MGA B2B Critical Gaming Supply Licence — Post-2024 Scope Guide

The 2024 expansion — what changed and why

The Malta Gaming Authority’s B2B regulatory framework operated relatively stably from the 2018 Gaming Act consolidation through 2023. Critical Gaming Supply Licence covered the principal technical providers — game platform software, RNG components, live-dealer streaming. Material Supply Licence (a lighter notification regime) covered non-critical suppliers. A range of technical and operational service layers sat outside both — software providers in adjacent categories operating without formal MGA supervision through narrow interpretation of Critical Gaming Supply scope.

The 2024 MGA Directive on Critical Gaming Supply scope reset the perimeter. Specific categories explicitly captured:

Aggregator wallets — wallet infrastructure providers serving multiple B2C operators with consolidated player-fund holding and payment-routing. The argument for inclusion: aggregator wallets materially affect gambling operations through payment infrastructure, AML risk profile, and customer-fund custody.

Game-server-side logic providers — entities operating server-side game logic for B2C operators (white-label and shared infrastructure arrangements). The argument for inclusion: game logic determines RTP, RNG outputs, and game integrity — materially affects gambling operations.

Payment-routing layers materially affecting gambling operations — payment-infrastructure providers operating in the layer between operator and acquirer where the routing decisions affect player payment outcomes or AML monitoring. Narrower scope than general payment processing — targets layers with material gambling-operational impact.

The Directive followed industry consultation and reflected MGA supervisory experience that these categories were operating with material impact on gambling operations without formal supervisory oversight. The post-2024 framework brings them into the regulatory perimeter under standard B2B Critical Gaming Supply Licence conditions.

What’s in Critical Gaming Supply vs Material Supply

The distinction between Critical Gaming Supply (full B2B licence) and Material Supply (lighter notification) is now clearer after the 2024 Directive but still requires substantive analysis for ambiguous service offerings.

Critical Gaming Supply (full B2B licence required):

• Game platform software (the platform on which games run)
• Random Number Generator components
• Live-dealer streaming infrastructure
• Game-server-side logic providers (post-2024 expansion)
• Aggregator wallets (post-2024 expansion)
• Payment-routing layers materially affecting gambling operations (post-2024 expansion)
• Specific other technical providers determined by MGA on case-by-case basis

Material Supply (lighter notification regime):

• Marketing-services providers (advertising, performance marketing)
• Geo-location services
• Certain analytics and reporting providers
• General SaaS not specific to gambling operations
• Affiliate-marketing platforms (subject to other affiliate-marketing rules)

Out of MGA scope entirely:

• General-purpose technology vendors (cloud infrastructure, generic software)
• Professional services (legal, accounting, audit)
• Office services (real estate, facilities)

The ambiguity sits at the boundary cases. A payment-routing layer that provides standard PSP services without gambling-specific routing logic is typically Out of Scope. The same layer with gambling-specific routing rules, AML monitoring integration, or operator-managed routing decisions becomes Critical Gaming Supply. The substantive impact on gambling operations is the test, not the service description.

Application process and cost

The MGA B2B Critical Gaming Supply Licence application is structurally similar to B2C Type applications but proportionate to B2B operational scope.

Application fee — EUR 5,000 + due-diligence and consultancy costs EUR 10,000-25,000.

Annual licence fee — EUR 25,000 per licence.

Application timeline — 4-7 months from complete file for clean B2B applications. Lighter than B2C (6-12 months) because the substance and operational evaluation is proportionate to B2B scope.

Substance requirements:

• Maltese registered entity
• AML/MLRO function
• Governance arrangements proportionate to B2B operations (board structure, risk management, compliance function)
• Key persons subject to fit-and-proper review
• Sufficient operational presence for substantive MGA engagement

Ongoing reporting — quarterly returns to MGA, monthly compliance contributions (proportionate to B2B services revenue), annual external audit, ongoing supervisory engagement.

Substance for B2B operations

B2B substance requirements are proportionate to operational scope but substantively real. The MGA expects:

Maltese operational presence — registered office, local-corporate-services-provider arrangement at minimum. Many B2B licensees operate with smaller Maltese staff complement than B2C licensees (typically 3-10 staff for B2B vs 15-30 for established B2C).

Key persons — fit-and-proper review of CEO, MLRO, Key Function holders for IT, Compliance. Maltese residency is preferred for at least one or two key persons; remote senior management is acceptable subject to documented working presence and ability to attend the MGA in person.

AML programme — substantive AML programme aligned with FIAU AML Implementing Procedures. B2B providers face indirect AML risk through their B2C operator customers; the AML programme must address the substantive risk profile rather than relying on B2C operator AML programmes.

Governance — board structure with documented risk management, internal controls, three-lines-of-defence model proportionate to operational scale. Smaller B2B operations face proportionately-lighter governance documentation requirements but the substantive expectation is real.

Cross-border B2B scope — serving non-Malta operators

The MGA B2B Critical Gaming Supply Licence authorises service provision to B2C gambling operators globally — not limited to Malta-licensed B2C operators. A Maltese B2B licensee can serve operators in:

• Other MGA-licensed B2C operators in Malta
• B2C operators in other EU jurisdictions (Sweden, Germany, France, etc.)
• B2C operators in non-EU jurisdictions (UK, IoM, Gibraltar, Curaçao, etc.)
• Global B2C operators across multiple jurisdictions

The MGA B2B framework is structurally one of the most operationally flexible B2B frameworks in iGaming because of this cross-border scope. Maltese B2B licensees can build global B2C operator customer bases from a single regulatory home.

The trade-off: MGA B2B Licensees must ensure their B2C operator customers hold appropriate gambling licences in their respective jurisdictions. Serving unlicensed B2C operators creates indirect regulatory and AML risk for the B2B Licensee. Documented operator-licence verification at customer onboarding plus ongoing monitoring is the MGA expectation.

When MGA B2B is the right choice

Critical Gaming Supply providers serving multiple jurisdictions — operators whose B2C customers span multiple jurisdictions benefit from the cross-border scope of MGA B2B. Single MGA authorisation enables service provision globally.

Established B2B operations professionalising regulatory cover — providers previously operating in unregulated grey zones (particularly post-2024 expanded scope categories) bringing operations into formal supervision. The MGA framework provides regulatory clarity for ongoing operations.

Operators positioning for institutional capital — institutional investors and acquirers increasingly require formal B2B regulatory authorisation as part of due-diligence. MGA B2B is recognised and well-understood in institutional contexts.

Aggregator and payment-routing providers post-2024 — providers in the categories explicitly captured by the 2024 expansion. The choice is between MGA B2B authorisation or restructuring operations to fall outside the expanded scope (which is often operationally impractical).

MGA B2B is the wrong choice for providers whose service genuinely falls under Material Supply (lighter regime is appropriate), providers serving only one jurisdiction’s operators where local B2B regulatory cover would be sufficient, or providers whose business model is incompatible with the Maltese substance and operational engagement requirements.