Economic Substance for Licensed VASPs in Malta

A virtual asset service provider (VASP) holding a Maltese licence without genuine local operations is an enforcement target. The Malta Financial Services Authority (MFSA) has progressively tightened its expectations around physical presence, local governance and operational substance – and regulators across the EU are watching. Under the transition from Malta's prior VFA framework (Virtual Financial Assets framework) to the CASP authorisation regime introduced by MiCA (the Markets in Crypto-Assets Regulation), substance requirements are no longer a soft expectation. They are a condition of holding the licence and of exercising the passporting rights that make Malta commercially valuable in the first place.

Economic substance for a licensed VASP in Malta means demonstrating to the MFSA that the entity has sufficient local management, decision-making infrastructure and operational capacity to justify the authorisation it holds. Failure to maintain that substance risks licence withdrawal, loss of EU passporting, and – for businesses banking cross-border – frozen correspondent rails. This page explains what substance means in practice, how the MFSA assesses it, and what an inbound operator must build before committing to Malta as its primary EU hub.

What Economic Substance Means for MFSA-Licensed Entities

Economic substance, in the Maltese regulatory context, is the demonstrable connection between the entity on the licence and the real business decisions made within Malta's borders. The MFSA does not simply count employees. It examines where the board meets, where senior management exercises discretion, where compliance functions are performed and where key contracts are signed and negotiated.

For a CASP authorisation under MiCA, which is now the operative EU licence for crypto-asset service providers, the MFSA expects the applicant to maintain a registered office and genuine headquarters in Malta. A director with a Maltese address and a forwarding service does not satisfy this standard. Operators we advise routinely underestimate how granular the MFSA's assessment has become. The regulator looks at board meeting minutes, internal audit trails, the physical location of IT infrastructure and AML monitoring functions, and the employment contracts of the people who run the business day to day.

The cross-border dimension matters immediately. Many businesses structure their group with an operational entity in one jurisdiction and an EU-facing licensed entity in another. Where the licensed Malta entity is effectively managed from a third country – a UAE parent company directing all decisions, for example – the substance test will fail. The MFSA has the authority to review management and control, and ESMA's supervisory convergence expectations push national competent authorities to apply this standard consistently across the bloc.

How Does the MFSA Assess Substance During the Authorisation Process?

The MFSA embeds its substance assessment directly into the CASP authorisation process, not as a post-licensing review. Applicants submit governance documentation, organisational charts with named individuals and their jurisdictions of residence, and a business plan that maps where each regulated activity will actually be performed.

The authority focuses on four indicators: board composition and meeting location, the residency and time-commitment of senior managers, the location and independence of the compliance and AML function, and the technical infrastructure supporting service delivery. An entity that outsources all of these functions offshore will face rejection or a formal request for information that delays the process materially.

In our cross-border practice, we have seen applications fail at the governance documentation stage because the proposed compliance officer held five simultaneous directorships across three jurisdictions. The MFSA expects the nominated compliance function to be dedicated, qualified and Malta-proximate. Part-time arrangements are scrutinised. Contracted arrangements with Maltese service providers are permitted but must be documented with clear accountability lines – the regulated entity bears responsibility, not the service provider.

The VFA framework that preceded MiCA introduced the concept of a VFA agent – a licensed intermediary who acts as the point of contact between the applicant and the MFSA. Under the transition to MiCA, this role evolves, but the principle of documented accountability between the applicant and its Malta-based governance representatives continues. Operators should not assume that appointing a VFA agent discharges their substance obligations. It does not. The agent facilitates the process; the operator builds the substance.

The process above describes the standard application path. Your specific entity structure – the parent company jurisdiction, the group banking setup, the planned user geography – changes the analysis materially. For a scoped assessment of your Malta licence strategy, contact OBOLUS at info@oboluslaw.com.

The Transition from VFA to MiCA CASP: What Existing Licence Holders Must Do

Entities that obtained authorisation under Malta's prior VFA framework are not automatically grandfathered into the MiCA CASP regime. The transition requires existing licensees to file for CASP authorisation under MiCA within the timelines set by the applicable transitional provisions, while demonstrating that their operations continue to meet the updated substance standards.

The MiCA transition is not a rubber-stamp exercise. The MFSA is using the transition window to reassess the substance of each existing licensed entity. Operators who built their Malta structure around minimal local presence during the earlier, lighter-touch regime now face the choice of building genuine substance in Malta or re-licensing in a jurisdiction where they have stronger operational roots.

For some businesses, the honest analysis is that Malta was chosen for speed and cost at a time when the VFA framework was new and enforcement was limited. The MiCA environment is different. ESMA's supervisory convergence guidelines apply across all national competent authorities, meaning the MFSA cannot maintain a lower standard than its peers without attracting EU-level scrutiny. Regulators in the leading hubs increasingly expect that a licensed entity is where its management actually sits.

We have guided operators through this transition, mapping the gap between their existing governance structure and the MFSA's current expectations. In most cases the work involves revising the board composition, appointing a Malta-based compliance officer with a clear mandate, and restructuring the intra-group service agreement so that core functions are demonstrably performed within the licensed entity.

