Malta (MGA) gambling licence: cost, requirements, timeline (2026)
| Application fee | €5,000 non-refundable (as of 2026) |
|---|---|
| Annual fee | €25,000 fixed licence fee + compliance contribution 1.25–4% of GGR (capped by type; as of 2026) |
| GGR/turnover tax | 5% gaming tax on GGR from players located in Malta (as of 2026) |
| Review timeline | 12–16 weeks stated; 4–6 months realistic end-to-end |
| Validity | 10 years, renewable (confirm with the MGA) |
| Market access | Open markets that accept MGA; no access to locally regulated markets |
A Malta gambling licence is a B2C or B2B authorization issued by the Malta Gaming Authority (MGA) under the Gaming Act (Cap. 583) that allows a Malta-established company to offer or supply online gambling services from Malta. For two decades it has been the default European base licence: not a passport into regulated markets, but the credibility layer that opens banks, PSPs, and game-studio contracts for everything a locally licensed regime does not cover.
What the licence is
The MGA issues one consolidated B2C licence (and a separate B2B critical gaming supply licence for platforms and studios) with per-vertical type approvals: Type 1 for RNG casino, Type 2 for fixed-odds betting, Type 3 for P2P/poker, Type 4 for controlled skill games. A licence runs for ten years, which is unusually long — most regimes work in five-year cycles.
The cost structure has three layers: a €5,000 application fee, a €25,000 fixed annual licence fee, and a compliance contribution of 1.25–4% of GGR depending on type, with per-type minimums and caps (as of 2026 — confirm current figures with the MGA). Gaming tax proper is 5% of GGR — but only on revenue from players physically located in Malta, which for most international operators is a rounding error. That is the core of Malta's economics: you pay fixed fees and a modest revenue contribution, not a headline GGR tax, and Malta's refundable corporate tax system can bring the effective corporate rate to approximately 5% for trading companies — structure this with Maltese tax counsel, not a blog post.
Applicant requirements
Corporate structure. A Malta-registered company (or EEA entity with a Maltese establishment) holds the licence. Group structures are examined in full; the MGA runs a fit-and-proper assessment on every entity and person in the ownership chain above 10% (confirm the current disclosure threshold).
UBO checks. Ultimate beneficial owners provide certified identity documents, police conduct certificates, bank references, and a documented source-of-wealth trail. The MGA cross-checks against sanctions and adverse media; nominee opacity is disqualifying.
Minimum capital. €100,000 paid-up share capital for Type 1 and Type 2; €40,000 for Types 3 and 4, with combined requirements capped at €240,000 for multi-type licensees (as of 2026 — confirm with the MGA).
Local presence and key functions. The MGA requires designated key persons approved by the Authority: CEO, compliance officer, MLRO, plus key functions for technology, internal audit and risk — several of which can, subject to approval, be outsourced to Malta-based firms. Core gaming equipment (or a real-time replica) must be located in Malta or another approved jurisdiction.
Step-by-step application process
- Pre-application. Incorporate the Maltese entity, open the ownership file, draft the business plan and three-year financial projections.
- Fit-and-proper stage. Submit personal declarations for all UBOs, directors and key persons; respond to MGA due-diligence queries. This is the longest and least predictable stage.
- Business and technical review. Policies (AML/CFT, RG, data protection), game and platform architecture, hosting plan, and terms and conditions are reviewed against the Gaming Authorisations and Compliance Directive.
- System review. The MGA issues a letter of intent; you deploy in a live-ready environment and undergo a system audit by an MGA-approved service provider within 60 days (confirm the current window).
- Licence grant and go-live. After a successful audit, the ten-year licence issues, and your licence number and seal must appear on the site, linked to the MGA verification register.
- Post-licensing. A compliance audit follows within the first year of operation, then periodic audits, monthly player-funds reports, and annual audited accounts.
