Malta VFA to CASP Transition: 2026 Deadline Guide

Malta got to crypto regulation early. Its Virtual Financial Assets (VFA) Act, launched in 2018, was one of the EU’s earliest dedicated crypto regimes and earned the island its “Blockchain Island” reputation. That framework has now been switched off. Under the Markets in Crypto-Assets Regulation (MiCA), the VFA licence is replaced by a single EU credential, the Crypto-Asset Service Provider (CASP) authorisation, issued in Malta by the Malta Financial Services Authority (MFSA). If you hold a Maltese VFA licence, the date that counted was 1 July 2026, when grandfathering ended.

For a VFA holder the CASP file is a new application to the MFSA, with its own plan and budget. The ones who wait discover the problem the way most compliance problems surface: a banking partner asks for a licence reference that resolves to a regime that has been wound down. The good news is that Malta’s head start cuts both ways: the MFSA has supervised crypto since 2018, so it knows what a complete CASP file looks like. This guide is the practical path from a VFA licence to a full CASP authorisation in 2026.

Why the VFA regime closed

The VFA Act and MiCA answer to different masters. Malta’s VFA framework was a national creation: a bespoke Maltese regime, supervised locally, whose authority stopped at the border. It was pioneering precisely because no EU-wide rulebook existed in 2018. MiCA changed that: it replaced the patchwork of national crypto rules with one directly applicable EU regulation and a single licence type that carries across the whole bloc. There was never a mechanism to keep the VFA regime and MiCA running in parallel indefinitely, so the national framework was always going to be absorbed into MiCA.

The specific provision that matters to you is Malta’s grandfathering rule. A VFA licence that was valid on 30 December 2024 (the date MiCA’s CASP provisions began applying) could continue under the VFA Act during a transitional period. That period ended on 1 July 2026, or earlier for a holder whose CASP authorisation the MFSA granted or refused before then. Since the window closed, a VFA licence has been a lapsed permission rather than a durable legal footing. You are not renewing a licence. You are obtaining a different, heavier credential in its place. Our MiCA regulation explained guide covers the regime change in full; this article focuses on what a Maltese VFA holder specifically has to do about it.

What a VFA holder must actually do now

Converting to a CASP means real substance and compliance work. The good news for VFA holders is that you start from a stronger base than operators in lighter national regimes: Malta’s VFA framework already demanded a licensed company, a compliance function, and AML controls, so a good deal of that work carries over. The work is closing the delta between VFA obligations and full MiCA ones, and the MFSA assesses the CASP application as a complete financial-services licence. The applicant is a Maltese company with genuine substance — real management on the island, a real office, and a real compliance function.

The core build looks like this:

• A Maltese company as the licence applicant, with a registered office and genuine operating presence in Malta.
• Class-based initial capital of €50,000, €125,000 or €150,000 depending on the CASP service class, or a quarter of the prior year’s fixed overheads where higher, in own funds, insurance or a combination.
• Fit-and-proper management assessed by the MFSA, plus a dedicated MLRO and board-level compliance oversight.
• AML/CFT policies aligned to the EU’s fifth and sixth anti-money-laundering directives and the Travel Rule (originator/beneficiary data on transfers).
• A DORA-compliant ICT framework — risk management, incident reporting, resilience testing and third-party ICT oversight, applicable to CASPs since 17 January 2025.
• A programme of operations, business plan and financial projections, plus custody, safeguarding, conflicts and complaints-handling policies.

The real project sits where the VFA and MiCA regimes diverge: MiCA conduct rules, the DORA ICT build and the class-based capital tiers. The full breakdown is in our Malta crypto licence requirements guide, and the authorisation itself is covered end to end in our Malta CASP licence explainer. The point here is to start the mapping and gap-analysis now, because the ICT and conduct work cannot be rushed through in a matter of weeks.

Old VFA licence vs new CASP authorisation

The 1 July 2026 cutoff — and what a lapsed licence really costs

VFA holders tend to underestimate this because the licence can still look valid on paper. The exposure is twofold. First, regulatory: with the grandfathering window now shut, providing crypto-asset services on a lapsed VFA licence is unauthorised activity, and the MFSA can act on it. Second, and often sooner, commercial: crypto-friendly banks, EMI and payment-institution partners verify authorisation status directly, and a licence that resolves to a sunset regime simply fails that check. When it fails, settlement holds and account closures follow quickly, and unlike a fine there is no negotiating your way out of a bank’s risk decision.

There is also a scope cost to drifting. The VFA licence never passported, and neither does a lapsed one, so any EU expansion you had planned stalls until the CASP is granted. If your VFA licence lapsed before the new authorisation went live, you now face a re-authorisation exercise under time pressure; our crypto licence renewal in Europe guide sets out how that works.

What changes commercially once you hold a Malta CASP

The upside of the work is reach. The VFA licence only ever authorised you in Malta; every other EU market was closed to you, or required its own local registration. A CASP authorisation passports across all 27 member states under MiCA Article 65 — you apply once with the MFSA, notify the host states you want to serve, and operate EU-wide from a single licence. For any operator with ambitions beyond one country, that step change in addressable market is the real return on the compliance work.

The credential also carries more weight. An MFSA CASP authorisation is a recognised, EU-harmonised financial-services licence, and Malta’s standing as fifth in the EU by authorised CASP count (22 of 360 on ESMA’s register, 27 September 2026) gives it real signalling value: crypto-friendly banking and EMI partners, institutional counterparties, auditors and listing venues all read a MiCA CASP differently from a national VFA entry. In our experience that shows up as smoother onboarding and a shorter due-diligence cycle when you open new banking or payment relationships. The substance you build for the licence, meaning the Maltese company, the MLRO and the DORA and AML stack, is the same foundation you reuse to add service classes or scale into new markets later. Our Malta crypto licence pillar sets out the full picture of what the authorisation unlocks.

Transition in Malta, or relocate?

Not every VFA holder should assume Malta is still the answer, though for most already established here it is. The real question is where your genuine substance sits. If your management, staff, auditors and banking are already in Malta, converting the existing company into a CASP applicant is the cleanest route: you are closing the gap on capital, DORA and MiCA conduct in a business that already exists, and the MFSA’s VFA-era experience means it knows the business it is reviewing. Relocation only earns its cost if your real operating centre is somewhere else, in which case it may make more sense to license where your people and controls actually are.

Either way, make the decision by modelling both routes. With the 1 July 2026 cutoff behind us, standing still turns what should have been a planned re-authorisation into an outage. Whether you transition in Malta or license elsewhere, continuing to operate on a lapsed VFA licence is the one option that isn’t safe. Book a free consultation and we’ll size the CASP transition against your service classes, capital, banking needs and timeline.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.