Why Malta for a Crypto Licence
Malta authorises crypto-asset service providers under a single MiCA framework administered by the MFSA, an established regulator that licensed virtual asset firms from 2018 and carries seven years of supervisory experience into the MiCA regime. For the right operator it is one of the strongest positions in the EU, and it is one of the eight jurisdictions where we deliver crypto licensing ourselves.
Malta’s MiCA passport to 30 EEA states is genuine regulatory reach, but the working capital of that licence is banking access, which does not follow automatically. We file hundreds of applications; the ones that stall post-authorisation are typically those where operator-banking relationship failed because fund flow could not survive Maltese credit-institution due diligence. If your model involves high-velocity settlement, complex cross-border flows, or counterparty risk that sits outside mainstream fintech, the banking friction will define whether you actually trade or sit idle behind a certificate. We start the banking dialogue at the same time as the application because a licence without working capital is a regulatory exercise, not a business.
- Full MiCA passport from a cleared jurisdiction. Malta exited the FATF grey list on 17 June 2022, and a Malta CASP authorisation passports to 30 EEA states under Article 65 of Regulation (EU) 2023/1114.
- 5% effective tax on active trading income. The full-imputation system applies a 35% headline rate with a 6/7ths shareholder refund, producing a 5% effective rate at group level. That beats Cyprus and Ireland at 12.5% and Estonia at 22% on distribution.
- English-language supervision. English is the working language of the MFSA and the FIAU, so no certified translations are needed for any submission, which removes weeks from a typical file.
- A real track record. The MFSA had authorised 13 CASPs by May 2026, one of the largest cohorts in the EU, including significant exchanges and custodians. It kept licensing after the ESMA peer review tightened its gating, so the pipeline is open but the bar is high.
Who Malta Is Right For
Malta is a high-value position for a specific profile of operator and a poor fit for several others. We are candid about this on the first call rather than after you have spent six months on a file that was never going to clear.
- Existing VFA holders converting before the deadline. The simplified Article 143(6) route and its 50% fee discount close on 1 July 2026. If you hold a VFA licence, this is the single most time-sensitive decision on the page, and we file you under it.
- Mid-to-large exchanges, custodians and trading platforms that need a full EU passport and want the tax efficiency to compound across real volume.
- Operators who value an English-language regulator and a common-law counsel ecosystem over the lowest possible entry cost.
If your binding constraint is Year 1 budget or speed, a position in Lithuania may suit you better, and we deliver there too. We do not act for US persons. Tell us your model and we will point you at the right jurisdiction even when it is not this one.
Regulatory Framework
The MFSA is Malta’s sole competent authority for MiCA under the Markets in Crypto-Assets Act, Chapter 647 of the Laws of Malta, enacted as Act No. XXXVI of 2024. The consolidated MiCA Rulebook (FIR/03) covers authorisation, ongoing CASP requirements, ART issuers, and surrender of authorisation. We work inside this framework every week and we know what the MFSA expects to see in a file.
What a Malta MiCA CASP authorisation is
An MFSA-issued authorisation under Title V of Regulation (EU) 2023/1114 and the Markets in Crypto-Assets Act 2024 (Cap. 647), permitting the authorised entity to provide one or more of the ten crypto-asset services defined in MiCA Article 3(1)(16) across all 30 EEA states under Article 65 passporting. Authorisations are indefinite, subject to ongoing prudential, conduct, AML/CFT, and DORA obligations. Corporate income is taxed at a 35% headline rate with a 6/7ths shareholder refund producing a 5% effective rate on active trading income.
