Overview
The Malta Gaming Authority (MGA) license is widely recognized as the gold standard for iGaming regulation worldwide. As a full European Union member state, Malta offers operators a robust regulatory framework that combines credibility, market access, and a favorable tax environment.
Malta was among the first jurisdictions to regulate online gaming and has built a mature ecosystem of legal, technical, and advisory services around the industry. The MGA operates an open-window licensing model with no cap on the number of licenses issued, making it accessible to both established operators and new entrants. A single MGA license is accepted by major payment providers, banking institutions, and players across the EU, giving licensees a significant commercial advantage.
The regulatory framework is anchored in the Gaming Act 2018 (Chapter 583 of the Laws of Malta), which consolidated all previous gaming legislation into a single technology-neutral statute. This act applies uniformly across all gaming channels, from remote online operations to land-based casinos, and is supported by 12 pieces of subsidiary legislation covering licensing, player protection, commercial communications, and data retention.
Regulatory Framework
The Malta Gaming Authority serves as the single regulatory body overseeing all gaming activities in Malta. The MGA is responsible for licensing, compliance monitoring, enforcement, and policy development for both remote (online) and land-based gaming.
Primary Legislation:
- •Gaming Act 2018 (Chapter 583 of the Laws of Malta)
- •12 pieces of subsidiary legislation
- •Player Protection Directive (Directive 2 of 2018)
- •Gaming Authorisations and Compliance Directive
The Gaming Act 2018 replaced the previous Lotteries and Other Games Act and Remote Gaming Regulations, introducing a unified framework that covers all forms of gaming including casino games, sports betting, lotteries, poker, and skill-based games.
License validity is set at 10 years, with renewal requiring a 9-month advance notice to the MGA. The authority maintains a technology-neutral approach, ensuring the regulatory framework applies consistently regardless of the delivery channel or technology platform used by the operator.
License Types: B2C and B2B Categories
The MGA issues licenses under two main categories: B2C (Gaming Service Licence) for operators dealing directly with players, and B2B (Critical Gaming Supply Licence) for entities providing gaming products and services to licensed operators.
B2C Gaming Service Licence Types:
- •Type 1 (Casino/RNG Games): Games of chance played against the house with outcomes determined by a random number generator. Covers slots, roulette, blackjack, baccarat, live casino, virtual sports, online lotteries, secondary lotteries, and scratch cards.
- •Type 2 (Fixed-Odds Betting): Pre-match and live in-play fixed-odds betting where the operator manages risk through odds-setting.
- •Type 3 (Peer-to-Peer/Commission-Based): Games where the operator takes a commission rather than acting as the house. Includes peer-to-peer poker, betting exchanges, pool betting, peer-to-peer bingo, and lottery messenger services.
- •Type 4 (Controlled Skill Games): Currently limited to fantasy sports betting.
B2B Critical Gaming Supply Licence:
Covers the supply and management of gaming software to generate, capture, control, or process essential regulatory records. Sub-categories include Game Providers (supply of games) and Back-end/Back Office services (platform provision, player account management).
Corporate Group Licence:
Available where a parent entity controls over 90% of subsidiary entities. Requires a minimum of 2 entities, all established in Malta or an EU/EEA jurisdiction. Only one annual MGA fee applies to the group.
Recognition Notice:
For operators already licensed in another EU/EEA member state or a jurisdiction deemed equivalent by the MGA. Valid for 1 year with annual renewal. Operators can hold multiple B2C types under a single umbrella licence, allowing flexible addition of game verticals without separate authorizations.
Capital Requirements
The MGA Capital Requirements Policy, effective May 2025, sets minimum issued and paid-up share capital thresholds for each license type.
Minimum Share Capital by License Type:
- •B2C Type 1 (Casino/RNG): EUR 100,000
- •B2C Type 2 (Fixed-Odds Betting): EUR 100,000
- •B2C Type 3 (P2P/Commission-Based): EUR 40,000
- •B2C Type 4 (Controlled Skill Games): EUR 40,000
- •B2B Critical Gaming Supply: EUR 40,000
- •Multiple Types Combined: Capped at EUR 240,000 maximum
Capital must consist of issued and paid-up capital and share premium. Importantly, the capital can be used operationally and does not need to be blocked or ring-fenced in a separate account.