How Does Substance Interact with EU Passporting Under MiCA?

EU passporting under MiCA allows a CASP authorised in Malta to offer services across every EU and EEA member state without obtaining a separate licence in each country – but only if the home authorisation is valid and the substance supporting it is maintained. This is the central commercial reason why operators choose Malta: one licence, twenty-seven markets. The substance obligation is the price of that access.

If the MFSA identifies a substance deficiency post-authorisation – after a periodic review, a supervisory notification from ESMA, or a complaint – it has the authority to impose conditions, suspend activities or initiate withdrawal proceedings. Each of those outcomes cuts off the passporting right. A business that built its EU distribution model around a Malta passport faces immediate commercial disruption.

The cross-border read is direct. A business serving users in Germany, France and the Netherlands from a Malta-licensed entity must be able to demonstrate to the MFSA – and, indirectly, to those host-country regulators – that the licensed entity is genuinely conducting its regulated activities from Malta. Host-country regulators under MiCA retain the authority to notify ESMA if they believe a foreign CASP is circumventing local oversight. This creates a multi-directional substance obligation.

Tax planning around the Malta structure adds a further layer. Malta's participation exemption and holding company regime are attractive for digital-asset groups. However, a structure that works for EU passporting – genuine management and control in Malta – is also the structure that the tax analysis requires to claim Malta's treaty and domestic tax benefits. Where substance is genuine, the licensing and tax positions reinforce each other. Where it is contrived, both collapse together.

What Does a Compliant Substance Model Look Like in Practice?

A well-structured Malta VASP substance model has four observable pillars: governance, compliance, operations and banking. Each must be documentable and auditable before the MFSA makes a request.

On governance, the board of the Maltese entity should include at least two Malta-resident or Malta-proximate directors who actively participate in board meetings held in Malta. Board minutes must reflect genuine deliberation – not ratification of decisions already made by a parent company elsewhere. The managing director or CEO should have a meaningful portion of their professional time dedicated to the Malta entity and should be reachable by the MFSA on a Malta time-zone basis.

On compliance, the Money Laundering Reporting Officer (MLRO) and the compliance function must be positioned within the Malta entity. The MFSA expects the MLRO to be an approved person – cleared through the fit-and-proper process – and to maintain the AML and KYC programme locally, with records accessible in Malta. Outsourcing AML monitoring to a third country is permissible only with documented contractual accountability and active oversight by the Malta-based MLRO.

On operations, the server infrastructure or cloud-hosting arrangements for the core platform must be documented, with the licensed entity named as the contracting party for regulated-activity infrastructure. Service agreements between the Malta entity and group technology companies must be at arm's length and must reflect commercial reality.

On banking, Malta-licensed VASPs must maintain at least one Maltese or EU-based banking relationship for their operations. In our practice we have seen businesses lose their banking rail before their licence came under pressure – a correspondent bank reviewing the group's substance profile and deciding the Malta entity lacked genuine local operations. Substance and banking access are not separate problems. They are the same problem.

Restructuring Ahead of an MFSA Periodic Review

In a recent matter, an exchange operator holding a VFA-era Malta registration faced a scheduled MFSA periodic review during the MiCA transition window. The group's actual operations – technology, compliance monitoring and executive decision-making – were run from a non-EU jurisdiction. The Malta entity had two nominal directors, both part-time and resident elsewhere, and no local banking.

We were instructed in the months before the review. Working with the operator, we identified the specific gaps in board composition, MLRO appointment and operational documentation that the MFSA would examine. We assisted in restructuring the governance framework: replacing the nominal directors with two Malta-based individuals holding clearly defined mandates, appointing an independent MLRO with the requisite MFSA fit-and-proper clearance, and restructuring the intra-group service agreement to position the Malta entity as the primary contracting party for EU-facing regulated activities. The operator entered the periodic review with a documented, auditable substance model. The review concluded without adverse findings.

Cross-Border Interaction: Tax, Banking and the Substance Stack

A Malta CASP does not exist in isolation. It sits inside a corporate group that likely spans multiple jurisdictions, and every cross-border interface creates a point of substance scrutiny.

On tax, Malta applies its participation exemption and full-imputation dividend system to qualifying companies. For a digital-asset group, those benefits are accessible where the Malta entity is the genuine holding or operating company – which requires the same management-and-control evidence that the MFSA demands for licensing purposes. A tax adviser arguing Maltese residence for a company whose board meets in a third country will find the position unsustainable when the MFSA has already identified a substance deficiency.

On banking, EU correspondent banks – particularly those in Germany, the Netherlands and Luxembourg that serve Maltese entities – have adopted their own substance screening processes, informed by the EU's AML supervision expectations and by FATF's guidance on virtual assets under Recommendation 15. A bank that believes a Maltese VASP is a shell will close the account, often without a right of appeal. Operators we advise are increasingly aware that banking access is the practical enforcement mechanism for substance requirements, faster and harder to reverse than regulatory action.

