Token issuance in Malta sits at the intersection of a maturing national framework and a continent-wide regulatory shift. Under MiCA (the EU Markets in Crypto-Assets Regulation), any token offered to the public within the EU – including from a Malta-domiciled issuer – must meet whitepaper publication requirements and, where the token qualifies as an asset-referenced token or e-money token, requires prior authorisation from the MFSA (Malta Financial Services Authority). For tokens outside those categories, the offering regime is lighter but not absent. A Malta company issuing tokens without first resolving the classification question exposes itself to enforcement by the MFSA, by ESMA (the European Securities and Markets Authority) under the MiCA passporting architecture, and – depending on where tokens are sold – by regulators in each distribution jurisdiction. This page maps the regime, the process and the cross-border pressure points an inbound issuer needs to understand before committing to a Malta structure.
What is the regulatory basis for token issuance in Malta?
Malta's token-offering rules have operated through two successive regimes. The original VFA (Virtual Financial Assets) framework, administered by the MFSA, governed token offerings and required a licensed VFA agent to countersign and file a whitepaper. That domestic regime is now transitioning to MiCA, which applies directly as an EU regulation and supersedes member-state rules for in-scope tokens. The practical result for an issuer today: the classification analysis runs first under MiCA, and any residual domestic rules apply only to instruments that MiCA explicitly leaves to national law.
MiCA divides tokens into three categories. ARTs (asset-referenced tokens) maintain stable value by reference to multiple currencies, commodities or other crypto-assets. EMTs (e-money tokens) reference a single fiat currency. All other crypto-assets fall into the "other" category – which covers the majority of utility-type tokens and most governance tokens. Each category carries different authorisation and disclosure obligations. The classification is determined by the substance of the rights the token confers, not by the label on the marketing materials.
Where a token constitutes a transferable security under EU financial markets law, it falls outside MiCA and into the EU prospectus regime and MiFID II – a materially more demanding path. Malta's MFSA is the national competent authority for both regimes. Issuers need to resolve the security-vs-crypto-asset boundary before any other step.
The MFSA's transition guidance confirms that existing VFA-registered entities must migrate to MiCA CASP authorisation as national equivalence periods run down. New applicants applying now are directed toward the MiCA pathway from the outset.
Talk to OBOLUS before you classify. The regime boundary between a security and a crypto-asset is the highest-stakes determination in any token project. Our analysis is built on the substance of the rights, not the label. Map your options before the whitepaper is drafted.
Who needs to publish a whitepaper under MiCA?
Any person offering a crypto-asset to the public in the EU must publish a MiCA-compliant whitepaper, with limited exceptions. The whitepaper must be notified to the MFSA before publication, and the MFSA has a defined review period within which it may raise objections – though notification is not approval in the way a prospectus review is. For ARTs and EMTs, authorisation is required in addition to whitepaper publication, and the MFSA must issue an authorisation decision before the offering can proceed.
Exemptions exist. Offerings below the de-minimis thresholds set out in MiCA, offerings exclusively to qualified investors, and certain types of limited network tokens may fall outside the whitepaper obligation. Each exemption has conditions. Issuers relying on an exemption should document their analysis in writing, because the MFSA and ESMA can question reliance on an exemption after the fact.
The whitepaper itself must cover the issuer, the project, the rights and obligations attached to the token, the underlying technology, the risks and the offer terms. It must not contain materially misleading statements. The issuer's liability for a misleading whitepaper under MiCA runs to purchasers who suffer loss – a civil liability standard that gives institutional buyers a real recovery right.
For a Malta-based issuer, the whitepaper notified to the MFSA carries passporting effect across the EU/EEA. A single notification can support distribution in every member state without repeat filings. That passporting advantage is the primary structural reason operators continue to choose Malta as an EU base for a token project.
How does token classification work in practice?
Token classification under MiCA is a substance-over-form analysis, and it is the step where most issuers underestimate the legal risk. A token that grants profit-sharing rights, dividend-equivalent rights or voting rights over a profit-generating enterprise will be analyzed as a security first – and if it meets the transferable-security test under EU financial instruments law, MiCA will not apply to it at all. That analysis turns on the specific rights conferred, the economic substance of the arrangement and the structure of the issuing entity.
