Malta

The defining licensing development this cycle is the closure of MiCA's Article 143 transitional grandfathering mechanism. That provision had permitted existing Malta crypto-asset providers who were operating lawfully before 30 December 2024 to continue operating without MiCA authorisation until the earlier of authorisation, refusal, or a fixed cutoff date. A Challenger finding corrected that cutoff this cycle: the deadline is 1 July 2026, not the 30 June 2026 date originally recorded, per ESMA's official grandfathering-periods tracker -- and that corrected deadline has now passed. The practical consequence is that Malta's crypto-licensing regime has moved from a transitional posture to a settled one: every provider must now hold full MiCA authorisation, with no residual grandfathering cover remaining.

That settlement, however, comes with a live supervisory-quality caveat. An ESMA fast-track peer review of MFSA's CASP authorisation and supervision practice found that MFSA authorised at least one CASP despite unresolved issues, and identified gaps in governance arrangements, conflicts-of-interest management, ICT architecture, and business-risk assessment -- alongside positive findings on MFSA's resourcing levels and supervisory engagement. Related to this, MFSA's accelerated pre-authorisation pathway for existing VFA licence holders transitioning to MiCA CASP status has drawn industry commentary characterising it as favourable or fast-tracked treatment; this cycle's review reframed that characterisation away from an affirmative 'quasi-equivalence recognition' (which the underlying source itself does not assert) and toward what the ESMA peer review frames as industry-observed practice that itself drew supervisory scrutiny. No field values were changed in that reframing -- the claim's confidence remains Probable, as it was already, but the characterisation was tightened to avoid overstating a formal equivalence determination that ESMA's review does not describe as having occurred.

Traffic light for this module remains green: Malta operates a comprehensive, binding licensing regime combining VFA Act and MiCA CASP authorisation, and the transitional period has now definitively closed, leaving a settled authorisation requirement. The green rating nonetheless carries the ESMA peer-review caveat as a material qualifier rather than a disqualifying factor, since the underlying legal requirement to be authorised is not in doubt -- only the quality of some past authorisation decisions.

Outlook

The open question for this module is what, if anything, follows from ESMA's critical peer review of MFSA's fast-track authorisation practice. As of this cycle, it is not known whether any authorised CASPs are subject to remediation, corrective measures, authorisation review, or any EU-level escalation -- this is flagged as an unresolved research question requiring direct MFSA/ESMA follow-up. Given that the underlying licensing perimeter is otherwise settled, the trajectory to watch is less about new legislative change and more about supervisory enforcement follow-through: whether Malta's regulator responds visibly to the peer-review criticisms, and whether that response affects market confidence in the fast-track pathway that helped establish Malta's positioning as a CASP hub. Any confirmed action on this front would likely shift the module's traffic-light rationale, even without a change to the underlying legal requirement.

A further classification question concerns non-fungible tokens. MFSA had proposed excluding NFTs displaying clear uniqueness and non-fungibility from the scope of the VFA framework, a move that anticipated MiCA's own NFT exclusion at EU level. This remains recorded as a proposal rather than a finalised legal change, and is non-binding in its current form, consistent with its low materiality rating relative to the ART/EMT and Financial Instrument Test claims.

Taken together, the picture is one of a token-classification regime that is largely settled and increasingly harmonised: the EU-level ART/EMT taxonomy under MiCA now takes precedence for stablecoin-type instruments, while the national Financial Instrument Test continues to do useful classificatory work for the broader universe of DLT assets that fall outside ART/EMT status, and NFT treatment is being actively aligned across both regimes rather than left as an unresolved conflict. The module's green traffic light reflects that settled taxonomy and the absence of any live classification dispute, notwithstanding the confidence downgrade on the ART/EMT sourcing.

Outlook

The classification regime itself is not expected to change materially in the near term; MiCA's Titles III/IV taxonomy is directly applicable EU law and Malta's residual national test is already substantially harmonised with it. The item most likely to move is NFT scope: whether MFSA's earlier exclusion proposal, and MiCA's parallel EU-level exclusion, are finalised in a way that leaves no residual gap for tokens marketed with fungibility-adjacent features (fractionalised NFTs, NFT-backed collateral products, and similar hybrid instruments) that may not cleanly fit either the 'unique NFT' exclusion or the ART/EMT/financial-instrument categories. No specific timeline for that finalisation is recorded in this cycle's evidence base, and the underlying claims here were carried forward unchanged from the prior baseline research pass on the NFT and Financial Instrument Test points, meaning the last confirmed movement on this front is the ART/EMT sourcing correction rather than any substantive taxonomy change.

