Since 1 July 2026, the MiCA transitional period has closed across the European Union, and any crypto-asset service provider wishing to passport its services into or out of Malta must hold a full CASP authorisation issued by a competent national authority – in Malta's case, the Malta Financial Services Authority (MFSA). Firms that relied on grandfathering arrangements and have not yet obtained authorisation are now operating unlawfully if they continue to serve EU clients beyond the narrow wind-down permissions confirmed by ESMA on 23 June 2026. For operators considering Malta as their MiCA home jurisdiction, the strategic window is not closed, but the regulatory and operational requirements demand careful and timely preparation.
Why the Transitional Period Closure Changes Everything for Malta-Based CASPs
Malta was an early mover in crypto regulation, having introduced the Virtual Financial Assets Act well before MiCA entered into force. That regulatory heritage attracted a significant number of crypto businesses to the island and gave the MFSA experience in supervising digital asset firms. Yet the arrival of the EU-wide MiCA regime has reset the compliance baseline: legacy licences and grandfathered status no longer confer the right to provide crypto-asset services to clients across the EU.
ESMA's statement of 17 April 2026 made it explicit that no extensions to the transitional period would be granted. The follow-up public statement of 23 June 2026 went further, clarifying that unauthorised CASPs must immediately stop onboarding new clients and stop marketing their services. The only activities such firms may continue are selling or transferring assets on behalf of existing clients, or closing open positions – in short, an orderly wind-down, not business as usual. Any Malta-incorporated firm still operating outside this narrow perimeter after 1 July 2026 faces direct regulatory and civil liability.
The MFSA's Role as Competent Authority and What It Means in Practice
Under MiCA, each member state designates a single competent authority responsible for authorising and supervising CASPs. In Malta, that authority is the MFSA. The MFSA both receives CASP applications and acts as the home-state supervisor once a licence is granted – meaning it is also the authority that notifies host-state regulators when a Malta-authorised CASP wishes to passport its services across the EU under Article 60 of MiCA.
In practical terms, this creates a two-stage process for any firm seeking to use Malta as a passporting base. First, the firm must satisfy the MFSA's authorisation requirements: governance, capital adequacy, AML/CFT programme, custody arrangements, conflict-of-interest policies, and the fit-and-proper assessment of management and beneficial owners. Second, once authorised, the firm notifies the MFSA of its intention to provide services in a particular host member state, and the MFSA transmits that notification to the relevant host authority within the deadlines set by MiCA. Only after that notification process is completed – and, where required, after the host authority has acknowledged receipt – may the CASP begin cross-border activities.
The MFSA has built on its existing VFA supervisory framework, but firms should not assume that a prior VFA licence translates automatically into a MiCA CASP authorisation. The two regimes differ in scope, categorisation of services, and prudential requirements. Firms that previously held a VFA licence need to undertake a structured gap analysis and submit a full MiCA application, not a simple conversion.
Open Questions and Areas of Regulatory Interpretation
Despite the clarity of the post-1 July 2026 position, several interpretive questions remain active for Malta-based applicants and licence holders.
- Scope of "crypto-asset services": MiCA's list of regulated services is broad, but the boundary between operating a trading platform and providing related ancillary services is not always obvious. ESMA has issued guidance, but national application by the MFSA may involve additional interpretive layers, particularly where services overlap with MiFID II instruments.
- Beneficial ownership thresholds: The fit-and-proper and AML/CFT assessments require disclosure of the full beneficial owner chain, including any natural person holding, directly or indirectly, a qualifying interest. Where complex holding structures are involved – as is common with international fund-backed crypto ventures – the MFSA's expectations around Malta Business Registry filings and supporting documentation should be confirmed at the pre-application stage rather than discovered mid-process.
- NFT and DeFi perimeter: MiCA expressly excludes certain non-fungible tokens and decentralised protocols from its scope, but the exclusions are narrow and fact-specific. The MFSA has not yet published comprehensive national guidance on how it will assess borderline products, and applicants operating in these spaces should treat the classification question as legally live.
