Operating a digital-asset business in the European Union without the correct regulatory authorisation is not a calculated risk – it is a structural flaw. A business that processes crypto transactions for EU users without a valid licence faces enforcement action, disrupted banking relationships, and the kind of reputational damage that is difficult to reverse. Malta entered the digital-asset regulatory conversation early, and the island's transition from its own Virtual Financial Assets (VFA) framework to the EU's MiCA (Markets in Crypto-Assets Regulation) regime reshapes the calculus for every operator considering a European base. The Malta Financial Services Authority (MFSA) remains the competent national authority through that transition and into the MiCA era.
This page sets out the regulatory regime in Malta, who needs authorisation, what the application process involves, and how Malta compares for an operator weighing European entry options. It covers the cross-border dimensions – where your users are, where your banking sits, and how a Malta authorisation interacts with EU passporting rights – that determine whether the jurisdiction actually solves your problem.
The Regulatory Architecture: VFA Framework Transitioning to MiCA
Malta was among the first EU member states to enact domestic crypto-asset legislation, and that early-mover position defined its reputation as a European digital-asset hub. The VFA (Virtual Financial Assets) Act created a structured regime administered by the MFSA, covering exchanges, wallets, brokers and portfolio managers operating with crypto assets that did not qualify as financial instruments under existing securities law. That domestic architecture now transitions into MiCA authorisation as a CASP (Crypto-Asset Service Provider), the EU-wide licence that supersedes national VFA licences across all member states.
The transition is material for incumbents and new applicants alike. Firms already holding a VFA licence are working through a grandfathering pathway set by the MFSA. New applicants entering the Maltese market are assessed under the MiCA CASP framework from the outset. Both tracks lead to the same destination: a MiCA-compliant authorisation that carries EU-wide passporting rights. The MFSA has published transition guidance, and operators should not assume that a pre-existing VFA registration is equivalent to a completed CASP authorisation without engaging that process directly.
The retained concept of a VFA agent – a mandatory intermediary who previously supported licence applications under the VFA Act – has evolved under MiCA alignment, but the MFSA's expectation that applicants demonstrate genuine substance in Malta has not changed. A registered address and a nominee director are not substance. The authority examines governance, fit-and-proper status of controllers, and operational capacity in the jurisdiction.
Who Needs Authorisation in Malta?
Any business providing crypto-asset services to clients in Malta or across the EU from a Maltese base requires a CASP authorisation under the MiCA regime. The services covered under MiCA are defined broadly: custody and administration, operation of a trading platform, exchange of crypto assets for fiat or for other crypto assets, execution of orders, placing of crypto assets, reception and transmission of orders, portfolio management, and advice. If your business does any of these things for clients, a licence is the starting point of the analysis, not the end.
Token issuers also have obligations that sit alongside the CASP regime. The MiCA framework distinguishes between asset-referenced tokens (ARTs), e-money tokens (EMTs), and other crypto assets. Each category carries its own whitepaper obligation and, for ARTs and EMTs, authorisation and reserve requirements that are separate from – and in addition to – the CASP licence. A stablecoin issuer operating from Malta therefore faces a dual regulatory engagement: the token authorisation and, if the issuer also provides exchange or custody services, the CASP layer on top.
Businesses that are entirely offshore in structure but serve EU-based users are not exempt. MiCA applies on the basis of where clients are located, not only where the operator is incorporated. Operating without authorisation while serving EU users exposes the entity to the MFSA and, through ESMA coordination, to NCAs in the member states where users reside.
For a scoped assessment of whether your current structure requires MFSA authorisation, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
What Does a CASP Authorisation Cover?
A CASP authorisation under MiCA is activity-based: the authority granted is tied to the specific services listed in the application, not a blanket permission to operate across all crypto-asset activities. An operator must identify each service it intends to provide and demonstrate the governance, capital, and operational capacity appropriate to that service profile. Adding a new service after authorisation requires a variation of the authorisation – it is not automatic.
The practical implication is that pre-application scoping is not optional. Operators who apply for a narrower activity set to simplify the initial application and then seek to expand quickly find that the variation process adds time and cost that could have been avoided by a complete service-mapping exercise at the outset. In our practice, we see this pattern consistently with exchange operators who later add custody or lending – both require distinct capability demonstrations before the MFSA.
