Malta Gambling Software Provider: MGA Licence, Costs and Operating Model

Start with the product, not the company registration

The first operator is ready to sign, but the contract asks for evidence of regulatory authorisation. Start with what the software actually does—not with whether a Maltese company has been incorporated. The MGA describes a Critical Gaming Supply licence as a B2B authorisation to provide or carry out a critical gaming supply from Malta, to a Maltese person or through a Maltese legal entity.

A gambling software provider can remain entirely B2B and never offer games directly to players. That does not, however, place it outside the MGA perimeter. The product, contracting chain, location of supply and regulatory function must be mapped before the business relies on a non-licensable-SaaS assumption.

Prepare a product-perimeter memo covering each module, the data it handles, the customer using it, the contracting entity, jurisdictions served and whether it can affect player balances, game outcomes, regulatory records, KYC, payments or reporting. That memo should drive the licence category, technical file and commercial structure.

What falls within the B2B critical-supply perimeter?

The MGA expressly includes software that generates, captures, controls or otherwise processes essential regulatory records, together with the control system on which that software resides. A back-office, regulatory reporting system or platform performing that function therefore requires focused B2B analysis.

The broader B2B category also covers providing or carrying out a critical gaming supply and managing material elements of a game. That may bring game content, a game server, game engine, RNG-related function or other core component into a different regulatory analysis from ordinary business software.

A PAM, sportsbook engine, casino platform, game server, RNG, KYC layer, fraud tool or reporting system cannot be classified safely from its commercial label. The MGA’s published categories and technical requirements—not the product name—control the analysis. Obtain a product-specific view before signing contracts or freezing the architecture.

For a licensable game, the MGA FAQ identifies three cumulative elements: a stake, predominance of chance and a prize of money or money’s worth. That test concerns the game or service and does not, by itself, decide how a technology supplier should be authorised.

B2B supplier or B2C operator? Keep the boundary clear

The MGA distinguishes a B2C Gaming Service Licence, which concerns offering or carrying out gaming services to consumers, from a B2B Critical Gaming Supply Licence, which concerns business-to-business supplies. A pure platform provider can therefore operate without offering games directly to players, provided its actual activities remain within the authorised B2B model.

The boundary becomes less comfortable if the provider contracts with players, controls the consumer-facing gaming service, determines player-facing terms, holds player funds or otherwise performs the operator’s function. In that case, the business may need analysis beyond a pure B2B licence.

Supplying an existing licensed operator is not a separate exemption. Where the service is a critical gaming supply, the supplier generally needs its own MGA B2B licence or recognition notice. The operator’s licence, outsourcing approval or commercial contract does not replace the supplier’s authorisation.

Routes into the Malta market

The main route is an MGA B2B Critical Gaming Supply Licence. An entity established in the EU or EEA may apply if it meets the applicable capital and financial-reporting requirements. That eligibility is not an approval guarantee, and a non-EU group should not assume it can apply on the same basis without reviewing its structure and supply arrangements.

A Recognition Notice may be available where an authorisation issued by an EU or EEA member state, or by another jurisdiction accepted by the MGA as offering largely equivalent safeguards, is recognised for the relevant gaming supply. The certificate is maintained annually, and the MGA retains the final decision on comparability and safeguards.

The practical third route is usually a properly structured supply to an existing licensee—not a route around authorisation. If the supplier’s activity is critical, its own B2B licence or recognition notice remains the central question. Ordinary outsourcing notifications and approvals deal with the operator’s governance; they do not automatically legalise an unauthorised critical supplier.

One licence for a corporate group? Sometimes

A corporate group may apply for a B2B corporate MGA licence where the parent exercises control of more than 90% over other group companies by shareholding or voting rights. The group is treated as the licensee for the relevant arrangement, while the nominated holder retains primary responsibility for regulatory dues, information and reporting.

Review the group chart, ownership changes, contracting entities, intellectual-property ownership and the location of technical and management functions before choosing this structure. It is not a shortcut around fit-and-proper review or responsibility for the conduct of the relevant group companies.

Technical documentation, governance and key people

The MGA directs applicants to consult the System Documentation Checklist before starting a gaming-licence application and to submit the required material electronically through the Licensee Portal. The exact file depends on the product, architecture, game types, verticals, integrations and approval category.

