Crypto-Asset Service Provider authorisation under Regulation (EU) 2023/1114 (Malta)

At a glance

What it lets you do, and where

What does a Malta MiCA CASP licence let you do, and where can you serve clients?

A Malta CASP licence lets you provide crypto-asset services across the EEA through single-market passporting under MiCA Article 65, after notifying the home NCA, which communicates with host Member States. Under Cap. 647 Article 32, the MFSA must communicate cross-border passport notifications to host NCAs and ESMA within 10 working days.¹⁹²

Activities it covers

Where it is valid

Do you need it, and is Malta the right choice?

What is a Malta MiCA CASP licence and do you actually need one?

A Malta CASP authorisation is granted by the Malta Financial Services Authority (MFSA) under the Markets in Crypto-Assets Act (Cap. 647) and Regulation (EU) 2023/1114 (MiCA). MiCA Articles 59 and 63 require authorisation to provide crypto-asset services in the Union, and Cap. 647 Article 26 prohibits unauthorised crypto-asset services in Malta.¹²

Is a Malta CASP licence right for your model, and when is Malta the wrong choice?

Tracked Malta CASP applications took 14 to 16 months, against 8 to 10 months in Cyprus. Annual supervision fees under S.L. 647.01 Reg. 6 are EUR 10,000 to EUR 50,000 as a base, plus a volume charge capped at EUR 250,000.²⁰³

Can one Malta CASP licence cover the whole EU, and how does passporting work?

Yes. MiCA Article 65 provides EU-wide passporting rights following home NCA notification. Cap. 647 Article 32 mandates the MFSA to forward cross-border service notifications within 10 working days to host NCAs and ESMA. ESMA guidelines clarify that reverse solicitation under Article 61 cannot be invoked if marketing or promotional material is directed at EU persons.¹²²¹

It depends on the activity. MiCA Article 48 restricts e-money token issuance to credit institutions and authorised electronic money institutions. MiCA Article 60 enables authorised investment firms and credit institutions to provide crypto-asset services via prior notification instead of a separate CASP licence. The Financial Institutions Act (Cap. 376) and Investment Services Act (Cap. 370) govern EMI and investment firm licensing in Malta.¹²²

Is Malta a fast track for MiCA CASP authorisation, and is that a risk?

OKX converted from a VFA licence to a full MiCA CASP authorisation in four days (23-27 January 2025), which drew public criticism likening it to ordering food in McDonald's. ESMA's fast-track peer review (10 July 2025, ESMA42-2004696504-8164) rated MFSA's authorisation process as partially meeting expectations, with material issues unresolved at authorisation. Standard applications took 14 to 16 months.²³²⁴²⁰

MiCA Recital 22 excludes crypto-asset services provided in a fully decentralised manner without any intermediary. Under Cap. 647, providing advice on crypto-assets, executing orders for crypto-assets on behalf of clients, and placing of crypto-assets are treated as equivalent to the corresponding MiFID services in Annex I, Section A to Directive 2014/65/EU. ESMA's peer review on Malta flagged that risks related to the adequacy of the use of Web3 products by a CASP were not adequately assessed during authorisation.¹²³²

MiCA Article 75(8) establishes custodian liability for lost client crypto-assets or means of access resulting from attributable incidents, but excludes liability for incidents not attributable to the CASP, such as a problem inherent in the operation of a distributed ledger the CASP does not control. Cap. 647 Article 28 requires the application for authorisation to include a description of the procedure for segregation of clients' crypto-assets and funds.¹²¹⁶

What it really takes

How much capital do you really need for a Malta MiCA CASP licence?

Minimum initial capital is €50,000, €125,000 or €150,000 depending on service class (MiCA Article 67 and Annex IV). Cap. 647 Article 28(3)(e) requires applicants to prove they meet the prudential safeguards in Article 67. In practice, mid-sized CASPs typically hold €350,000 to €750,000 in segregated own funds as a cushion above the statutory floor.²¹⁰

Who do you have to hire for a Malta CASP and do they have to be based in Malta?

Cap. 647 Article 28(3)(g) to (i) requires fit-and-proper management body members, shareholder repute vetting, and internal control policies for AML/CFT risks. MFSA supervisory rules require at least one local resident director or manager and real office presence, and reject letterbox companies.²²⁵

Under the VFA Act (Cap. 590), regulations may be published in English only, and the English text prevails. Article 5 of the Constitution of Malta makes Maltese and English the official languages; Article 74 concerns the language of laws.²⁶²⁷

Application contents are defined by MiCA Article 62, Cap. 647 Article 28 and Commission Delegated Regulation (EU) 2025/305, with standard forms under Implementing Regulation (EU) 2025/306. Cap. 647 Article 28 requires details including governance, ICT systems, segregation of client funds and AML risk procedures.²⁸²⁹²

Requirements

The legal framework

The procedure under the law

How long it takes

How long does getting a Malta MiCA CASP licence really take?

Under Cap. 647 Article 28 and MiCA Article 63, the MFSA has 25 working days to assess completeness and 40 working days to decide on a complete application; an information request can suspend that period for up to 20 working days. In practice, OKX converted in 4 days (23-27 January 2025) via legacy VFA grandfathering, while tracked standard applications took 14 to 16 months.²²⁰²⁴

Under Cap. 647 Article 28(6), (9) and (11), the MFSA has 25 working days to check application completeness, then 40 working days for a substantive decision, with a suspension power of up to 20 working days. MiCA Article 63 sets the same 25- and 40-working-day periods at EU level. In practice, Malta MiCA CASP applications have taken 14 to 16 months.²¹²⁰

Statutory: 40 working days from receipt of a complete application, following a 25 working days completeness assessment². Observed: not published. The statutory clock usually starts only when the regulator treats the application as complete, and pauses while it waits for answers to its questions.

