Malta#
Malta operates a dual-track crypto regime under the MFSA: new entrants apply directly for MiCA CASP authorisation; the legacy VFA Act (Chapter 590) was formally repealed effective 3 July 2026 under Act XXXVI of 2024, closing the legacy route entirely.
The defining licensing development this cycle is the closure of MiCA's Article 143 transitional grandfathering mechanism. That provision had permitted existing Malta crypto-asset providers who were operating lawfully before 30 December 2024 to continue operating without MiCA authorisation until the earlier of authorisation, refusal, or a fixed cutoff date. A Challenger finding corrected that cutoff this cycle: the deadline is 1 July 2026, not the 30 June 2026 date originally recorded, per ESMA's official grandfathering-periods tracker -- and that corrected deadline has now passed. The practical consequence is that Malta's crypto-licensing regime has moved from a transitional posture to a settled one: every provider must now hold full MiCA authorisation, with no residual grandfathering cover remaining.
That settlement, however, comes with a live supervisory-quality caveat. An ESMA fast-track peer review of MFSA's CASP authorisation and supervision practice found that MFSA authorised at least one CASP despite unresolved issues, and identified gaps in governance arrangements, conflicts-of-interest management, ICT architecture, and business-risk assessment -- alongside positive findings on MFSA's resourcing levels and supervisory engagement. Related to this, MFSA's accelerated pre-authorisation pathway for existing VFA licence holders transitioning to MiCA CASP status has drawn industry commentary characterising it as favourable or fast-tracked treatment; this cycle's review reframed that characterisation away from an affirmative 'quasi-equivalence recognition' (which the underlying source itself does not assert) and toward what the ESMA peer review frames as industry-observed practice that itself drew supervisory scrutiny. No field values were changed in that reframing -- the claim's confidence remains Probable, as it was already, but the characterisation was tightened to avoid overstating a formal equivalence determination that ESMA's review does not describe as having occurred.
Traffic light for this module remains green: Malta operates a comprehensive, binding licensing regime combining VFA Act and MiCA CASP authorisation, and the transitional period has now definitively closed, leaving a settled authorisation requirement. The green rating nonetheless carries the ESMA peer-review caveat as a material qualifier rather than a disqualifying factor, since the underlying legal requirement to be authorised is not in doubt -- only the quality of some past authorisation decisions.
Outlook
The open question for this module is what, if anything, follows from ESMA's critical peer review of MFSA's fast-track authorisation practice. As of this cycle, it is not known whether any authorised CASPs are subject to remediation, corrective measures, authorisation review, or any EU-level escalation -- this is flagged as an unresolved research question requiring direct MFSA/ESMA follow-up. Given that the underlying licensing perimeter is otherwise settled, the trajectory to watch is less about new legislative change and more about supervisory enforcement follow-through: whether Malta's regulator responds visibly to the peer-review criticisms, and whether that response affects market confidence in the fast-track pathway that helped establish Malta's positioning as a CASP hub. Any confirmed action on this front would likely shift the module's traffic-light rationale, even without a change to the underlying legal requirement.
Crypto Licensing
Malta's domestic crypto-licensing framework has completed its transition to the Markets in Crypto-Assets Regulation. The Virtual Financial Assets Act, Chapter 590, which had provided Malta's original domestic crypto-asset framework since entering into force on 1 November 2018, was repealed on 3 July 2026, following the close of MiCA's Article 143 transitional window on 1 July 2026. The Markets in Crypto-Assets Act, Chapter 647, now stands as the applicable domestic implementing instrument alongside MiCA itself, administered by the Malta Financial Services Authority. This transition had already occurred before the start of this cycle and is recorded here as the stable structural backdrop against which the one notable development, the MFSA's event-contract classification circular, should be read. No new licensing requirement, authorisation pathway, or penalty provision specific to Chapter 647 was identified as a new development; the precise penalty provisions for unauthorised crypto-asset services under Chapter 647 were not independently re-verified against primary legislative text and remain a documented gap. For an operator assessing Malta's licensing environment, the relevant framework is now singular and EU-harmonised rather than split between a domestic VFA regime and MiCA, which simplifies the authorisation landscape relative to the pre-transition period, though the exact current count of MFSA-authorised crypto-asset service providers is contested between secondary sources and was not independently confirmed against the MFSA's own register.
