A crypto license in Malta: VFA, MiCA, and the transition to CASP

Malta is called the «blockchain island» not for flourish. In 2018 it became the first country in the world to adopt a full-fledged crypto-asset law - the VFA regime (Virtual Financial Assets Act) under MFSA's supervision. By 2026 the rules had changed: the pan-European MiCA regulation took effect, and the Maltese crypto license is turning into the CASP format with the right to work across the whole EU. Let's break down, fact by fact, how the transition is structured, what the regulator's requirements for capital, substance, and compliance are, and why Malta remains a serious jurisdiction for crypto.

What a crypto license in Malta is, and why people seek it

A crypto license in Malta is the regulator's authorization to conduct regulated crypto-asset activity: holding clients' wallets, exchanging coins, operating a trading platform, advising, or transmitting orders. Without such authorization you can't legally serve EU clients.

Interest in Malta is explained by three reasons. First, it's a full EU and eurozone member with official English - convenient both for documents and the team. Second, MFSA has eight years of real experience vetting crypto companies: the regulator knows how to audit wallets and check founders. Third, a Maltese license opens access to the entire European market.

It's important to set expectations right away: the «blockchain island» isn't about speed and leniency, but about the reputation of a serious jurisdiction. The path to a license here is a regulatory marathon, not a sprint.

«Blockchain island»: where the VFA regime came from

In 2017-2018, Malta bet on blockchain ahead of everyone else. In November 2018, a package of three laws took effect, which created the country's reputation as the «blockchain island».

• VFA Act(Virtual Financial Assets Act) - the main law on virtual financial assets: regulates token issuance (ICOs) and crypto-asset services.
• ITAS(Innovative Technology Arrangement and Services Act) - the law on certifying technology solutions and DLT platforms.
• MDIA(Malta Digital Innovation Authority Act) - the law establishing a separate digital agency.

The VFA regime introduced its own classification: «virtual tokens» (utility, unregulated), financial instruments (security tokens, under general EU rules), and VFA proper - crypto assets falling under Maltese law. This experience became the foundation on which the country now builds its work under MiCA.

A VFA license in Malta vs. MiCA: what's the difference

Malta's VFA license was a national regime that applied only within the country. MiCA (Markets in Crypto-Assets) is a pan-European regulation that took effect for all EU countries on December 30, 2024, and replaces fragmented national rules with a single standard.

The key difference is market coverage. The previous Maltese license gave the right to operate in Malta. A CASP license under MiCA gives the right to serve clients in all 27 EU and EEA countries under one authorization, through the passporting mechanism (notifying host countries' regulators).

CASP transition status in 2026

Malta applies the MiCA regulation through its national regulator, MFSA, which is responsible for issuing CASP licenses, ongoing supervision, and monitoring compliance.

For companies already operating under the previous VFA regime, a transition period (grandfathering) has been set. Under current guidance it endsJuly 1, 2026: by this date, previous licensees must either convert their authorization to CASP format or stop serving EU clients.

For new applicants the regime is already clear: from the moment MiCA fully takes effect, you need to apply directly for a CASP license - a separate new VFA license can no longer be obtained. Specific timelines and procedures should be checked as of the date of inquiry, since the regulator refines requirements as practice accumulates.

What services MiCA regulates: CASP classes

MiCA doesn't issue a single «cryptocurrency license» - the set of permitted services depends on exactly what the company does. Capital requirements also depend on the list of services. Below is a broad mapping of «service - what it regulates».

The broader the range of services and the more the activity involves holding client funds, the higher the regulator's requirements - both on capital and risk control.

MFSA requirements: legal entity, substance, key functions

You can't get a crypto license in Malta «remotely and formally». The regulator assesses not just paperwork, but the business's genuine presence in the country.

• A legal entity in Malta.The company registers locally - this is the base for the license and the tax regime.
• Substance.Genuine management from Malta: local directors, regular board meetings on the island, keeping documents in the country, conducting genuine activity.
• Key functions.Officers responsible for compliance, risk management, internal audit, and anti-money laundering (MLRO) are appointed. The regulator checks their competence separately.
• Fit and proper.Founders, beneficiaries, and executives undergo a fit-and-proper integrity check.