At the EU level, the joint EBA/ESMA report published under MiCA Article 142 analysed DeFi adoption, lending, borrowing and staking business models alongside associated ICT and money-laundering/terrorist-financing risks, but stopped short of issuing binding policy recommendations. This leaves the on-chain activity space governed, for now, by MiCA's general provisions rather than any bespoke DeFi-specific rule: crypto-asset service providers offering crypto-asset lending services remain subject to MiCA's general conduct obligations -- acting honestly, fairly and professionally, and ensuring fair, clear and non-misleading marketing communications -- notwithstanding the absence of a dedicated DeFi-lending authorisation regime. This is a meaningful gap-filler rather than a settled bespoke framework: it means lending-type DeFi activity touching a regulated CASP is not unregulated, but nor is it subject to rules designed specifically for its risk profile.

The module's amber traffic-light rating reflects this state of affairs precisely: no settled, finalised licensing treatment exists specifically for DeFi, staking, lending, mining or node-operation activities, and the MFSA discussion paper -- the most concrete sign of movement toward such a treatment -- is pre-final, with outcomes not yet determined.

Outlook

The single most consequential open item for this module is the outcome of MFSA's DeFi discussion paper. Depending on what MFSA publishes following the consultation's reported 10 July 2026 close, Malta could either formalise a 'decentralisation spectrum' test that brings some DeFi protocols within MiCA's authorisation perimeter -- a meaningfully expansive move relative to the current EU-level treatment -- or decide against bespoke rulemaking and leave the general-conduct-obligation baseline in place. Either outcome would be significant enough to shift this module's traffic-light rating, and the current amber status should be read as provisional pending that publication. In the interim, EU-level thinking remains at the report-and-analysis stage rather than the rulemaking stage, with the EBA/ESMA Article 142 report functioning as an evidence base rather than a binding instrument; any future EU-level DeFi authorisation proposal would likely track the themes -- centralisation-in-fact, ICT risk, and ML/TF exposure -- that the joint report and MFSA's own discussion paper both surface.

These reserve, own-funds and disclosure obligations were all downgraded this cycle from Confirmed to Probable confidence, as part of a batch correction affecting seven claims across the stablecoin, consumer-protection and token-classification modules. The underlying issue was sourcing quality rather than substance: each of these claims rested solely on a T2 ESMA overview page summarising MiCA's provisions, rather than the MiCA regulation text (a T1 source) itself, which fails the crypto monitor's confidence-floor rule requiring at least two independent T1/T2 anchors before a claim can carry Confirmed status. The underlying regulatory requirements themselves are not in doubt -- MiCA Titles III and IV are directly applicable, binding EU law -- but the composed record reflects a more conservative confidence rating on these specific claims pending a stronger primary-source anchor.

A related compliance-timing development: ESMA and the European Commission set an end-Q1-2025 deadline for CASPs and issuers to bring non-MiCA-compliant ART/EMT (stablecoin) offerings into compliance with Titles III and IV. That deadline has now passed, and this claim -- also downgraded to Probable under the same T2-sourcing batch correction -- describes a compliance deadline for bringing legacy offerings into line with an already-binding regime, rather than a commencement date for the regime itself, which took effect earlier under MiCA's general applicability timeline.

The module's green traffic light reflects that stablecoin issuance, reserve, redemption and disclosure requirements are fully binding, in force, and administered by a settled national competent authority, notwithstanding the confidence downgrades applied to several individual claims this cycle.

Outlook

No open stablecoin-specific rulemaking is recorded for Malta this cycle; the regime is directly-applicable EU law and Malta's implementation runs through MFSA's designated competence rather than any Malta-specific stablecoin statute. The item most likely to generate future movement is not a new rule but stronger primary-source verification: several of this module's claims currently rest on ESMA's T2 overview material rather than the MiCA regulation text itself, and closing that sourcing gap would allow the Confirmed-tier confidence these claims previously carried to be re-established on firmer ground. Separately, and outside this module's direct scope but adjacent to it, the world-payments monitor's interest in ART/EMT reserve and redemption mechanics as payment-instrument-adjacent obligations means any future EU-level amendment to MiCA's Title III/IV reserve or redemption requirements would likely carry cross-monitor significance.

A materially important qualifier on this module comes directly from supervisors rather than from any gap in the rules as drafted. The Joint European Supervisory Authorities (EBA, ESMA and EIOPA) have warned that MiCA's consumer protections for crypto-assets are less extensive than for traditional financial products, and that no compensation scheme applies if a crypto-asset service provider fails -- meaning a Malta-licensed CASP's clients do not benefit from anything equivalent to a deposit-guarantee or investor-compensation scheme in the event of provider failure. This warning claim was also downgraded to Probable under the same batch sourcing correction, but its substantive content -- supervisors themselves flagging a structural protection gap -- is unaffected by that confidence adjustment.