Outlook
The licensing architecture itself is not expected to change materially in the near term, having just completed its structural transition to the MiCA/Chapter 647 regime. What remains open is the application of adjacent guidance, particularly the MFSA's event-contract classification circular, to specific licensing decisions: a product found to be a crypto-asset under that circular's three-way test would fall to be licensed under Chapter 647/MiCA rather than under gambling or financial-instrument rules, and the first such determination would be a useful marker of how the classification test operates in practice. Independent verification of the current MFSA-authorised CASP register and of Chapter 647's penalty regime for unauthorised activity remain open items for a future cycle.
4 earlier distinct update(s)
Crypto Licensing
Malta's crypto-asset licensing framework completed a structural transition this cycle. The Virtual Financial Assets Act, Chapter 590, was formally repealed with effect from 3 July 2026 under Article 64 of Act XXXVI of 2024. The MiCA-based Chapter 647 Crypto-Asset Service Provider authorisation regime is now the sole legal basis for crypto-asset services in Malta; there is no longer a parallel VFA pathway. The transitional grandfathering window available to pre-existing VFA licence holders closed on the earlier of 1 July 2026 or the date on which the Malta Financial Services Authority granted or refused CASP authorisation to that firm under Article 63 of MiCA. No new VFA applications have been accepted since the transition began, meaning any firm that has not by now secured CASP authorisation, or had it refused, is operating without a lawful VFA fallback.
Alongside this completed transition, a supervisory-quality finding has emerged regarding how Malta administers the new regime. ESMA's ad hoc Peer Review Committee reviewed the MFSA's CASP authorisation process and found that it partially met expectations, recommending that the Authority place greater weight on the threat of licence rejection at the point of authorisation rather than relying primarily on post-authorisation monitoring to catch deficiencies after the fact. This finding is about supervisory process and institutional capacity rather than a named enforcement action against any firm, and it should be read as a signal about how rigorously new CASP applications are likely to be scrutinised going forward, not as a retrospective judgment on firms already authorised.
The combination of these two facts, a completed and now-exclusive MiCA/CASP legal basis together with an external finding that the authorisation process underpinning it only partially meets expectations, defines the current state of Malta's crypto licensing regime: settled in law, but under active scrutiny in practice. Malta's licensing population includes firms combining e-money institution authorisation with CASP status, reflecting a commercial pattern of building on an existing EMI base to add digital-asset services, discussed further under commercial activity. The exact penalty provisions in Chapter 647 for unauthorised crypto-asset services were not independently fetched this cycle and remain an open item.
Outlook
The item to watch is whether the MFSA responds to the ESMA peer-review finding by tightening its authorisation-stage scrutiny, as recommended, and whether any further ESMA or MFSA register update confirms new CASP authorisation activity in Malta within the next review window. No such confirmation was available via the MFSA or ESMA register this cycle.
Crypto Licensing
Malta's crypto-asset licensing framework has fully consolidated onto the Markets in Crypto-Assets Act, Cap. 647, following the repeal of the Virtual Financial Assets Act (Cap. 590) on 3 July 2026. That repeal came at the end of the maximum eighteen-month MiCA grandfathering period available to Member States, and legacy VFA licences were cancelled on 2 July 2026, or upon the grant or refusal of MiCA authorisation for a given firm, whichever occurred earlier. The practical effect is that there is no longer a parallel domestic crypto-licensing track in Malta: every crypto-asset service provider operating from Malta must now hold, or be in the process of obtaining, authorisation under the MiCA-implementing Cap. 647 framework administered by the Malta Financial Services Authority.
The stakes attached to that authorisation requirement are substantial. Breach of the Article 59 authorisation requirement under Cap. 647 carries a penalty of up to six years' imprisonment and fines of up to EUR5,000,000 for a natural person or EUR15,000,000 for a legal person. This is a criminal, not merely administrative, sanctions structure, and it signals that Malta has retained, through its domestic implementing legislation, a materially more severe enforcement posture for unauthorised crypto-asset activity than a purely civil-penalty framework would provide.
