To obtain a MiCA CASP licence in Malta, a crypto-asset service provider must submit a formal application to the Malta Financial Services Authority (MFSA), the competent authority designated under Regulation (EU) 2023/1114. The process involves preparing a structured application file covering governance, capital, AML/CFT controls, and operational safeguards, followed by a review period during which the MFSA may request supplementary information. Since the EU-wide transitional period ended on 1 July 2026, authorisation is no longer optional: providing crypto-asset services to EU clients without a valid CASP licence is now unlawful.
Why Malta and Why Now
Malta has been an active participant in the digital assets space since the early wave of Virtual Financial Assets legislation, and that regulatory heritage shapes how the MFSA approaches MiCA applications today. The authority has developed internal procedures for assessing crypto-asset businesses, which gives applicants a degree of institutional familiarity – though it also means the MFSA applies a well-informed and exacting standard of review.
The urgency of the current moment cannot be overstated. The ESMA statement of 17 April 2026 confirmed that no extension to the grandfathering period would be granted. A subsequent public statement of 23 June 2026 directed unauthorised CASPs to stop onboarding new clients and conducting marketing activities, limiting their operations to selling or transferring client assets or closing open positions, and to wind down in an orderly fashion. As of 12 August 2026, the ESMA public register recorded 325 authorised CASPs across the EU. Businesses that have not yet secured authorisation are operating under acute regulatory and commercial pressure.
If you are assessing whether a Malta CASP licence is the right structure for your business, our team can help you evaluate the options. Contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
Legal Basis
The primary legal basis is Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), which is directly applicable across all EU Member States, including Malta. Title V of MiCA sets out the authorisation requirements for crypto-asset service providers. Malta has transposed the relevant national implementation provisions, designating the MFSA as the competent authority responsible for receiving applications, conducting supervisory assessments, and granting or refusing authorisation.
Where MiCA grants Member States discretion – for example, in certain procedural timelines or specific national provisions concerning fit-and-proper assessments – the MFSA's rules and guidance apply. Applicants should monitor MFSA circulars and policy statements, as national implementing rules continue to be refined in light of ESMA guidance and early supervisory experience.
Step-by-Step Procedure in Malta
Step 1 – Pre-Application Engagement
Before submitting a formal application, prospective CASPs are strongly advised to engage with the MFSA through its pre-application process. This allows the authority to provide early feedback on the proposed business model, the scope of crypto-asset services intended, and any structural issues that may require resolution before a formal file is lodged. Early engagement reduces the risk of material deficiencies surfacing mid-review.
Step 2 – Corporate Setup and Registration
The applicant entity must be legally established in Malta. This requires incorporation through the Malta Business Registry, with the company's registered office and, in practice, meaningful operational substance located on the island. MiCA requires that the entity genuinely carries out its activities from Malta, not merely maintains a registered address. Directors, senior managers, and the compliance function must have demonstrable ties to the jurisdiction.
Step 3 – Preparing the Application File
The application file is the centrepiece of the process. MiCA specifies the information that must be provided, and the MFSA may supplement these requirements through national rules or standard application templates. Core components include:
- Programme of operations: a detailed description of the crypto-asset services to be provided, the types of crypto-assets involved, and the target client base.
- Business plan: financial projections, revenue model, and a demonstration of financial viability.
- Governance arrangements: organisational structure, management body composition, segregation of duties, and internal control functions.
- Fit-and-proper documentation: information on all members of the management body and qualifying shareholders, including the beneficial owner disclosure required under MiCA and Malta's AML/CFT framework.
- AML/CFT policies and procedures: a comprehensive compliance manual demonstrating adherence to Directive (EU) 2015/849 as transposed in Malta, and to relevant FATF standards. The quality of AML/CFT documentation is one of the most common grounds for additional information requests.
- Prudential requirements: evidence of own funds meeting the applicable MiCA threshold for the category of services applied for, or a professional indemnity insurance policy where permitted as an alternative.
- Safeguarding arrangements: policies for segregating client assets and funds, and for ensuring continuity in the event of insolvency.
- ICT and security: documentation of information and communication technology systems, cybersecurity policies, and business continuity planning.
- Complaints handling and conflicts of interest policies.
For a more detailed overview of the AML/CFT documentation standards expected in Malta, see our dedicated guidance on AML compliance in Malta.
Step 4 – Formal Submission
The completed file is submitted to the MFSA through its designated application portal. The MFSA will acknowledge receipt and confirm whether the application is complete. An incomplete submission resets the review clock, so accuracy and completeness at the point of submission are essential. All documents must be in English or accompanied by a certified translation.
Step 5 – MFSA Review Period
Under MiCA, the competent authority has 25 working days from receipt of a complete application to assess completeness, and thereafter a review period within which it must reach a decision. During the review, the MFSA may issue requests for additional information; each such request suspends the statutory clock. In practice, complex applications – particularly those involving multiple service categories or novel business models – have taken longer than the minimum statutory period. Applicants should plan for a realistic timeline of several months from submission of a complete file to a decision, depending on the volume of applications at the authority and the complexity of the proposed business.
