Since 1 July 2026, any business providing crypto-asset services to clients in the European Union must hold a MiCA CASP authorisation – the transitional period has closed, with no extensions granted by ESMA. In Malta, the competent authority for CASP licences is the Malta Financial Services Authority (MFSA), and authorised firms benefit from EU-wide passporting rights. Ferraz & Whitmore advises international businesses on the full authorisation process, from structural preparation through to ongoing regulatory compliance.
Why the Deadline Matters – and What Is at Stake Now
The closure of the MiCA transitional period on 1 July 2026 marks a decisive shift: operating without a valid CASP authorisation in any EU member state is no longer a matter of managing a grace period. It is a regulatory breach. Firms that have not yet secured their licence face suspension of EU operations, potential enforcement action by the MFSA or the competent authority of the member state where they operate, and reputational damage that is difficult to reverse.
For businesses that were relying on transitional provisions – or that delayed their applications expecting regulatory flexibility – the risk is immediate and concrete. The question is no longer whether to apply, but how to do so as efficiently as possible without compromising the quality of the submission.
If your firm is evaluating its position under the current framework, our team can help you assess exposure and identify the fastest credible path to authorisation. Reach out at info@ferrazwhitmore.com or visit our contacts page.
Malta as a CASP Jurisdiction: Strategic Considerations
Malta has positioned itself as a regulated hub for digital asset businesses since well before MiCA entered force. The MFSA has developed institutional familiarity with crypto-asset business models, which matters in practice: the authority's technical capacity to review complex applications – including those involving DeFi-adjacent structures, staking services, or multi-asset custody models – is relevant to application timelines and the quality of regulatory dialogue.
A Malta CASP authorisation issued by the MFSA carries full EU passporting rights under MiCA. This means a firm authorised in Malta may provide crypto-asset services across all 27 EU member states by notifying the MFSA rather than seeking separate licences in each jurisdiction. For international groups with a broad European client base, this structural advantage is significant.
Malta also offers a well-developed corporate and professional infrastructure, including experienced local counsel, auditors familiar with crypto-asset businesses, and established relationships between the Malta Business Registry and the MFSA for the corporate formalities that accompany authorisation.
Our broader capital markets practice in Malta provides context on how CASP licensing intersects with other regulatory frameworks: learn more about our Malta capital markets work.
Scope of CASP Authorisation Under MiCA
MiCA defines a specific list of crypto-asset services, and authorisation covers only those services explicitly applied for. Firms must identify each service category with precision: a mismatch between the authorisation scope and actual operations is one of the most common – and most avoidable – compliance failures at an early stage.
The principal services covered include:
- Custody and administration of crypto-assets on behalf of clients
- Operation of a trading platform for crypto-assets
- Exchange of crypto-assets for funds or other crypto-assets
- Execution of orders on behalf of clients
- Placing of crypto-assets
- Reception and transmission of orders on behalf of clients
- Providing advice on crypto-assets
- Portfolio management of crypto-assets
- Transfer services for crypto-assets on behalf of clients
Where a firm's business model spans several of these categories, the application must address each one individually in terms of governance, capital adequacy, and operational controls. A well-scoped application avoids both under-authorisation (leaving services uncovered) and over-authorisation (creating compliance obligations that the firm cannot yet meet).
The White Paper Requirement
Depending on the type of crypto-assets involved and the nature of services offered, MiCA may require the publication of a white paper. The white paper is not a marketing document: it is a regulated disclosure instrument with prescribed content requirements, and in some cases it must be notified to or approved by the MFSA before publication.
Common drafting errors include insufficient disclosure of the rights attached to a token, inadequate description of the underlying technology, and failure to align the white paper with the actual terms of service. The MFSA can request amendments, which delays the timeline. Getting the document right at the outset is therefore both a compliance matter and a commercial one.
How We Support the Authorisation Process
Our role begins before any documents are filed. We conduct a structured pre-application assessment of the client's business model, ownership structure, and existing regulatory history across jurisdictions. Where the business model requires refinement to fit the MiCA framework cleanly – without unnecessarily constraining commercial operations – we address this at the design stage.