A further disclosure obligation applies specifically to crypto-asset lending: CASPs providing crypto-asset lending services must disclose counterparty, collateral-shortfall and access-loss risks to clients in a fair, clear and non-misleading way, precisely because MiCA's asset-safeguarding rules do not extend to assets that clients have placed into lending programmes. This creates a two-tier client-asset protection picture within the same regulatory regime: standard custody-type holdings benefit from MiCA's safeguarding rules, while assets committed to lending programmes rely on disclosure of risk rather than a safeguarding backstop.

The module's amber traffic light reflects this combination directly: binding disclosure, marketing and complaint-handling rules do exist and are in force, but supervisors themselves characterise the overall protection level as materially narrower than in traditional finance, with no compensation-scheme backstop for provider failure.

Outlook

Because the principal constraint on this module is architectural -- MiCA was designed with a lighter consumer-protection layer than parallel traditional-finance regimes, and that design choice is not something Malta's national implementation can independently remedy -- the trajectory to watch is EU-level rather than Malta-specific. Any future EU-level move to introduce a compensation-scheme mechanism for CASP failure, or to extend safeguarding rules to lending-committed assets, would be a materially significant regulatory shift for this module and would likely move its traffic-light rating from amber toward green. Absent such a change, the Joint ESAs' warning suggests supervisors expect this structural gap to persist, and retail-facing communications about crypto-asset risk in Malta should be read against that backdrop.

Beyond DAC8 reporting, the underlying question of how Malta taxes crypto-asset transactions substantively -- as capital gains, as trading income, or under some other characterisation -- remains unresolved at primary-source level. The composed record carries only an Uncertain-confidence claim that the general Malta Income Tax Act applies to crypto-asset transactions absent bespoke crypto capital-gains legislation, with tax treatment reportedly depending on the nature and frequency of the transaction (trading versus capital), sourced to secondary commentary rather than a Commissioner for Revenue primary source; no primary-source Commissioner for Revenue guideline, ruling, or published tax note specific to crypto-asset gains could be located in this research pass. A further, lower-materiality claim records that Malta is commonly cited in commentary as a comparatively low-tax jurisdiction for crypto businesses and investors relative to peers such as Italy -- this is explicitly a Speculative-confidence, commentary-grade claim rather than a regulatory position, and should be read accordingly.

The module's amber traffic light reflects this gap directly: a general tax framework does apply, and the one specific, binding crypto-adjacent obligation (DAC8 reporting) is now well-sourced, but a definitive, currently-in-force primary-source ruling or guideline on how Malta taxes crypto-asset gains has not been confirmed, and escalation to primary source is recommended.

Outlook

This module is the clearest candidate in Malta's record for a dedicated primary-source research pass. Two specific gaps stand out: first, direct research into Commissioner for Revenue guidance, rulings, or published tax notes addressing how Malta characterises crypto-asset gains (capital versus trading income) for tax residents; and second, Malta's VAT/GST treatment of crypto-asset exchange services, which was not verified in this pass and sits separately from the EU's Skatteverket/Hedqvist VAT-exemption case-law line that governs crypto-exchange VAT treatment elsewhere in the EU. Until both gaps are closed with primary-source material, this module's confidence should be expected to remain capped below Confirmed for its substantive (non-DAC8) claims, and its traffic-light rating is unlikely to move from amber on the strength of secondary commentary alone.

Running alongside passporting is a binding cross-border tax-data obligation. The EU's DAC8 directive extends cross-border tax-data reporting and exchange obligations to crypto-asset service providers, including those established in Malta, effective from 1 January 2026. This is a distinct claim from the tax_treatment module's DAC8 reporting-to-Commissioner-for-Revenue obligation, though the two describe overlapping aspects of the same directive: this cross-border claim addresses DAC8's cross-jurisdictional data-exchange dimension, while the tax_treatment module claim addresses the domestic Malta reporting channel confirmed via Legal Notice 162 of 2026. No incremental Malta-specific cross-border restriction -- such as a capital-outflow control or a Malta-specific transfer-reporting threshold beyond DAC8 -- was identified in this research pass.

The module's green traffic light reflects that EU-wide passporting rules are settled and directly applicable, and that the one incremental cross-border obligation identified (DAC8) is a binding EU-level data-reporting requirement rather than a restriction on the flow of crypto-asset services or capital.

Outlook

The cross-border module is likely to remain stable absent a change either to MiCA's passporting architecture at EU level or to DAC8's reporting scope. The item most worth monitoring is downstream: as more crypto-asset service providers use a Malta CASP authorisation as an EU market-access base -- following the pattern the Gemini example illustrates -- the volume and profile of cross-border activity routed through Malta may itself become a supervisory-attention point, particularly given the ESMA peer-review criticisms of Malta's CASP-authorisation practice recorded under the crypto-licensing module. A jurisdiction whose licence is used as a wide EU-passporting base while its own authorisation process draws supervisory criticism is a combination worth tracking across modules, even though neither individual claim currently records a formal cross-border restriction.