🇲🇹 Malta · Malta Gaming Authority (MGA)

Malta Online Gambling Licence — 2026

The gold-standard EU online gambling licence — strict MGA supervision, strong reputational signal, B2B and B2C cleanly separated, mature supplier ecosystem since 2004.

Tier 1 — Premium reputation

Malta has been the architectural template for European online gambling licensing since the Lotteries and Other Games Act 2001. The Malta Gaming Authority (MGA), established 2004, regulates one of the world's largest concentrations of remote-gambling operators — over 300 licensed B2C and B2B entities employ roughly 12% of Malta's GDP. The MGA licence carries the strongest reputational signal in EU iGaming and is the benchmark against which other tier-1 regulators are compared.

The current regime under the Gaming Act 2018 consolidated the previous multi-class structure into two principal frameworks: B2C (Gaming Service Licence) covering operators that take customer bets, and B2B (Critical Gaming Supply Licence) covering platform providers, RNG suppliers, and live-dealer providers. Each B2C licence further subdivides into Type 1 (casino games where outcomes depend on RNGs), Type 2 (sports betting against the house), Type 3 (peer-to-peer poker and exchange betting), and Type 4 (controlled skill games and fantasy sports).

The substance bar is uniquely real among Tier 1 regulators. MGA file teams test physical presence, key-person residency, and operational depth at first review — Malta is not a "letterbox jurisdiction" in any practical sense, and the substance audit is the most common reason for first-application rejection.

Quick facts

Regulator	Malta Gaming Authority ↗
Tier	Tier 1 — Premium reputation
Licence types	B2C Type 1 — casino, B2C Type 2 — sports betting, B2C Type 3 — poker / peer-to-peer, B2C Type 4 — controlled skill games, B2B Critical Gaming Supply, Material Supply Licence
Application cost	EUR 5,000 application + EUR 25,000-50,000 due-diligence & consultancy
Annual cost	EUR 25,000-35,000 annual licence per Type + 5% compliance contribution on GGR
Gaming tax	0.4-5% of GGR (sliding scale by revenue band) + 5% compliance contribution
Corporate tax	35% headline; ~5% effective via shareholder refund mechanism for non-Maltese owners
Substance	Registered office in Malta; at least two key persons resident in Malta or EU; documented physical presence; data centre or cloud hosted in MGA-approved facility
Timeline	6-12 months end-to-end; 90-day temporary licence period for technical implementation

Pros

Highest reputational signal in EU iGaming
B2B and B2C regimes cleanly separated
MGA case team accessible in English; substantive engagement
Mature ecosystem of payment processors, banks, and suppliers

Cons

High annual fees and compliance cost
Heavy substance bar — letterbox arrangements rejected at first review
EU passporting is operationally limited (most host member states require local licence regardless)
35% headline corporate tax (5% effective requires shareholder structuring through holding co)

Best for

EU-customer operators wanting top reputational tier
B2B suppliers needing critical-gaming-supply licence
Multi-product operators (casino + sports + poker on one stack)
Operators raising institutional capital

Malta gaming licence types — B2C vs B2B

The B2C Gaming Service Licence authorises an operator to take bets from end-customers across the four Type categories. Most operators apply for combined Type 1 + Type 2 (casino + sportsbook) on a single licence, with optional Type 3 (poker) added where peer-to-peer products are offered. The B2B Critical Gaming Supply Licence is a separate authorisation for any entity providing platform software, RNG components, live-dealer streaming, or other critical gaming services to B2C operators. The B2B regime tightened materially in 2024 — the Critical Gaming Supply definition was expanded to capture aggregator wallets, game-server-side logic providers, and certain payment-routing layers. Operators that previously sat in unregulated grey zones now require B2B authorisation. A separate Material Supply Licence covers non-critical suppliers (e.g., marketing-services providers, geo-location services) under a lighter notification regime.

Cost structure — what an MGA licence really costs

The headline MGA fees are misleadingly modest. The published application fee is EUR 5,000 per Type, with annual licence renewal at EUR 25,000-35,000 per Type. The substantive cost lives in (a) due-diligence and consultancy fees through the application phase (EUR 25,000-50,000 typical for a clean Type 1+2 file), (b) the 5% compliance contribution on monthly GGR paid to the MGA Players Protection Fund, (c) Malta corporate setup (~EUR 5,000-10,000 plus retainer for company secretary and registered office), and (d) the ~EUR 250,000-500,000 annualised cost of substantive Maltese operational presence — local senior management, AML and compliance team, MGA reporting infrastructure. The gaming-tax sliding scale starts at 0.4% of GGR for revenue under EUR 3M, rising to 5% above EUR 30M; in practice most established mid-tier operators land in the 1-3% effective range. Malta's corporate-tax position requires structuring — the 35% headline drops to ~5% effective only through a Malta holding-company structure with a non-Maltese-resident parent that claims the 6/7 refund.

