing Process (Indicative)

Stage 1 — Company Set-up (≈ 2–4 weeks)

  • Incorporation, governance mapping, UBO/director due diligence
  • Capital planning and initial banking/EMI outreach

Stage 2 — Application Build (≈ 3–6 weeks)

  • CASP class selection aligned to services and operating model
  • Draft and finalize MiCA documentation and control evidence
  • Prepare digital submission pack for MFSA processes

Stage 3 — MFSA Review & Q&A (variable)

  • Formal intake and completeness checks
  • Iterative Q&A cycles (governance, AML, ICT, client asset safeguards)
  • Decision and authorization

Stage 4 — Operational Launch (banking rails)

  • Finalize operational accounts (bank or EMI)
  • Confirm capital and activate settlement/fiat rails
  • Go-live with monitoring, reporting, and governance cadence

Planning range: Many teams target ~3–4 months when documentation is complete and the operating model is straightforward; complex exchange/custody platforms may require longer cycles.

Grandfathering (Legacy Entities)

Legacy Malta-authorized operators may benefit from a time-limited transition into MiCA, subject to eligibility, MFSA-defined windows, and timely submission. The practical task is a gap analysis against MiCA (governance, ICT, client protection, own funds, disclosures) and a structured remediation plan prior to filing.

Taxation (High-Level)

  • Headline corporate tax: commonly cited at 35%
  • Effective outcomes: can differ materially depending on structure and refund mechanics
  • Practical note: For CASPs, regulatory substance and operational credibility usually matter more than optimizing the headline rate early on

FAQs — Malta CASP

  • Resident director? Not always mandatory, but substance and control functions must be credible.
  • Office? Registered address is mandatory; physical presence expectations increase with risk and scope.
  • Banking? Often workable via EMIs; authorization typically improves success rates.
  • Class selection? Advisory/transfer = Class 1; custody/exchange = Class 2; trading platforms = Class 3.
  • VFA agent? MiCA is a different authorization model; legacy VFA-era constructs are not the core driver under MiCA.

CryptoWisely.io Comment

Malta’s move into MiCA is best viewed as a reputational upgrade, not just compliance migration.

Strengths: English-speaking ecosystem, mature service providers, MFSA experience supervising financial services.
Watch-outs: Governance expectations are real; documentation and operational proof must be audit-grade.

CryptoWisely insight: If you are building a serious exchange/custody platform, MiCA in Malta works when you treat licensing as an operational build (controls, ICT, and accountability), not a paperwork exercise.

Disclaimer: Informational only and not legal advice. Always verify the latest MFSA guidance and MiCA technical standards before proceeding.