Malta gaming license

The applicant must be a body corporate established in the European Union or the European Economic Area. Most applicants choose to incorporate a Maltese Limited Liability Company to facilitate local operations and bank onboarding.

The MGA conducts thorough due diligence on all ultimate beneficial owners (UBOs), directors, and key persons. This “fit and proper” assessment includes criminal record checks, credit history reviews, and verification of professional experience.

1. The authorized share capital must be fully paid up before the application is submitted. The requirements depend on the license type:

• Type 1 and Type 2 (B2C): Minimum 100,000 EUR.

• Type 3 and Type 4 (B2C): Minimum 40,000 EUR.

• Critical Gaming Supply (B2B): Minimum 40,000 EUR.

Applicants must submit a detailed three-year business plan, including financial forecasts and marketing strategies. Technical requirements include a system audit to verify the security and integrity of the gaming software and hardware.

The company must appoint individuals to hold specific “Key Functions” (such as Compliance, AML, and Technical operations). These individuals must be approved by the MGA and, in many cases, are required to have a physical presence or a clear operational link to Malta.

Operators must maintain two separate bank accounts: one for operational funds and a dedicated, segregated account for player funds to ensure their protection in case of insolvency.

Your RNG and games must be certified by an independent testing lab, and change control must be disciplined. Security posture matters—think ISO‑aligned processes, encryption at rest and in transit, strict access controls, and regular pen tests. Hosting can be cloud or on‑prem, but it must meet MGA standards for availability, logging, and incident response in a remote setup.

On the people side, expect named Key Function holders: compliance, AML (MLRO), data protection, information security, responsible gaming, and internal audit. Their independence and competence are tested. Policies must be lived, not laminated—KYC verification, transaction monitoring, PEP/sanctions screening, self‑exclusion handling, and affordability interventions are operational muscles you’ll be asked to flex.

And a word to the wise: do not target restricted jurisdictions “without Swedish authority check” or its equivalent elsewhere. If you want Sweden, you need a local license from Spelinspektionen. Same logic for the Netherlands, the UK, some U.S. states, and other regulated markets.