CASP License in Malta

Quick Facts: Malta CASP License

What Is a CASP License in Malta?

A CASP (Crypto-Asset Service Provider) license in Malta authorizes a company to provide regulated crypto-asset services across the European Union under MiCA. CASP authorization in Malta is issued by the Malta Financial Services Authority, which acts as the competent national authority for MiCA implementation.

Malta introduced a dedicated crypto regulatory framework in 2018 under the Virtual Financial Assets Act. This early supervisory experience now informs how MFSA applies MiCA requirements, with emphasis on governance, internal controls, and long-term sustainability.

Malta and MiCA: Regulatory Context

Malta applies the Markets in Crypto-Assets Regulation (MiCA) through its national competent authority, the Malta Financial Services Authority. MFSA is responsible for CASP authorization, ongoing prudential supervision, and enforcement of MiCA requirements at the national level.

Unlike jurisdictions that adopted crypto regulation only after MiCA was finalised, Malta entered the MiCA framework with an established supervisory infrastructure. This has a direct impact on how CASP applications are reviewed, assessed, and monitored.

From the VFA Framework to CASP Authorization

Before MiCA entered into force, Malta regulated crypto-asset activities under the Virtual Financial Assets (VFA) Act, which introduced licensing and ongoing supervision for crypto businesses as early as 2018.

With the application of MiCA, the VFA framework no longer serves as a standalone licensing regime for crypto-asset service providers. New market entrants must apply directly for CASP authorization under MiCA. Existing VFA license holders are required to transition to the CASP regime.

VFA to CASP Transition (Grandfathering Period)

MiCA provides an 18-month grandfathering period for crypto-asset service providers licensed under national frameworks prior to MiCA. In Malta, this transition period ends on 1 July 2026.

During the grandfathering period:

• existing VFA license holders may continue operating under their current authorization,
• CASP applications must be submitted within the prescribed timeframe,
• firms are expected to progressively align governance, capital, and compliance structures with MiCA standards.

Failure to obtain CASP authorization by the end of the grandfathering period results in the loss of the right to provide crypto-asset services within the EU.

Simplified Application for Existing VFA License Holders

In practice, streamlined review is typically limited to:

• governance structures previously assessed by MFSA,
• historical compliance performance,
• existing operational substance in Malta.

Capital requirements must still meet MiCA thresholds of €50,000 to €150,000, depending on the CASP service class. Overall first-year compliance and operational costs commonly remain within the €200,000–€300,000 range, including capital, staffing, and infrastructure.

Regulatory Oversight and AML/CFT Supervision

In addition to prudential supervision by MFSA, CASPs in Malta are subject to AML/CFT oversight by the Financial Intelligence Analysis Unit.

Ongoing supervision includes periodic reporting, compliance reviews, and targeted inspections. Particular attention is typically paid to transaction monitoring, outsourcing arrangements, and governance effectiveness.

Capital Requirements for a Malta CASP License

Under MiCA, capital requirements depend on the CASP service class. In Malta, statutory capital represents a minimum entry threshold, not an automatic indicator of regulatory approval.

Minimum Capital Thresholds

Regulation (EU) 2023/1114 (MiCA) establishes the following minimum own funds:

• €50,000 — Class 1 (advisory and order transmission, no custody);
• €125,000 — Class 2 (custody, exchange, wallet services);
• €150,000 — Class 3 (trading platform operations).

Capital must be fully paid up prior to authorization and maintained on an ongoing basis.

When Capital Above the Minimum Is Required

The Malta Financial Services Authority assesses whether proposed capital is proportionate to the CASP’s actual risk profile.
In practice, higher capital is commonly expected where the business model involves custody, multiple CASP services, high transaction volumes, complex outsourcing arrangements, or exposure to higher-risk clients or markets.

In such cases, statutory minimums are often insufficient.

Capital as an Ongoing Requirement

Capital adequacy is reviewed on a continuous basis. MFSA evaluates own funds together with governance, staffing, technology, and compliance capacity to ensure resilience under operational or market stress.

Overall Timeline Summary

CASP Activities and License Classes in Malta

Under MiCA, CASP authorization in Malta is granted based on the specific crypto-asset services provided. The selected scope determines the applicable CASP class, minimum capital, and the level of supervisory scrutiny applied by the Malta Financial Services Authority.

Selecting the correct CASP class at the structuring stage is critical. Misclassification often leads to extended review cycles, higher capital requirements, or the need to revise parts of the application.

