Malta Crypto Licence 2026: The Definitive CASP Guide

If you want a full EU crypto licence with a regulator that has actually supervised this sector before, Malta is the jurisdiction to understand first. A CASP authorisation from the Malta Financial Services Authority (MFSA) under MiCA passports across all 27 EU member states on a notification basis, and Malta reviews faster than the big-three markets of Germany, France and Italy — realistically six to nine months on a complete file. It is the original “Blockchain Island”, and that head start shows in the quality of the supervision.

In our practice, the operators who choose Malta are rarely chasing the cheapest number. They are the ones for whom credibility is the point — established exchanges, custodians and reputation-first teams that need a licence banks and institutional counterparties respect. Malta is a premium EU base, priced accordingly, with real substance and a genuine compliance build behind it. This is the definitive guide to what a Malta crypto licence actually is in 2026 — the framework, the capital, the passport, the VFA transition, the timeline, and the honest trade-off you are signing up for.

What a Malta CASP licence is — and the VFA legacy behind it

A Malta crypto licence is a Crypto-Asset Service Provider (CASP) authorisation, issued by the MFSA under the Markets in Crypto-Assets Regulation — MiCA, Regulation (EU) 2023/1114. It is the single EU credential for firms that provide crypto services: running an exchange, safeguarding client assets, executing orders, operating a trading platform, or advising on crypto-assets.

What sets Malta apart is what came before. In 2018 Malta enacted the Virtual Financial Assets (VFA) Act, giving it the EU’s earliest dedicated, purpose-built crypto regime and the “Blockchain Island” label. While most European regulators were still deciding whether crypto was their problem, the MFSA was already licensing and supervising it. That experience carried directly into MiCA: the MFSA assesses crypto business models with a depth that newer entrants to the field simply do not have, and Malta now sits among the top five EU jurisdictions by authorised CASP count. If you have read our VASP, CASP and MiCA explainer, Malta is the jurisdiction that arguably invented the “onshore, supervised” model that MiCA has now made the European standard. The class-by-class detail of the authorisation itself lives in our dedicated Malta CASP licence guide.

Capital by service class

MiCA sets minimum capital by the class of service you provide, and — this is the point operators most often miss — those tiers are identical in every EU country. You do not choose Malta for cheaper capital; the capital is fixed by the regulation. You choose it for the regulator’s pedigree, the ecosystem and the credibility. What Malta determines is which class (or classes) your business falls into and how rigorously your file is assessed.

Two things matter in planning. First, the capital is funded, not a fee — it stays in the business as working capital, held in a bank or e-money account within the EEA, not paid away to the regulator. Second, the classes are cumulative: an exchange with custody sits in Class 2, and a full order-book trading venue lands you in Class 3 at €150,000. Most exchange and broker projects sit at €125,000. Scoping the right class before you incorporate is the single decision that most affects your budget — our Malta crypto licence cost breakdown models the full year-one number, capital and MFSA fees included.

One licence, 27 markets: the EU passport

The reason a CASP licence justifies the substance is the passport. Under MiCA Article 65, once the MFSA authorises you, you can provide your licensed services into every other EU/EEA member state on a notification basis — the regulator in each host country is notified, and you are in. You license once in Malta and passport everywhere, instead of applying licence-by-licence across 27 jurisdictions.

That is the single biggest upgrade in crypto licensing to date, and it is why an EU CASP is not really comparable to an offshore registration. An offshore permit gets you legally live in one place; a Maltese CASP gets you the entire European single market — the largest regulated crypto market in the world — from one file. And because it comes from a regulator that has supervised crypto since 2018, it carries unusual weight with the parties that decide whether you can actually operate: banks that hold your funds, the crypto-friendly banking and EMI/PI partners that provide your fiat rails, auditors and institutional counterparties.

Timeline: faster than the big three

Speed is a quiet Malta advantage that surprises people who assume a premium jurisdiction must be slow. The MFSA typically clears a CASP file in six to nine months on a complete, well-prepared application — faster than Germany, France or Italy, whose queues routinely run longer. Years of VFA supervision mean the regulator is not learning crypto on your file; it knows exactly what it wants to see.

