CASP License in Malta (MiCA)

A CASP (Crypto-Asset Service Provider) license in Malta authorizes a company to provide regulated crypto-asset services across the European Union under MiCA. CASP authorization in Malta is issued by the Malta Financial Services Authority, which acts as the competent national authority for MiCA implementation.

Malta introduced a dedicated crypto regulatory framework in 2018 under the Virtual Financial Assets Act. This early supervisory experience now informs how MFSA applies MiCA requirements, with emphasis on governance, internal controls, and long-term sustainability.

Malta applies the Markets in Crypto-Assets Regulation (MiCA) through its national competent authority, the Malta Financial Services Authority. MFSA is responsible for CASP authorization, ongoing prudential supervision, and enforcement of MiCA requirements at the national level.

Unlike jurisdictions that adopted crypto regulation only after MiCA was finalised, Malta entered the MiCA framework with an established supervisory infrastructure. This has a direct impact on how CASP applications are reviewed, assessed, and monitored.

From the VFA Framework to CASP Authorization

Before MiCA entered into force, Malta regulated crypto-asset activities under the Virtual Financial Assets (VFA) Act, which introduced licensing and ongoing supervision for crypto businesses as early as 2018.

With the application of MiCA, the VFA framework no longer serves as a standalone licensing regime for crypto-asset service providers. New market entrants must apply directly for CASP authorization under MiCA. Existing VFA license holders are required to transition to the CASP regime.

VFA to CASP Transition (Grandfathering Period)

MiCA provides an 18-month grandfathering period for crypto-asset service providers licensed under national frameworks prior to MiCA. In Malta, this transition period ends on 1 July 2026.

During the grandfathering period:

• existing VFA license holders may continue operating under their current authorization,
• CASP applications must be submitted within the prescribed timeframe,
• firms are expected to progressively align governance, capital, and compliance structures with MiCA standards.

Failure to obtain CASP authorization by the end of the grandfathering period results in the loss of the right to provide crypto-asset services within the EU.

Simplified Application for Existing VFA License Holders

In practice, streamlined review is typically limited to:

• governance structures previously assessed by MFSA,
• historical compliance performance,
• existing operational substance in Malta.

Capital requirements must still meet MiCA thresholds of €50,000 to €150,000, depending on the CASP service class. Overall first-year compliance and operational costs commonly remain within the €200,000–€300,000 range, including capital, staffing, and infrastructure.

Regulatory Oversight and AML/CFT Supervision

In addition to prudential supervision by MFSA, CASPs in Malta are subject to AML/CFT oversight by the Financial Intelligence Analysis Unit.

Ongoing supervision includes periodic reporting, compliance reviews, and targeted inspections. Particular attention is typically paid to transaction monitoring, outsourcing arrangements, and governance effectiveness.

Under MiCA, capital requirements depend on the CASP service class. In Malta, statutory capital represents a minimum entry threshold, not an automatic indicator of regulatory approval.

Minimum Capital Thresholds

Regulation (EU) 2023/1114 (MiCA) establishes the following minimum own funds:

• €50,000 — Class 1 (advisory and order transmission, no custody);
• €125,000 — Class 2 (custody, exchange, wallet services);
• €150,000 — Class 3 (trading platform operations).

Capital must be fully paid up prior to authorization and maintained on an ongoing basis.

When Capital Above the Minimum Is Required

The Malta Financial Services Authority assesses whether proposed capital is proportionate to the CASP’s actual risk profile.
In practice, higher capital is commonly expected where the business model involves custody, multiple CASP services, high transaction volumes, complex outsourcing arrangements, or exposure to higher-risk clients or markets.

In such cases, statutory minimums are often insufficient.

Capital as an Ongoing Requirement

Capital adequacy is reviewed on a continuous basis. MFSA evaluates own funds together with governance, staffing, technology, and compliance capacity to ensure resilience under operational or market stress.

Decision Summary (At a Glance)

Malta is typically selected when a CASP requires:

• EU-wide operations under a single MiCA authorization,
• predictable supervisory expectations from an experienced regulator,
• a regulated EU structure combined with tax efficiency,
• long-term operational stability rather than speed or low entry cost.

Established Supervisory Practice

Malta introduced a dedicated crypto regulatory framework in 2018. This resulted in a developed supervisory track record before MiCA entered into force.
As a consequence, the Malta Financial Services Authority applies MiCA within an already established control environment. Supervisory expectations are generally clearer and more consistent than in jurisdictions that began crypto supervision only after MiCA became applicable.