In our practice, the most common misclassification risks arise in three patterns. First, governance tokens with treasury access rights are often structured as utilities but carry economic substance closer to equity. Second, yield-bearing tokens – staking rewards, lending returns, liquidity incentives – can attract a security characterization depending on how the yield is generated and who controls it. Third, tokens issued by DAOs or unincorporated protocols present the additional complication that the "issuer" for regulatory purposes may be ambiguous.
A common assumption is that applying a utility label in the whitepaper settles the classification. It does not. Regulators across the EU – and ESMA in its published guidance – assess classification against the economic reality of what the token does, not what the issuer calls it. An incorrect classification is not a paperwork problem. It can convert a product launch into an unregistered securities offering, with enforcement, disgorgement and civil liability following.
The classification analysis should be completed before the token's economic model is finalized, not after. Structural choices – how yield is generated, how governance rights attach, how the treasury is managed – all affect the classification outcome and can be adjusted at the design stage far more cheaply than after issuance.
What does the Malta token-offering application process involve?
For an "other" crypto-asset offering, the process is centered on whitepaper preparation and MFSA notification. The issuer prepares the whitepaper in compliance with MiCA's content requirements, notifies the MFSA before publication, and may publish after the prescribed review period unless the MFSA intervenes. The issuer must also ensure it has the operational and technical infrastructure to support the token throughout its lifecycle – ongoing disclosure obligations attach to material changes.
For ARTs and EMTs, the process is more extensive. The issuer must apply for MFSA authorisation, submit a detailed application including the whitepaper, a business plan, governance arrangements, reserve management policies and remuneration disclosures. The MFSA will conduct a substantive review and may require additional information. Authorisation timelines are measured in months, not days, and are determined by the completeness of the application and the complexity of the structure. Specific timelines are subject to MFSA workload and the current state of MiCA implementation guidance; an experienced Malta counsel should be engaged for current estimates.
A separate question is whether the token distribution requires a CASP (Crypto-Asset Service Provider) authorisation for the issuer or a placement agent. If the issuer operates a platform through which tokens are sold – controlling order execution, custody or settlement – the CASP regime applies independently of the token-offering rules. The two regimes interact but do not merge: an issuer can offer tokens without being a CASP, and a CASP can list third-party tokens without being an issuer.
In a recent matter, a tokenized real-estate project sought to use Malta as its EU offering base. The initial structure had the issuer also acting as the custodian of token proceeds during the offering period. That arrangement required separate CASP analysis. We restructured the custody arrangement so that proceeds were held through a licensed custodian during the subscription window, separating the issuer and CASP functions and avoiding a regulatory gap that would have delayed the offering timetable by several months.
How do cross-border tax and banking considerations interact with a Malta token offering?
A Malta token structure does not operate in isolation. The issuer's tax residency, the location of token purchasers and the banking arrangements for token proceeds all introduce cross-border legal obligations that sit alongside – and sometimes constrain – the MiCA compliance path.
On the tax side, the treatment of token sale proceeds – as capital, revenue or something else – is jurisdiction-specific and is not resolved by the MiCA framework. Malta has published guidance on the income and VAT treatment of certain digital asset transactions, but specific rates and thresholds are subject to legislative change and must be verified against current domestic tax law. Issuers with beneficial owners in high-tax jurisdictions need to map the withholding and exit-tax implications of the Malta structure early. A MiCA-compliant whitepaper does not produce tax efficiency on its own.
Banking is the operational constraint that most Malta-based token issuers encounter first. European banks remain cautious about token-issuance proceeds – particularly for ARTs and EMTs, where reserve-management and redemption obligations create concentrated balance-sheet risk from the bank's perspective. In practice, issuers often need a combination of a licensed electronic-money institution for operating accounts and a more traditional banking arrangement for reserve assets. The banking relationship should be in place – or at least term-sheet stage – before the MFSA application is filed, because the authorisation process includes scrutiny of financial arrangements.
Distribution jurisdiction is the second cross-border pressure point. MiCA passporting covers EU/EEA distribution. Token purchasers in the United States, the United Kingdom, Singapore, Hong Kong or any non-EU jurisdiction bring in the local securities and financial services law of that jurisdiction. No EU-based offering framework creates a carve-out from US securities law, the FCA's financial promotion regime or MAS licensing requirements. Issuers targeting non-EU purchasers need jurisdiction-specific analysis for each material distribution market, and that analysis must be completed before marketing begins – not after token generation events have already occurred in multiple markets.