MiCA also draws a clear line between crypto assets that fall within its scope and those that qualify as financial instruments under MiFID II. If a token confers equity-like rights, revenue-sharing, or voting interests that mirror those of a transferable security, it sits outside MiCA and within the existing securities regime. That classification question – substance over the label the issuer applies – is one the MFSA takes seriously. A mislabelled token that later attracts a securities-law analysis creates enforcement exposure that a proper pre-launch classification review would have addressed.
What Does the MFSA Application Process Involve?
The CASP application process under MiCA follows a structured sequence, and the MFSA expects a materially complete submission before it commences its formal review period. Incomplete applications are returned, and the clock does not run until the authority is satisfied with the submission package. That practical reality means preparation time matters as much as the formal review period.
The core submission typically includes: a detailed business plan; governance and ownership structure documentation; fit-and-proper assessments for controllers, directors and senior management; an AML/CFT programme aligned with the applicable VASP provisions and the FATF Travel Rule; technology and security documentation; a client asset safeguarding framework (for custody services); and, where relevant, a MiCA whitepaper. The quality of these documents – not their volume – is what the MFSA examines. A boilerplate AML policy that does not reflect the actual risk profile of the business will generate questions and delays.
Timeline depends on the complexity of the application and the responsiveness of the applicant to queries. Straightforward applications with well-prepared documentation move through the process in a matter of months; complex multi-service applications, or those where fit-and-proper queries arise, take longer. We advise clients to treat the pre-application phase – engaging with the MFSA, resolving structuring questions, and preparing the submission package – as a substantive piece of work, not an administrative step. Underestimating it is the single most common reason timelines extend.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. To map the licence, banking and tax stack for your build, write to info@oboluslaw.com or message us via t.me/oboluslaw. Map your options.
Substance, Governance, and Capital Expectations
The MFSA's substance expectations for CASP applicants reflect a broader EU-wide expectation that authorised entities are genuinely present in – and managed from – their home member state. A shell structure with nominal Maltese presence and real management elsewhere does not satisfy the MiCA authorisation conditions. The authority looks at where the mind and management of the business actually sits, whether the board includes directors with genuine decision-making authority in Malta, and whether the operational team supporting compliance and risk is in place.
Capital requirements under MiCA vary by the category of service. The regulation sets minimum own-funds thresholds that differ between, for example, a firm providing only advice and a firm operating a multilateral trading platform. Those thresholds are set at the EU level by MiCA and are [VERIFY]-categorized in the registry – meaning the specific figures should be confirmed against current ESMA and MFSA guidance at the time of application. What can be said with confidence is that the thresholds are tiered by service category, and that the MFSA monitors ongoing capital adequacy, not just the position at authorisation.
In a recent engagement, we assisted an exchange operator preparing its CASP application under the Maltese transition pathway. The primary challenge was not the capital position – that was adequately funded – but the governance documentation. The operator's existing board structure did not clearly evidence MFSA-compatible decision-making authority. We restructured the governance documentation, identified the additional locally-resident executive the authority would expect, and the application proceeded without a formal request for further information on that point. Early-stage governance mapping avoids mid-process restructuring.
AML Obligations and the Travel Rule in Malta
Every CASP operating from Malta is a virtual asset service provider (VASP) for AML/CFT purposes, subject to full customer due diligence, transaction monitoring, and suspicious-transaction reporting obligations under the applicable VASP provisions of Malta's AML legislation and the EU's AML directives. The MFSA supervises AML compliance for CASPs alongside the Financial Intelligence Analysis Unit (FIAU), Malta's financial intelligence unit.
The Travel Rule – the obligation to pass originator and beneficiary information with a virtual asset transfer – applies to transfers above the applicable threshold. That threshold is a [VERIFY] figure in the registry and should be confirmed against current EU-level and Malta-specific AML guidance. What is certain is that the Travel Rule is operationally demanding: it requires a technical implementation that can originate, receive and screen Travel Rule messages, and a counterparty-assessment programme for transfers to unhosted wallets.
Operators we advise routinely underestimate the Travel Rule implementation workload. Building the policy is straightforward. Building the technical infrastructure to execute it reliably at transaction speed – including handling responses from non-compliant counterparties – requires early-stage vendor engagement and testing. MFSA inspections have examined this area closely, and a licence that sits on top of an inadequate Travel Rule implementation creates ongoing supervisory risk that undermines the value of the authorisation itself.