EU Market Access Through MiCA Passporting

A Malta CASP license provides automatic passporting rights across all 27 EU member states. Cross-border services may be offered without obtaining additional national licenses, subject to MiCA notification procedures.

For EU-focused business models, this replaces multiple national authorization processes. Compared to parallel licensing in several major EU jurisdictions, this approach can reduce overall regulatory and legal costs by an estimated €2–3 million.

Tax Efficiency Within an EU Regulatory Framework

CASPs operating through Malta may benefit from an effective corporate tax rate of approximately 5% via the shareholder refund mechanism. This allows tax efficiency while remaining fully compliant with EU regulatory and substance requirements.

Institutional Perception and Banking Context

Malta authorization can support regulatory credibility when engaging EU banks, EMIs, and payment institutions. Banking access remains selective and case-specific. However, a Malta CASP license is generally perceived as more institutionally robust than authorizations from lightly regulated or newly established crypto jurisdictions.

Suitable Use Cases

Malta is most often selected by:

• CASPs targeting EU-wide regulated operations,
• firms requiring long-term regulatory certainty,
• projects prepared to meet substance, governance, and compliance expectations from the outset.

Malta is not a universal solution for all crypto projects. Its regulatory depth, cost structure, and substance requirements make it unsuitable for certain business profiles.

Typical Scenarios Where Malta Creates Risk

Limited budget or early-stage setup
With first-year costs typically at €200,000–€300,000 and capital starting from €50,000, Malta is rarely suitable for bootstrap or pilot-stage launches.

Expectation of fast or informal licensing
Malta does not offer light-touch or accelerated CASP authorization. Applications based on minimal substance or temporary arrangements often exceed the typical 3–6 months timeline.

Heavy reliance on outsourcing
Extensive outsourcing of core functions attracts increased scrutiny. Decision-making and control are expected to remain within the licensed entity.

Unclear business model
Applications must define services and operations upfront. Plans to refine the model after authorization commonly lead to re-scoping and delays.

High AML/CFT risk without mitigation
Complex transaction flows or weak monitoring frameworks require significant upfront investment to meet supervisory expectations.

Malta applies a substance-driven supervisory approach to CASP authorization. MFSA assesses whether strategic decision-making, risk oversight, and operational control are genuinely exercised from Malta rather than contractually assigned on paper.

In practice, substance is evaluated holistically. Local management involvement, an operational office, appointed key function holders, and effective oversight of outsourced activities are all considered together. Where substance is assessed as insufficient or artificial, the Malta Financial Services Authority typically extends the review process or attaches conditions to the authorization.

After authorization, CASPs remain subject to continuous regulatory oversight. Ongoing obligations typically include:

• periodic regulatory and prudential reporting,
• maintenance of AML/CFT controls and transaction monitoring,
• governance and risk function oversight,
• retention of minimum capital and substance thresholds,
• responsiveness to supervisory requests and inspections.

These requirements generate recurring compliance costs and apply regardless of transaction volume or business activity level.

Gofaizen & Sherle is an international consulting and legal firm advising regulated business models across crypto, digital assets, fintech, payments, and tokenization. The firm operates across 50+ jurisdictions and has supported the structuring and licensing of 800+ regulated projects worldwide, including crypto-asset service providers operating under EU and non-EU regulatory regimes.

In the context of MiCA, Gofaizen & Sherle advises international clients on CASP authorization in Malta, supporting projects from activity scoping and license class selection through authorization and post-licensing compliance. The firm focuses on aligning business models with the supervisory expectations of the Malta Financial Services Authority, emphasizing governance, substance, and long-term regulatory sustainability rather than formal or transitional interpretations of MiCA.

A CASP license in Malta provides structured access to the EU crypto market under MiCA, combining regulatory stability, EU passporting, and tax efficiency. The jurisdiction is best suited for well-capitalized projects with a clear long-term EU strategy and readiness to meet substance and governance requirements. While Malta is not a low-cost or fast-track option, it offers predictability, experienced supervision, and scalability within a single regulatory framework. Choosing Malta requires careful activity scoping and realistic budgeting, but for the right business model, it remains one of the most robust CASP jurisdictions in the European Union.