Application process and the 90-day temporary licence

The MGA application runs through five formal phases: (1) initial inquiry and fit-and-proper pre-checks on directors and qualifying shareholders (>10% holdings), (2) full submission of the business plan, technical documentation, AML programme, and financial projections, (3) systems audit by an MGA-certified third-party tester to verify RNG, RTP, and game integrity, (4) issuance of the 90-day temporary licence which permits go-live and technical implementation, and (5) full licence grant after the temporary period if compliance is demonstrated. The 90-day window is the critical operational gate — operators that miss it have to apply for an extension or face suspension. The MGA expects the operator to use this period to integrate Player Protection Directives (deposit limits, self-exclusion via Self-Exclusion Register, reality-checks), complete its IT-security and BCP attestations, and onboard the central reporting infrastructure. End-to-end timeline from first inquiry to full licence is typically 6-12 months; complex multi-Type applications run longer.

Substance, fit-and-proper, and the MGA's rigour

Substance under the Gaming Act is more than a registered address. The MGA expects key functions (CEO, MLRO, Key Function holders for IT, Customer Protection, Finance) to be physically resident in Malta or another EU member state with documented working presence and the ability to attend the MGA in person on short notice. Local employees are not strictly mandated by the rules but in practice the MGA prefers to see Malta-resident senior compliance staff. Fit-and-proper testing covers directors, qualifying shareholders, and Key Function holders, with criminal-record checks across all jurisdictions of nationality and prior residence, reputation checks, and source-of-wealth review for the qualifying shareholders. The MGA cooperates closely with the FIAU (Maltese FIU) and the Maltese Police on suitability checks, and has visibly tightened post-2018 in response to FATF grey-list pressure. Applicants with adverse prior regulatory history (suspended licences elsewhere, criminal records of key persons) face material risk of refusal even at the pre-application phase.

EU passporting and the local-licence overlay

A Malta licence does not by itself grant operating right in every EU member state. While EU services freedom in principle covers gambling, every EU member state has imposed local licensing requirements via the public-policy carve-out (Articles 51 and 52 TFEU), and most enforce against unlicensed inbound operators. Germany requires its own licence under the Glücksspielstaatsvertrag; the Netherlands requires KSA licence; Sweden requires Spelinspektionen licence; Spain DGOJ; France ANJ — among others. The Malta licence remains useful as: (a) the home-state regulatory foundation for an operator structuring multi-jurisdictional services, (b) the licence enabling operation into the remaining "open" EU markets (small markets without local regulation), (c) the licence accepted by major payment processors and B2B suppliers as proof of regulated status, and (d) the licence required for serving non-EU markets via a Maltese base where Malta-licensed operations carry a trust premium. In practice, established multi-national operators (Bet365, Entain, Flutter, Kindred) hold MGA licences alongside multiple host-state licences.

Application process

Stage 1 — Pre-engagement: company structure analysis, beneficial-owner mapping, fit-and-proper pre-check on directors and qualifying shareholders (>10%)
Stage 2 — Maltese company formation: incorporate Maltese limited company, appoint local directors (or use Malta-corporate-services provider), open Maltese bank account
Stage 3 — Application file submission: business plan, financial projections (3-year), AML programme, ICT framework, key-function appointments, technical documentation
Stage 4 — MGA review and information requests: typically 2-4 rounds of clarifications over 8-16 weeks
Stage 5 — Systems audit: MGA-certified third party (typically Gaming Laboratories International, BMM, or eCOGRA) tests RNG, RTP, game certificates, integration
Stage 6 — 90-day temporary licence: live operations permitted, customer onboarding begins, full Player Protection Directive integration required
Stage 7 — Full licence grant: after the 90-day window if all compliance milestones are met
Stage 8 — Ongoing compliance: quarterly returns to MGA, monthly compliance contribution (5% GGR), annual external audit

Operational realities

Capital requirements

No specific share-capital floor for MGA B2C licences (unlike Curaçao or some offshore regimes). However, the MGA requires the operator to maintain "sufficient financial resources" to meet ongoing player liabilities, which in practice means working capital equivalent to at least 30 days of average customer-deposit balances plus reserves. Malta-resident audited financial statements are required annually. For B2B Critical Gaming Supply licensees the financial-resources standard is less prescriptive but proportional to the operational scale.

Player protection

The MGA Player Protection Directives are among the most comprehensive in iGaming. Operators must implement: (a) deposit limits (daily, weekly, monthly) configurable by the customer at any time; (b) reality-check notifications at minimum every 60 minutes of continuous play; (c) self-exclusion options at the operator level and through the central Self-Exclusion Register (mandatory integration since 2020); (d) cooling-off periods after losses above defined thresholds; (e) age-verification at the strictest standard in EU iGaming; (f) responsible-gambling messaging on all marketing materials; (g) reporting of problem-gambling indicators to the MGA quarterly. The 5% compliance contribution on GGR feeds the MGA Players Protection Fund used for player-compensation in operator-insolvency scenarios.

Banking & payment processing

Maltese banks (Bank of Valletta, HSBC Malta, APS Bank) have varying appetite for iGaming clients — historically restrictive after the 2018 FIAU restructuring but improving since 2023. Most established operators bank through EMI partners (notably Revolut Business, ConnectPay, Bilderlings) or specialist EU iGaming-friendly banks (Bank Frick, KapitalBank, several Liechtenstein institutions). The MGA does not require Maltese-bank accounts but requires the operating account to be EU-located and the operator to demonstrate banking arrangements adequate to handle player deposit/withdrawal volumes. Cross-border SEPA Instant adoption has eased payment-processing setup compared with five years ago.