Where MiCA overlaps with other regimes
Part of what we do is keep your application on the right side of each regulatory perimeter. The common overlaps:
| Regime | Trigger | Practical consequence |
|---|---|---|
| MiCA + DORA | Any authorised CASP | Full ICT risk management framework, incident reporting on a 4/72-hour cadence, Register of Information, third-party ICT risk register, penetration testing for significant CASPs. |
| MiCA + PSD2 / Financial Institutions Act | CASPs handling EMT custody, transfers, or fiat-to-crypto exchange | EMT-related fiat handling may require Financial Institutions Act authorisation alongside the CASP licence. |
| MiCA + Gaming (MGA) | Crypto-funded gaming operations | A separate Malta Gaming Authority licence is required; the MFSA does not authorise gaming activity. |
| MiCA + Travel Rule (Regulation 2023/1113) | All CASPs from 30 December 2024 | Originator and beneficiary information transmission for crypto-asset transfers; self-hosted wallet attestation expected. |
VFA to MiCA Transition
The 1 July 2026 deadline matters more than the 3 July repeal. A VFA holder that has not filed under the simplified route by then loses both the discount and the streamlined procedure and defaults to the full Category B process at the full fee. For a Category A conversion we file the board resolution, surrender the VFA licence subject to the MiCA grant, and complete the MiCA thematic questionnaire. For a Category B application we build the full file from the Statement of Intent forward.
| Milestone | Date | Why it matters |
|---|---|---|
| MiCA entry into force | 30 December 2024 | New CASP authorisations begin; transitional regime starts. |
| DORA full application | 17 January 2025 | ICT framework, incident reporting, Register of Information obligations live. |
| Simplified Article 143(6) route closes | 1 July 2026 | 50% fee discount expires; VFA holders not yet converted lose the simplified route. |
| VFA Act repeal | 3 July 2026 | Legacy regime ends; unauthorised entities lose the right to operate. |
What the Licence Covers
The MFSA authorises CASPs to provide one or more of the ten MiCA crypto-asset services, grouped into three prudential classes by capital floor. Authorisation is service-specific, so an exchange operator that later wants to add custody adds a service class through a variation rather than a fresh application. We scope the exact service classes you need at the outset so you are not paying for capital and substance you will not use.
Covered activities (MiCA Article 3(1)(16) service types)
| Class | Service | What It Covers |
|---|---|---|
| Class 1 (€50k) | Reception and transmission of orders | Routing client orders to other CASPs or trading venues for execution. |
| Class 1 (€50k) | Advice on crypto-assets | Personal recommendations to clients about acquiring, holding, or disposing of crypto-assets. |
| Class 1 (€50k) | Portfolio management | Managing crypto-asset portfolios on a discretionary client-by-client basis. |
| Class 1 (€50k) | Transfer services for crypto-assets | Transferring crypto-assets from one address or account to another on behalf of clients. |
| Class 1 (€50k) | Placement | Placing crypto-assets on behalf of issuers (without firm commitment underwriting). |
| Class 1 / Class 2 | Execution of orders | Concluding agreements to buy or sell on behalf of clients (Class 2 floor applies where execution combined with custody or exchange). |
| Class 2 (€125k) | Custody and administration | Safekeeping or controlling crypto-assets or means of access on behalf of clients. The Class 3 floor does not apply because custody is the canonical Class 2 service. |
| Class 2 (€125k) | Exchange of crypto-assets for funds | Buying or selling crypto-assets against fiat using own capital (fiat-to-crypto). |
| Class 2 (€125k) | Exchange of crypto-assets for other crypto-assets | Buying or selling crypto-assets against other crypto-assets using own capital. |
| Class 3 (€150k) | Operation of a trading platform | Bringing together multiple third-party buying and selling interests in crypto-assets, resulting in a contract. |
The MFSA also authorises issuers of asset-referenced tokens and supervises e-money token issuers (EMTs may only be issued by an authorised electronic money institution or credit institution). If your model involves token issuance, we structure the issuer and the whitepaper alongside the CASP file.
What falls outside the CASP perimeter
Some activity does not need a CASP authorisation at all, and we will tell you if yours is one rather than sell you a licence you do not need. Purely peer-to-peer activity, unique non-fungible tokens, and fully decentralised protocols with no identifiable operator generally sit outside MiCA. The harder case is tokenised securities: MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments, so a security token falls under MiFID and the Investment Services Act. The MFSA Financial Instrument Test routes each token to the correct side, and where a tokenised fund vehicle is the better structure we deliver it through our fund licensing work.
