The Malta Casino Launch Checklist (2026)

Launching a Malta casino is a six-phase build: incorporate and fund a Malta company, prepare the MGA application file, pass the MGA’s fit-and-proper and systems review, then go live — several months, not a permit you buy. Most operators asking how to launch a Malta casino underestimate one thing: Malta is not a permit you buy, it is a business you build. The Malta Gaming Authority (MGA) runs the most respected licence in online gambling precisely because it demands real substance — a Malta company, funded share capital, local key functions and a compliance operation the regulator can supervise — before it will issue anything. That bar is the whole point. It is why an MGA licence carries tier-1 credibility with players, PSPs and banks, and it is why the honest timeline is 4–6 months, not weeks.

This is an end-to-end map from idea to live product: the Malta company and capital, the MGA application build, the fit-and-proper and business review, the system audit and licence issue, then banking and payments, and finally live-ops — tax, reporting, geo-blocking and the recurring audits that run for the ten-year term. The numbers here come from our own desk. Treat any provider promising a Malta licence in a few weeks with suspicion; that is not how this regulator works.

The launch at a glance

Before the detail, here is the whole sequence in one view. Phases overlap where they safely can — you can begin the application build while the company is being formed — but the dependencies are real. You cannot pass fit-and-proper before the entity and capital exist, and you cannot complete the system audit before the application clears the MGA’s business review.

Phase 1 — The Malta company and capital

The first practical decision is the entity, and for Malta the answer is unambiguous: the licensee is a Malta-registered company. This is the defining difference between Malta and lightweight offshore regimes — there is no filing-a-shell-from-abroad shortcut here. You incorporate in Malta, and you fund it. Minimum share capital runs from €40,000 to €240,000 depending on the licence type you are applying for, so the type decision drives your capital budget from day one; our Malta gaming licence types breakdown maps each type to its capital floor.

What this phase delivers is a functioning Malta structure the MGA can supervise: the company, the funded capital, local presence and key functions, and a dedicated compliance and MLRO function. If you are running a holding structure above the operating company for tax or liability reasons, settle it now — the regulator will trace every ultimate beneficial owner behind whatever sits on top. The mechanics of forming the entity and establishing substance are covered in our Malta company setup guide; get it locked before you build the application, because everything downstream references it.

Phase 2 — The application build

This is the phase that makes the application credible and keeps the licence alive afterwards. The MGA does not accept template filler — it expects real policies, a real business plan and system documentation written to its standards, all operated by named, qualified people. The full requirements bar is set out in our Malta gaming licence requirements breakdown, and this phase runs in parallel with company formation.

The core set: a detailed business plan with multi-year financial projections; an AML/KYC and customer due-diligence procedure covering player identification, source-of-funds verification and transaction monitoring to EU standards; responsible-gaming controls (self-exclusion, deposit limits, cooling-off periods and reality checks); a GDPR-aligned data-protection policy; and full system and control documentation describing the platform architecture, security controls and the certified gaming systems and RNG. Alongside the policies you assemble identity verification and background checks for every UBO, shareholder, director and key person, plus a documented source-of-funds and source-of-wealth assessment. The FATF international standards are the baseline every AML policy here is measured against. Draft to the regulator’s expectations now — retrofitting after a query is slower and more expensive than doing it once.

Phase 3 — The MGA review and fit-and-proper

With the company, the capital, the policies and the system file ready, the application goes to the MGA — and this is the longest single wait. The Authority runs a detailed due-diligence and business review: it interrogates the business plan for viability, tests the compliance framework against its standards, and puts every UBO, director and key person through a fit-and-proper assessment covering financial stability, source of funds, and any sanctions or disqualifying history. Budget 8–12 weeks for this on a clean file; a thin or inconsistent submission adds a round of back-and-forth and pushes you toward the far end.

This is where Malta spends the time that offshore regimes do not, and it is the reason the credential is worth what it is. The strategic case for the jurisdiction — why serious operators accept the substance and the wait — sits in the flagship Malta gaming licence guide, and the full cost picture, including how to read a quote, is in the Malta gaming licence cost breakdown.

Phase 4 — System audit and go-live

Once the application clears the business review, the technical layer has to prove itself. A system audit by an MGA-approved party examines the live platform against the documentation you filed — the certified gaming systems, the RNG certificate from an approved laboratory, the security and hosting controls, and the player-protection mechanics built into the technical layer rather than merely described in a policy. When the audit is satisfied, the MGA issues the licence and you can launch.

Budget 4–8 weeks for this phase. The system audit is not a one-off gate: it recurs during the ten-year term, so the platform you certify has to stay certifiable. Proprietary games need their own RNG certificates, and third-party content comes through tested providers under the right agreements. The practical lesson is to build the platform to audit standard from the start, because remediating a failed audit after go-live is far more disruptive than passing it clean.

Phase 5 — Payments and banking

Here is the phase most first-timers underestimate. Malta’s licence is tier-1, but gambling is still a high-risk category everywhere, and mainstream processors prohibit it outright. Do not build on Wise, Stripe or PayPal — their terms ban gambling and they will freeze or close the account on discovery. Even an MGA operator settles through tier-1 banks and specialist high-risk gaming PSPs and acquirers, not consumer fintech.

The difference Malta makes is access. Its EU credential and real substance open banking relationships an offshore permit never will — the honest reason well-capitalised operators tolerate the cost and the wait. You still live inside the card schemes’ high-risk rules, such as Visa’s Integrity Risk Program, which is why acquirers scrutinise gambling so hard. Sequence this in parallel with Phases 3 and 4 — start bank and PSP conversations while the application is with the regulator — so accounts are ready when the licence lands. Malta operators do not need the Cyprus payment-agent workaround that lightweight offshore casinos rely on; the tier-1 credential is precisely what lets you bank directly.

Phase 6 — Live-ops and the ten-year term

The final phase is not a finish line — it is the operating model for the next decade. Wire up the compliance tooling you drafted in Phase 2: KYC onboarding, transaction monitoring, self-exclusion and deposit limits all have to be live, not just written. Then the ongoing obligations begin. Gaming tax is 5% on revenue from Maltese players, and the MGA’s progressive compliance contribution is a percentage of GGR payable for the life of the licence, on top of the €25,000 fixed annual fee.

Two more non-negotiables. First, reporting and recurring audits: regular MGA reporting, notification of material changes, and the recurring system audits that keep certification current. Second, geo-blocking. A Malta licence carries EU standing but is not blanket market access — before go-live, GEO-IP fencing must exclude any market that requires its own local licence, the United States, and every sanctioned or FATF-listed territory. Keep responsible-gaming tools live throughout, maintain the Malta substance in good standing, and manage renewals and change-of-control filings across the ten-year term.

Where this fits

If you want the strategic case for the jurisdiction rather than the step-by-step, the flagship Malta gaming licence guide covers why serious operators choose Malta and how it stacks up against lighter regimes. This checklist is the operational companion: the same facts, ordered as a build plan.

We run this entire sequence end to end — the Malta company and capital, the MGA application and fit-and-proper file, the system audit, and the tier-1 banking and specialist PSP layer most providers leave you to solve alone. See the Malta gaming licence service, or book a free consultation and we will map your launch timeline against your actual product.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.