Malta Crypto Licence 2026: The CASP Guide

If you want a full EU crypto licence with a regulator that has actually supervised this sector before, Malta is the jurisdiction to understand first. A CASP authorisation from the Malta Financial Services Authority (MFSA) under MiCA passports across all 27 EU member states on a notification basis, and the MFSA review realistically takes six to nine months on a complete file. It is the original “Blockchain Island”, and that head start shows in the quality of the supervision.

The operators who choose Malta are rarely chasing the cheapest number. They are the ones for whom credibility matters most: established exchanges, custodians and reputation-first teams that need a licence banks and institutional counterparties respect. Malta is a premium EU base, priced accordingly, with real substance and a genuine compliance build behind it. This guide explains what a Malta crypto licence actually is in 2026: the framework, the capital, the passport, the VFA transition, the timeline, and the trade-off you are signing up for.

What a Malta CASP licence is and the VFA legacy behind it

A Malta crypto licence is a Crypto-Asset Service Provider (CASP) authorisation, issued by the MFSA under the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114). It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing orders, operating a trading platform, or advising on crypto-assets.

What sets Malta apart is what came before. In 2018 Malta enacted the Virtual Financial Assets (VFA) Act, giving it one of the EU’s earliest dedicated, purpose-built crypto regimes and the “Blockchain Island” label. While most European regulators were still deciding whether crypto was their problem, the MFSA was already licensing and supervising it. That experience carried directly into MiCA: the MFSA assesses crypto business models with a depth that newer entrants to the field simply do not have, and Malta now holds 22 of the 360 CASPs authorised across the EU, fifth by member state on ESMA’s register (27 September 2026). If you have read our VASP, CASP and MiCA explainer, Malta is the jurisdiction that arguably invented the “onshore, supervised” model that MiCA has now made the European standard. The class-by-class detail of the authorisation itself lives in our dedicated Malta CASP licence guide.

Capital by service class in Malta

MiCA sets minimum capital by the class of service you provide, and operators often miss that those tiers are identical in every EU country. You do not choose Malta for cheaper capital; the capital is fixed by the regulation. You choose it for the regulator’s pedigree, the ecosystem and the credibility. What Malta determines is which class (or classes) your business falls into and how rigorously your file is assessed.

Two points shape the budget. First, the capital is not a fee. It stays in the business as own funds or is covered by an insurance policy, at the higher of the class floor or a quarter of the previous year’s fixed overheads. Second, the classes are cumulative: an exchange with custody sits in Class 2, and a full order-book trading venue lands you in Class 3 at €150,000. Most exchange and broker projects sit at €125,000. Scoping the right class before you incorporate is the single decision that most affects your budget; our Malta crypto licence cost breakdown models the full year-one number, capital and MFSA fees included.

From Malta, one licence and 27 markets: the EU passport

The reason a CASP licence justifies the substance is the passport. Under MiCA Article 65, once the MFSA authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis, meaning the regulator in each host country is notified and you can then serve that market. You license once in Malta and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

An offshore permit makes you legal in one place; a Maltese CASP reaches the whole single market, 27 member states under one rulebook, from one file. And because it comes from a regulator that has supervised crypto since 2018, it carries unusual weight with the parties that decide whether you can actually operate: banks that hold your funds, the crypto-friendly banking and EMI/PI partners that provide your fiat rails, auditors and institutional counterparties.

Timeline: six to nine months

Speed is a quiet Malta advantage that surprises people who assume a premium jurisdiction must be slow. The MFSA typically clears a CASP file in six to nine months on a complete, well-prepared application. Years of VFA supervision mean the regulator is not learning crypto on your file; it knows exactly what it wants to see.

