Malta Crypto Casino Business: Licensing, Crypto Rules and Launch Decisions

The short answer: gaming and crypto are separate questions

The product team wants to add Bitcoin deposits before the first market launch. The sensible pause is to ask which entity operates the casino, which entity touches the crypto and which regulator sees each function. In Malta, getting those lines wrong can affect the licence, the architecture and the launch timetable.

If a Maltese or EU/EEA entity offers a gaming service from Malta, to a Maltese person or through a Maltese legal entity, the MGA says a B2C Gaming Service Licence is required. Casino products fall within Type 1, including live casino, roulette, blackjack and baccarat. Incorporating a Malta company does not itself authorise gaming activity.

Crypto creates a second perimeter to analyse: what asset is accepted, who controls the wallet, whether the operator converts or transfers crypto, and whether another group entity provides custody, exchange, brokerage or trading-platform services. The MFSA supervises entities authorised under Malta’s Markets in Crypto-Assets Act, Chapter 647, including CASPs and certain crypto-asset issuers.

An MGA licence also does not authorise marketing or accepting players in every foreign jurisdiction. Before launch, test each intended market for local licensing, advertising, geo-blocking, consumer-protection, AML, sanctions and payment rules. A Malta licence is one part of the launch plan, not a passport for global distribution.

Which licence category applies?

A casino operator normally falls within MGA Type 1. The licence covers the gaming service, not every financial or technology function around it. A group may use a corporate-group licence structure, but the designated nominal licence holder carries primary responsibility for regulatory dues, information and reporting obligations.

A separate entity supplying critical gaming functions from Malta, to a Maltese person or through a Maltese legal entity may need an MGA Critical Gaming Supply Licence. The relevant question is what the software or back-office provider actually does, rather than which company in the group signed the commercial contract.

There is no established blanket rule that every crypto casino must hold both an MGA licence and a CASP licence. Accepting crypto as consideration does not, on the facts described, by itself identify a MiCA crypto-asset service. The conclusion changes if the operator or a group company holds customer assets, exchanges crypto assets, transfers assets for customers, operates a trading platform or performs another regulated service.

That conclusion should be confirmed against the current MiCA service definitions and the precise settlement model. A third-party payment or custodial provider may alter the perimeter, but outsourcing a function does not remove the need to understand who contracts with players, who controls private keys, who converts assets and who bears customer-facing responsibility.

Crypto payments, tokens and DLT approval

The MGA requires approval before a prospective licensee accepts DLT assets or uses relevant innovative technology arrangements. A new applicant applies through the new-licence process; an existing licensee uses the operational payment-method route for DLT-asset acceptance and the relevant technical route for changes to key essential components.

The operator should identify and classify every proposed asset. The MGA may request an EU/EEA legal opinion on classification. Assets that fall within financial-instrument or electronic-money categories may be accepted as gaming payment methods only with specific case-by-case MGA approval.

The MGA’s DLT policy is dated January 2023 and uses VFA terminology developed before the current MiCA framework. It remains relevant to the MGA’s approach to gaming payments and DLT controls, but it does not settle the present-day MFSA classification of every token, payment, custody or transfer model.

Privacy-enhancing or anonymising assets are incompatible with the MGA’s DLT policy where they obscure the sender, recipient or amount transferred. A closed-loop in-platform token can be possible where it remains confined to the platform and follows the policy’s conditions, but external transfer, redemption, exchangeability or investment-style marketing can create additional crypto-asset, financial-instrument, electronic-money or payment-services questions.

The MGA policy does not permit the authorised person’s platform to operate as an exchange for crypto assets, except for transactions involving a closed-loop virtual token. A gaming website should therefore not allow players to exchange one external crypto asset for another inside the casino ecosystem.

AML, wallets and player protection

Type 1 B2C operators must apply a risk-based AML/CFT framework, including a business risk assessment, Customer Acceptance Policy and procedures. Crypto payments make wallet screening, source-of-funds analysis, transaction monitoring, sanctions screening and blockchain-analytics decisions central to the control design; the right controls depend on the assets, players and payment routes.

The operator must appoint a sufficiently senior MLRO, register that person with the FIAU and obtain MGA approval for the relevant key function. The reporting line and systems should be capable of understanding both gambling risk and crypto-transaction risk, rather than treating wallet screening as a bolt-on vendor service.

Crypto deposits do not reduce ordinary player-protection duties. The MGA requires responsible-gaming information, a message before the first deposit, self-exclusion and deposit or wagering-limit tools, together with underage-gambling protections. If smart contracts automate payouts, the DLT policy also requires wallet verification before wagering, safeguards for limits and self-exclusion, and a way to revoke or neutralise the contract if a flaw is found.

The wallet design should also explain how deposits and withdrawals are logged, how linked wallets are handled, how suspicious activity is escalated and how the operator prevents a player from using the casino merely as a crypto storage or conversion venue. The historic MGA consultation material is useful context, but current licence conditions and approvals should control the final design.

Capital, fees and operating substance

The MGA currently lists €100,000 of minimum issued paid-up share capital for a Type 1 Gaming Service Licence. Its remote-gaming page lists a €5,000 non-refundable application fee and a €25,000 non-refundable fixed annual licence fee. These are published MGA figures, subject to the applicable licence type, game types and current regulations.

The MGA’s published Type 1 compliance-contribution guidance lists a €15,000 minimum and €375,000 maximum, with progressive revenue bands. The MGA also introduced a Positive Equity Position requirement through its Capital Requirements Policy, effective 2 July 2025, subject to transitional arrangements.

The application should demonstrate more than a Maltese registered office. The group needs clear governance, approved key functions, operational responsibility, technical controls, tested gaming systems, AML oversight, player-protection processes and payment arrangements that can support the proposed markets. The MGA application materials include system documentation, audit, review and financial-management requirements.