- Third-country client treatment: MiCA passporting governs cross-border services within the EEA. Firms also serving clients in non-EU jurisdictions must separately assess whether those activities require authorisation under the laws of each target country. A Malta CASP licence does not, by itself, grant permission to solicit clients in, for example, the United Kingdom or the United States.
If your business model touches any of these interpretive zones, a pre-application consultation with the MFSA – ideally supported by written legal advice – can help surface issues before they become grounds for refusal or delay. Ferraz & Whitmore regularly assists clients in structuring those engagements. You are welcome to reach out at info@ferrazwhitmore.com or via our contacts page.
The Passporting Mechanism: How Cross-Border Access Works Under MiCA
Once a CASP is authorised by the MFSA, it acquires the right to provide the specific services listed in its licence across all EEA member states, either on a freedom-of-services basis or by establishing a branch. The passporting notification system is intended to be procedurally straightforward, but in practice it involves several steps that require attention.
The CASP must submit a notification to the MFSA specifying the host member state, the services to be provided, and – where a branch is proposed – information about the branch's governance, address, and management. The MFSA then transmits the notification to the competent authority of the host state within the timeframe set by MiCA. The host authority cannot in principle block the passport on prudential grounds (home-state control governs), but it retains supervisory powers over conduct-of-business rules and AML/CFT compliance in its jurisdiction. This division of supervisory competence can create practical complexity, particularly where local conduct rules in a host state impose requirements that are stricter than or different from Malta's.
By 12 August 2026, the ESMA register recorded 325 authorised CASPs across the EU. This figure reflects the cumulative effect of national authorisation processes since MiCA became applicable, with a significant acceleration in the first half of 2026 as the transitional deadline approached. Malta's share of those authorisations reflects the island's established position as a crypto-friendly jurisdiction, but competition for the passporting base is real: other member states, including Ireland, Luxembourg, and the Netherlands, are also active in attracting CASP applicants.
AML/CFT Compliance as a Structural Requirement, Not an Add-On
For Malta-authorised CASPs, AML/CFT compliance is not a separate workstream to be addressed after the licence is granted – it is embedded in the authorisation assessment and in the ongoing supervisory relationship with the MFSA. Malta has historically faced scrutiny over its AML/CFT framework at the national level, and the MFSA has responded by tightening its supervisory expectations, particularly around crypto-asset businesses.
Practically, this means that a CASP application to the MFSA will be reviewed with close attention to the firm's customer due diligence procedures, transaction monitoring systems, suspicious activity reporting lines, and the adequacy of its compliance function relative to the scale and risk profile of its business. Applicants that cannot demonstrate a credible, operational AML/CFT programme – not merely a policy document – are likely to face requests for further information or outright refusal.
For firms already authorised and passporting into multiple EU jurisdictions, the AML/CFT dimension multiplies: each host-state regulator may apply its own interpretation of the EU AML framework to the local branch or service activity, and the MFSA retains home-state oversight of the firm's group-wide programme. Maintaining a coherent, documented AML/CFT framework that satisfies both home and host expectations simultaneously is one of the most operationally demanding aspects of a passporting strategy.
Our AML/CFT compliance team advises on programme design, internal audit, and regulatory liaison for Malta-authorised firms. Further information is available on our AML compliance – Malta page.
Strategic Recommendations for Firms Evaluating Malta as a MiCA Base
Based on the current state of the regulatory environment, the following considerations are relevant to any firm weighing Malta against alternative EU home-state options for MiCA authorisation.
- Early engagement with the MFSA: The MFSA operates a pre-application process. Using it effectively – submitting a well-prepared outline of the proposed business model and ownership structure before lodging a formal application – reduces the risk of procedural delays and allows the firm to calibrate its application to the MFSA's current supervisory expectations.
- Corporate structure and beneficial ownership transparency: Malta's company law framework is EU-compatible and provides flexibility in structuring holding entities. However, any structure involving tiered holdings, special purpose vehicles, or foreign intermediate entities must be mapped clearly against the beneficial owner disclosure requirements under both MiCA and Malta's AML legislation. Incomplete or inconsistent Malta Business Registry filings are a common source of application delay.