Requirements
The make-or-break elements are a Maltese-incorporated company with local key-function presence, MiCA Article 67 capital held in cash, and a DORA-aligned ICT framework. Generic templates do not pass the MFSA authorisation gate, and substance is tested directly through post-authorisation supervision. We build each of these for you rather than hand you a checklist.
Requirements at a glance
| Requirement | Specification |
|---|---|
| Entity type | Maltese-incorporated company (private limited or public limited under the Companies Act). |
| Minimum directors | 2, with at least 1 Malta-resident executive director (MFSA “dual control” expectation per MiCA Rulebook FIR/03 R3-2.3). |
| MLRO | Approved by MFSA pre-appointment; typically Malta-resident; independent of business lines. |
| Compliance Officer | Approved by MFSA pre-appointment; typically Malta-resident; reports to the board. |
| Risk Manager | Required per FIR/03 R3-2.3, scaled to business size. |
| Internal Auditor | Proportionate to business size and complexity (may be outsourced under DORA Article 30 contract). |
| Local substance | Registered office in Malta plus a team of approximately 10 staff within 6 months of authorisation, scaled to business model; mix of employees and qualifying service arrangements. |
| Capital: Class 1 | €50,000 (or 25% of preceding-year fixed overheads, whichever is higher). |
| Capital: Class 2 | €125,000 (or 25% fixed overheads). |
| Capital: Class 3 | €150,000 (or 25% fixed overheads). |
| Capital composition | CET1 instruments per Articles 26–30 CRR (Reg 575/2013) after Article 36 deductions; founder loans and uncalled capital do not count; must be paid up in cash and held in a segregated account at authorisation. |
| Foreign ownership | No restrictions; UBO disclosure under PMLA Cap. 373. |
| Professional indemnity insurance | Article 67(4)(b) permits PII covering EU territories as a partial alternative to capital; MFSA practice is to expect capital primarily, PII in addition. |
| Programme of operations | Detailed business plan covering 3-year financial projections, target client base, marketing approach, governance, risk framework, ICT architecture, AML/CFT manual. |
People, substance and AML
The MFSA assesses every beneficial owner, qualifying holder, director, MLRO and Compliance Officer for fitness and propriety, and approval must land before any appointment takes effect. This is the longest serial dependency, so we open the fit-and-proper packs first. The supervisory expectation is roughly 10 substance staff within six months of authorisation, scaled to your business, with a real Maltese office. We help you build that team using Malta-resident appointees who clear review most cleanly.
CASPs are Subject Persons supervised by the FIAU under the Prevention of Money Laundering Act (Cap. 373), with a six-monthly Business Risk Assessment cadence and Travel Rule obligations under Regulation (EU) 2023/1113. We build the AML/CFT suite and the Travel Rule integration to the Malta standard, not adapted from another jurisdiction.
What We Do For You
This is a direct engagement, not an introduction. We form the company, file the application, deal with the MFSA, and stand behind the outcome, so you work with one accountable firm from the first call to the grant and beyond. Where an in-country specialist is the right hand for a task, it goes to a lawyer or compliance professional we have personally vetted and work with directly. We never hand you to an unverified third party.
- We form the Maltese company and build the holding structure, including the registered office and the Companies Act mechanics. See our Malta company formation work.
- We build the full MFSA application: the programme of operations, the governance manual, the fit-and-proper packs, and the business plan with three-year financials, all written to your model rather than from a template.
- We draft the compliance suite: the AML/CFT manual, Enterprise-Wide Risk Assessment, risk appetite statement, sanctions and transaction-monitoring procedures, Travel Rule implementation, and the DORA ICT framework.
- We deal with the regulator directly, manage the pre-application meeting, and answer every MFSA request for information so the statutory clock keeps moving.