What it costs

What does a Malta MiCA CASP licence cost in total, first year and ongoing?

Application fees under S.L. 647.01 Reg. 6(1) are €10,000 (Class 1), €20,000 (Class 2) and €25,000 (Class 3); Reg. 6(5) sets annual supervisory fees. One-off pre-authorisation legal, application, recruitment and translation costs total €195,000 to €505,000 across itemised budget lines. First-year bare-bones setup estimates for Malta span €36,000 to €95,000 depending on service scope.³¹⁰⁹

Approval odds and who can own it

What are the real approval odds for a Malta CASP licence and why do applications fail?

Approval odds are roughly 17% EU-wide: around 210 of 1,200-plus pre-MiCA VASP entities converted to full CASP authorisation. The MFSA published formal refusal decisions for MoonPay Limited (2021-07-09) and NMVA Limited (2022-02-22), alongside voluntary cancellations for Mint Exchange, Bequant Exchange and AMoney Ventures. As of 28 September 2026, the ESMA interim MiCA register records 22 authorised CASPs under MFSA supervision.³⁰³¹

Cap. 647 Article 28(3)(g)-(h) and MiCA Article 68 regulate the fitness and propriety of management body members and qualifying shareholders, without nationality restrictions. Cap. 647 Article 33 requires prior notification and a 60-working-day assessment for acquisitions crossing the 20%, 30%, or 50% thresholds.²

How many MiCA CASP licences has the MFSA actually granted in Malta?

As of 28 September 2026, the ESMA CASPs central register shows 22 authorised entries under the Malta competent authority (MFSA), with the latest row updated on 22 September 2026. A practitioner tracker recorded around 12 authorised CASPs in Malta as of May 2026, prior to deadline transition completions. Major crypto exchanges including OKX and Crypto.com secured Maltese MiCA CASP authorisations.³²²⁴

After you get the licence

Three regimes sit alongside a Malta CASP licence. MiCA Article 48 restricts e-money token issuance to authorised credit institutions and electronic money institutions. DORA Regulation (EU) 2022/2554 applies directly to CASPs from 17 January 2025. Crypto derivatives and CFDs are financial instruments requiring authorisation under the Investment Services Act (Cap. 370).¹³³³⁴

Will a Malta MiCA CASP get a bank account and payment processing?

MiCA Article 70 requires prompt segregation and safeguarding of client fiat funds with a central bank or authorised credit institution. Practitioners rate Malta's crypto banking difficulty as high, with extensive documentation required and late banking preparation listed as a high-risk blocker.¹³⁵

Keeping a Malta CASP licence means paying the annual supervisory fee set by S.L. 647.01 Reg. 6(5) by 30 July each year (Reg. 6(7)), and staying active. Under Cap. 647 Article 30, authorisation can be withdrawn if unused within 12 months or inactive for 9 consecutive months. MiCA Article 143(3) transitional grandfathering ended across the EU on 1 July 2026.²³¹⁸

Yes. Cap. 647 Article 49 gives a right of appeal to the Financial Services Tribunal against decisions and directives of the MFSA. A licence refusal is a decision of the MFSA, so the appeal right covers it.²

Under Cap. 647 Article 30, authorisation can be withdrawn if unused within 12 months or inactive for 9 consecutive months. Under Cap. 647 Article 33 and MiCA Article 83, acquiring or increasing qualifying holdings above 20%, 30% or 50% requires prior assessment.²

Is an old Malta VFA licence still valid, what happened after 1 July 2026?

Only until the end of Malta's transitional period, which runs until 1 July 2026, or until authorisation is granted or refused if that comes sooner. ESMA's grandfathering overview documents the national period as 18 months under Article 143(3) MiCA. Cap. 647 Part X sets transitional provisions for existing VFA licence holders aligning with MiCA Article 143(3).³⁶¹

Buying a company that already holds it

The CASP authorisation is granted exclusively to the specific legal entity that applied and cannot be assigned, transferred, or sold directly to another entity. Any commercial acquisition of the regulated business must be executed through a share deal (transfer of corporate equity) of the licensed Maltese company, subject to prior change-of-control notification and assessment by the MFSA under Article 33 of Cap. 647. An asset transfer requires the acquiring entity to obtain its own separate CASP authorisation.²

Prior notification with an objection period. Any natural or legal person proposing to acquire or increase a direct or indirect qualifying holding in a CASP so that voting rights or capital reach or exceed 20%, 30%, or 50%, or make the CASP a subsidiary, must submit prior written notification to the MFSA under Cap. 647 Art. 33 and MiCA Art. 83. The MFSA acknowledges receipt within 2 working days and conducts a statutory assessment within 60 working days (interruptible once by up to 20 working days for additional information). If the MFSA does not oppose the transaction in writing before the expiry date, the acquisition is deemed approved under Art. 33(10). Disposals reducing holdings below 10%, 20%, 30%, or 50% also require prior notification.²

Ready-made companies holding this licence: see verified positions.

CASP in other countries

Values come from each licence's page, where every figure has its source.

Laws behind it

• Markets in Crypto-Assets Regulation: Regulation (EU) 2023/1114

Getting this licence

Protegra handles this licence end to end: CASP license in Malta: process, timeline and our fee.