The caveat is “complete file”. The clock that matters is not the regulator’s queue but your own preparation: the classes are scoped, the Maltese company is incorporated and capitalised, the programme of operations and the AML, DORA and safeguarding policies are drafted to MFSA standard, and management is genuinely fit-and-proper. Poorly prepared applications stall in review questions, which is where most of the timeline risk sits — not in the regulator being slow, but in the file being thin. Our Malta crypto licence requirements guide sets out the complete document and governance checklist that keeps a file moving.

The VFA transition and the 1 July 2026 deadline

Malta’s crypto pedigree creates one transition that no other jurisdiction has in quite the same form. Because Malta was already licensing crypto firms under the VFA Act before MiCA arrived, it has a population of existing VFA licence-holders who must move onto the new regime. VFA licences that were valid on 30 December 2024 are grandfathered — they may continue under the VFA Act until 1 July 2026, or until a CASP authorisation is granted or refused, whichever comes first.

The critical point for VFA holders is that there is no automatic conversion. A grandfathered VFA licence does not become a CASP by operation of law; the firm must apply to the MFSA for CASP authorisation and complete the transition before the window closes. Leave it to the cliff edge and you risk a gap in your authorisation. New entrants, meanwhile, apply directly for CASP from the start. Either way, 1 July 2026 is the date to plan around — our Malta VFA-to-CASP transition guide walks an existing holder through exactly what changes and in what order.

The real substance requirement

This is where a Malta CASP separates hardest from an offshore registration, and where the real work goes. A CASP authorisation requires a Maltese company with genuine local substance — not a nominee shell. That means a registered office and a real operating presence in Malta, initial capital funded into an EEA account, and management the MFSA assesses as qualified and fit-and-proper, with relevant financial-services or crypto experience on the board.

On top of the entity, you need a live compliance function. A dedicated MLRO (money-laundering reporting officer) and AML/CFT policies aligned to the EU’s 5th and 6th AML directives, the EU Transfer of Funds Regulation (the Travel Rule) for originator and beneficiary data on transfers, and suitability and source-of-funds checks on shareholders and UBOs. And under MiCA, firms must run a DORA-compliant ICT programme — operational resilience, incident reporting, resilience testing and third-party ICT oversight — which for a crypto business also means serious custody, key-management and cybersecurity controls. Building it properly is a project in itself, and it is exactly what gives the Maltese licence its standing.

Cost, and who Malta suits

Malta pairs its pedigree with a transparent — if premium — fee structure. The MFSA application fee runs roughly €8,000 to €30,000 depending on the CASP class, with annual supervisory fees on top of the class-based initial capital and the substance. Malta is not the value hub; it costs more than the lean Baltic routes. What the extra money buys is a recognised, experienced regulator and a jurisdiction whose name opens doors — the whole point for a reputation-first business.

So who is it for? Malta suits operators who genuinely need the EU market and value credibility over the cheapest entry — established exchanges, custodians, trading-platform operators and VFA holders completing their transition, all able to meet the capital and substance bar. If your priority is the leanest possible EU route, a Baltic hub may suit better; if your market is global or non-EU, an offshore or Gulf regime is often faster and cheaper, and no single licence covers every market. When you are ready to move, our Malta crypto exchange licence guide sequences the build for the most common use case.

The honest trade-off

Malta is a premium jurisdiction, and it would be dishonest to sell it as a bargain. A CASP file here costs real money in MFSA fees, capital and substance, takes six to nine months, and requires a live compliance and DORA programme you maintain for as long as you hold the licence. What it buys is the entire EU single market from one authorisation, a regulator with genuine crypto pedigree, and a credential that unlocks banking and institutional relationships an offshore permit cannot. For a business meant to operate in Europe for years — and to be taken seriously while it does — that is the whole point.

If a credible EU crypto licence is where your project is heading, we run the entire file — the Maltese company, the substance and management, the AML and DORA framework, the MFSA application and the crypto-friendly banking around it — with our fees and the state costs shown separately. See the scope on our Malta crypto licence page, then book a free consultation and we’ll model the real year-one economics — the right service class, the capital, the MFSA fees, and whether Malta or a leaner neighbour fits your plan — before you commit a euro.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.