- We put the team and substance in place: the Malta-resident director, the MLRO and Compliance Officer, and the office, scaled to your business.
- We arrange banking in parallel with the authorisation, not after it, so you launch with working accounts rather than a licence and nowhere to put client funds.
- We stay on after the grant for the quarterly CASP Return, the DORA Register of Information, and the ongoing supervisory cycle.
The Process and Timeline
The realistic Malta timeline is 9 to 18 months: 4 to 7 months of pre-application preparation plus a formal review of 5 to 11 months. The MFSA targets a statutory clock of 25 working days for the completeness check plus 40 for substantive assessment, but it pauses during information requests. Most of the elapsed time is the pre-application work, and that is the part we control. The whole file is in English.
Stage 1 4–8 weeks
We form the Maltese company
We set up the Maltese-incorporated company and registered office first, because every later step references the entity, and build the holding structure on top where it suits you. See the Malta company formation guide →
Stage 2 2–4 weeks
We file the Statement of Intent
We file the Statement of Intent and the supporting legal opinion confirming the activities fall within MiCA scope, and run the pre-application meeting. This is the gate that opens the formal authorisation track.
Stage 3 8–12 weeks (parallel)
We open the fit-and-proper packs
We prepare the Personal Questionnaire packs for every owner, director, MLRO and Compliance Officer, and gather the certificates behind them. We run these in parallel because an unresolved fit-and-proper concern halts the whole file.
Stage 4 12–20 weeks
We build and file the application
We assemble the programme of operations, governance manual, the AML/CFT and conduct suite, the DORA framework, the three-year financials, and the capital evidence, and file it through the MFSA LH Portal. We write the compliance documentation to your model, because the MFSA screens hard for templates lifted from elsewhere.
Stage 5 25 + 40 working days (+ RFI iteration)
We manage the MFSA review
We answer every request for information and represent you at the senior-management meeting the MFSA holds before deciding. Realistic substantive review including iteration is 4 to 8 months.
Stage 6 2–4 weeks
Grant and launch
On grant the authorisation is published and runs indefinitely. We finalise the safeguarding accounts, the onboarding flows, and the first CASP Return so you launch operating, not just authorised.
| Stage | Duration | Cumulative |
|---|---|---|
| Maltese entity formation | 4–8 weeks | 4–8 weeks |
| Statement of Intent and legal opinion | 2–4 weeks | 6–12 weeks |
| Fit-and-proper packs (parallel) | 8–12 weeks | overlap |
| Application preparation and filing | 12–20 weeks | 18–32 weeks |
| MFSA completeness check | 25 working days | 23–37 weeks |
| MFSA substantive review including RFIs | 16–32 weeks | 39–69 weeks |
| Grant and operational launch | 2–4 weeks | 41–73 weeks (9–18 months) |
Speed is set by the quality of the pre-application file, not by MFSA throughput. The 9-month end is for Category A applicants on the simplified route with complete documentation; new applicants should plan against the 14 to 18-month end. Our job is to get you as close to the fast end as your facts allow.
Costs and Capital
Two kinds of money sit behind a Malta CASP. The first is the regulatory cost of the licence itself: the MFSA application and supervisory fees, the locked capital, the substance team, the audit, and the compliance tooling. The second is our fee for delivering the work, which we quote once we understand your model, because a Class 1 advisory firm and a Class 3 trading platform are very different files. There is no fixed price on this page on purpose.
The capital requirement
MiCA Article 67 sets own funds at the higher of the class floor (€50,000 Class 1, €125,000 Class 2, €150,000 Class 3) or 25% of the preceding year’s fixed overheads. It must be CET1 instruments, cash, paid up, in a segregated account at authorisation; founder loans and uncalled capital do not count. We size it with a buffer above the floor so a late MFSA query does not stall your grant. The licence is indefinite, so once authorised you carry an annual MFSA supervisory cost plus the FIAU contribution rather than a renewal fee, and we set those out in your budget.
