Malta B2B Gaming Licence 2026: Critical Gaming Supply

Most suppliers who build for online gaming think about licensing as an operator problem — the casino needs the permit, the studio just plugs in. In Malta that assumption is wrong, and getting it wrong costs you integrations. If your product materially affects how a game plays out or whether an operator stays compliant, the Malta Gaming Authority (MGA) wants you licensed in your own right, under a Critical Gaming Supply licence — the Malta B2B credential. And the tier-1 operators you want to sell to will not integrate you without it.

This guide covers what “critical gaming supply” actually means, why a B2B supplier serving MGA-licensed operators needs its own licence, how the supplier permit differs from the B2C operator licence, the requirements and substance the MGA expects, how supplied systems and RNGs are certified, and why being MGA-B2B-licensed has become a commercial prerequisite to supply the best brands. The facts here come from running the full MGA file for both operators and suppliers — not a stale marketing page.

What the Critical Gaming Supply licence actually is

Malta was the first EU member state to regulate remote gaming, and its licence still carries the most weight with players, payment providers and tier-1 banks. Under the Gaming Act, the MGA issues two families of authorisation: a Gaming Service (B2C) licence for operators who take bets and run games — split into four types, Type 1 casino/RNG, Type 2 fixed-odds betting, Type 3 peer-to-peer and poker, Type 4 controlled skill games — and a Critical Gaming Supply (B2B) licence for the suppliers whose products sit behind them. Our flagship Malta gaming licence guide covers the operator side in full, and the Malta licence types guide breaks down the four B2C types.

The B2B licence exists because a game engine, a platform and an aggregation layer are not neutral vendors — they are load-bearing parts of a regulated gambling product. If the software that decides outcomes fails, players are harmed and the operator’s licence is on the line. The MGA brings those suppliers inside supervision directly. A Critical Gaming Supply holder is licensed and monitored by the MGA, but it never takes a player deposit; it sells to operators. That single fact shapes the risk profile, the banking conversation and the reason the licence exists. Like the B2C route, it runs for a ten-year term and demands real Maltese substance.

Who needs a B2B licence — and what “critical gaming supply” means

The MGA’s test for whether a supplier needs a Critical Gaming Supply licence is whether its service or component is material to the gaming operation — whether it affects the outcome of a game or the operator’s regulatory position. That phrase does real work, so it is worth unpacking on both limbs:

• Materially affects outcomes — the product decides or influences a game result. The random number generator, the game engine, the platform or remote gaming server (RGS) that determines and records bets. If a fault in your software could change who wins or loses, you are inside the test.
• Materially affects the regulatory position — the component carries duties that determine whether the operator meets its Gaming Act obligations: recording bets and outcomes, safeguarding the integrity of the game, feeding the compliance and reporting stack. If your product sits on that path, it is critical.

In practice the suppliers that fall inside it are broader than most expect:

• Game studios — developers whose slots, table games and live content run on MGA-licensed casinos, particularly where proprietary titles carry an RNG certificate.
• Platform and RGS providers — turnkey and white-label platform vendors, and the remote gaming servers that host and settle game rounds.
• Aggregators and content hubs — the middleware that integrates many studios’ games into a single operator lobby.
• Some other suppliers — technology whose components are material to game outcomes or the operator’s regulatory duties, decided case by case on what the product actually does.

A vendor whose product is purely cosmetic, informational, marketing or back-office — a skin, an affiliate feed, a CRM — generally does not meet the test. The distinction is whether you touch the result or the operator’s regulatory position.

B2C operator licence vs B2B Critical Gaming Supply licence

Both permits share a regulator, a statute, a substance requirement and a due-diligence standard. What separates them is the permitted activity — and therefore who each one is for. This is the comparison suppliers ask us to draw first:

The practical takeaway is that the two are siblings, not opposites. A company that both builds a platform and runs its own casino can hold both — a B2C Gaming Service licence with Critical Gaming Supply scope mapped in — provided the Malta company and substance are built once and the scope reflects what the business actually does.

Requirements, substance and system certification

The most important structural fact for a Malta supplier is one that catches out anyone coming from a lighter regime: there is no third-country shortcut. The MGA requires the applicant — operator or supplier alike — to be a Malta company with local presence, key functions on the island and a dedicated compliance function. Unlike an offshore permit you can file from a Costa Rica company, Malta wants the substance in Malta; that is the point of a tier-1 regime and the reason the credential is worth holding. The Malta requirements guide walks through how the company, capital and key functions are put together.

On documentation, a supplier file tracks the operator process closely: fit-and-proper due diligence on every UBO, shareholder, director and key person — certified identity and address evidence, criminal-record checks, and source-of-funds and source-of-wealth evidence — corporate documents for the applicant entity, a business plan, and AML/KYC and data-protection policies drafted to MGA format. Two things are specific to the supply side. First, technical documentation of the systems you supply — the game engine, RGS, platform or aggregation layer — described to the standard the MGA expects at application, so the regulator can see exactly what your components do to the gaming operation. Second, certification of the supplied systems and RNG: proprietary game content and any random number generator must be certified by an MGA-approved laboratory, and the platform undergoes a system audit that recurs during the ten-year term.

Timing follows the operator pattern. Plan for roughly 4–6 months end to end: a few weeks to build the Malta company, substance and compliance stack, then the MGA’s fit-and-proper and business review, and finally the technical system audit before the licence issues. Because the year-one economics turn on substance and certification rather than a single headline fee, we model the full cost for your supply scope before you commit and quote the MGA fee and our service cost separately.

Why MGA-B2B-licensed is a commercial prerequisite

The regulatory requirement is only half the story. The stronger driver is commercial: MGA-licensed operators ask their critical suppliers for a credential before they integrate. An operator that has done the work to hold a Malta Gaming Service licence — the Malta company, the substance, the compliance and MLRO functions — will not put an unlicensed game engine, RGS or platform into its product. That supplier becomes a compliance exposure the operator’s auditor, its bank or an MGA inspection can flag, and the operator drops it. So the Critical Gaming Supply licence has quietly turned from optional into a passport: without it you lose integrations to competitors who hold one; with it you clear vendor due diligence on the first pass and you are on the list tier-1 brands are allowed to buy from.

This matters most on the banking and payments side, where Malta’s whole value is credibility. A Malta licence unlocks tier-1 banks and specialist gaming payment providers that a pure offshore permit never will — but even here, mainstream consumer processors do not serve gambling: Wise, Stripe and PayPal all prohibit gambling-linked flows, so operators and suppliers alike bank through tier-1 banks and specialist high-risk acquirers, or an EMI or neobank account, not consumer fintech. Being MGA-B2B-licensed is exactly what makes those tier-1 relationships available to a supplier at all. The Malta gambling licence pillar sets out the framework end to end, from company and substance through certification and banking.

If you build the game content, platform, RGS or aggregation technology behind Malta casinos and your operator clients have started asking for a credential, the Critical Gaming Supply licence is now part of the deal — not an afterthought. We run the full MGA B2B file end to end, incorporate the Malta company and build the substance the Gaming Act requires, handle system and RNG certification, and can add B2C scope where you need both sides. Book a free consultation and we will map the right licence scope to what you actually supply — with the MGA fee and our service cost shown separately, never blended.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.