The caveat is “complete file”. The clock that matters is not the regulator’s queue but your own preparation: the classes are scoped, the Maltese company is incorporated and capitalised, the programme of operations and the AML, DORA and safeguarding policies are drafted to MFSA standard, and management is genuinely fit-and-proper. Poorly prepared applications stall in review questions, which is where most of the timeline risk sits; thin files cause more delay than the regulator does. Our Malta crypto licence requirements guide sets out the complete document and governance checklist that keeps a file moving.

The VFA transition and the 1 July 2026 deadline

Malta’s crypto pedigree creates one transition that no other jurisdiction has in quite the same form. Because Malta was already licensing crypto firms under the VFA Act before MiCA arrived, it had a population of existing VFA licence-holders who had to move onto the new regime. VFA licences that were valid on 30 December 2024 were grandfathered and could continue under the VFA Act until 1 July 2026, or until a CASP authorisation was granted or refused, whichever came first.

The critical point for VFA holders was that there is no automatic conversion. A grandfathered VFA licence does not become a CASP by operation of law; the firm had to apply to the MFSA for CASP authorisation and complete the transition before the window closed, and leaving it to the cliff edge risked a gap in authorisation. New entrants apply directly for CASP from the start. Our Malta VFA-to-CASP transition guide walks an existing holder through exactly what changes and in what order.

The real substance requirement in Malta

This is where a Malta CASP separates hardest from an offshore registration, and where the real work goes. A CASP authorisation requires a Maltese company with genuine local substance rather than a nominee shell. That means a registered office and a real operating presence in Malta, own funds or insurance at the MiCA level, and management the MFSA assesses as qualified and fit-and-proper, with relevant financial-services or crypto experience on the board.

On top of the entity, you need a live compliance function. A dedicated MLRO (money-laundering reporting officer) and AML/CFT policies aligned to the EU’s 5th and 6th AML directives, the EU Transfer of Funds Regulation (the Travel Rule) for originator and beneficiary data on transfers, and suitability and source-of-funds checks on shareholders and UBOs. And under MiCA, firms must run a DORA-compliant ICT programme (operational resilience, incident reporting, resilience testing and third-party ICT oversight), which for a crypto business also means serious custody, key-management and cybersecurity controls. Building it properly is a project in itself, and it is exactly what gives the Maltese licence its standing.

Cost, and who Malta suits

Malta pairs its pedigree with a transparent, if premium, fee structure. The MFSA application fee is €10,000, €20,000 or €25,000 for Class 1, 2 or 3, with an annual supervisory fee of €10,000, €25,000 or €50,000 by class (plus €2,000 per authorised service and 0.05% of transaction volume, capped at €250,000) on top of the class-based initial capital and the substance. Malta is not the value hub; it costs more than the lean Baltic routes. What the extra money buys is a recognised, experienced regulator and a jurisdiction whose name banks and partners recognise, which is what a reputation-first business is paying for.

So who is it for? Malta suits operators who genuinely need the EU market and value credibility over the cheapest entry: established exchanges, custodians, trading-platform operators and VFA holders completing their transition, all able to meet the capital and substance bar. If your priority is the leanest possible EU route, a Baltic hub may suit better; if your market is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market. When you are ready to move, our Malta crypto exchange licence guide sequences the build for the most common use case.

The Malta trade-off

MFSA application fees alone run €10,000 to €25,000 by class, a file takes six to nine months, and the compliance and DORA programme has to keep running after approval, so Malta is priced as the premium option it is. Malta also holds 22 of the 360 authorised CASPs on ESMA’s register, fifth in the EU. What the premium buys is the single market from one authorisation and a regulator that has supervised crypto since 2018.

If a credible EU crypto licence is where your project is heading, we run the entire file (the Maltese company, the substance and management, the AML and DORA framework, the MFSA application and the crypto-friendly banking around it), with our fees and the state costs shown separately. See the scope on our Malta crypto licence page, then book a free consultation and we’ll model the real year-one economics (the right service class, the capital, the MFSA fees, and whether Malta or a leaner neighbour fits your plan) before you commit a euro.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.