Skip to content
World Watch

Is crypto legal in Malta? Rules & regulation (2026)

Crypto is regulated in Malta.

Crypto is fully legal in Malta and operates under a comprehensive in-force EU framework (MiCA), applied by the MFSA, layered on top of Malta's pioneering 2018 Virtual Financial Assets Act which is being phased out by 1 July 2026 in favour of MiCA's CASP regime. New crypto-asset service providers must apply directly for a MiCA CASP authorisation; pre-existing VFA licensees benefit from a transitional period until 1 July 2026. As of mid-2026 the MFSA had authorised roughly 12 CASPs and two e-money-token (stablecoin) issuers, although a July 2025 ESMA peer review criticised MFSA's authorisation process as not sufficiently thorough.

Last verified Official sources first · MethodologyCompare Malta with other countries

Legal framework

EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), directly applicable, with the Malta Financial Services Authority (MFSA) as competent authority. Malta's national Virtual Financial Assets Act (Cap. 590, VFA Act) of 2018 remains in force during the transitional/grandfathering period (running to 1 July 2026); a 2024-25 reform aligned the VFA framework with MiCA. AML/CFT for VASPs/CASPs is supervised by the FIAU under the Prevention of Money Laundering Act. Tax treatment of DLT assets follows Commissioner for Revenue Guidelines (November 2018) under the Income Tax Act and Income Tax Management Act.

Status by sub-area

  • Stablecoins

    In force

    MiCA Titles III (ARTs) and IV (EMTs) apply directly in Malta. EMT issuance is restricted to authorised credit institutions or EMIs; ART issuance requires bespoke MFSA authorisation with own-funds, reserve-asset segregation, redemption-at-par and white-paper requirements. MFSA had approved at least two EMT issuers, including Malta-headquartered StablR (EURR).

  • Exchanges / VASP

    In force

    Exchanges and other VASP-type providers must hold a MiCA CASP authorisation from the MFSA (new applicants since 30 December 2024), with a grandfathering window for existing VFA licensees until 1 July 2026. Authorisation covers fit-and-proper, governance, prudential capital (€50k/€125k/€150k by class), conduct-of-business and market-abuse rules.

  • Token Offerings

    In force

    Offerings of crypto-assets other than ARTs/EMTs (typically utility tokens) are governed by Title II of MiCA — offerors must publish, notify MFSA of and observe content rules for a crypto-asset white paper, subject to limited exemptions. Tokens qualifying as financial instruments fall under the EU Prospectus Regulation, MiFID II and Malta's Financial Markets Act / Investment Services Act.

  • Custody

    In force

    Custody and administration of crypto-assets on behalf of clients is a regulated CASP service under MiCA, requiring MFSA authorisation, asset segregation, an obligation to keep an internal register, and liability for loss attributable to incidents within the CASP's sphere of control. Domestic detail remains in Chapter 3 of the MFSA VFA Rulebook during the transition.

  • DeFi

    Partial

    MiCA (and therefore Maltese law) excludes from its scope crypto-asset services that are 'provided in a fully decentralised manner without any intermediary'; centralised front-ends, governance entities or service providers around DeFi protocols can be caught as CASPs. The European Commission is expected to deliver a dedicated DeFi report by end-2026, with no Maltese national DeFi-specific statute yet in force.

    Still pending: EC DeFi report pending (end-2026); no Maltese national DeFi statute in force

  • Tax

    In force

    Malta has no dedicated 'crypto tax' law; instead the Commissioner for Revenue's November 2018 Guidelines apply the Income Tax Act, Income Tax Management Act, Duty on Documents and VAT Act to DLT assets based on a coin/financial-token/utility-token/hybrid classification. Long-term holdings of 'coins' generally avoid CGT, while trading and financial-token returns are taxed as income at 15–35%.

How to get a crypto license in Malta

To provide crypto-asset services in Malta you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Malta Financial Services Authority (MFSA), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.

Authority
the Malta Financial Services Authority (MFSA)
License required
a MiCA CASP authorisation (Crypto-Asset Service Provider)
Framework / law
the EU Markets in Crypto-Assets Regulation (MiCA), Title V
Minimum capital
€50,000–€150,000 minimum, by service class (Class 1/2/3)
Timeline
about 40 working days of substantive review; 1–3 months for a well-prepared application
Cost
an application fee of roughly €5,000–€25,000, plus ongoing supervisory fees
Passporting
Yes: a single MiCA CASP licence passports across all 27 EU member states.

What a crypto license in Malta covers

  • Custody and administration of crypto-assets for clients
  • Operating a trading platform for crypto-assets
  • Exchanging crypto-assets for funds, or for other crypto-assets
  • Executing orders for crypto-assets on behalf of clients
  • Reception and transmission of orders, and placing of crypto-assets
  • Advice and portfolio management on crypto-assets
  • Transfer services for crypto-assets on behalf of clients

Step by step: getting a crypto license in Malta

  1. Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU.

  2. Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation.

  3. Submit the application to the national competent authority.

  4. Completeness check: the authority has 25 working days to confirm the file is complete and request anything missing.

  5. Substantive assessment: the authority has 40 working days to grant or refuse the authorisation.

  6. Once authorised, notify the passport to the host member states you intend to serve, then begin operating across the EU.