We then prepare and coordinate the full authorisation package for submission to the MFSA. This includes the application form and supporting documentation, the white paper where required, the governance and compliance framework, AML/CFT policies, and the business plan in the format the MFSA expects.
For the detailed procedural walkthrough of the CASP licensing process in Malta – application stages, document checklists, MFSA review phases and indicative timelines – we have prepared a dedicated step-by-step resource: read the full MiCA CASP Licence Guide for Malta.
Post-authorisation, we support clients in establishing ongoing compliance programmes, including transaction monitoring, periodic reporting to the MFSA, and management of any passporting notifications to other EU jurisdictions. Our AML and compliance team works alongside the licensing team throughout: see our AML and compliance services in Malta.
Typical Pitfalls and How to Avoid Them
Based on our experience with cross-border digital asset clients, the following issues cause the most significant delays or adverse outcomes during MiCA CASP applications in Malta:
- Incomplete UBO documentation: The MFSA applies rigorous scrutiny to beneficial ownership chains, particularly where intermediate holding structures cross multiple jurisdictions. Documentation gaps at this stage can suspend the entire review.
- Misclassification of crypto-assets: Whether a token falls under the asset-referenced token, e-money token, or general crypto-asset category determines the applicable legal regime. Misclassification in the application results in material rework.
- Insufficient localisation: Applicants must demonstrate a genuine, substantive presence in Malta. The MFSA assesses whether key personnel, decision-making functions, and operational infrastructure are actually located in the jurisdiction – not merely registered there.
- Underestimating the AML/CFT build-out: MiCA CASP authorisation requires a demonstrably functional AML/CFT framework at the time of application, not a plan to build one after authorisation is granted.
- White paper inconsistencies: Any material inconsistency between the white paper and the service terms, governance documents, or technology description will prompt MFSA questions and delay approval.
- Scope drift during the application period: Changes to the business model or planned services after submission require notification to the MFSA and may necessitate a revised application.
Cross-Border Dimension and Passporting Strategy
For groups operating across multiple EU markets, the Malta CASP authorisation is frequently the starting point of a wider passporting strategy rather than a standalone regulatory event. Once authorised, the firm must manage passporting notifications to the MFSA for each additional EU member state where it intends to provide services, and must remain alert to any national implementation rules that those member states may impose within the limits permitted by MiCA.
International groups that also hold licences in third-country jurisdictions – for example, in the UAE, UK, or Singapore – need to consider how their Malta authorisation interacts with those frameworks: whether client agreements need to be restructured, how data flows and custody arrangements are governed across entities, and how the group's compliance function is organised at group level without creating regulatory arbitrage risks.
For groups with operations in Portugal or other jurisdictions where Ferraz & Whitmore maintains active practices, we can provide coordinated cross-border advice rather than requiring separate instructions to separate firms.
Self-Assessment: Are You Ready to Apply?
Before beginning a formal application to the MFSA, it is worth reviewing the following questions honestly:
- Is your Maltese entity incorporated and in good standing with the Malta Business Registry, with a demonstrable local presence?
- Have you identified all of the MiCA service categories that your business model requires, and mapped them to the specific authorisation scopes you will apply for?
- Do your key personnel – including your compliance officer and AML officer – meet the fitness and propriety standards the MFSA will assess?
- Is your AML/CFT framework documented, functional, and capable of being demonstrated to the MFSA at the time of application?
- Have you determined whether a white paper is required for your products or services, and if so, have you prepared it in line with MiCA's content requirements?
- Does your capital base meet the applicable prudential requirements for the services you intend to provide?
- Have you planned your passporting strategy for any EU markets you intend to serve beyond Malta?
If any of these points requires clarification or development, we recommend addressing them before submitting to the MFSA. Premature applications that require substantial rework during the review phase typically take longer overall than well-prepared applications submitted after a structured readiness assessment.
To discuss your firm's position and what a realistic path to CASP authorisation looks like, contact our team at info@ferrazwhitmore.com or through our contacts page. We work with clients from initial assessment through to post-authorisation compliance, and we can advise on the cross-border implications of a Malta authorisation for groups operating across multiple jurisdictions.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.