B2B vs B2C licensing

The B2C vs B2B distinction is more substantive than other jurisdictions. B2C is the gambling-operator licence — taking customer bets directly. B2B is the supplier licence — providing critical platform components (game servers, RNG, live-dealer streams, aggregator wallets) to B2C operators. A single entity can hold both if structurally appropriate, but most operators hold either-or. The B2B Critical Gaming Supply regime expanded in 2024 to cover several previously-unregulated technical layers; software providers operating in Malta without B2B authorisation should reassess scope.

Recent developments (2025-2026)

MGA published 2026 Strategy emphasising supervisory rigour over throughput; B2B regime tightened on Critical Gaming Supply scope; new Sandbox Framework for blockchain-asset games published 2025.

How it compares

Versus Isle of Man (GSC): Malta is larger and more cost-effective but with higher gaming-tax exposure (5% effective vs IoM 0.1-1.5%). IoM has 0% corporate tax versus Malta's 5% effective. Both Tier 1 reputation, both accept crypto-payment. IoM has lighter operational substance demand. Versus Gibraltar: Malta has lower entry cost but more bureaucracy; Gibraltar has the lightest tax burden of any Tier 1 (~0.15% gaming yield capped at GBP 425k/year). Versus Curaçao: Malta requires 10x the operational investment but produces materially stronger reputational signal, payment-processor acceptance, and B2B-supplier credibility.

Frequently asked questions

How long does an MGA gambling licence application take?

Six to twelve months end-to-end for a clean first-time application. The MGA pre-review and information requests typically run 8-16 weeks; the systems audit adds 4-8 weeks; the 90-day temporary licence period concludes the cycle. Complex multi-Type applications or applications with adverse fit-and-proper findings can extend to 18-24 months.

What is the difference between MGA Type 1, Type 2, Type 3, and Type 4?

Type 1 covers casino games (slots, table games) where outcomes depend on Random Number Generators. Type 2 covers sports betting against the house (fixed-odds). Type 3 covers peer-to-peer games where the operator is not a counterparty (poker, exchange betting). Type 4 covers controlled skill games and fantasy sports. Most casino-and-sportsbook operators apply for combined Type 1 + Type 2 on a single licence.

Does an MGA licence let me operate across the EU?

Not by itself. Most EU member states have imposed local licensing requirements via the public-policy carve-out. Germany requires Gemeinsame Glücksspielbehörde der Länder (GGL) licence; Netherlands requires KSA; Sweden Spelinspektionen; Spain DGOJ; France ANJ. The MGA licence enables Malta-domiciled operation, payment-processor and B2B-supplier acceptance, and access to the remaining unregulated EU markets — but not free passporting into regulated member states.

How much does an MGA gambling licence cost in total?

Headline EUR 5,000 application fee plus EUR 25,000-35,000 annual licence fee per Type. Substantive cost is much higher — typically EUR 250,000-500,000 in the first year covering Maltese company setup, due-diligence and consultancy, systems audit, Maltese operational presence, MGA application support, and the 5% compliance contribution on GGR. Ongoing annual cost from year two settles around EUR 200,000-400,000 plus the 5% GGR contribution and corporate tax.

Can a non-EU company hold an MGA licence?

The licensed entity must be a Maltese-incorporated company. The ultimate beneficial owners can be of any nationality, subject to MGA fit-and-proper review (criminal-record checks, source-of-wealth verification, reputation review). Owners from FATF grey-listed or sanctioned jurisdictions face enhanced due diligence and may be refused. EU-resident ultimate beneficial owners face a lighter review process than non-EU residents.

What is the MGA Players Protection Fund?

The fund into which operators pay the 5% compliance contribution on GGR. Its primary purpose is to compensate players in scenarios where a licensed operator becomes insolvent and cannot meet customer balances. The fund is administered by the MGA and has been used in several historical operator-failure cases. The contribution is a substantial ongoing cost but is also a substantive player-protection mechanism that distinguishes the MGA framework from offshore regimes.

Is the MGA licence good for cryptocurrency-payment iGaming?

Yes, with conditions. The MGA permits crypto-currency payment integration where the operator complies with AML/CFT obligations under the FIAU AML Implementing Procedures and the operator demonstrates adequate provenance verification on deposits. The MGA Sandbox Framework for Blockchain-Asset Games (2025) provides a controlled environment for blockchain-native gambling products. Crypto-only operators face heavier substance and AML scrutiny than fiat-equivalent operators.

Named experts covering Malta

Real, publicly-verifiable practitioners whose work informs our coverage of this jurisdiction.

James Scicluna Co-founding Partner · WH Partners Gaming & gambling · Regulatory & corporate · Licensing Olga Finkel Co-founding Partner · WH Partners Gaming law · Licensing frameworks · Disputes Dr Ian Gauci Managing Partner · GTG Advocates Gaming/gambling · Fintech & technology · Regulatory