Malta was among the first EU states to regulate remote gaming, and the framework now run by the Malta Gaming Authority has become a benchmark for iGaming regulation. For operators seeking a reputable European Union jurisdiction, securing an MGA licence remains a primary objective. This is not a simple tick-box exercise; the MGA is known for its rigorous due diligence and high standards of compliance.
This guide explains the entire process of obtaining a Maltese gaming permit. It covers the different licence types available, the multi-stage application procedure, key personnel requirements, and the ongoing obligations that follow a successful application. Understanding these steps is fundamental for any company planning to operate from this established iGaming hub.
Understanding the MGA Licence Framework
The current regulatory structure in Malta is governed by the Gaming Act of 2018. This legislation consolidated previous rules into a more streamlined system, creating two main categories of licence: Business-to-Consumer (B2C) and Business-to-Business (B2B). The Malta Gaming Authority (MGA) is the single regulatory body responsible for all gaming activities, including land-based and remote operations.
This authorization is attractive for several reasons. As a member of the EU, Malta provides operators with potential access to a vast market, although market entry is always subject to the laws of each target country. The MGA is also widely respected by players, suppliers, and financial institutions, which adds a layer of credibility and trust to any operation holding its permit. The regulator's focus on player protection, fair gaming, and anti-money laundering (AML) is central to its reputation.
B2C and B2B Licence Types Explained
The MGA simplified its licensing system to remove the previous multi-class structure. Today, an operator applies for either a B2C or B2B licence and then seeks approval for the specific game types it wishes to offer. This makes the system more flexible for businesses that want to expand their product portfolio over time.
Business-to-Consumer (B2C) Gaming Service Licence
A B2C licence allows an operator to offer gambling services directly to players. The MGA categorises these services into four types, and an operator must have approval for each type it provides:
- Type 1: Games of chance where the outcome is determined by a random number generator (RNG). This includes casino slots, roulette, blackjack, and lotteries.
- Type 2: Games of chance based on the outcome of an event or competition. This category covers fixed-odds sports betting.
- Type 3: Games that take a commission or rake from player-versus-player games. This includes poker, bingo, and betting exchanges.
- Type 4: Controlled skill games. This is for fantasy sports or other skill-based games where the outcome is influenced by player skill but still contains an element of chance.
Business-to-Business (B2B) Critical Gaming Supply Licence
A B2B licence is mandatory for any business that supplies critical gaming materials or software to other licensed operators. This includes platform providers, RNG game developers, and live casino studio operators. A B2B licence holder can supply their products to any MGA-licensed operator without the operator needing a separate approval for that supply. This recognition of B2B providers is a key part of the MGA's supply chain integrity.
The MGA Licence Application Process Step-by-Step
The MGA's application process is thorough and designed to ensure only suitable applicants are granted a licence. It is a multi-stage assessment that examines the applicant's fitness, business viability, and technical readiness. It is strongly recommended to engage a reputable Maltese corporate service provider or law firm to guide you through this detailed procedure.
Stage 1: Corporate Setup and Fit & Proper Assessment
Before a formal application is submitted, the applicant must establish a Maltese limited company. The MGA conducts a 'fit and proper' test on all ultimate beneficial owners (UBOs), directors, and persons performing Key Functions. This is a deep background check covering:
- Criminal records and law enforcement investigations.
- Personal and professional financial standing.
- Reputation and integrity, based on references and past business conduct.
Applicants must provide extensive personal documentation, including police conduct certificates, statements of affairs, and certified identification. Any failure at this stage will halt the entire application.
Stage 2: Business and Technical Documentation Review
Once the individuals are deemed fit and proper, the MGA reviews the company's operational plan. This involves submitting a detailed business plan that includes financial projections for three years, marketing strategies, and target markets. Alongside the business plan, the applicant must submit comprehensive technical documentation for its gaming and control systems.
This includes details on the gaming platform, RNG certification (if applicable), data security protocols, and player account management systems. Crucially, the MGA will scrutinise policies and procedures related to Anti-Money Laundering (AML), Responsible Gaming, and data protection (GDPR).
Stage 3: Systems Audit and Go-Live
After the MGA provides its provisional approval of the documentation, the applicant has 60 days to implement the operation in a technical environment and request a systems audit. This audit must be performed by an MGA-approved independent auditor. The auditor verifies that the live system matches the one described in the application and functions as intended. Any critical issues identified must be resolved before the licence is granted.
A small but relevant aside: The MGA has a Sandbox Framework for the acceptance of Virtual Financial Assets (VFAs) and Distributed Ledger Technology (DLT). Operators wishing to use cryptocurrencies must apply to participate in this framework, which involves additional scrutiny and specific system requirements.
Stage 4: Licence Issuance and Ongoing Compliance
Upon successful completion of the systems audit, the MGA will issue a ten-year gaming licence. However, the regulatory oversight does not end here. Operators are subject to continuous compliance obligations. These include submitting monthly player funds reports, bi-annual interim financial statements, and an annual audited set of accounts. The MGA also conducts periodic compliance audits, both on-site and remote, to ensure adherence to all regulations.
Key Costs and Financial Requirements
Obtaining and maintaining this permit involves several costs. Whilst the MGA publishes a schedule of fees, the total outlay will vary depending on the complexity of the operation and the services of third-party advisors.
- Application Fee: A non-refundable fee is payable upon submission of the application.
- Annual Licence Fee: This is a fixed fee paid each year, which varies for B2C and B2B licence holders.
- Compliance Contribution: This is a variable fee paid by B2C operators, calculated based on their gross gaming revenue (GGR). The MGA uses a tiered system, so the contribution rate decreases as revenue increases.
- Minimum Share Capital: The required paid-up share capital depends on the licence type. For example, a B2C operator with a Type 1 and Type 2 licence will have a higher capital requirement than an operator with only a Type 3 licence. These funds must be maintained throughout the life of the licence.
Operators must also budget for professional fees, auditing costs, and the costs of setting up and running a Maltese office and staff.
Common Mistakes to Avoid in Your Application
The path to obtaining this authorization is challenging, and several common errors can cause significant delays or even outright rejection. One of the most frequent issues is submitting an incomplete or poorly prepared business plan. The MGA expects a professional, realistic, and detailed document that demonstrates a clear understanding of the market and the operator's strategy.
Another major hurdle is underestimating the intensity of the 'fit and proper' test. Full transparency is essential. Attempting to hide or downplay past business issues or legal troubles is almost certain to be discovered and will destroy the applicant's credibility. Finally, a lack of technical preparedness is a common failing. The technical systems, including player protection tools and AML monitoring, must be fully functional and ready for audit before the final stages of the application.
Securing an MGA licence is the beginning of a long-term regulatory relationship, not the end of a process. The MGA’s Compliance and Enforcement directorate is an active and well-resourced part of the authority, with a growing focus on AML and responsible gaming audits. Operators should view compliance not as a static checklist but as a dynamic and continuous operational priority.
As regulatory standards tighten across Europe, the value of a permit from a diligent and respected authority like the MGA is likely to increase. For those prepared to meet its high standards, the Maltese licence remains a powerful asset in the global iGaming market. All operators must ensure players are over 18 and promote responsible gambling; support is available from organisations like GamCare and BeGambleAware.