Malta Crypto Licensing in 2026: MiCA, CASPs and the Practical Route

The short answer: classify the model before incorporating

A founder with a product ready to launch and EU customers waiting needs one answer before choosing Malta: what exactly is the asset, and what exactly will the business do with it? In 2026, the starting point is classification, not incorporation.

The MFSA’s framework directs applicants to assess whether a crypto-asset falls within MiCA or qualifies as a financial instrument under applicable EU financial-services legislation. A financial instrument may instead lead to an investment-services or another regulatory route. A token label, on its own, settles very little.

MiCA separately addresses asset-referenced tokens, e-money tokens, other crypto-assets and crypto-asset services. Activities outside the MiCA definition, such as some payment, technology, gaming or decentralised arrangements, still require their own perimeter analysis. A group combining token issuance, brokerage, custody, payments or investment services may therefore need more than one regulatory workstream.

Which route applies: Article 63 authorisation or Article 60 notification?

A new legal person intending to provide MiCA crypto-asset services generally applies to the MFSA for authorisation as a CASP under Article 63. The MFSA application is submitted through the Licence Holder Portal, with personal questionnaires required in advance for beneficial owners, qualifying holders, administrators and senior managers.

MiCA also recognises a different route for specified financial entities. Credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies and alternative investment fund managers may provide specified crypto-asset services through an Article 60 notification, subject to the conditions and service limitations applicable to their existing status.

That distinction matters when structuring a group. A bank, EMI or investment firm should not assume that its existing licence covers every crypto service, while a new crypto venture should not assume that forming a Maltese subsidiary creates an Article 60 route. The existing authorisation, proposed service and notification requirements must be matched carefully.

What an Article 63 CASP must establish in the Union

MiCA requires an Article 63 CASP to have a registered office in a Member State where it carries out at least part of its crypto-asset services. It must also have its place of effective management in the Union and at least one director resident in the Union.

For a Malta application, incorporation and a Maltese registered office are therefore only part of the picture. They do not, by themselves, demonstrate effective management, operational substance, credible control ownership or compliance with the requirement to carry out part of the services in the relevant Member State.

Which crypto services require authorisation?

The relevant MiCA service categories include custody and administration, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management and transfer services.

A business may also issue or offer crypto-assets, seek admission to trading, provide payment services or deal in financial instruments. Those activities do not all follow the same CASP route. Tokenised securities may instead engage investment-services, market-infrastructure or other EU rules; ARTs and EMTs have specific MiCA requirements; and NFTs, DeFi arrangements, stablecoin structures and crypto-gaming models require analysis of their actual rights, governance, technology, marketing and operating activity.

The MFSA’s consultation on tokenisation of financial instruments and real-world assets was dated May 15, 2026, closed on June 30, 2026 and was expressly non-binding. It should be treated as policy context, not as a new licence or a settled answer for every tokenisation structure.

CASP classes, capital and prudential safeguards

MiCA sets permanent minimum capital at EUR 50,000 for Class 1, EUR 125,000 for Class 2 and EUR 150,000 for Class 3. Class 2 adds custody and administration or exchange services to the Class 1 set, while Class 3 adds operation of a crypto-asset trading platform.

Those figures are floors, not a complete funding plan. Prudential safeguards must generally be at least the higher of the applicable permanent minimum and one quarter of the previous year’s fixed overheads. For a business operating for less than one year, projected fixed overheads for the first 12 months are used. The calculation is reviewed annually.

Custody also changes the operating risk, not merely the capital class. The business needs credible arrangements for wallet access, client-asset records, segregation, security, incident response and continuity. The proposed service mix should therefore be designed alongside the control framework rather than added to a generic corporate structure later.

What the MFSA will examine

The application is broader than ownership and paid-up capital. The MFSA’s catalogue covers corporate information, suitability, third-party outsourcing, digital operational resilience and ICT third-party arrangements. The operating file should also explain governance, safeguarding, ICT architecture, access controls, business continuity, conflicts, client communications and complaints handling.

Fitness and propriety applies to qualifying holders, beneficial owners, board members, senior managers, the MLRO, the compliance officer and other persons the Authority considers necessary. The applicant carries the burden of providing enough information for the MFSA to assess ownership, governance and individual responsibility.

Outsourcing may support the model, but it does not transfer regulatory responsibility. A technology provider can host wallets or infrastructure; it cannot become a substitute for accountable management, oversight, documented controls and the applicant’s own ability to respond when something fails. Regulators tend to notice the difference.

A practical application sequence

First, document the regulatory perimeter: each asset, service, customer type, target country, custody flow, settlement path, technology provider and group entity. Then identify whether the route is Article 63 authorisation, Article 60 notification, an issuer process or another EU or Maltese regime.

Next, engage with the MFSA, prepare the application materials and complete the required personal questionnaires before submission. The supporting file may include corporate, suitability, outsourcing, DORA, ICT, governance, AML/CFT, safeguarding, complaints, business-continuity and financial-resources material, depending on the service model.

The MFSA process includes an in-principle approval stage followed by pre-licensing conditions. These may include final certified constitutional documents, completion of due diligence, a signed business plan, evidence of capital, executed outsourcing arrangements, recruitment of key functionaries and appointment of key function holders.