If your token will be sold beyond the EU, the regulatory picture extends well past Malta. We regularly advise on the multi-jurisdiction stack – from MiCA notification through to US securities law compliance and FCA financial-promotion rules. To map the full offering regime for your project, write to us at info@oboluslaw.com or map your options here.
Which token issuers should choose Malta as their offering base?
Malta is a well-suited EU offering base for a specific operator profile, not a universal solution. The primary advantage remains MiCA passporting: a single MFSA-filed whitepaper authorizes public distribution across the EU without re-filing in each member state. That matters most for issuers with a genuinely EU-focused distribution strategy and a token that falls cleanly into the "other" crypto-asset category.
Profile A – the EU-focused utility token issuer – benefits most directly. The entity is Malta-domiciled, the token qualifies as "other" under MiCA, the offering targets EU retail and institutional purchasers, and the issuer has no US-person distribution ambitions. For this profile, the whitepaper notification process is workable and the passporting benefit is real. Timeline from a complete filing to publication is measured in weeks for non-ART/EMT tokens, though MFSA review periods are subject to current workload.
Profile B – the ART or stablecoin issuer – faces a materially more demanding process. MFSA authorisation is required, the reserve and governance requirements are extensive, and the ongoing compliance obligations after authorisation – including redemption handling and reserve composition reporting – require dedicated infrastructure. This profile should budget for a multi-month process and engage Malta-specialist counsel early.
Profile C – the issuer with significant non-EU distribution – should treat Malta as one component of a broader multi-jurisdiction structure, not the sole compliance answer. The Malta entity handles EU distribution; allied counsel in each material non-EU jurisdiction handles local compliance. This profile needs a coordinated cross-border legal architecture, not just a MiCA whitepaper.
Profile D – the issuer whose token may be classified as a security – should resolve the classification question before choosing any jurisdiction. A Malta structure built around the MiCA "other" category that later faces a security re-characterization by the MFSA or ESMA leaves the issuer in a worse position than one that engaged the prospectus and MiFID II regime from the outset. Classification must precede jurisdiction selection.
Related at OBOLUS
Related at OBOLUS
- Token Offerings and Securities for Digital Asset Businesses – our practice group covering token classification, securities law and offering structuring across jurisdictions.
- Token issuance and offering rules in the Cayman Islands – comparative analysis for operators weighing a Cayman structure against an EU base.
- NFT project legal structuring under heightened scrutiny – the specialist NFT offering analysis for projects at the boundary between utility and financial instrument.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – an approach that has proven essential for clients whose initial structures required recalibration before launch. To discuss your token project, contact info@oboluslaw.com or message us at t.me/oboluslaw.
FAQ
Is my token a security?
Whether a token constitutes a transferable security under EU financial instruments law depends on the substance of the rights it confers – profit-sharing, dividend-equivalent returns, voting over a profit-generating enterprise – not on the label applied in the whitepaper or marketing materials. If the token meets the transferable-security test, MiCA does not apply; the EU prospectus regime and MiFID II do. A written classification analysis prepared before the token's economic model is finalized is the primary tool for managing this risk. OBOLUS conducts that analysis against the actual rights structure of the instrument.
Do I need a MiCA whitepaper?
Any crypto-asset offered to the public in the EU – including from a Malta-domiciled issuer – generally requires a MiCA-compliant whitepaper to be published after notification to the MFSA. Exemptions exist for offerings below defined thresholds, offerings exclusively to qualified investors and certain limited-use tokens, but each exemption carries conditions that must be satisfied and documented. For ART and EMT offerings, a whitepaper alone is not sufficient: MFSA authorisation is required before the offering can proceed. The whitepaper notified in Malta carries passporting effect across the EU/EEA.
How should an airdrop be structured legally?
An airdrop – the distribution of tokens without payment – can still engage MiCA obligations if the distributed tokens constitute an offer to the public or if the airdrop is used as a marketing mechanism for a broader paid offering. The classification of the airdropped token is the first question; the second is whether the distribution satisfies an exemption from the whitepaper requirement. Airdrops tied to ecosystem adoption, governance participation or developer incentives typically face a different analysis than those used as pre-sale marketing. Each structure should be reviewed on its specific facts before distribution begins.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, DeFi protocol structuring and cross-border offering compliance under MiCA and related frameworks.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.