- Staffing and local substance: The MFSA expects meaningful local governance. Firms that propose to locate their authorised entity in Malta but manage it entirely from abroad will face questions about the adequacy of local management oversight. At minimum, the senior management function responsible for compliance and risk should have demonstrable proximity to the Maltese operations.
- Passporting plan: Before submitting a CASP application, firms should map the target markets they intend to serve and assess whether the services covered by their proposed licence are consistent with the regulatory status of those activities in each host state. Services that are within MiCA's scope in Malta may interact with additional national licensing requirements in certain member states, particularly where DeFi or tokenised securities are involved.
- Wind-down preparedness: Firms that are currently in the wind-down phase following the 1 July 2026 deadline should document their compliance with the ESMA 23 June 2026 parameters carefully, including cessation of onboarding and marketing, and should take legal advice before taking any action that could be characterised as providing services beyond the permitted scope.
Cross-Border Implications and the Position of Non-EU Parent Groups
A recurring strategic question for international groups is whether to acquire or establish a Malta CASP subsidiary as the EU passport vehicle, while keeping the wider group structure domiciled outside the EU. MiCA does not prohibit non-EU ownership of authorised CASPs, but it does impose fit-and-proper requirements at the level of the authorised entity and requires that the entity itself be capable of meeting its obligations independently of the parent group's regulatory status.
For groups with a US, UK, or Asian parent entity, this means that the Malta CASP must be genuinely capable of independent operation, must maintain its own capital and liquidity, and must not be structured in a way that effectively transfers decision-making authority outside the EU in a manner that undermines the MFSA's supervisory access. Intra-group outsourcing arrangements, shared technology infrastructure, and group treasury functions all require careful legal structuring to avoid creating unauthorised dependency.
Where a group already holds a licence in another EEA jurisdiction, the decision whether to passport from that existing base or to seek a separate Malta authorisation will depend on a combination of factors: the supervisory relationship already established with the home-state authority, the scope of services authorised, the group's longer-term European market strategy, and the relative speed and predictability of each national authorisation process. These decisions benefit from comparative legal advice rather than a single-jurisdiction perspective.
Outlook: Regulatory Trajectory and What to Watch
The closure of the MiCA transitional period on 1 July 2026 represents a definitive shift in the EU crypto regulatory landscape, but the framework is not static. ESMA continues to develop Level 3 guidance across a range of MiCA topics, including the treatment of stablecoins, reverse solicitation, and the perimeter of decentralised finance. Firms operating under a Malta CASP licence should monitor ESMA publications actively and assess how emerging guidance affects their product and service offering.
At the national level, the MFSA is expected to continue refining its supervisory expectations as it accumulates experience with the MiCA authorisation and supervision cycle. Changes in supervisory focus – for example, increased attention to cybersecurity governance or custody arrangements – will be signalled through thematic reviews and sector communications, and firms should maintain an active compliance monitoring function that captures MFSA outputs as well as ESMA guidance.
The ESMA register's growth from approximately 210 full CASP authorisations in May 2026 to 325 by 12 August 2026 illustrates the pace at which the authorised market is consolidating. Firms that have not yet obtained a CASP licence are now operating in a market where authorised competitors have a structural advantage – access to the full EU client base through passporting – that will become progressively more difficult to overcome as host-state regulators enforce the prohibition on unauthorised service provision.
For a current summary of Malta's MiCA transition status and the MFSA's post-deadline enforcement posture, see our MiCA transition alert for Malta.
How Ferraz & Whitmore Can Assist
Ferraz & Whitmore advises crypto-asset businesses, investment funds, and technology groups on the full lifecycle of MiCA authorisation – from initial jurisdictional analysis and corporate structuring through CASP application management, passporting notifications, and ongoing regulatory compliance. Our team in Malta works directly with the MFSA process and maintains close awareness of current supervisory practice.
If you are assessing whether Malta is the appropriate home jurisdiction for your MiCA CASP licence, or if you are already authorised and planning to expand your EU footprint through passporting, we would welcome the opportunity to discuss your situation. Further detail on our MiCA licensing services is available at MiCA Licensing – Malta.
To arrange an initial consultation, please contact us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.