All licensees must maintain a positive equity position throughout the license term, meaning assets must equal or exceed liabilities at all times. If negative equity occurs, the licensee has a 6-month restoration period to rectify the position through capital injection or loan conversion. For B2B licensees, mandatory restoration is triggered only when losses exceed EUR 3 million, subject to MGA discretion.
Application Process and Timeline
The MGA application process consists of five formal assessment stages, with a typical processing timeline of 3 to 6 months for remote gaming applications.
Stage 1 -- Fit-and-Proper Evaluation:
Background checks on all owners, shareholders, ultimate beneficial owners (UBOs), directors, and key management personnel. Individual key persons background checks take 3 to 4 months per person.
Stage 2 -- Financial Analysis:
In-depth review of the business plan, financial projections, and funding sources. The MGA examines the viability and sustainability of the proposed operation.
Stage 3 -- Operational and Statutory Requirements Review:
Assessment of compliance manuals, procedures, and policies including AML/CFT frameworks, player protection measures, responsible gaming procedures, and terms and conditions.
Stage 4 -- System Review:
Applicants have a 60-day deadline to implement the operation in a virtual or staging environment after system approval. An MGA-approved independent auditor then conducts a full systems audit covering player registration, account controls, game logs, and payment integration.
Stage 5 -- Compliance Review:
A 90-day audit window for final compliance verification before the license is granted.
Required Documentation:
- •Business plan with financial projections
- •AML/CFT and player onboarding procedures
- •Responsible gaming procedures
- •Technical setup policies and system architecture diagrams
- •Player-facing terms and conditions
- •Business partner and supplier contracts
- •Corporate documents, shareholder structure, and UBO declarations
The MGA assigns a case officer within the initial weeks of application, with gaps typically flagged within 4 to 6 weeks of submission. The realistic overall timeline from incorporation to go-live is 9 to 18 months depending on the applicant's readiness.
Fees and Taxation
Application Fees:
- •EUR 5,000 non-refundable application fee (B2C and B2B)
- •EUR 50 per director or key function holder
- •EUR 1,000 for material supply certificates
Annual License Fees (B2C):
- •Types 1, 2, and 3: EUR 25,000 per annum
- •Type 4 only: EUR 10,000 per annum
Annual License Fees (B2B Game Providers):
- •Revenue up to EUR 5,000,000: EUR 25,000
- •Revenue EUR 5,000,001 to EUR 10,000,000: EUR 30,000
- •Revenue above EUR 10,000,000: EUR 35,000
Annual License Fees (B2B Back-end/Back Office):
- •Revenue up to EUR 1,000,000: EUR 3,000
- •Revenue above EUR 1,000,000: EUR 5,000
Compliance Contributions (B2C):
Charged as a percentage of gaming revenue on a tiered scale. For Type 1, rates range from 1.25% on the first EUR 3 million down to 0.40% on revenue above EUR 30 million, with a minimum of EUR 15,000 and maximum of EUR 375,000 per year. The compliance contribution minimum is waived during the first year for new licensees.
Gaming Tax:
A flat 5% tax applies to gaming revenue generated from Malta-resident players only. Revenue from players outside Malta is fully exempt.
Corporate Tax:
Malta applies a headline corporate tax rate of 35%. However, through the full imputation system, non-resident shareholders can claim a 6/7ths refund upon dividend distribution, reducing the effective corporate tax rate to approximately 5%. Remote gaming services are largely VAT-exempt under Malta's 18% standard VAT regime.
Compliance and Player Protection
MGA licensees are subject to rigorous ongoing compliance obligations spanning financial reporting, player protection, anti-money laundering, and advertising standards.
Financial Reporting:
- •Annual Financial Reports due within 2 months of financial year-end
- •Interim Financial Reports due within 2 months of the 6-month period-end
- •Audited financial statements due within 180 days of fiscal year-end
Player Protection (Directive 2 of 2018):
- •Mandatory deposit and wagering limits
- •Play-time limits must be offered to all players
- •Self-exclusion mechanisms for definite or indefinite periods
- •Responsible gaming information provided before the first wager
- •Multi-brand operators must apply exclusion across all brands for problem gambling cases
- •Routine staff training on responsible gaming practices
AML/CFT Obligations:
B2C licensees are classified as subject persons under Malta's Prevention of Money Laundering Act. Requirements include customer due diligence at account opening, enhanced due diligence by first withdrawal or EUR 2,000 cumulative deposits within a rolling 180-day period, mandatory sanctions screening, appointment of an MGA-approved MLRO, automated transaction monitoring, and suspicious activity report filing.
