Malta Gaming Licence Requirements in 2026

A Malta gaming licence requires a Malta-registered company funded to the minimum share capital for its licence type, with genuine local presence and key functions carried out in Malta. A Malta Gaming Authority (MGA) licence is the most respected credential in online gambling — and the requirements file behind it reflects that. Where an offshore permit asks for little more than a company and a fee, Malta asks for a real business: a local company, funded capital, people on the ground and a working compliance programme, all vetted by the regulator itself.

This guide is the requirements checklist we work from on our own desk. It covers exactly what the 2026 MGA regime demands — a Malta company and genuine substance, fit-and-proper due diligence on everyone behind the business, and a certified-systems document pack — so you can price the licence on what it actually takes, not on the headline fees. If you are weighing Malta against a light offshore route, this is the substance you are really paying for.

The company and the licence types

Everything starts with a Malta company. The MGA licenses a Malta-registered entity — the applicant is incorporated in Malta, not an offshore holding company that applies from elsewhere. This is the first hard difference from the offshore permits: there is no remote-only route, and the licensee’s home is Malta.

The Authority issues Gaming Service (B2C) licences across four game types, plus a Critical Gaming Supply (B2B) licence for suppliers whose software or platform materially affects game outcomes. Which type you hold drives your share-capital floor and shapes the technical documentation you file. For a full breakdown of where your product fits, our Malta gaming licence types guide maps each one, and the Malta company setup walk-through covers standing up the entity itself.

Costs sit outside scope here — for fees, the 5% gaming tax on Maltese-player revenue and the year-one all-in, see the Malta gaming licence cost guide. The wider picture of what an MGA licence buys is covered in our flagship Malta gaming licence overview.

Substance and share capital

This is the requirement that catches operators pricing Malta on its fees alone. The MGA demands genuine substance, and it demands funded capital. At application you must have in place:

• A Malta company as the licensee — the entity that holds the licence, incorporated and administered in Malta.
• Minimum share capital of €40,000 to €240,000, set by licence type. This is issued and paid-up capital you must fund and evidence — Type 1 casino/RNG operations sit at the top of the range, other B2C types lower. Operators holding more than one type meet the highest applicable figure.
• Local presence and key functions in Malta — the business is genuinely directed and administered from Malta, with real people performing the core functions, not a nameplate address.
• A dedicated compliance and AML/MLRO function — someone accountable for the AML programme, responsible-gaming controls and the regulator relationship.

Note the contrast with the light offshore regimes: this is exactly what permits like Anjouan and Tobique do not require, and it is why they stay cheap and fast while Malta delivers EU standing and tier-1 banking. Share capital is not a fee you write off — it is working capital that also signals to the regulator, and to banks, that the business is real.

Fit-and-proper due diligence

Under the MGA’s regime, fit-and-proper vetting is run by the Authority itself, and it is run on every ultimate beneficial owner, shareholder, director and key person — not just the named applicant. Everyone behind the company clears the same bar, and the depth matches the licence’s reputation.

Detailed due diligence on all UBOs, shareholders, directors and key persons. Identity is verified from certified documentation, and each individual is screened against criminal records, sanctions lists and adverse-media watch-lists. A single unresolved file — a missing document, an unexplained connection — holds the whole application.

Financial stability and source of funds. You must demonstrate not only that the business is funded, but where the money comes from and how the beneficial owners built their wealth. This is a source-of-funds and source-of-wealth standard — the same test a tier-1 bank applies — and vague or undocumented wealth is the single most common reason a file stalls.

No sanctions or disqualifying convictions. Anyone in the ownership or control structure with disqualifying convictions, sanctions exposure or watch-list hits will fail the assessment; there is no working around it.

A credible, evidenced business plan. The MGA reviews the commercial case, not just the paperwork. The plan must be realistic, internally consistent and supported by financial projections that match the licence type and capital you have funded — an aspirational deck will not pass a regulator that expects a genuine operation.

Because these files take the longest to assemble — especially source-of-wealth evidence and certified documents from multiple jurisdictions — start them in parallel on day one rather than treating due diligence as a closing step.

The document and technology pack

Alongside people and substance, the MGA reviews a defined set of documents, and the technical elements are confirmed by audit before you launch. Filing with any of these missing, or written for a different product, is what turns a four-month approval into a six-month one. The core pack is:

Two elements deserve emphasis. The AML/KYC and responsible-gaming policies must be operable documents mapped to the FATF Recommendations and drafted to EU and MGA standards — because the compliance function is expected to actually run them, with real transaction monitoring, self-exclusion, deposit limits and reporting. Our primer on iGaming AML and KYC covers what an operable programme looks like. And the certified gaming systems and RNG must come from an MGA-approved laboratory: game fairness has to be demonstrable, and the technical system audit is part of licensing and recurs through the term, not a one-off gate. Full GDPR compliance on player data runs across all of it.

Ongoing requirements and payments

The requirements do not stop at issuance. Because Malta is a direct-supervision, tier-1 regime, you carry live obligations for the full ten-year term. You keep the Malta company, share capital and key functions in good standing — substance cannot lapse. You file regular MGA reporting, pay the progressive compliance contribution, and notify the Authority of material changes, including change of control. The compliance/MLRO function runs the AML and responsible-gaming programme continuously, and the certified systems and RNG remain subject to periodic technical audit.

On the payments side, Malta’s advantage is EU standing and access to tier-1 banking — a door a pure offshore permit never opens. But the rails still have to be built correctly. Mainstream processors such as Wise, Stripe and PayPal prohibit gambling, so Malta operators bank with tier-1 institutions and route payments through specialist high-risk acquirers and gaming PSPs, not consumer fintech. The licence earns you access to better rails; it does not exempt you from the fact that gambling remains a restricted category everywhere.

Assembling the file in the right order

Requirements are one thing; sequence is another. The order that avoids rework is: incorporate the Malta company, fund the share capital for your licence type and stand up local presence and the compliance/MLRO function first; assemble every UBO fit-and-proper file — source of funds and source of wealth — in parallel, because they take the longest; draft the AML/KYC, responsible-gaming and data-protection policies against your actual operating model; then finalise the certified systems, RNG and system documentation ahead of the technical audit. Only then does the MGA application go in. For a step-by-step run to go-live, see the Malta launch checklist.

None of this is the light-touch permit an offshore jurisdiction offers — and that is the point. The MGA regime asks for a real Malta company, real capital, real people and a real compliance programme, and in exchange gives you the strongest credential in online gaming, EU standing, tier-1 banking and a ten-year term. Get the file complete and internally consistent the first time and the 4–6 month window is achievable; file with gaps and it drifts.

Ready to assemble your MGA requirements pack, or want a second opinion on a file you have already started? Our team handles the full Malta substance, fit-and-proper and document build end to end and will review any application against the Authority’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.