Malta Crypto Licence Requirements in 2026

A Malta crypto (CASP) licence requires a Maltese company with genuine local substance — a registered office, real operating presence and management directing the business from Malta — plus the class-based MiCA capital (€50,000–€150,000). Malta was the “Blockchain Island” before MiCA existed — its Virtual Financial Assets framework, launched in 2018, made it the EU’s earliest dedicated crypto regime. That head start is exactly why the Malta crypto licence requirements read the way they do in 2026: the Malta Financial Services Authority (MFSA) brings years of real crypto supervision to a Crypto-Asset Service Provider (CASP) authorisation, so the file it expects is a full financial-services file, credibly reviewed, not a light registration.

This guide is the requirements checklist we work from on our own desk. It covers exactly what the 2026 Malta CASP regime demands — a Maltese company with genuine substance, initial capital by service class, fit-and-proper management vetted by the MFSA, an MLRO, and a DORA-compliant ICT framework — so you can price the licence on what it actually takes. Malta sits among the top five EU jurisdictions by authorised CASP count for a reason, and we scope it as the premium EU regime it is.

The company and local substance

Everything starts with a Maltese company. The MFSA authorises a Maltese legal entity with genuine substance behind it — there is no remote-only route. The applicant is incorporated in Malta, keeps a registered office there, and runs a real operating presence, not a virtual address. The regulator wants to see the business directed and administered from Malta, with the right people performing the core functions locally.

This is the first hard difference from an offshore VASP, and the requirement operators most often underestimate. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test — and Malta’s supervisory experience means the MFSA knows what genuine substance looks like and what a hollow structure looks like. For the full picture of what a CASP authorisation buys and how it sits within MiCA, our flagship Malta crypto licence overview maps the regime end to end.

Capital by service class

This is the requirement that catches operators pricing Malta on the application fee alone. MiCA sets a minimum capital floor by the service class you run, and Malta applies it directly. At application you must fund the initial capital and hold it in a bank or e-money account within the EEA — it is working capital of the business, not a fee.

These figures are identical in every EU member state — they come from MiCA, not from Maltese law — so the capital tier is not something you optimise by choosing Malta over another EU jurisdiction. What Malta offers around the same requirement is a recognised, experienced regulator and a deep crypto ecosystem of advisers, auditors and crypto-aware banking. Costs sit outside scope here; for the full year-one build, the MFSA application and supervisory fees and running costs, see the Malta crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and the MFSA’s fit-and-proper review

Under MiCA the people behind the company are assessed as rigorously as the business itself, and the MFSA runs the vetting. Malta’s VFA experience means this is a credible, searching review — not a rubber stamp. An unresolved file on any one person holds the whole application.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The MFSA expects a board and senior management with genuine financial-services or crypto backgrounds — not a founder team with no regulated-industry track record. Directors must show they can actually run a licensed EU financial-services business.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting — and must be a real, appointable person, not a name on an org chart.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. You must show not only that the business is funded, but where the money comes from and how the beneficial owners built their wealth. Vague or undocumented wealth is one of the most common reasons a file stalls — the same standard a tier-1 bank applies.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

The documents and programme

Alongside people and capital, the MFSA reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what turns a six-month approval into a nine-month one. The core pack is:

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s anti-money-laundering directives and the Travel Rule — the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers — because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody.

Transition, passporting and the VFA deadline

Two dates frame the requirements. First, the VFA-to-CASP transition, which is Malta’s own twist on the MiCA changeover: VFA licences valid on 30 December 2024 are grandfathered and may continue under the VFA Act until 1 July 2026, or until a CASP authorisation is granted or refused — whichever comes first. Because Malta already ran a dedicated crypto regime, a well-run VFA holder meets much of the CASP bar already, so the transition is an upgrade rather than a rebuild; new entrants apply directly. If you hold a Maltese VFA licence, our Malta VFA-to-CASP transition guide walks through the upgrade path and the deadline mechanics.

Second, the reward for meeting the full requirements: passporting. Once the MFSA grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65 — one licence, the single largest regulated crypto market in the world, without applying jurisdiction by jurisdiction. That EU-wide reach, backed by a regulator with real crypto credibility, is precisely what the substance, capital and DORA requirements are the price of. For how the CASP authorisation itself is structured, see our Malta CASP licence explainer.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: fix your CASP service classes and the matching capital tier first, then incorporate the Maltese company, fund the capital in an EEA account and stand up the local office and roles. Assemble every UBO and management fit-and-proper file — source of funds, suitability, experience evidence — in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model, not off a template. Only then does the MFSA application go in.

None of this is a light offshore registration — and that is the point. The Malta CASP regime asks for a real Maltese company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential from a regulator with genuine crypto pedigree — one that passports across 27 markets and carries weight with banks, PSPs and institutional partners. Get the file complete and internally consistent the first time and the six-to-nine-month window is achievable; file with gaps and it drifts.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Maltese substance, fit-and-proper, AML and DORA build end to end and will review any application against the MFSA’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.