CASP Class Overview

CASP Class 1: Advisory and Execution Services

CASP Class 1 applies to firms that do not hold client assets and do not operate trading platforms.

Typical permitted activities:

• crypto-asset advisory services,
• reception and transmission of orders,
• order execution without custody.

Suitable for:

• advisory-focused firms,
• brokerage models without asset custody.

Example business models:

• crypto investment advisory firm providing portfolio recommendations,
• OTC broker facilitating trades without holding client assets.

MFSA supervisory focus for Class 1:

Despite lower capital requirements, MFSA assesses the quality of advisory processes, conflict-of-interest management, staff competence, and oversight of outsourced execution arrangements. Governance must remain proportionate to business complexity.

CASP Class 2: Custody and Exchange Services

CASP Class 2 applies to firms that hold or control client crypto-assets.

Typical permitted activities:

• custody and administration of crypto-assets,
• exchange services involving client funds,
• wallet services with signing authority.

Suitable for:

• custodial wallet providers,
• crypto exchanges offering spot trading.

Example business models:

• crypto exchange with integrated custody,
• institutional custody platform for corporate clients.

From a supervisory perspective, custody significantly increases regulatory risk. MFSA places heightened emphasis on asset segregation, key management and security controls, and incident response frameworks.

CASP Class 3: Trading Platform Operations

CASP Class 3 covers firms operating trading platforms or multilateral systems.

Typical permitted activities:

• operation of crypto-asset trading platforms,
• order matching and execution infrastructure.

Suitable for:

• centralized exchanges with proprietary matching engines,
• multilateral trading venues.

MFSA expects demonstrable technical resilience, market integrity controls, and clear accountability for system operations.

Combining Multiple CASP Services

MiCA allows multiple services under a single authorization. In practice, combining services typically results in:

• higher effective capital requirements,
• increased compliance staffing needs,
• broader supervisory review.

Example: a firm providing both advisory services (Class 1) and custodial wallets (Class 2) must meet Class 2 capital (€125,000) and demonstrate governance controls for both activities, including conflict-of-interest management between advisory and custody functions.

Why Companies Choose Malta for CASP Licensing

Decision Summary (At a Glance)

Malta is typically selected when a CASP requires:

• EU-wide operations under a single MiCA authorization,
• predictable supervisory expectations from an experienced regulator,
• a regulated EU structure combined with tax efficiency,
• long-term operational stability rather than speed or low entry cost.

Established Supervisory Practice

Malta introduced a dedicated crypto regulatory framework in 2018. This resulted in a developed supervisory track record before MiCA entered into force.
As a consequence, the Malta Financial Services Authority applies MiCA within an already established control environment. Supervisory expectations are generally clearer and more consistent than in jurisdictions that began crypto supervision only after MiCA became applicable.

EU Market Access Through MiCA Passporting

A Malta CASP license provides automatic passporting rights across all 27 EU member states. Cross-border services may be offered without obtaining additional national licenses, subject to MiCA notification procedures.

For EU-focused business models, this replaces multiple national authorization processes. Compared to parallel licensing in several major EU jurisdictions, this approach can reduce overall regulatory and legal costs by an estimated €2–3 million.

Tax Efficiency Within an EU Regulatory Framework

CASPs operating through Malta may benefit from an effective corporate tax rate of approximately 5% via the shareholder refund mechanism. This allows tax efficiency while remaining fully compliant with EU regulatory and substance requirements.

Institutional Perception and Banking Context

Malta authorization can support regulatory credibility when engaging EU banks, EMIs, and payment institutions. Banking access remains selective and case-specific. However, a Malta CASP license is generally perceived as more institutionally robust than authorizations from lightly regulated or newly established crypto jurisdictions.

Suitable Use Cases

Malta is most often selected by:

• CASPs targeting EU-wide regulated operations,
• firms requiring long-term regulatory certainty,
• projects prepared to meet substance, governance, and compliance expectations from the outset.

When Malta Is NOT the Right Jurisdiction for CASP

Malta is not a universal solution for all crypto projects. Its regulatory depth, cost structure, and substance requirements make it unsuitable for certain business profiles.

Typical Scenarios Where Malta Creates Risk

Limited budget or early-stage setup
With first-year costs typically at €200,000–€300,000 and capital starting from €50,000, Malta is rarely suitable for bootstrap or pilot-stage launches.

Expectation of fast or informal licensing
Malta does not offer light-touch or accelerated CASP authorization. Applications based on minimal substance or temporary arrangements often exceed the typical 3–6 months timeline.