Step 6 – Decision and Registration
If the MFSA grants authorisation, it notifies ESMA, which adds the entity to the public CASP register. The authorisation specifies the exact services the CASP is permitted to provide. If the application is refused, the MFSA must provide reasons, and the applicant has recourse under Maltese administrative law, including ultimately to the Civil Court (First Hall) in Malta.
Documents: A Practical Checklist
- Certificate of incorporation and memorandum and articles of association from the Malta Business Registry
- Corporate structure chart identifying all direct and indirect shareholders and the beneficial owner
- CVs, criminal record certificates, and regulatory references for all members of the management body
- Source-of-funds and source-of-wealth documentation for qualifying shareholders
- Detailed programme of operations and business plan with three-year financial projections
- Governance manual and board committee terms of reference
- AML/CFT compliance manual, risk appetite statement, and customer due diligence procedures
- Own funds calculation or professional indemnity insurance certificate
- Safeguarding policy and custody arrangements
- ICT security policy and business continuity plan
- Outsourcing register and intra-group service level agreements, if applicable
- Complaints handling and conflicts of interest policies
Cost Drivers
The direct costs of a Malta CASP authorisation fall into several categories. The MFSA charges application and supervisory fees, the amounts of which are set out in the authority's current fee schedule and vary according to the scope of services applied for. Beyond regulatory fees, the principal cost drivers are legal and compliance advisory fees for preparing the application file, the cost of establishing and staffing the Malta entity with genuine operational substance, and the own funds or insurance requirements imposed by MiCA for the relevant service categories. Applicants operating across multiple jurisdictions should also factor in the cost implications of passporting, which MiCA enables after authorisation.
For a comprehensive view of passporting strategy following Malta authorisation, see our analysis of MiCA passporting strategy from Malta.
Common Errors Made by Foreign Applicants
Based on patterns observed across EU CASP applications, foreign businesses applying for a Malta licence frequently encounter the following difficulties:
- Substance deficiencies: establishing a letterbox entity rather than a genuine operational presence, which the MFSA will identify through its fit-and-proper and governance review.
- Incomplete beneficial owner disclosure: failing to trace the ownership chain to the natural person level, particularly in complex group structures with multiple layers of holding companies.
- Weak AML/CFT documentation: submitting generic compliance templates rather than policies tailored to the specific crypto-asset services and client base of the business. The MFSA's AML/CFT review is substantive, not merely formal.
- Mischaracterisation of services: applying for a narrower set of service categories than the business model actually requires, which risks authorisation being granted for services that do not cover all activities being conducted.
- Underestimating own funds requirements: not calculating the applicable MiCA capital floor correctly or failing to provide adequate evidence of the funds being available and unencumbered.
- Delayed senior management appointments: attempting to submit an application before the management body is fully constituted, resulting in an incomplete file.
- Ignoring ICT requirements: treating the technology and cybersecurity documentation as a secondary concern rather than a substantive part of the review.
Decision Checklist Before You Apply
- Is the Malta entity incorporated at the Malta Business Registry, with a real registered office?
- Does the management body include individuals who can demonstrate genuine connection to, and operational oversight from, Malta?
- Has the full beneficial owner chain been identified and documented?
- Is the programme of operations consistent with the business model as actually operated?
- Does the AML/CFT manual reflect Malta's national implementation of EU anti-money laundering directives?
- Are own funds or insurance arrangements in place and evidenced?
- Have outsourcing arrangements, if any, been documented and assessed for compliance with MiCA's outsourcing rules?
- Has a post-authorisation passporting plan been considered?
- Has the application been reviewed by a qualified lawyer in Malta before submission?
Our MiCA licensing team works with applicants at each stage of this process. For guidance on structuring your application for Malta, visit our MiCA licensing service page or reach out directly at info@ferrazwhitmore.com.
What Happens If You Are Not Yet Authorised
Businesses that have not obtained CASP authorisation by 1 July 2026 are no longer permitted to provide crypto-asset services to EU clients under any transitional arrangement. The ESMA statement of 23 June 2026 is explicit: unauthorised CASPs must cease onboarding new clients and marketing activities immediately, and may only assist existing clients in selling or transferring assets, closing positions, or winding down in an orderly manner. Continued provision of services beyond these limits exposes the business and its directors to enforcement action by the MFSA, potential civil liability to clients, and reputational harm. Businesses in this position should seek legal advice without delay on how to manage wind-down obligations whilst pursuing authorisation through the appropriate route.
If your business is navigating the post-deadline position and needs to understand its options, please contact us at info@ferrazwhitmore.com or visit our contacts page to speak with a member of our team.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.