Taxation
Malta is a 5% effective tax jurisdiction for active CASP trading income, achieved through the full-imputation system: a 35% corporate rate at company level with a 6/7ths refund on dividend distribution, producing a 5% effective rate at group level. This is the structural advantage that makes Malta worth its higher entry bar, and we build the holding structure that delivers it.
| Tax | Rate | Crypto-Asset Application |
|---|---|---|
| Corporate Income Tax | 35% (headline) / 5% effective after 6/7ths refund on active trading income | Applies to CASP trading profits routed through a Maltese parent. |
| 15% Pillar Two elective regime | 15% flat | Available where the imputation refund is not desired (e.g., for in-scope multinational groups). |
| Capital Gains Tax | Generally no separate CGT; trading profits fall within income tax, capital disposals of coins held as a capital asset are outside CGT scope | Coins designed as a means of payment are treated as the equivalent of fiat currency under the Commissioner for Revenue DLT Assets Guidelines; capital disposals of such coins held as investment fall outside the scope of capital gains tax. |
| VAT | 18% standard | Crypto-fiat exchange exempt under Hedqvist (C-264/14 CJEU); CASP custody and platform services may be taxable subject to CFR Guidelines. |
| Withholding Tax | 0% on most outbound dividends, interest, royalties (subject to treaty / participation conditions) | Favourable for cross-border holding structures. |
| Payroll Tax (employer PRSI) | ~10% employer social security contribution | Applies to employees on Maltese payroll. |
| Stamp Duty | Transactional only; no recurring property tax | Significant exemptions for international holding structures. |
All rates as of June 2026. We model your specific tax position rather than relying on the headline rate.
Talent and global minimum tax
Malta’s Highly Skilled Individuals Rules (Legal Notice 20 of 2026) apply a flat 15% personal income tax to qualifying employment income from €65,000 for non-domiciled employees in crypto, financial services, gaming and other sectors, for up to 15 years. This makes it easier to bring senior compliance talent on board, and we use it when staffing your Malta team. Larger groups should also weigh Pillar Two: Malta has elected the Article 50 deferral of the substantive global-minimum-tax rules, but a 15% elective top-up regime is available, and groups above the €750 million consolidated-revenue threshold should assess parent-jurisdiction exposure separately. DAC8 and the OECD Crypto-Asset Reporting Framework also bring CASP user-data reporting from 2026 data, due 2027. We factor all of this into the structure rather than leaving it for later.
Ongoing Compliance & Post-Registration
MFSA authorisations are indefinite. CASPs operate under continuous prudential, conduct, AML/CFT, and DORA obligations, with the supervisory cycle anchored by quarterly CASP Returns, annual audited financial statements, the DORA Register of Information, and an extensive notification regime for material changes.
Annual Reporting Obligations
| Obligation | Frequency | Detail |
|---|---|---|
| CASP Return (template v25-01-a) | Quarterly, cumulative within financial year | Submitted via MFSA LH Portal in.xlsx, signed Representations Sheet; first return deadline was 30 April 2025. |
| Annual Audited Financial Statements | Annual | Within 6 months of financial year-end. |
| Annual Audited Capital Return (AACR) | Annual | Signed by external auditor. |
| Prudential capital adequacy reporting | Quarterly (more frequent if elevated risk) | Fixed-overhead calculation per Article 67(3) refreshed against latest accounts. |
| DORA Register of Information | Annual | Submission window 1 January to 21 March; reference date 31 December of prior year. First cycle 2026 covers FY2025 data. |
| FIAU CASPAR submissions | As required (STRs same-day; BRA six-monthly) | Subject Person module on CASPAR platform. |
| Suspicious Transaction and Order Reports (STORs) | As required | For Class 3 trading platform operators under MiCA Title VI market-abuse regime. |
DORA and ongoing supervision
DORA (Regulation (EU) 2022/2554) applies in full to Malta CASPs, with no exemption for size or activity. Its five pillars are an ICT risk management framework with board ownership, incident reporting on a 4/72-hour cadence (initial report within 4 hours of classifying an incident as major, intermediate within 72 hours), digital operational resilience testing including threat-led penetration testing every three years for significant CASPs, third-party ICT risk including the annual Register of Information, and voluntary information-sharing. On the safeguarding side, the MFSA expects a documented cold-storage majority for client assets, multi-signature controls, and HSM-backed production keys. We build the DORA framework into the application file and keep it current after the grant.
