Malta VFA to CASP Transition: 2026 Deadline Guide

Malta got to crypto regulation first. Its Virtual Financial Assets (VFA) Act, launched in 2018, was the EU’s earliest dedicated crypto regime and earned the island its “Blockchain Island” reputation. That framework is now being switched off. Under the Markets in Crypto-Assets Regulation (MiCA), the VFA licence is replaced by a single EU credential — the Crypto-Asset Service Provider (CASP) authorisation — issued in Malta by the Malta Financial Services Authority (MFSA). If you hold a Maltese VFA licence, the date you need to watch is 1 July 2026.

In our practice, the VFA holders who come through this cleanly treat it as a re-authorisation project with a hard deadline, not a renewal. The ones who wait discover the problem the way most compliance problems surface — a banking partner asks for a licence reference that resolves to a regime being wound down. The good news is that Malta’s head start cuts both ways: the MFSA has supervised crypto since 2018, so it reviews CASP files faster than the big-three EU markets. This guide is the practical path from a grandfathered VFA licence to a full CASP authorisation in 2026.

Why the VFA regime is closing

The VFA Act and MiCA answer to different masters. Malta’s VFA framework was a national creation — a bespoke Maltese regime, supervised locally, whose authority stopped at the border. It was pioneering precisely because no EU-wide rulebook existed in 2018. MiCA changed that: it replaced the patchwork of national crypto rules with one directly applicable EU regulation and a single licence type that carries across the whole bloc. There is no mechanism to keep the VFA regime and MiCA running in parallel indefinitely — the national framework was always going to be absorbed into MiCA.

The specific provision that matters to you is Malta’s grandfathering rule. A VFA licence that was valid on 30 December 2024 — the date MiCA’s CASP provisions began applying — may continue under the VFA Act during a transitional period. That period ends on 1 July 2026, or the moment the MFSA grants or refuses your CASP authorisation, whichever comes first. After that, the VFA licence is not a durable legal footing; it is a lapsed permission. You are not renewing a licence. You are obtaining a different, heavier credential in its place. Our MiCA regulation explained guide covers the regime change in full — this article focuses on what a Maltese VFA holder specifically has to do about it.

What a VFA holder must actually do now

Converting to a CASP is a substance and compliance exercise, not a rubber stamp. The good news for VFA holders is that you start from a stronger base than operators in lighter national regimes: Malta’s VFA framework already demanded a licensed company, a compliance function, and AML controls, so a good deal of that work carries over. The gap is closing the delta between VFA obligations and full MiCA ones — and the MFSA assesses the CASP application as a complete financial-services licence. The applicant is a Maltese company with genuine substance — real management on the island, a real office, and a real compliance function.

The core build looks like this:

• A Maltese company as the licence applicant, with a registered office and genuine operating presence in Malta.
• Class-based initial capital of €50,000, €125,000 or €150,000 depending on the CASP service class, held in an EEA bank or e-money account.
• Fit-and-proper management assessed by the MFSA, plus a dedicated MLRO and board-level compliance oversight.
• AML/CFT policies aligned to the EU’s fifth and sixth anti-money-laundering directives and the Travel Rule (originator/beneficiary data on transfers).
• A DORA-compliant ICT framework — risk management, incident reporting, resilience testing and third-party ICT oversight, applicable to CASPs since 17 January 2025.
• A programme of operations, business plan and financial projections, plus custody, safeguarding, conflicts and complaints-handling policies.

Where the VFA and MiCA regimes diverge — MiCA conduct rules, the DORA ICT build, and the class-based capital tiers — is where the real project sits. The full breakdown is in our Malta crypto licence requirements guide, and the authorisation itself is covered end to end in our Malta CASP licence explainer. The point here is to start the mapping and gap-analysis now, because the ICT and conduct work does not compress into the weeks before the deadline.

Old VFA licence vs new CASP authorisation

The 1 July 2026 cutoff — and what a lapsed licence really costs

VFA holders tend to underestimate this because the licence still “works” today. The exposure is twofold. First, regulatory: once the grandfathering window shuts, providing crypto-asset services on a lapsed VFA licence is unauthorised activity, and the MFSA can act on it. Second — and usually faster — commercial: crypto-friendly banks, EMI and payment-institution partners verify authorisation status directly, and a licence that resolves to a sunset regime simply fails that check. When it fails, settlement holds and account closures follow quickly, and unlike a fine there is no negotiating your way out of a bank’s risk decision.

There is also a scope cost to drifting. The VFA licence never passported, and neither does a lapsed one, so any EU expansion you had planned stalls until the CASP is granted. If your VFA licence ever does lapse before the new authorisation is live, you are looking at a re-authorisation exercise under time pressure — the exact situation our crypto licence renewal in Europe guide exists to help operators avoid. The cheapest version of this transition is the one you start early.

What changes commercially once you hold a CASP

The upside of the work is reach. The VFA licence only ever authorised you in Malta; every other EU market was closed to you, or required its own local registration. A CASP authorisation passports across all 27 member states under MiCA Article 65 — you apply once with the MFSA, notify the host states you want to serve, and operate EU-wide from a single licence. For any operator with ambitions beyond one country, that is a step change in addressable market, not a compliance chore.

The credential also carries more weight. An MFSA CASP authorisation is a recognised, EU-harmonised financial-services licence, and Malta’s standing as a top-five EU jurisdiction by authorised CASP count gives it real signalling value — crypto-friendly banking and EMI partners, institutional counterparties, auditors and listing venues all read a MiCA CASP differently from a national VFA entry. In our experience that shows up as smoother onboarding and a shorter due-diligence cycle when you open new banking or payment relationships. The substance you build for the licence — the Maltese company, the MLRO, the DORA and AML stack — is the same foundation you reuse to add service classes or scale into new markets later. Our Malta crypto licence pillar sets out the full picture of what the authorisation unlocks.

Transition in Malta, or relocate?

Not every VFA holder should assume Malta is still the answer — but for most already established here, it is. The honest question is where your genuine substance sits. If your management, staff, auditors and banking are already in Malta, converting the existing company into a CASP applicant is the cleanest route: you are closing the gap on capital, DORA and MiCA conduct in a business that already exists, and the MFSA’s VFA-era experience means it reviews faster than Germany, France or Italy. Relocation only earns its cost if your real operating centre is somewhere else, in which case it may be more honest to license where your people and controls actually are.

Either way, the decision is a modelling exercise, not a default. The wrong move is to do nothing and let the 1 July 2026 cutoff decide for you — because standing still converts a manageable, planned re-authorisation into an outage. Whether you transition in Malta or license elsewhere, the one option that isn’t safe is running past the window on a VFA licence that has lapsed. Book a free consultation and we’ll size the CASP transition against your service classes, capital, banking needs and timeline before the clock runs down.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.