Against this backdrop, ESMA's fast-track peer review of Malta's CASP authorisation and supervision regime, published 10 July 2025, offers a mixed assessment. ESMA found Malta fully meeting expectations on supervisory settings and resources, and largely meeting expectations on the conduct of supervisory reviews. However, it found Malta only partially meeting expectations on the CASP authorisation process itself. This distinction matters for anyone assessing the reliability of a Maltese MiCA authorisation as a passport into the wider EU market: the supervisory apparatus once a firm is authorised appears, on ESMA's own assessment, considerably more robust than the process by which that authorisation is granted in the first place.
No current, published list of Malta-granted MiCA CASP authorisations for Malta-domiciled firms was located this cycle. This leaves unresolved exactly which of the formerly VFA-licensed firms successfully transitioned to MiCA authorisation, and which wound down or had their MiCA applications refused following the 3 July 2026 cutover. The absence of such a published register is itself a gap worth noting for market participants trying to assess the current competitive landscape of licensed Maltese CASPs.
Outlook
The clearest forward-looking item for Malta's crypto-licensing regime is whether the Malta Financial Services Authority publishes a current register of granted MiCA CASP authorisations, which would resolve the open question of which firms converted successfully from the VFA regime. Given ESMA's finding that Malta's authorisation process only partially meets expectations, continued supervisory attention to how new and converting CASP applications are processed should be expected. No Malta-specific on-chain activity regime distinct from the MiCA CASP perimeter was identified this cycle, suggesting the authorisation question is likely to remain the single dominant licensing issue for Malta in the near term.
Crypto Licensing
Malta's crypto-asset licensing framework completed a dated statutory transition this cycle. The Virtual Financial Assets Act (Cap. 590) was repealed effective 3 July 2026, pursuant to Article 64 of the Markets in Crypto-Assets Act (Chapter 647), itself enacted as Act 36 of 2024; the repeal operates without prejudice to anything done or omitted to be done under the VFA Act prior to that date. Under the Malta Financial Services Authority's own transitional guidance, VASPs holding a VFA Act licence as at 30 December 2024 were permitted to continue operating under that licence only until 1 July 2026, or until the Authority granted or refused a CASP authorisation application, whichever occurred first. Any entity that had not, by that point, obtained CASP authorisation or wound down its licensed activity was required to do so while continuing to safeguard client assets and meet its existing anti-money-laundering obligations throughout the transition.
Separately, and consistent with the wind-down of the legacy gateway, the Authority ceased accepting new applications under the VFA Act as of August 2024. Since that point, any new applicant seeking to provide crypto-asset services from Malta has been required to apply directly for CASP authorisation under Chapter 647; there is no residual VFA Act pathway available to new entrants. Together, these two facts describe a licensing perimeter that has now fully pivoted to the MiCA-derived Chapter 647 regime for new business, while a defined and now-closed window governed the conversion or exit of the pre-existing VFA Act licensee population.
The practical consequence for any entity whose status has not been independently confirmed is uncertainty: a grandfathered VASP whose CASP application had not been granted or refused by 3 July 2026 sits in an unresolved position under the current evidence, since the repeal of the VFA Act removes the legal basis for continuing to rely on the old licence beyond the earlier of the two triggering events. This is a live, dated transition rather than a settled structural fact, and the population of affected entities and their individual conversion status were not independently confirmed from a primary Authority source this cycle beyond the general transitional rule itself.
Outlook
The near-term question for this module is the status of any VASP whose CASP application remained pending as the 3 July 2026 repeal date passed: whether such an entity secured authorisation, was refused, or is operating in a gap between the two regimes is not resolved in the current evidence base. Confirmation of the CASP own-funds and prudential capital schedule by service class, and of the administrative-fine maxima under Chapter 647 for unauthorised crypto-asset service provision, both remain outstanding from a primary Malta Financial Services Authority source and would materially sharpen the entry-cost and non-compliance-risk picture for this module going forward.
