Crypto licence in Malta (MiCA CASP)

Malta no longer issues VFA licences. Since 1 July 2026 crypto services here run on a MiCA CASP authorisation from the MFSA, the Malta Financial Services Authority. The transitional period for existing VFA holders ended on that date, and new entrants apply directly under MiCA.

Why Malta is still worth choosing

Every EU regulator now applies the same rulebook, so the honest differences are not in the law — they are in the regulator. Malta wrote its own crypto framework in 2018, five years before MiCA, and the MFSA has been reading crypto applications ever since. By May 2026 it had authorised around a dozen CASPs, putting Malta among the top five EU jurisdictions by authorised provider count.

Two practical consequences. Supervision is in English, which removes a translation layer from every letter you will exchange for the next decade. And the local ecosystem — VFA agents, auditors, systems auditors, MLROs — already exists, so you are hiring from a pool rather than teaching a market what a crypto file looks like.

What the authorisation covers

• custody and administration of crypto-assets for clients;
• exchange of crypto-assets for funds or for other crypto-assets;
• operating a trading platform;
• execution, reception and transmission of orders;
• placement of crypto-assets;
• transfer services, portfolio management, advice.

One authorisation is passported across the European Economic Area by notification: supervised in Malta, serving clients in all member states without a second licence.

What it costs

• Own funds — set by MiCA, identical in every member state, and depending on the class of services: € 50 000 for advice and order execution, € 125 000 for a trading platform, € 150 000 for custody or exchange. The requirement is the higher of that floor or one quarter of the previous year's fixed overheads.
• MFSA application and supervisory fees — set by the authority's fee schedule and depend on the services applied for.
• Local costs — office, resident directors and compliance staff, systems audit, statutory audit.

Our fee is quoted in writing after a free review of your model. Anyone publishing one price for «a Malta crypto licence» is either guessing or selling you the wrong class.

How long it takes

MiCA gives the regulator 25 working days to confirm the file is complete and 60 working days after that to decide. Preparation is the longer half: three to six months to assemble something fileable. Plan four to twelve months in total, and start with the parts that cannot be bought in a hurry — resident senior staff and a real office.

What the MFSA actually checks

• fit and proper assessment of directors, senior managers and beneficial owners;
• substance in Malta: resident management, premises, staff, decisions taken locally;
• AML/CFT programme, MLRO, transaction monitoring, sanctions screening, Travel Rule;
• ICT and operational resilience under DORA, including outsourcing and incident reporting;
• segregation and safekeeping of client crypto-assets, custody policy, key management;
• governance, conflicts of interest, complaints handling, marketing communications;
• capital, prudential safeguards and a wind-down plan that works without shareholder support.

If you hold a VFA licence

The VFA regime is closed. A VFA licence is not a CASP authorisation and does not convert into one by itself — the transition had to be completed by 1 July 2026. If your file is still open, or if you stopped halfway through, the practical questions are what the MFSA already has, what is missing, and whether continuing in Malta is faster than filing fresh elsewhere. We answer that before taking the work.

How we work on it

1. Model review, free

We map what you do onto MiCA service classes and tell you whether Malta is the right regulator for that model. Sometimes it is not, and we say so.

2. Structure and substance

Company, board, resident senior staff, office, budget, capital — built against what the MFSA checks.

3. The application file

Programme of operations, AML/CFT framework, ICT and security documentation, custody and safeguarding rules, business continuity, wind-down plan, financial projections.

4. Filing and correspondence

We file, answer the MFSA's questions and keep the timetable visible to you.

5. After authorisation

Reporting, MLRO support, passporting notifications, changes of control and of service classes.

Frequently asked questions

Can I still get a VFA licence in Malta?

No. The VFA regime closed and the transitional period for existing holders ended on 1 July 2026. New applications are made under MiCA.

Is Malta cheaper than other EU jurisdictions?

Capital and documentation requirements are set by MiCA and are the same everywhere. What differs is regulator throughput, language and local costs. Choose by fit and speed, not by price.

Do I need resident directors and a real office?

Yes. Substance is assessed, and a registered address with no people behind it does not pass.

Can a Malta CASP serve clients in Germany or France?

Yes, through passporting notification — that is the point of the single authorisation.

How many CASPs has the MFSA actually authorised?

Around a dozen as of May 2026, which places Malta among the top five member states by authorised provider count. Ask any adviser for this number: it separates jurisdictions that process applications from those that only accept them.

Reviewed: August 2026, against the MFSA's publications on the VFA-to-CASP transition and Regulation (EU) 2023/1114 (MiCA).