On the Travel Rule – the obligation under FATF Recommendation 16 to pass originator and beneficiary data with a virtual-asset transfer – the Malta entity must have its own Travel Rule solution in place. Reliance on a group-level solution operated from outside Malta creates an accountability gap that the MFSA's AML supervisory team will identify. The Travel Rule solution must be contracted to and operated by the Malta entity, with auditable oversight by the local MLRO.

If a prior application stalled, a periodic review raised questions, or a banking relationship was closed, a structured review of your Malta substance position can identify the root cause and the route forward. Write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.

Decision Point: Is Malta Still the Right EU Hub?

Malta remains a viable and commercially well-supported EU licensing jurisdiction. The MFSA has a developed understanding of digital-asset business models, a functioning VFA-agent ecosystem and a legal system that operators from common-law jurisdictions find workable. The substance requirements that now apply are demanding – but they are not materially different from what MiCA requires of any CASP authorisation across the EU.

The question is whether Malta fits your operational model, not whether Malta has become too strict.

Profile A – an exchange operator with a technology team that can be Malta-based or Malta-proximate, a compliance function that can be structured locally, and a banking relationship with an EU correspondent bank – is well suited to a Malta CASP. The substance obligations are buildable, the local professional services market is capable, and the passporting right is commercially significant.

Profile B – a business whose entire technology, executive and compliance infrastructure is located in Asia or the Gulf, with no intention of relocating any of those functions – will find it difficult to maintain genuine substance in Malta. For this operator, the honest analysis points toward a jurisdiction where the business already has genuine operational roots, or toward a structure where the Malta entity is a genuinely separate business unit with its own governance, rather than a licensed shell over an offshore operation.

Profile C – an operator currently licensed under the VFA framework who has been operating with minimal local substance and is approaching the MiCA transition deadline – has a defined and time-limited window to restructure. The cost and disruption of building genuine substance in Malta is real. So is the cost of losing the licence and the EU passport, and then attempting to re-enter the market under a new authorisation in a different member state.

In our practice, we map the licence, banking and tax stack across all three profiles before a client commits to a build. The analysis is faster and cheaper than unwinding a structure that the MFSA subsequently rejects.

A Common Assumption That Costs Operators

A common assumption among inbound businesses is that an existing offshore licence – a Cayman VASP registration, a BVI FSC filing, or a registration in a non-EU jurisdiction with lighter regulatory demands – extends to EU clients by virtue of the cross-border reach of digital services. It does not. MiCA's market-access regime is geographic and authorisation-based. A business offering crypto-asset services to EU-resident clients without a CASP authorisation from an EU national competent authority is operating outside the regulated perimeter, regardless of where its offshore licence is held.

Malta, as an EU member state, gives a CASP authorisation its EU-wide force. But that force is conditional on genuine substance. The offshore licence and the EU licence are not substitutes for each other, and they are not additive in a way that reduces the substance obligation. Each structure must stand on its own regulatory footing.

Operators who have built on the assumption that a light-touch offshore registration covers their EU business are exposed to enforcement action from multiple directions – from the MFSA if they claimed Malta substance without delivering it, and from host-country regulators across the EU if they served local clients without proper authorisation.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – how OBOLUS maps the full licence stack across operating, custody and payment layers
• ADGM vs BVI: Where to License – a comparative analysis of two leading offshore and free-zone hubs for digital-asset operators
• Utility Token Legal Opinion in Australia under AUSTRAC – token classification and registration considerations under the Australian framework

FAQ

How long does a crypto licence take to obtain?

Under Malta's transition to the MiCA CASP regime, authorisation timelines depend on the completeness of the application and the complexity of the business model. The MFSA follows the statutory review periods set under MiCA, with the clock paused when the authority issues requests for further information. Well-prepared applications with complete governance documentation and a clear substance plan proceed materially faster than those requiring multiple supplementary rounds. Budget for a process measured in months, not weeks, for a full CASP authorisation.

Which jurisdiction is best for licensing my crypto business?

There is no universal answer. The right jurisdiction is determined by where your users are located, where your operations sit, what activities you conduct and what banking relationships you can access. For EU market access, a Malta CASP authorisation provides passporting across all member states – but only where genuine substance is maintained. For businesses with operations in the Gulf, the VARA regime in Dubai or the FSRA framework in Abu Dhabi may be more appropriate. OBOLUS maps the jurisdiction, substance and banking stack before you commit.

Do I need a separate custody licence?

Under MiCA, custody and administration of crypto-assets on behalf of clients is a defined regulated activity that requires specific authorisation as part of a CASP licence. Whether you need a standalone custody authorisation or whether custody is covered within your primary CASP authorisation depends on the scope of your proposed activities and how you have structured the custody function – particularly where custody is performed by a separate group entity. This is a structural question that should be resolved before you file, not during the review.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so the structure you build is one the regulator will accept and the bank will service. To discuss your Malta substance position, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in EU CASP authorisation, MFSA engagement and cross-border licence structuring for digital-asset businesses.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.