Once authorised you are in a continuous supervisory cycle, and the MFSA actively inspects and enforces. We stay engaged so the reporting calendar is met and the file stays clean rather than drifting until a supervisory visit finds a gap. Marketing must also be fair, clear, not misleading, and accompanied by MiCA risk warnings, and cross-border promotion remains subject to host-state conduct rules even under the passport.
Banking
Banking is the single largest operational friction for a Malta CASP, and we treat it as part of the engagement rather than something you sort out alone afterwards. A licence with nowhere to settle client funds is a certificate on the wall. We start the banking work in parallel with the MFSA submission, not after the grant, because account opening runs 4 to 8 months on its own.
Maltese credit institutions apply enhanced due diligence to every CASP: detailed transaction-flow analysis, source-of-funds evidence, and demonstrated AML maturity are universal entry conditions. Access is hardest for high-velocity Class 3 trading platforms and easier for Class 1 advisory businesses. We match your profile to institutions whose risk appetite fits before any formal approach, so you are not burning months on applications that were never going to clear. Banking is one of our core services, and it is the part that most often decides whether a licensed business can actually trade.
How Malta Compares
Malta sits in the established EU crypto-centre tier alongside Cyprus, with Estonia and Lithuania as the cost-led alternatives and Gibraltar on a non-EU, post-Brexit footing. Malta leads on tax efficiency and supervisory track record; Estonia and Lithuania lead on entry cost and speed. We deliver crypto licensing in Malta, Cyprus, Gibraltar, Lithuania, Switzerland, Poland, Bosnia and Liberia, so we will point you at the jurisdiction that fits your model rather than the one that suits us.
| Factor | Malta | Cyprus | Gibraltar | Estonia |
|---|---|---|---|---|
| Licence Type | MiCA CASP authorisation | MiCA CASP authorisation | DLT Provider authorisation (non-MiCA) | MiCA CASP authorisation |
| Regulator | MFSA | CySEC | GFSC | Finantsinspektsioon |
| Timeline | 9–18 months | 9–15 months | 6–12 months | 6–12 months |
| Min. Capital | €50k / €125k / €150k | €50k / €125k / €150k | £50k / £100k / £100k | €50k / €125k / €150k |
| Corporate Tax | 5% effective (35% / 6-7ths refund) | 12.5% | 12.5% | 22% on distribution |
| Local Presence | Local company, Malta-resident director, ~10 substance staff | Local company, Cyprus-resident director, local substance | Local company, Gibraltar-resident director, physical substance | Local OÜ, Estonian board member, local AML officer |
| EU Passporting | Yes (full MiCA passport, 30 EEA states) | Yes (full MiCA passport, 30 EEA states) | No (post-Brexit; non-MiCA) | Yes (full MiCA passport, 30 EEA states) |
| FATF Status | Member, off grey list since June 2022 | Member, no adverse listings | UK-affiliated, MoneyVal-monitored | Member, no adverse listings |
| Best For | Mid-to-large CASPs needing EU passporting plus 5% effective tax | Mid-size CASPs needing EU passport and lower substance cost than Malta | Established DLT businesses with non-MiCA-EU client base | Cost-led CASPs prioritising fastest EU MiCA path |
If your binding constraint is entry cost or speed, Lithuania is the faster, cheaper EU MiCA path and we deliver there too. If your target market is German or French institutional, host-state familiarity may point elsewhere. And if you carry unresolved regulatory history from another jurisdiction, be ready for hard MFSA scrutiny since the July 2025 ESMA peer review tightened its gating. We will tell you which of these applies to you on the first call.