Heavy reliance on outsourcing
Extensive outsourcing of core functions attracts increased scrutiny. Decision-making and control are expected to remain within the licensed entity.

Unclear business model
Applications must define services and operations upfront. Plans to refine the model after authorization commonly lead to re-scoping and delays.

High AML/CFT risk without mitigation
Complex transaction flows or weak monitoring frameworks require significant upfront investment to meet supervisory expectations.

Cost of a CASP License in Malta

Estimated First-Year Cost Structure

Cost assessment note

The cost of a Malta CASP license should be assessed as a first-year regulatory and operational budget, not as a standalone licensing fee. Projects involving custody, exchange, or trading platforms typically face higher substance, compliance, and capital expectations during MFSA review, which can increase total spend beyond baseline estimates.

Malta Corporate Tax Structure for CASPs

Malta applies a full-imputation corporate tax system. The statutory corporate tax rate is 35%, but licensed CASPs may reduce their effective tax burden through a shareholder refund mechanism, subject to tax residency and substance requirements.

For compliant structures, the mechanism results in an effective tax rate of approximately 5%.

Tax administration is handled by the Malta Inland Revenue Department.

Malta CASP Corporate Tax Overview

Practical Note

The 5% effective rate applies only where regulatory substance and shareholder eligibility are properly demonstrated. Malta should not be treated as a standalone tax structure disconnected from licensing and operations.

EU Passporting for Malta CASPs

A CASP license issued in Malta allows firms to operate across all 27 EU member states under MiCA through a passporting mechanism. This removes the need to obtain separate national licenses in each jurisdiction.

Passporting is coordinated by the Malta Financial Services Authority and is subject to notification requirements rather than re-authorization.

How MiCA Passporting Works

Once authorized in Malta, a CASP may:

• provide services cross-border from Malta, or
• establish branches in other EU member states.

In both cases, the process relies on regulatory notifications, not new licensing procedures.

Passporting Models Under MiCA

Notification and Supervision

Passporting requires:

• submission of a notification file to MFSA,
• onward transmission to host state regulators,
• compliance with local consumer protection and marketing rules.

Prudential supervision remains with the home regulator (MFSA).

Substance Requirements for Malta CASPs

Malta applies a substance-driven supervisory approach to CASP authorization. MFSA assesses whether strategic decision-making, risk oversight, and operational control are genuinely exercised from Malta rather than contractually assigned on paper.

In practice, substance is evaluated holistically. Local management involvement, an operational office, appointed key function holders, and effective oversight of outsourced activities are all considered together. Where substance is assessed as insufficient or artificial, the Malta Financial Services Authority typically extends the review process or attaches conditions to the authorization.

Ongoing Compliance Obligations

After authorization, CASPs remain subject to continuous regulatory oversight. Ongoing obligations typically include:

• periodic regulatory and prudential reporting,
• maintenance of AML/CFT controls and transaction monitoring,
• governance and risk function oversight,
• retention of minimum capital and substance thresholds,
• responsiveness to supervisory requests and inspections.

These requirements generate recurring compliance costs and apply regardless of transaction volume or business activity level.

About Gofaizen & Sherle and CASP Licensing in Malta

Gofaizen & Sherle is an international consulting and legal firm advising regulated business models across crypto, digital assets, fintech, payments, and tokenization. The firm operates across 50+ jurisdictions and has supported the structuring and licensing of 800+ regulated projects worldwide, including crypto-asset service providers operating under EU and non-EU regulatory regimes.

In the context of MiCA, Gofaizen & Sherle advises international clients on CASP authorization in Malta, supporting projects from activity scoping and license class selection through authorization and post-licensing compliance. The firm focuses on aligning business models with the supervisory expectations of the Malta Financial Services Authority, emphasizing governance, substance, and long-term regulatory sustainability rather than formal or transitional interpretations of MiCA.

Conclusion

A CASP license in Malta provides structured access to the EU crypto market under MiCA, combining regulatory stability, EU passporting, and tax efficiency. The jurisdiction is best suited for well-capitalized projects with a clear long-term EU strategy and readiness to meet substance and governance requirements. While Malta is not a low-cost or fast-track option, it offers predictability, experienced supervision, and scalability within a single regulatory framework. Choosing Malta requires careful activity scoping and realistic budgeting, but for the right business model, it remains one of the most robust CASP jurisdictions in the European Union.