Tax Environment and Banking Access
Malta's general corporate tax rate is set nationally, and the island has a well-developed refund mechanism that can reduce the effective rate for qualifying structures. The interaction of that mechanism with crypto-asset income – trading revenue, exchange fees, staking rewards and token issuance proceeds – requires a transaction-by-transaction analysis, since the Maltese tax authority's treatment of specific crypto income streams has evolved alongside the sector. We work alongside allied counsel and specialist tax advisors in Malta to map the tax stack as part of the licensing engagement, because structuring after the entity is established costs more than structuring alongside the licensing process.
Banking access for crypto-licensed entities remains a practical constraint across the EU, and Malta is not an exception. EU-licensed exchanges and custodians are often turned away by larger clearing banks that have not developed crypto-specific compliance programmes. In practice, operators need a dedicated strategy: identifying EMI partners with crypto-asset experience, payment institutions that can provide fiat settlement rails, and, for larger operations, a direct bank relationship with an institution that has a documented crypto-sector AML policy. A MiCA CASP licence improves the conversation with banks because it signals regulatory accountability – but it does not guarantee account opening. We map this parallel with the licence application so that the operator knows, before authorisation, where it will bank on day one.
How Malta Compares for an Inbound Operator
For a business weighing European licensing options, Malta sits alongside Lithuania, Germany and Ireland as an EU member-state route to MiCA CASP authorisation and EU passporting. The passport is the point: a CASP authorisation in any EU member state allows the operator to passport its services across the EU/EEA without requiring a separate licence in each country. The question, therefore, is not which jurisdiction grants the most permissive licence – MiCA harmonises the substantive standards – but which NCA is best equipped to process the application, and which jurisdiction offers the right substance environment for the specific business.
Malta's advantages are a common-law-influenced legal tradition within an EU civil-law framework, a deep pool of digital-asset practitioners and compliance professionals on the island, and an MFSA that has accumulated meaningful experience with crypto-asset applications through the VFA era. Its limitations are the same as any smaller NCA: periodic capacity constraints in the review pipeline and a post-VFA regulatory posture that some operators have found more exacting than the pre-2021 environment suggested.
Lithuania, by contrast, entered the MiCA era from a lighter-touch VASP registration regime and is processing CASP applications with a different application culture. ADGM and VARA in the UAE are outside the EU passport and serve a different use case entirely – the Middle East and Asia connectivity play. For a business whose client base is European and whose operational home can be EU-based, Malta and Lithuania are natural comparators, and the decision turns on where the management team can genuinely be present and where the business model fits the specific NCA's supervisory expectations.
In our cross-border practice, we regularly advise operators running parallel analyses – Malta for EU operations, a Gulf hub for MENA distribution, Singapore or Hong Kong for Asia – and the structuring question is how those entities interact: shared infrastructure, intra-group licensing, and the cross-border AML obligations that arise when assets move between them.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how OBOLUS structures a licence application from scoping to authorisation
- VASP Licence Application: Practical Lessons for Boards – governance and preparation insights drawn from application experience
- Oracle and Data-Feed Liability in Singapore – the Singapore regulatory environment for DeFi infrastructure operators
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and application complexity. Under the MiCA regime in Malta, well-prepared applications with complete governance, AML and capital documentation move through the MFSA review process in a matter of months. Incomplete submissions, fit-and-proper queries, or multi-service applications extend that timeline. In our practice, total elapsed time from engagement to authorisation – including the pre-application preparation phase – is typically measured in months rather than weeks for a straightforward single-service application.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your clients are, where your management team can genuinely be present, which regulatory regime fits your business model, and where you can realistically bank. For EU distribution, a MiCA CASP authorisation in Malta, Lithuania or another EU member state provides passporting rights. For Middle East access, VARA or ADGM serve different use cases. A common mistake is optimising for a single variable – speed or cost – rather than the full stack of licensing, banking and ongoing compliance.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto assets on behalf of clients is a regulated CASP service. If your business holds client assets – whether on a centralised exchange, a custodial wallet or a sub-custody basis – that activity falls within the scope of authorisation. Exchanges that also hold client assets are providing both trading and custody services and must demonstrate the additional safeguarding capability the MFSA expects for both. A separate entity structure for custody is sometimes used for operational and liability reasons, but the regulatory requirement is activity-driven, not entity-driven.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit, and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU and Gulf digital-asset authorisation pathways, MiCA CASP structuring, and multi-hub licence stacks for exchange and custodian operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.