A realistic budget should include regulatory fees, compliance contributions, capital, technical testing, security, staff, customer support, payment-provider charges, banking, blockchain analytics, legal advice, tax work and a runway for licensing questions. The published MGA charges are only the visible part of the operating cost.

Tax and the 1 October 2026 framework

Malta’s revised VAT and gaming-tax frameworks took effect on 1 October 2026 through Legal Notices 84 and 86 of 2026. The MGA says the reforms clarify the treatment of certain gaming services, introduce relevant place-of-supply rules, provide for eligible input-VAT recovery and consolidate gaming tax and the gaming-device levy for qualifying activities supplied to players present in Malta.

The MTCA’s gambling VAT guideline, effective from 1 October 2026, identifies supplies covered by the VAT exemption without credit, including low-risk games, certain occasional junket events and facilities for gambling on the outcome of a real-life sporting event that can only be accessed where the event takes place. A casino operator should not assume that every casino supply falls into the same VAT category.

The final calculation for a crypto casino remains transaction-specific. It depends on the game category, mode of offer, whether the supply is treated as occurring in Malta, player location, the applicable VAT classification, eligible input-VAT recovery and the gaming-tax rules for the relevant activity. The MGA has also stated that the revised reporting portal is expected to support the new framework by 1 November 2026.

The MGA’s remote-gaming page still displays a 5% gaming-tax line, while the revised framework now applies from 1 October 2026. Do not use the displayed line as a complete post-reform tax model without reconciling it with Legal Notice 84, the player-location rules and current implementation guidance.

Corporate tax, shareholder refunds, tax residence, permanent establishment, transfer pricing, withholding and player-location rules must be analysed separately. Malta incorporation does not create tax residence, operational substance or a particular effective-tax result by itself.

Ownership, structure and launch sequence

A family office can own shares in a Malta gaming group without automatically becoming the gaming operator or a CASP. Ownership is still relevant: controllers, beneficial owners, group arrangements, ownership changes and reporting obligations can affect MGA fitness-and-propriety analysis. A family office conducting additional services may itself enter a regulated perimeter.

The cleanest structure usually starts by allocating functions: the B2C operator runs the casino; a B2B supplier provides critical gaming functions where required; a separate payment or crypto-service provider handles custody, conversion or transfers where appropriate; and a holding company owns shares without performing regulated operations. Each entity should have a genuine role and documented responsibility.

A sensible sequence is to define the games and target countries, map the group’s functions, classify every token and payment flow, decide who holds or converts assets, and design AML, player-protection and technical controls. Then incorporate and capitalise the relevant Malta entity, appoint governance and key-function personnel, line up banking and payment providers, and submit the MGA application together with any separate MFSA application before launch.

Target-country analysis belongs near the start of that sequence, not after the product is built. A market may prohibit crypto gambling, require a local licence, restrict advertising or impose payment, sanctions and consumer-protection conditions that make the proposed architecture uneconomic.

Before committing capital, prepare a written perimeter memo covering the casino licence, DLT approval, token classification, CASP analysis, player markets, AML model, wallet architecture, tax assumptions and responsibility split between group entities. Then test that memo against the current MGA application pack and MFSA rules. That exercise exposes expensive ambiguities early—before they become product architecture.

Questions people ask

Can a Malta company legally operate an online casino accepting cryptocurrency?

Potentially, but it generally needs an MGA Type 1 B2C Gaming Service Licence and MGA approval for the proposed DLT assets or payment arrangement. The precise crypto model may also require separate MFSA/MiCA authorisation, depending on custody, conversion, transfer and settlement functions.

Does every crypto casino need both an MGA licence and a CASP licence?

No automatic two-licence rule applies on the facts described. Accepting crypto as consideration does not, by itself, identify a MiCA crypto-asset service. The answer depends on the actual wallet, custody, conversion, transfer and trading-platform model.

Can the casino issue its own token?

A closed-loop in-platform token may be possible under the MGA’s DLT approach. External transfer, redemption, exchangeability or investment-style marketing can create additional crypto-asset, financial-instrument, electronic-money or payment-services issues. The token must also be assessed under the current MiCA framework.

Can the casino exchange Bitcoin for stablecoins inside the platform?

The MGA’s DLT policy does not permit the authorised person’s platform to operate as an exchange for external crypto assets. Exchange activity should be kept outside the casino ecosystem and analysed separately under the current financial-services framework.

What wallet and AML controls are important?

The operator should address wallet verification, source of funds, blockchain analytics, sanctions screening, transaction monitoring, suspicious-activity escalation, withdrawal controls and records of relevant transactions. The control set should be risk-based and integrated with the MGA’s player-protection obligations.

Does an MGA licence let the casino accept players worldwide?

No. Each target country needs a separate market-access analysis covering licensing, advertising, geo-blocking, consumer protection, AML, sanctions and payment rules.

What are the headline MGA Type 1 costs?

The MGA currently lists a €5,000 application fee, €25,000 fixed annual licence fee and €100,000 minimum issued paid-up share capital for Type 1. Published Type 1 compliance contributions range from €15,000 to €375,000. Confirm the applicable figures for the proposed game types, revenue and launch date.

How should the 1 October 2026 tax changes be modelled?

Use Legal Notices 84 and 86 of 2026, the MTCA gambling VAT guideline and current MGA implementation guidance. The calculation remains dependent on game category, mode of offer, player location, VAT classification, input-VAT recovery and the applicable gaming-tax rules.

What should founders do first?

Map the games, target countries, tokens, wallets, payment flows and group entities before incorporation or product build. Obtain a current MGA/MFSA perimeter analysis, then design controls and prepare the licensing applications.