Prepare the system architecture, data flows, access controls, technical specifications, regulatory-record logic, business continuity, security controls, change management, testing evidence and relevant certifications or independent audits. The MGA materials do not establish one universal audit list for every supplier, so the file should be mapped to the product rather than copied from another applicant.

Applicants and licensees must satisfy fit-and-proper requirements on an ongoing basis. The MGA assesses integrity, honesty, reputation, competence and capability, while key-function appointments require prior approval and an individual certificate process.

Capital, fees and the cost of being regulated

The MGA’s May 2025 Capital Requirements Policy lists €40,000 as the minimum nominal share capital for a Critical Gaming Supply licence. It also requires applicants and licensees to maintain a positive equity position, meaning assets must equal or exceed liabilities under the policy’s definition. The policy contains transitional provisions, so confirm how it applies to the proposed application or existing licence.

As at 1 October 2026, the MGA’s current Game Providers and Back Office page lists a €5,000 application fee, annual B2B Critical Gaming Supply fees of €25,000, €30,000 or €35,000 by revenue band, and €10,000 for providers supplying solely Type 4 gaming supplies. These are the relevant current figures for that page’s category.

The MGA’s separate Back Office page lists €3,000 annually where revenue does not exceed €1 million and €5,000 above that threshold. Do not apply those figures automatically to every software provider: the correct category depends on whether the activity is Back Office software or the broader B2B Critical Gaming Supply category.

Compliance contribution is separate from the annual licence fee and depends on the applicable activity and revenue rules. Add key-function applications, technical reviews, audits, legal and compliance work, personnel, insurance, hosting, security, reporting and any required re-certification to the budget. The MGA’s current guidance should be checked for the applicable calculation and minimums.

Go-live, verticals and product changes

The MGA generally gives a licensee 90 days to go live after the licence is issued. Licence fees, compliance contribution and gaming tax are due from the date of issuance under the applicable rules, even if the product is still completing launch preparation. If the business cannot go live within the period, the MGA FAQ refers to a voluntary suspension process and a possible extension.

Several gaming verticals can be offered under the same B2B licence, but the MGA states that they require prior approval. The licence should therefore be treated as approval for the authorised scope, not blanket permission for every game type, vertical, RNG, engine or future customer integration.

The MGA’s compliance directive requires prior approval for changes to critical game elements, including an RNG or part of a game engine, and allows the Authority to require supporting documents, re-certification or an audit. Build regulatory change control into the product roadmap before promising rapid releases to operators.

Reporting and customer onboarding

A B2B licensee must submit monthly B2B Compliance Reports identifying its B2B and B2C client companies, the relevant relationship and the type of licensable service supplied. These reports are due by the 20th day of the following month through the MGA portal.

Other reporting may include financial information, industry performance returns, ownership and key-function changes, outsourcing notifications and event-driven regulatory submissions. Customer onboarding, contract metadata and product classification should therefore be designed as compliance data, not left in sales systems alone.

Adding a new operator, game provider, game type, vertical, RNG or engine should be assessed against the approved scope and the relevant MGA notification or approval process. The operator integration process published by the MGA also points to technical setup, essential components, provider authorisation, services, verticals and jackpot information where relevant.

Outsourcing, cloud and third-party infrastructure

Development, hosting, cloud infrastructure, customer support, payments, KYC, fraud management and risk functions should be mapped individually. Outsourcing does not transfer regulatory accountability: the licensee remains responsible for third parties involved in licensed activities.

The MGA’s 25 June 2024 revised shared conduct requirements state that material-supply outsourcing must be notified within 30 days, while critical supplies or critical services require prior approval before the agreement is entered into. The classification of a particular cloud, support or technical arrangement must be tested against the applicable instruments.

Contracts should allocate regulatory access, audit rights, incident reporting, data retention, subcontracting controls, business continuity and exit assistance. Those provisions will not cure an incorrect licence classification, but they make the operating model easier to explain and supervise.

Tax, VAT and gaming tax: keep the questions separate

Malta’s general corporate-tax framework subjects Maltese companies to tax at 35% on worldwide income and capital gains. A shareholder refund mechanism may apply after dividend distribution, but its availability and amount depend on the facts, income type, shareholder, anti-avoidance rules, treaty position and compliance. There is no standard effective rate that follows automatically from incorporation.

Incorporation alone does not establish tax residence, management and control, operational substance, refund eligibility or a particular effective tax rate. The MTCA identifies incorporation, management and control, and carrying on activity in Malta as relevant tax-registration circumstances; the actual result depends on governance, people, functions, contracts, transfer pricing, intellectual property and the wider group.