Frequently Asked Questions
Can a non-EU company apply for a Malta MiCA CASP authorisation?
The licensed entity must be a Maltese-incorporated company with a registered office in Malta, but it can be owned by a non-EU parent. We form the operating company and build the holding structure, and put the Malta-resident director plus the MLRO and Compliance Officer in place. We do not act for US persons.
Does a Malta MiCA CASP licence cover tokenised securities or RWA?
No. MiCA Article 2(4) excludes crypto-assets that qualify as financial instruments, so a tokenised security falls under MiFID and Malta’s Investment Services Act, not MiCA. The MFSA Financial Instrument Test routes each token to the correct side. We run that analysis first, and where a tokenised fund vehicle fits we deliver it through our fund licensing work.
How long does a Malta MiCA CASP authorisation take?
9 to 18 months end-to-end: 4 to 7 months of pre-application preparation plus a formal review of 5 to 11 months. Existing VFA holders on the Article 143(6) route can land near the 9-month end; new applicants should plan for 14 to 18. We prepare the file so the MFSA has fewer reasons to stop the statutory clock.
What is the simplified Article 143(6) conversion route?
It is a simplified conversion for entities that held a VFA licence before 30 December 2024, with a 50% MFSA application-fee discount, closing on 1 July 2026. If you hold a VFA licence, this is the deadline that matters, and we move fast to file you under it.
How is the MiCA Article 67 capital requirement calculated?
It is the higher of the class floor (€50,000 Class 1, €125,000 Class 2, €150,000 Class 3) or 25% of the preceding year’s fixed overheads. It must be CET1 instruments, cash, paid up, in a segregated account at authorisation. We size it with a buffer above the floor so a late MFSA query does not delay your grant.
Will you arrange banking for the Malta CASP?
Yes. The realistic pattern is a Maltese operational account at a credit institution plus a licensed EU EMI for safeguarding, fiat on-ramps, and SEPA flows. Account opening runs 4 to 8 months, so we start it in parallel with the authorisation rather than after the grant.
Does DORA apply to Malta CASPs?
Yes, in full from 17 January 2025, with no size or activity exemption. The five pillars are the ICT risk framework, incident reporting on a 4/72-hour cadence, resilience testing, third-party ICT risk including the annual Register of Information, and information-sharing. We build the DORA framework into the application file rather than bolting it on later.
What happens if my VFA licence is not converted by 1 July 2026?
The simplified route and the 50% discount expire on 1 July 2026, and you default to the full Category B process at the full fee. The VFA Act repeals on 3 July 2026, after which unauthorised entities lose the right to operate. This is why the deadline, not the repeal, is the one we work to.
[Formation
Malta Company Formation
We form the Maltese private or public limited company your CASP application needs, including entity selection, share capital, and registered office.](/company-formation/malta/) [Crypto Licensing
Lithuania MiCA CASP Licence
The faster, lower-cost EU MiCA path. We deliver it directly if Malta’s entry bar is heavier than your model needs.](/crypto-licensing/lithuania/) [Banking
Banking for Licensed Crypto Businesses
We arrange the operating and safeguarding accounts your authorised CASP needs, planned in parallel with the licence.](/banking/)
Book a free consultation
We form the Maltese company, file the MiCA CASP application with the MFSA, deal with the regulator directly, arrange banking, and stand behind the outcome. One accountable firm, from the first call to the grant. Tell us your model and we will tell you, honestly, whether Malta is the right move and what it takes.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Malta Company Formation: the Maltese entity we form for your CASP
- Crypto Licensing (VASP / CASP / MiCA): our full crypto licensing service
- Banking: operating and safeguarding accounts for licensed crypto businesses
- Solutions for Crypto Exchanges: end-to-end support for exchange operators