Malta Gaming Licence Check: Verify an MGA Operator in 2026

Whether you are an operator proving your own permit to a bank, a payment provider about to onboard a merchant, or a player deciding whether a casino is safe, a Malta gaming licence is only worth what the regulator’s register says it is worth. The good news is that Malta makes this easy: unlike much of the offshore world, the Malta Gaming Authority (MGA) publishes an official, searchable Licensee Register, and every genuine licensee must link to it from its own site.

In our practice we run a Malta gaming license check before every partner introduction and every payment-provider application, and with an MGA licence the process is refreshingly clean when you know where to look. This guide shows you how to find an operator on the MGA’s official register on mga.org.mt, what a valid entry actually shows, how the mandatory licence seal on an operator’s website should link back to that register, and the red flags that separate a real tier-1 EU licence from a lapsed one or a cloned seal.

Why the MGA register is the source of truth

Malta was the first EU member state to regulate remote gaming, and the MGA has run a public licensee database ever since — a deliberate feature of a tier-1 regime, not an afterthought. Because a Malta licence is held by a Malta-registered company with real local substance, supervised directly by the regulator under the Gaming Act, the MGA can and does publish who holds what. That is the whole reason a malta gaming authority licensee register search is worth more than any certificate an operator can hand you.

Contrast this with the offshore world, where for years a “licence” was often a private sub-licence that appeared on no independent register at all. Malta is the opposite: the operator does not decide what its record says — the MGA does. A counterfeiter can clone a PDF, mock up a seal and invent a plausible company name, but they cannot make a fraudulent entry appear on a regulator-hosted database at mga.org.mt. That single fact is what makes the check reliable, and it is why every step below routes back to the register rather than to anything on the operator’s own site.

The register also reflects the structure of the licence. The MGA issues B2C Gaming Service licences in four types — Type 1 (casino and RNG games), Type 2 (fixed-odds betting), Type 3 (peer-to-peer, such as poker and betting exchanges) and Type 4 (controlled skill games) — and B2B Critical Gaming Supply licences to platform and software providers. A B2B supplier’s entry does not authorise it to run a consumer casino, and a Type 2 betting licence does not cover a Type 1 casino product.

How to verify an MGA operator, step by step

Step one — reach the real MGA, not a lookalike. Go to the Malta Gaming Authority directly at mga.org.mt and find its Licensee Register. Be wary of search results that echo the regulator’s name with an odd domain spelling, and never reach the “register” by clicking a link embedded in a certificate. The regulator’s own site is the one route that cannot be spoofed.

Step two — search by the licensee company, not the brand. Enter the exact legal entity that operates the site — not the consumer brand name in the logo. A genuine licence returns a clean record naming that Malta company, its licence number, the licence type and its status. A brand that cannot be tied to a licensed entity on the register is a reason to stop.

Step three — match type, status, dates and the URL. Confirm the licence type fits the product, the status reads active, the validity window makes sense, and — the decisive test — the domain you are actually transacting with appears among the licence’s authorised URLs. All four must line up. Any one of them failing is enough to withhold trust until the operator resolves it.

Step four — follow the seal back to the record. Return to the operator’s site and click the MGA licence seal in its footer. It should link through to the same register entry you just found. If the seal is a static image, or links to anything other than an mga.org.mt record for the same company, treat the whole set-up as unverified.

What a valid MGA entry shows: the field-by-field check

Knowing what each field on a record tells you is what turns a glance into a real check. Use the table below as the verification you — or a diligent PSP — should run before onboarding or depositing.

The authorised-URLs field is the one to lean on. A counterfeiter can invent a plausible company name and mock up a seal, but they cannot make your specific domain appear on a regulator-hosted MGA record. If the casino operates on a URL that is not listed against the licence, the licence does not cover that site — even when the rest of the entry looks legitimate. This is the field a careful review of the Malta licence requirements always confirms, and the one thin verifications skip.

Reading the seal and the licence type

The MGA licence seal is a genuine tool, but only when you use it correctly. Every licensee must display the seal on its site, and it must resolve to that operator’s own entry on the register. The seal is not the verification — it is a shortcut to the verification. Clicking it should land you exactly where a manual register search would.

The licence type is the other signal people misread. Because the MGA splits B2C into four types plus a separate B2B licence, the entry has to fit the product:

• A Type 1 licence covers casino-style and RNG games — slots, table games and the like. This is what most “online casino” brands should hold.
• A Type 2 licence covers fixed-odds betting; Type 3 covers peer-to-peer products such as poker rooms and betting exchanges; Type 4 covers controlled skill games.
• A B2B Critical Gaming Supply licence authorises a platform, aggregator or software supplier to serve licensed operators — it does not authorise that company to run a consumer-facing casino itself.

None of this means an operator is illegitimate because its type is unusual; it means the type must match what it is actually selling you. Our flagship Malta gaming licence guide walks through the full regime, and the dedicated Malta licence types breakdown covers exactly what each of the four B2C types allows.

Red flags of a fake, lapsed or cloned licence

Most problem cases give themselves away before you finish the register search, if you know the tells. In our experience these recur:

• A seal that does not link, or links to a lookalike. A static MGA badge, or one that resolves to anything other than an mga.org.mt record, is the single most common tell. Legitimate seals link straight to the register.
• A licensee name absent from the register. If the operating company cannot be found on the MGA Licensee Register at all, nothing else matters — stop there.
• Authorised URLs that do not include the live site. A real operator’s site is on the record. Silence in that field is a warning that the licence does not cover the domain you are using.
• A status that reads suspended or cancelled. MGA licences can be suspended or revoked, and the register reflects it. A footer seal will not — only the live record tells you the current status.
• A “verify here” link the operator controls. Verification should never depend on a route the seller supplies. Type mga.org.mt yourself.
• A mainstream payments stack. Card processing through Stripe or PayPal on a gambling site is not reassurance; those processors prohibit gaming. Genuine MGA operators settle through tier-1 banks and specialist high-risk acquirers — Malta’s EU standing gives it real banking, but not consumer fintech.

Verifying your own MGA licence — and using it as a credential

If you are the operator, verification is not a one-off. Pull your own MGA Licensee Register entry before every major onboarding — a new PSP, a game studio, a banking relationship — and send the counterparty the register link rather than a PDF. It shortens their due diligence and signals that you understand how a tier-1 regime is checked. Because the licence is held by a Malta company with local substance, make sure the licensee name on the record matches the entity your partners are contracting with, not just your consumer brand.

Keep the authorised-URLs field current, too. If you launch a new site or migrate domains, that URL has to be registered against your licence and reflected on the record — an operating domain that is not listed will fail exactly the check a diligent PSP runs, and it is a common reason onboarding stalls even when the underlying licence is perfectly valid. Make sure your MGA seal links cleanly to your live entry as well; a broken or mislinked seal undermines the very trust the licence is meant to buy you.

A licence that verifies cleanly is the foundation everything else — tier-1 banking, PSP acceptance, B2B partnerships — is built on. If you want that foundation laid correctly the first time, or a free check on a Malta licence you have been offered or hold today, book a free consultation and we will run it against the MGA Licensee Register with you.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.