Regulatory AlertsMalta: crypto & digital assets regulation
RegulatedVASP licensing via MFSA under DORA; DeFi consultation ongoing
- Lead regulator
- Malta Financial Services Authority (MFSA)
- Also involved
- Central Bank of Malta (CBM) · Data Protection Commissioner
- Core law
- Financial Instruments and Related Activities Act (FIRA) 2018
- Entry capital
- EUR 125,000 (VASP)
- Approval timeline
- 6-12 months
- Customer assets
- Segregated in licensed custodian accounts
- Data protection
- GDPR · Data Protection Commissioner
- Sandbox
- Yes - MFSA Regulatory Sandbox
Malta regulates crypto-asset service providers (CASPs) primarily through the MFSA under the DORA framework. The regime requires licensing for core activities like exchange and custody. The MFSA is currently consulting on DeFi regulation, signaling a shift towards covering decentralized protocols, but the current statutory baseline remains the traditional VASP model.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Exchange / trading platform | LicenceVirtual Financial Assets (VFA) Service Provider[1] Requires fit and proper test and AML compliance | EUR 125,000 | 6-12 months | MFSA |
| Custody of client assets | LicenceVirtual Financial Assets (VFA) Service Provider[1] Must meet strict custody and segregation rules | EUR 125,000 | 6-12 months | MFSA |
| Token issuance / public offering | LicenceVFA Agent / Issuer[1] Whitepaper registration and VFA Agent appointment required | EUR 125,000 | 6-12 months | MFSA |
| Broker-dealer / OTC desk | LicenceVFA Service Provider[1] OTC desks fall under VASP licensing if dealing on own account | EUR 125,000 | 6-12 months | MFSA |
| Stablecoin issuance | LicenceVFA Service Provider[1] Treated as asset-referenced tokens under VFA Act | EUR 125,000 | 6-12 months | MFSA |
| Crypto payments acceptance | LicenceVFA Service Provider[1] Crypto-to-fiat or crypto-to-crypto payment services | EUR 125,000 | 6-12 months | MFSA |
| Mining / staking services | Uncertain[1]verify with regulator DeFi consultation explores this; current status unclear | — | — | — |
| Advisory / portfolio management | LicenceInvestment Advisor[1] If advice relates to VFA, VFA license may apply | EUR 125,000 | 6-12 months | MFSA |
New — what changed recently
- 2026-06MFSA DeFi Discussion Paper — MFSA launched consultation on regulating decentralized finance, indicating potential expansion of VASP rules to DeFi protocols.[1]
Market-entry checklist
- 1Establish Maltese entityIncorporate a Maltese company with registered office in Malta.
- 2Secure minimum capitalDeposit EUR 125,000 as initial capital for VFA service provider license.
- 3Appoint fit and proper personsIdentify and vet management and beneficial owners for MFSA approval.
- 4Submit VFA license applicationFile comprehensive application with business plan, AML policies, and whitepaper (if applicable).
- 5Implement AML/CFT frameworkEstablish robust anti-money laundering procedures compliant with Maltese law.