Advertising Standards:
All commercial communications must include responsible gaming messages. Operators are prohibited from portraying gaming as socially attractive, suggesting skill influences chance-based outcomes, referencing credit availability, or targeting minors and vulnerable persons.
Key Personnel and Establishment Requirements
Corporate Establishment:
The operating company must be registered in Malta or an EU/EEA jurisdiction, with a registered office address in Malta. At least one director must be resident in Malta, and a physical office in Malta is recommended and effectively required for B2B licensees.
Key Function Holders (B2C -- 8 mandatory roles):
- •Chief Executive or equivalent
- •Day-to-day management
- •Compliance Officer
- •Legal affairs
- •Money Laundering Reporting Officer (MLRO)
- •Data Protection Officer (DPO)
- •Chief Technology Officer or IT lead
- •Internal audit
B2B licensees require 7 mandatory key functions, with the MLRO exempted. All key function holders must undergo MGA vetting and obtain a Certificate of Approval, which is renewed every 3 years at EUR 50 per certificate. Beneficial owners with more than 10% stake require full vetting.
MLRO Requirements (B2C only):
The MLRO must be Malta-resident with physical presence for face-to-face availability during MGA investigations. Eligibility requires either 2 years of MLRO experience with a relevant degree or 4 years of work experience as an MLRO, plus a minimum of 10 CPD hours annually.
Advantages of MGA Licensing
The Malta MGA license offers several strategic advantages that make it the preferred choice for iGaming operators targeting European and global markets.
EU Jurisdiction and Market Access:
As an EU member state, Malta provides operators with access to the single market framework. Licensees can service players across 27 EU member states under a single license, subject to local regulatory requirements. The Recognition Notice mechanism enables mutual recognition with other EEA-licensed operators.
Industry Reputation:
The MGA is widely considered the benchmark regulator in iGaming. An MGA license signals credibility to players, affiliates, payment processors, and banking partners. Major payment providers including Visa and Mastercard accept the MGA license as a prerequisite for processing gaming transactions.
Favorable Tax Environment:
The 5% gaming tax applies only to revenue from Malta-resident players, with international revenue exempt. Combined with the approximately 5% effective corporate tax rate through the imputation refund system, Malta offers one of the most competitive fiscal frameworks in the EU.
Mature Ecosystem:
Malta hosts a deep talent pool of gaming professionals, an established network of legal and advisory firms, and a concentration of iGaming companies that creates a self-reinforcing cluster of expertise and infrastructure.
Flexible Licensing Structure:
The umbrella licence model allows operators to add game verticals without separate authorizations, and the open-window policy ensures no artificial cap on the number of licenses issued.
Recent Regulatory Changes
The MGA has introduced several significant regulatory updates that operators should be aware of when planning their licensing strategy.
Capital Requirements Policy (May 2025):
The updated Capital Requirements Policy, effective May 2025, established new minimum share capital thresholds for all license types. Existing holders with negative equity as of 31 December 2024 and shortfalls exceeding EUR 1 million must submit recapitalization plans by 30 November 2025.
Digital Asset Policy:
The MGA now permits cryptocurrency deposit and withdrawal functionality subject to prior approval. Licensees must provide detailed policies covering virtual wallet management and KYC/AML procedures. Privacy-focused assets that obscure sender addresses remain prohibited.
Enhanced Enforcement Framework:
Penalties for non-compliance have been strengthened. Major offenses carry fines of EUR 10,000 to EUR 500,000 or up to 5 years imprisonment. AML non-compliance can result in fines up to EUR 2.5 million, with officers facing up to 18 years imprisonment. Administrative penalties reach EUR 25,000 per breach or EUR 500 daily for ongoing non-compliance. Regulatory settlement agreements are available to extinguish criminal liability upon payment.
Technical Standards:
RNG certificates issued by MGA-approved independent testing laboratories are required for every RNG-driven game. A full technical dossier including system diagrams, front-end architecture, game servers, wallets, payment gateways, and geoblocking configurations must be submitted. Remote and cloud infrastructure is permitted provided it meets MGA security, logging, and audit standards.