The Malta CASP Licence Explained: 2026 Guide

If you are looking at a European crypto base with real regulatory pedigree, “CASP in Malta” is the phrase you keep landing on. It is not marketing shorthand — it is a specific authorisation, issued by a specific regulator, under a specific EU law. This guide sets out exactly what a Malta CASP licence is, which services fall into which capital class, what the MFSA charges, and how the EU passport works, so you can build the application around the parts that actually decide the outcome.

In our practice, the operators who choose Malta are usually the ones who want a recognised name behind them — an established regulator, an English-language EU jurisdiction, and a review that clears faster than the big continental markets. The ones who stumble are those who treat it as a light-touch registration. Malta was the “Blockchain Island” first, but a MiCA CASP is a full financial-services licence. Below is the version we scope from.

What a Malta CASP authorisation actually is

CASP stands for Crypto-Asset Service Provider. It is the single licence created by MiCA — the EU’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114 — for any business that provides crypto-asset services to third parties. Before MiCA, each EU country ran its own regime. Malta’s was the Virtual Financial Assets (VFA) Act of 2018, the earliest dedicated crypto framework in the Union and the reason Malta earned the “Blockchain Island” label. MiCA replaces that national framework with one harmonised authorisation.

The Malta Financial Services Authority (MFSA) is the competent authority that issues and supervises CASPs in Malta. That head start matters: because the MFSA spent years supervising VFA-licensed firms, it brings genuine depth to assessing crypto business models under MiCA, and Malta now sits among the top five EU jurisdictions by authorised CASP count. A CASP is not a company registration or an AML notice — it is a supervised financial-services licence in the same family as an e-money or investment-firm authorisation. You apply to the MFSA, you are assessed on fit-and-proper management and capital, and you report to that regulator for the life of the licence. For how these terms fit together, our explainer on VASP, CASP and MiCA unpacks the vocabulary in full.

The three service classes and their capital

MiCA does not charge one flat capital figure. It bundles the regulated crypto services into three capital classes, and your minimum own-funds requirement is fixed by the highest-class service you provide. Because these thresholds live in the regulation itself, they are the same in Malta as in every other EU state — you do not shop between EU countries for cheaper capital, only for regulator, cost and speed.

Read the dividing lines carefully, because they set your capital and your fee. The moment you hold client assets — custody, wallets, safeguarding — or run an exchange desk, you are in Class 2 at €125,000. The moment you operate the matching venue itself — a trading platform with an order book — you are in Class 3 at €150,000. A pure advisory or order-routing model that never touches client crypto can sit in Class 1 at €50,000. Most businesses people casually call “a crypto exchange” turn out to be Class 2 or Class 3 once you map what they really do; our Malta crypto exchange licence guide walks that classification through, and our CASP capital requirements piece breaks the tiers down further.

What Malta costs — and why it is a premium base

Malta is not the value hub; it is the reputation hub. The MFSA application fee runs roughly €8,000 to €30,000 depending on the CASP class, with annual supervisory fees layered on for the life of the licence. Add the MiCA initial capital of €50,000–€150,000, a Maltese company with genuine substance, and the AML and DORA build, and Malta plainly costs more than the leanest EU entry points.

What you buy for that premium is a regulator with real crypto history, a recognised jurisdiction that banks and institutional counterparties take seriously, and an English-language, common-law-influenced EU base with specialist advisers, auditors and crypto-aware banking already on the ground. For a serious exchange, custodian or trading platform — the operators for whom credibility drives banking and partnerships — that is often the right trade. For a lean startup optimising purely on time-to-market, another EU hub may fit better, and we will say so. The full jurisdiction picture lives in our Malta crypto licence pillar.

How EU-27 passporting works

This is the reason to license in the EU at all. Under MiCA Article 65, an authorised CASP that wants to provide services in other member states does not re-apply anywhere. It notifies the MFSA of the host states and services it intends to offer; the MFSA forwards that notification to the competent authorities in those states; and after a short notice period the firm can operate there. One Maltese authorisation, up to 27 markets, on a notification basis.

In practice that turns a single Malta CASP into a passport for the entire European single market — the largest regulated crypto market in the world. You still respect each host country’s local marketing and consumer rules, and you still geo-block jurisdictions you are not authorised in — plus the United States, sanctioned and FATF-listed territories — but you are not filing 27 licence applications or funding 27 lots of capital. That single-licence economics is the whole case for the EU route.

DORA, AML and the compliance backbone

A CASP is a supervised licence, so the obligations run well past day one. Two frameworks sit underneath every Maltese CASP.

AML/CFT. You need a dedicated money-laundering reporting officer (MLRO), customer due-diligence, transaction monitoring and suspicious-activity reporting aligned to the EU’s 5th and 6th AML directives, plus the Travel Rule — originator and beneficiary data attached to crypto transfers under the EU Transfer of Funds Regulation. This is the operational heart of the licence and the part the MFSA scrutinises hardest.

DORA. The Digital Operational Resilience Act — Regulation (EU) 2022/2554 — has applied to CASPs since 17 January 2025. It requires an ICT risk-management framework, incident classification and reporting, resilience testing, and oversight of your third-party technology providers. A CASP file submitted without a credible DORA programme is incomplete, and it is one of the most common reasons applications stall. On top of both sit MiCA’s own conduct rules: client-asset safeguarding and segregation, conflict-of-interest management, disclosures and complaints handling. The applicant for all of this is a Maltese company with real local substance — a registered office, genuine operating presence and fit-and-proper management the MFSA can assess — not an offshore shell with a nameplate.

From the VFA Act to CASP — the 1 July 2026 cliff

Malta’s VFA Act gave it a running start, but MiCA supersedes it. VFA licences valid on 30 December 2024 are grandfathered and may continue under the VFA Act until 1 July 2026, or until a CASP authorisation is granted or refused, whichever comes first. Critically, there is no automatic conversion — an existing VFA holder must file a CASP application with the MFSA to carry its business into the MiCA era.

For anyone still holding a VFA licence, the sequence is straightforward but time-sensitive: scope your service classes and capital now, stand up the substance and the DORA and AML programmes, and file for CASP well ahead of the cliff rather than at it — VFA holders generally clear the review faster than cold applicants because much of the supervisory relationship already exists. New entrants skip the legacy stage entirely and apply for CASP directly.

The upside for the extra rigour is real. An MFSA CASP carries weight with banks, PSPs, auditors and institutional counterparties in a way an offshore registration never did, and it opens the whole EU by notification. It costs more in fees, substance and capital than the old world, but it buys a durable, passportable EU credential from one of the most experienced crypto regulators in the Union — and for a serious crypto business, that is precisely the point.

If you are deciding between service classes, weighing Malta against another EU home, or timing a VFA-to-CASP migration before the July 2026 deadline, we will map it to where your users and your capital actually sit and quote the real number. Book a free consultation and we will scope your Malta CASP file end to end.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.