MGA Licence Check 2026: Register, Seal and Licence Number

Whether you are an operator proving your own permit to a bank, a payment provider about to onboard a merchant, or a player deciding whether a casino is safe, a Malta gaming licence is only worth what the regulator’s register says it is worth. The good news is that Malta makes this easy: unlike much of the offshore world, the Malta Gaming Authority (MGA) publishes an official, searchable Licensee Register, and every genuine licensee must link to it from its own site.

We run a Malta gaming licence check before every partner introduction and every payment-provider application, and with an MGA licence the process is refreshingly clean when you know where to look. This guide shows you how to find an operator on the MGA’s official register on mga.org.mt, what a valid entry actually shows, how the mandatory licence seal on an operator’s website should link back to that register, and the red flags that separate a real tier-1 EU licence from a lapsed one or a cloned seal.

Why the MGA register is the source of truth

Malta was the first EU member state to regulate remote gaming, and the MGA has run a public licensee database ever since as a deliberate feature of a tier-1 regime. Because a Malta licence is held by a Malta-registered company with real local substance, supervised directly by the regulator under the Gaming Act, the MGA can and does publish who holds what. That is the whole reason a malta gaming authority licensee register search is worth more than any certificate an operator can hand you.

Contrast this with the offshore world, where for years a “licence” was often a private sub-licence that appeared on no independent register at all. Malta is the opposite: the operator does not decide what its record says — the MGA does. A counterfeiter can clone a PDF, mock up a seal and invent a plausible company name, but they cannot make a fraudulent entry appear on a regulator-hosted database at mga.org.mt. That single fact is what makes the check reliable, and it is why every step below routes back to the register rather than to anything on the operator’s own site.

The register also reflects the structure of the licence. The MGA issues B2C Gaming Service licences in four types (Type 1 for casino and RNG games, Type 2 for fixed-odds betting, Type 3 for peer-to-peer products such as poker and betting exchanges, Type 4 for controlled skill games) and B2B Critical Gaming Supply licences to platform and software providers. A B2B supplier’s entry does not authorise it to run a consumer casino, and a Type 2 betting licence does not cover a Type 1 casino product.

How to read an MGA licence number

Most people search for an MGA licence the way it appears in a casino footer: a string like MGA/B2C/976/2022. Knowing how that string is built tells you straight away whether it is plausible and what kind of licence to expect on the register.

The class matters more than people expect. In our capture of the MGA Licensee Register (311 licences, mirrored at Malta licence data), 154 hold B2B numbers, 109 hold B2C numbers and 48 hold CRP numbers. So a consumer casino quoting a B2B number is quoting a supplier licence, and a CRP number means the licence is held at group level — the company you are dealing with should appear in that group’s record. The register also lists each licensee’s Malta company registration number (in the form “C 89109”), which you can cross-check against the Malta Business Registry.

The year is only a sanity check and proves nothing on its own. The register’s numbers run from 2000 to 2026, with the heaviest years 2018–2020. A footer quoting a year earlier than the brand’s own launch is not automatically fake, since group licences often predate a brand, but it is a reason to confirm the brand’s domain appears under that licence.

What the MGA seal page actually shows

The MGA’s licence seal is not a picture. It is a “Dynamic Seal of Authorisation” that pulls data from the regulator’s servers, and a genuine one opens a page on authorisation.mga.org.mt/verification.aspx followed by a company identifier. That page is more detailed than most guides suggest. On a live seal page you will find:

• Licensee information and address — the licensed company, which should match your contract counterparty.
• Status of licence, licence number, licence type and class type — the current status and the full number, including any suffix.
• Game types and game type approved — what the licence actually covers.
• Service providers approved — the third-party suppliers approved under the licence.
• Approved ADRs — the alternative dispute resolution provider a player can go to.
• Website Urls — the domains the licence covers.

Seal pages can also show licences that are no longer active; one live example lists a primary licence alongside a surrendered one. Read the status against each licence number, including those below the top line.

Two further MGA tools finish the check. The Licensee Register page includes a URL Checker for testing a domain directly, and the MGA publishes a running list of Unauthorised URLs — sites falsely claiming an MGA licence, with entries going back to 2006 and still being added in September 2026. If the domain you are checking is on that list, stop there.

How to verify an MGA operator, step by step

Step one — go to the real MGA website. Go to the Malta Gaming Authority directly at mga.org.mt and find its Licensee Register. Be wary of search results that echo the regulator’s name with an odd domain spelling, and never reach the “register” by clicking a link embedded in a certificate. The regulator’s own site is the one route that cannot be spoofed.

Step two — search by the licensee company. Enter the exact legal entity that operates the site rather than the consumer brand name in the logo. A genuine licence returns a clean record naming that Malta company, its licence number, the licence type and its status. A brand that cannot be tied to a licensed entity on the register is a reason to stop.

Step three — match type, status, dates and the URL. Confirm the licence type fits the product, the status reads active, the validity window makes sense, and the domain you are actually transacting with appears among the licence’s authorised URLs, which is the decisive test. All four must line up. Any one of them failing is enough to withhold trust until the operator resolves it.