Crypto Licensing
Malta operates a fully harmonised MiCA authorisation regime for crypto-asset service providers and issuers or offerors, requiring authorisation by the Malta Financial Services Authority under the Markets in Crypto-Assets Act. This is a high-confidence, primary-sourced standing baseline position. The legacy transition arrangement, under which existing Virtual Financial Assets Act licensees could continue operating pending full MiCA authorisation, ended on 1 July 2026, closing what had been the principal remaining accommodation for pre-MiCA licensees. This closure is itself a high-confidence finding and marks the crypto-licensing module as having reached a settled, fully in-force baseline rather than a transitional state.
The practical effect of the grandfathering closure is that every CASP now operating in Malta must hold direct MiCA authorisation; there is no longer a legacy pathway available to new or continuing licensees. This represents the completion of a multi-year regulatory transition rather than a new development in its own right, and it is the reason the module's traffic-light rationale characterises the regime as fully harmonised with a now-closed transition pathway.
Outlook
With the transition period closed, the crypto-licensing module has reached a stable baseline; future cycles are more likely to surface enforcement or supervisory-practice developments under this module than further structural licensing-pathway change.
Sources and findings (11)
- T1 · European Banking Authority (EBA)MiCA (Regulation (EU) 2023/1114) — CASP authorisation from a national competent authority to operate within the EU; the regime became applicable to most CASPs from 30 December 2024 retrieved M5 binding in force
- T1 · Laws of Malta / EUR-Lex national implementing measureVirtual Financial Assets Act (Chapter 590) — an MFSA licence for admission of virtual financial assets to trading, or for offering virtual financial assets to the public, in and from Malta retrieved M4 binding in force
- T1 · ESMAMiCA Article 143 transitional (grandfathering) mechanism — existing Malta crypto-asset providers operating lawfully before 30 December 2024 to continue operating without MiCA authorisation until 1 July 2026 (or until authorised/refused, whichever is sooner) - a deadline that has now passed retrieved M4 binding in force
- T3 · CoinDeskMFSA fast-track authorisation pathway — an accelerated pre-authorisation route for existing VFA licence holders transitioning to MiCA CASP status; per ESMA's peer review, this is industry-observed favourable treatment rather than a formally documented equivalence determination, and is itself what drew supervisory scrutiny retrieved M3 non-binding
- T1 · ESMAMalta Financial Services Authority (MFSA) — Malta's competent authority under MiCA holding supervisory competence across all Titles of the Regulation retrieved M5 binding in force
- T3 · Gofaizen & SherleMarkets in Crypto-Assets Act (Chapter 647), Act 36 of 2024 — Virtual Financial Assets Act (Cap. 590) is repealed on 3 July 2026 without prejudice to anything done or omitted to be done thereunder. retrieved M5 binding enacted not yet effective new
- T1VFA Act (Malta) — VASPs licensed under the VFA Act as at 30 December 2024 may continue under it until 1 July 2026, or until the MFSA grants/refuses a CASP authorisation, whichever occurs first; grandfathered entities must obtain CASP authorisation or wind down while safeguarding clients and meeting AML obligations. retrieved M5 binding in force
- T4Malta Financial Services Authority — MFSA ceased accepting new applications under the VFA Act as of August 2024; any new crypto-asset service applicant in Malta must apply directly for CASP authorisation under Chapter 647. retrieved M4 binding in force
- T1Malta Financial Services Authority — Crypto-asset service providers and issuers/offerors in Malta must be authorised by MFSA under the Markets in Crypto-Assets Act implementing MiCA retrieved M5 binding in force
- T3 · Gofaizen & SherleMalta MiCA grandfathering (VFA transition) — Malta's MiCA grandfathering period for existing VFA-licensed CASPs ended 1 July 2026 retrieved M4 binding in force
- T1Malta Financial Services Authority — CASP authorisation under the Markets in Crypto-Assets Act is the sole lawful basis to provide crypto-asset services in/from Malta since 1 July 2026, when the VFA Act transitional grandfathering window closed. retrieved M4 binding in force