What the MGA licence does NOT cover
- Locally regulated markets. The MGA licence grants zero rights in the UK, Sweden, Denmark, the Netherlands, Germany, Spain, Italy, Romania, Ontario or any US state. The old "EU freedom of services" argument has lost in practice: EU members with national regimes enforce them against MGA licensees, including payment blocking and blacklisting.
- Guaranteed payment acceptance. MGA opens more doors than Curacao, but PSPs still apply their own market-by-market risk rules; an MGA licence does not force anyone to process your Dutch or French traffic.
- A tax shelter without substance. Malta's effective 5% corporate rate depends on real establishment and the refund mechanism; EU anti-avoidance rules and home-country CFC regimes can claw back the benefit for shell setups.
- Sub-licensing. There is no white-label right embedded in the licence. Serving other operators as a platform requires the separate B2B critical gaming supply licence.
MGA vs alternative jurisdictions
Comparative figures are indicative as of 2026 — confirm with each regulator.
| MGA | Isle of Man | Curacao | |
|---|---|---|---|
| First-year direct cost | ~€30,000 + contribution | ~£42,000 | ~€28,000 |
| Tax on international GGR | Compliance contribution 1.25–4% | 0.1–1.5% GGY | 0% gaming tax |
| Counterparty acceptance | Strongest offshore tier | Strong | Improving under LOK, still weakest of the three |
| Timeline | 4–6 months | 10–12 weeks | 8–12 weeks |
Choose MGA when banking, EU perception and studio access drive revenue; Isle of Man when tax efficiency with real substance matters more than EU optics; Curacao when speed and cost dominate and your markets tolerate it.
Ongoing obligations and realistic budget
Holding an MGA licence is an operating rhythm, not a certificate on a wall. Monthly: player-funds reports demonstrating segregation, gaming-tax and compliance-contribution calculations. Annually: audited financial statements, the licence fee, and key-function attestations. Periodically: compliance audits by MGA-appointed reviewers (the first within the initial period of operation), AML inspections coordinated with Malta's FIAU, and incident notifications for outages, breaches and reportable player-protection events. The MGA publishes enforcement actions on its register; AML and player-funds failures are recurring grounds for fines and licence suspensions.
Budget-wise, the recurring stack for a mid-size operator — key-function salaries or outsourcing (compliance officer and MLRO are the expensive seats), audit and legal fees, FIAU supervisory contributions, hosting in approved locations, and re-certification on platform changes — runs well beyond the headline fees. The compliance contribution on GGR sits on top, scaling with revenue.
The strategic payoff for that spend is optionality. An MGA licensee with a clean audit history walks into Tier-1 applications — UKGC, Ontario, Nordic regimes — with evidence instead of assertions: audited player-funds handling, tested AML casework, a regulator reference.
How Vuch helps
The licence application, Maltese entity, key persons and MGA relationship are yours — typically run with a Malta corporate services firm. Vuch removes technical workload that sits on top:
- Platform and certification roadmap. The MGA's system review examines the platform in a live-ready environment. Certification and licensing strategy for a target jurisdiction is scoped as part of deployment; a certification roadmap and due-diligence pack are available on request.
- Regulator-reporting tooling. Player-funds data, monthly regulatory figures and a full audit trail are generated as reports and exports from the admin back office; mapping to the MGA's prescribed formats is part of deployment scope.
- Risk and RG tooling. A built-in real-time risk engine — transaction velocity control, AML signals, anti-manipulation and wash-trading detection, with thresholds configurable per jurisdiction — plus responsible-gambling and self-exclusion integration capability, implemented per deployment, via Vuch Shield.
- Payments. USDT deposits and withdrawals are live today; a fiat payment layer is on the roadmap. For fiat-led target markets, treat payments as an early item in the deployment conversation.
What stays with the operator: the licence itself, key-function accountability, AML ownership and marketing compliance. White-label deployment on the turnkey model typically takes 4–8 weeks depending on integrations and jurisdiction.