Malta’s revised VAT and gaming-tax frameworks took effect on 1 October 2026. The MGA says they clarify VAT treatment and place-of-supply rules for certain gaming services and revise the gaming-tax structure around game type and mode of offer. A B2B software provider needs a transaction-specific VAT, place-of-supply and gaming-tax analysis rather than assuming that operator rules apply identically.

The 5% gaming-tax figure in the MGA’s 2025 fact sheet belongs to the pre-1 October 2026 framework and should not be carried forward as a current universal rate. Confirm whether the revenue is a gaming service, a B2B supply, an exempt or taxable transaction and where the relevant supply is treated as taking place.

A sensible sequence for founders and boards

First, freeze the product perimeter and draw the architecture and contracting chain. Second, classify each activity as B2B critical supply, Back Office software, material game-element supply, possible B2C gaming service, recognition-notice candidate, outsourced function or ordinary non-licensable service. Third, confirm the category with Maltese gaming counsel and the MGA before building the application around it.

Only then should the group settle the licence holder, corporate structure, ownership disclosures, key functions, technical governance, operating model, capital plan and tax position. The MGA does not promise a universal end-to-end application period; completeness, ownership review, product scope, audits and follow-up questions will affect timing.

Before supplying from Malta or to a Maltese person without the necessary authorisation, obtain written advice on the statutory perimeter. The MGA has warned that entities may operate in or from Malta only with the relevant authorisation, subject to applicable routes such as a recognition notice.

This subject should remain distinct from the planned Malta Gaming Licence, Malta iGaming Company Setup, Malta Crypto Casino Business and Malta Sports Betting Company articles. Its decision is narrower: whether the technology, governance and supply chain are authorised as a B2B gambling software business.

A short Malta pause

UNESCO includes the Ġgantija temples on Gozo within the Megalithic Temples of Malta World Heritage property. It is useful context for the island’s long institutional memory, though it has no bearing on licensing, tax or operational eligibility.

Questions people ask

Can a Malta gambling software provider operate without offering games directly to players?

Yes, a business can remain B2B where it supplies technology to gaming businesses rather than offering gaming services to consumers. If the technology is a critical gaming supply, however, the supplier generally needs its own MGA B2B licence or recognition notice.

Does every PAM, sportsbook engine or RNG require the same licence?

No. The MGA’s published categories and technical requirements control the analysis, not the commercial label. The answer depends on the product’s function, architecture, regulatory records, game elements, contracting structure and place of supply.

Does supplying an existing licensed operator remove the need for a B2B authorisation?

Not generally for a critical gaming supply. The supplier generally needs its own B2B licence or recognition notice. The operator’s licence and outsourcing approval do not automatically replace the supplier’s authorisation.

Can one MGA B2B licence cover several group companies?

A corporate group may apply where the parent exercises more than 90% control over other group companies by shareholding or voting rights. The nominated licence holder remains responsible for regulatory dues, information and reporting.

What are the current published annual fees?

As at 1 October 2026, the MGA’s Back Office page lists €3,000 or €5,000 depending on revenue. Its Game Providers and Back Office page lists €25,000, €30,000 or €35,000 for B2B Critical Gaming Supply, and €10,000 for providers supplying solely Type 4 supplies. Confirm the category before budgeting.

What is the minimum share capital?

The MGA’s May 2025 Capital Requirements Policy lists €40,000 for a Critical Gaming Supply licence and requires a positive equity position for applicants and licensees, subject to the policy’s application and transitional provisions.

How quickly must the business go live?

The MGA generally gives a licensee 90 days from licence issuance to go live. Licence fees, compliance contribution and gaming tax are due from issuance under the applicable rules.

Does Malta incorporation guarantee a favourable tax result?

No. Maltese companies are generally subject to 35% corporate tax on worldwide income and capital gains, with a possible shareholder refund mechanism subject to conditions. Residence, substance, management, transfer pricing, treaty and shareholder facts require separate advice.

What should be confirmed before signing supplier contracts?

Confirm the product perimeter, licence or recognition route, EU/EEA eligibility or structuring, group ownership, key persons, technical documentation, outsourcing approvals, reporting duties, go-live timing, capital and fee category, VAT, gaming tax, place of supply and tax-residence position.