Step four — follow the seal back to the record. Return to the operator’s site and click the MGA licence seal in its footer. It should open a page on authorisation.mga.org.mt showing the same company, the same licence number and your domain under Website Urls. If the seal is a static image, or opens anything other than an mga.org.mt address, treat the whole set-up as unverified.

Step five — run the domain through the MGA’s own lists. Test the exact domain in the URL Checker on the Licensee Register page, and search it on the Unauthorised URLs list. A domain on the second list is a site the MGA has publicly said it has no connection with.

What a valid MGA entry shows: the field-by-field check

Knowing what each field on a record tells you is what turns a glance into a real check. Use the table below as the checklist for your own verification, or a diligent PSP’s, before onboarding or depositing.

The authorised-URLs field is the one to lean on. A counterfeiter can invent a plausible company name and mock up a seal, but they cannot make your specific domain appear on a regulator-hosted MGA record. If the casino operates on a URL that is not listed against the licence, the licence does not cover that site — even when the rest of the entry looks legitimate. This is the field a careful review of the Malta licence requirements always confirms, and the one thin verifications skip.

Reading the seal and the licence type

The MGA licence seal is a genuine tool, but only when you use it correctly. Every licensee must display the seal on its site, and it must resolve to that operator’s own entry on the register. The seal is a shortcut to the verification. Clicking it should land you exactly where a manual register search would.

The licence type is the other signal people misread. Because the MGA splits B2C into four types plus a separate B2B licence, the entry has to fit the product:

• A Type 1 licence covers casino-style and RNG games — slots, table games and the like. This is what most “online casino” brands should hold.
• A Type 2 licence covers fixed-odds betting; Type 3 covers peer-to-peer products such as poker rooms and betting exchanges; Type 4 covers controlled skill games.
• A B2B Critical Gaming Supply licence authorises a platform, aggregator or software supplier to serve licensed operators — it does not authorise that company to run a consumer-facing casino itself.

None of this means an operator is illegitimate because its type is unusual; it means the type must match what it is actually selling you. Our flagship Malta gaming licence guide walks through the full regime, and the dedicated Malta licence types breakdown covers exactly what each of the four B2C types allows.

Red flags of a fake, lapsed or cloned licence

Most problem cases give themselves away before you finish the register search, if you know the tells. In our experience these recur:

• A seal that does not link, or links to a lookalike. A static MGA badge, or one that resolves to anything other than an mga.org.mt record, is the single most common tell. Legitimate seals link straight to the register.
• A licensee name absent from the register. If the operating company cannot be found on the MGA Licensee Register at all, nothing else matters — stop there.
• Authorised URLs that do not include the live site. A real operator’s site is on the record. Silence in that field is a warning that the licence does not cover the domain you are using.
• A status that reads suspended or cancelled. MGA licences can be suspended or revoked, and the register reflects it. A footer seal will not — only the live record tells you the current status.
• A “verify here” link the operator controls. Verification should never depend on a route the seller supplies. Type mga.org.mt yourself.
• A licence class that does not fit the business. A player-facing casino quoting a B2B number, or a number whose class, sequence and year differ between footer and seal page, needs an explanation before you go further.
• A domain on the MGA’s Unauthorised URLs list. The regulator names these sites publicly. It is the clearest red flag there is.
• A mainstream payments stack. Card processing through Stripe or PayPal on a gambling site is not reassurance on its own; those processors either refuse gambling or accept it only from merchants they have pre-approved. Genuine MGA operators settle through tier-1 banks and specialist high-risk acquirers, which Malta’s EU standing opens up.

Verifying your own MGA licence — and using it as a credential

If you are the operator, verification is not a one-off. Pull your own MGA Licensee Register entry before every major onboarding, whether a new PSP, a game studio or a banking relationship, and send the counterparty the register link rather than a PDF. It shortens their due diligence and signals that you understand how a tier-1 regime is checked. Because the licence is held by a Malta company with local substance, make sure the licensee name on the record matches the entity your partners are contracting with, which may differ from your consumer brand.

If you are applying rather than verifying, the licence types, costs and timelines are set out in our Malta gaming licence requirements and Malta gaming licence cost guides, and the regulator itself is profiled in our Malta Gaming Authority explainer.

Keep the authorised-URLs field current, too. If you launch a new site or migrate domains, that URL has to be registered against your licence and reflected on the record — an operating domain that is not listed will fail exactly the check a diligent PSP runs, and it is a common reason onboarding stalls even when the underlying licence is perfectly valid. Make sure your MGA seal links cleanly to your live entry as well; a broken or mislinked seal undermines the very trust the licence is meant to buy you.

A licence that verifies cleanly is what tier-1 banking, PSP acceptance and B2B partnerships are built on. If you want the licence set up correctly the first time, or a free check on a Malta licence you have been offered or hold today, book a free consultation and we will run it against the MGA Licensee Register with you.

Iryna H.

Gaming Licensing at Vantegris

Iryna H. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.