The rulebook expects post-in-principle conditions to be met within a maximum of six months, subject to a possible justified extension. That is not a guaranteed end-to-end approval timetable. The wider schedule still depends on document quality, due diligence, recruitment, capital evidence, regulator questions and the applicant’s ability to close outstanding conditions.

AML, Travel Rule and the operating model

CASPs are subject persons under Malta’s AML/CFT framework. The FIAU’s crypto-assets procedures apply alongside the general procedures and the EBA Travel Rule Guidelines, bringing risk-based customer due diligence, transaction monitoring and transfer controls into the operating design.

Transfers to or from self-hosted addresses need a documented, risk-based response. The FIAU procedures address measures to assess ownership or control where the transfer exceeds EUR 1,000, alongside escalation and mitigation where information is incomplete or the activity does not fit the customer or transaction profile.

Passporting from Malta across the EU

A Malta-authorised CASP can provide services in other EU Member States through MiCA’s Article 65 cross-border notification process. Before offering the services cross-border, it must notify the MFSA as its home Member State competent authority using the applicable procedure.

Passporting is a MiCA mechanism, not a blanket answer for every activity in every market. Host-state rules on marketing, consumer protection, tax, employment, local conduct requirements or non-MiCA services may still matter. A Malta home Member State also does not mean that every customer, employee, control function or operational activity is located in Malta.

Legacy VFA permissions and the October 2026 position

Malta’s former VFA framework has been overtaken by MiCA for the relevant regulated activities. Chapter 647 allowed qualifying VFA-licensed providers to continue only until July 1, 2026 or until MiCA authorisation was granted or refused, whichever came first.

The transition could not continue beyond July 1, 2026. Unless the permission had already ended because of a grant or refusal, the legacy licence was automatically cancelled on July 2, 2026. As at October 1, 2026, an old VFA permission should not be treated as a substitute for MiCA authorisation.

Tax, DAC8 and substance: keep the claims separate

A CASP licence does not itself establish Maltese tax residence, management and control, operational substance, eligibility for a tax mechanism or a particular effective tax rate. Those questions depend on the company’s facts and should be analysed separately from regulatory authorisation.

The MTCA’s DLT guidance says transactions must be analysed by reference to the nature of the activity, the status of the parties and the specific facts. It also states that a cryptocurrency payment is generally treated like a payment in another currency for income-tax purposes. That does not resolve the treatment of every business, token or transaction.

DAC8 was implemented into Maltese legislation on May 22, 2026. Reporting CASPs began collecting data on reportable crypto-asset transactions of EU-resident users from January 1, 2026, with first reporting due during 2027 for the first covered fiscal year, subject to the applicable reporting period and administrative requirements.

How to verify a provider and what to do next

Before dealing with a purported Malta-licensed crypto business, search the MFSA Financial Services Register by legal name, authorisation and service type. Then check the ESMA MiCA register, particularly where the provider claims EU-wide authorisation or cross-border status. Match the legal entity and the specific service; a familiar brand name is not enough.

The MFSA’s crypto-assets section also provides complaints guidance and publishes supervisory material, returns and reporting information. A customer or counterparty should use the provider’s complaints process first where applicable, then follow the MFSA’s published guidance for raising a complaint or concern with the Authority.

Before incorporation or marketing, prepare a short perimeter memorandum, model fixed overheads, identify the Article 63 or Article 60 route, test the custody and AML controls in live scenarios, and confirm the proposed owners and key personnel. Malta can be a credible EU home Member State, but the decision rests on the operating model—not the company certificate.

Questions people ask

Can a newly incorporated Maltese company provide crypto services immediately?

No. Incorporation is only a corporate step. A new business providing regulated MiCA crypto-asset services generally needs Article 63 authorisation before operating, unless another route such as the Article 60 notification regime applies.

What establishment requirements apply to a Malta Article 63 CASP?

The CASP must have a registered office in a Member State where it carries out at least part of its crypto-asset services, effective management in the Union and at least one director resident in the Union. A registered office or outsourced technology alone is not enough.

Can an existing bank or EMI avoid a standalone CASP licence?

Possibly. Certain credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies and AIFMs may provide specified crypto-asset services through the Article 60 notification route, subject to the applicable conditions.

Is EUR 50,000 enough capital for a Malta CASP?

It is the permanent minimum for Class 1 services. Prudential safeguards must generally be at least the higher of the applicable minimum and one quarter of fixed overheads. For a new business, projected first-year fixed overheads are used, so the requirement may be higher.

Does a Malta CASP licence automatically passport across the EU?

It enables the MiCA cross-border notification route. The CASP must notify its home-state competent authority before offering services cross-border, and separate host-state rules may still affect marketing, tax, employment, consumer protection or non-MiCA activities.

Are old Malta VFA permissions still enough on October 1, 2026?

No. The transition could not continue beyond July 1, 2026. Unless the permission had already ended because of a MiCA grant or refusal, the legacy licence was automatically cancelled on July 2, 2026.

When did DAC8 reporting begin for crypto businesses in Malta?

DAC8 was implemented in Malta on May 22, 2026. Reporting CASPs began collecting data on reportable transactions of EU-resident users from January 1, 2026, with first reporting scheduled during 2027 for the first covered fiscal year.

How should I verify a purported Malta crypto licence?

Search the MFSA Financial Services Register by legal entity and authorised service. Also check the ESMA MiCA register, especially where the provider claims EU-wide or cross-border authorisation.