Documents required in Malta

  • Programme of operations describing each crypto-asset service you will provide
  • Business plan with three-year financial projections
  • Evidence of prudential safeguards (own funds or qualifying insurance)
  • Governance arrangements, organisational chart and internal-control description
  • AML/CFT policies and the appointment of a compliance officer
  • ICT security, business-continuity and DORA-aligned resilience policies
  • Custody and client-asset segregation arrangements
  • Complaints-handling procedure and conflict-of-interest policy
  • Fit-and-proper evidence for directors and qualifying shareholders (CVs, criminal-record certificates)

Ongoing obligations in Malta

  • Maintain prudential safeguards and own funds at or above the class minimum
  • Keep client crypto-assets segregated from the firm's own assets
  • Run continuous AML/CFT monitoring, screening and suspicious-activity reporting
  • Keep marketing communications fair, clear and not misleading
  • Operate complaints handling and manage conflicts of interest
  • Meet ICT resilience and incident-reporting duties under DORA
  • File periodic reports to the national competent authority

Key points: crypto & digital assets in Malta

  1. MiCA fully applicable; MFSA is competent authority

    MiCA's CASP regime entered into application on 30 December 2024 and is directly binding in Malta; the MFSA grants CASP authorisations, EMT/ART issuer approvals, and exercises ongoing supervision. Maltese authorisations passport across the EU/EEA.

    mfsa.mt mfsa.mt

  2. VFA Act phase-out and 1 July 2026 grandfathering deadline

    Entities licensed under the VFA Act (Cap. 590) before 30 December 2024 may continue services until 1 July 2026 or until they are granted/refused CASP authorisation; new applicants must apply under MiCA. After 1 July 2026 the VFA service-provider regime ceases for in-scope crypto-asset services.

    mfsa.mt contact.com.mt

  3. ESMA peer review flagged MFSA authorisation gaps

    On 10 July 2025 ESMA published a peer review concluding that MFSA's CASP authorisation process only 'partially met expectations', material issues including pending enforcement matters were not adequately resolved before authorisations were granted, though supervisory resources and expertise were rated favourably.

    harneys.com hoganlovells.com

  4. AML/CFT for VASPs and CASPs

    VFA/CASP firms are 'subject persons' under the Prevention of Money Laundering Act and PMLFTR, supervised by the FIAU; they must comply with the EU AML directives transposed in Malta, including KYC, transaction monitoring and STR filing, and apply the Travel Rule under Regulation (EU) 2023/1113.

    iclg.com mfsa.mt

  5. Tax: CfR Guidelines treat DLT assets by category

    The Commissioner for Revenue's November 2018 guidelines split DLT assets into coins (treated like fiat, outside capital-gains tax), financial tokens (returns taxed as income; CGT possible if a 'security' under Article 5 ITA), and utility/hybrid tokens (generally outside the capital-assets list). Business income from trading is taxed at standard 15-35% income-tax rates.

    assets.kpmg.com maint.loc.gov

  6. Stablecoin issuance under MiCA Titles III/IV

    EMTs may only be issued by an EU-authorised credit institution or e-money institution; ARTs require a dedicated MiCA authorisation from MFSA. MFSA had authorised at least two EMT issuers by mid-2026, including Malta-based StablR (EURR); offerors must notify MFSA at least 40 working days before public offering or trading admission.

    mfsa.mt news.tokenizer.estate

Crypto license in Malta: FAQ

Do you need a license to run a crypto business in Malta?

Yes. To provide crypto-asset services in Malta you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Malta Financial Services Authority (MFSA), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.

Which authority issues crypto licenses in Malta?

The Malta Financial Services Authority (MFSA).

How much does a crypto license cost in Malta?

An application fee of roughly €5,000–€25,000, plus ongoing supervisory fees.

How long does it take to get a crypto license in Malta?

Typically about 40 working days of substantive review; 1–3 months for a well-prepared application.

What documents do you need for a crypto license in Malta?

The application file centres on programme of operations describing each crypto-asset service you will provide; business plan with three-year financial projections; evidence of prudential safeguards (own funds or qualifying insurance); governance arrangements, organisational chart and internal-control description; plus fit-and-proper evidence for directors and qualifying shareholders.

What is the application process for a crypto license in Malta?

Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU. Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation. The authority then assesses the file and, once authorised, you can begin operating.

Does a Malta crypto license work in other EU/EEA countries?

Yes: a single MiCA CASP licence passports across all 27 EU member states.

Timeline of decisions

  1. Decision
    Malta's financial regulator explores bringing parts of DeFi under MiCA's orbit

    CoinDesk Policy

Sources

  1. mfsa.mt/our-work/crypto-assets/
  2. mfsa.mt/our-work/virtual-financial-assets/
  3. mfsa.mt/wp-content/uploads/2025/03/MiCA-Rulebook.pdf
  4. harneys.com/our-blogs/regulatory/esma-reviews-malta-s-mica-authorisation-standard
  5. hoganlovells.com/en/publications/mica-casp-authorisations-esma-recommendations-in-peer
  6. iclg.com/practice-areas/fintech-laws-and-regulations/malta/
  7. assets.kpmg.com/content/dam/kpmg/mt/pdf/2020/11/blockchain-tax-guidelines-in-malta.pd
  8. maint.loc.gov/law/help/cryptocurrency/block-rewards/malta.php
  9. contact.com.mt/complete-guide-to-mica-regulation/
  10. news.tokenizer.estate/bvnk-wins-malta-mfsa-mica-casp-licence-cites-eea-passporting/

Next for Malta: Artificial IntelligenceComprehensive law

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 13 Jun 2026. Methodology & how to cite · State of Technology Regulation 2026