It's convenient to plan the registration of a Maltese company, as the foundation for a future license, in advance - more in our article onregistering a company in Malta.

AML and compliance: where applicants most often stumble

Crypto business is a zone of heightened attention to money laundering and terrorist financing. It's exactly the quality of the AML system (anti-money laundering) that often determines whether the license is granted.

• KYC and client screening.Identification, risk assessment for each client, ongoing transaction monitoring.
• Policies and procedures.Written policies on AML, sanctions screening, data retention, and reporting.
• MLRO.A dedicated officer responsible for filing suspicious activity reports.
• Travel Rule.Transmitting sender and recipient data on crypto transfers.

Weak or formal compliance is the most common reason for refusal or delay. This is especially sensitive for clients from CIS countries: the source-of-funds check is strict, with no leniency.

The VFA agent and the intermediary's role in filing

A historical feature of the Maltese regime is the institution of the VFA agent. This is an MFSA-registered intermediary (usually a legal or consulting firm), without which the application simply wasn't accepted for review.

The VFA agent performed several functions: co-signed the application, checked compliance with requirements, and acted as a regulated «interface» between the applicant and the regulator. By approximate market data, the annual retainer for such an agent was around 10,000-25,000 €.

With the transition to MiCA, the emphasis shifts to direct interaction with MFSA and the quality of the company's internal compliance team, but the role of professional support for the filing remains key - the volume of documents and depth of review are high. The specific format of intermediary involvement should be clarified at the time of filing.

How to get a license: stages and timelines

The process of obtaining a Maltese crypto license (CASP) is built sequentially and requires preparation well before filing.

• Step 1.Registering a legal entity in Malta and building substance (office, directors, key staff).
• Step 2.Preparing the package: business plan, governance model, risk management and AML policies, service description.
• Step 3.Fit and proper checks on key persons and confirmation of paid-up capital.
• Step 4.Filing the application with MFSA and interacting with the regulator on follow-up requests.
• Step 5.Obtaining authorization and launching in compliance with ongoing supervision.

By market benchmarks, review takes from 3 to 6 months - the timeline depends heavily on the completeness and quality of the application. Rushing works against the applicant here: an incomplete package lengthens the process.

Cost and capital: what to budget for

The budget for a crypto license isn't just the minimum capital. The capital must be fully paid up before the license is issued and maintained continuously.

The regulator assesses whether capital is proportionate to the real risk profile: with custody services, large transaction volumes, complex outsourcing, or dealing with high-risk clients, capital above the minimum is expected. All figures are approximate and are refined for the specific project.

A crypto license or another foundation for business in Malta

A crypto license isn't the only way onto the island. Sometimes it's more optimal to start with a holding structure and add licensable activity later - or choose a neighboring industry entirely, where Malta holds the strongest EU position.

• iGaming.Malta is Europe's gaming hub; more abouta gaming license in Malta.
• Holding or operating companywith Malta's tax regime without licensable crypto activity.
• Combinationa structure and license for a specific business model.

Which foundation suits your specific project depends on the services, volumes, and beneficiary composition. It's better to calculate this individually rather than by template.

Need a structure for a crypto business in Malta?Discuss your task with BRIDGES GLOBAL specialists- we'll work out the model, license, and taxes for your project.

Taxes for a crypto company in Malta

The tax profile is one of the reasons Malta is considered for crypto structures. The nominal corporate tax rate is 35%, but thanks to the full imputation system and the refund mechanism, the effective burden for foreign shareholders drops to roughly 5%.

It works like this: the company pays 35%, and after dividends are distributed the shareholders get a 6/7 refund of the tax paid - resulting in an effective rate of about 5%. But this isn't a «button»: the mechanism requires correct dividend distribution and genuine substance. Purely paper companies with no presence don't qualify for this rate.

The tax effect is always calculated for a specific structure - details in our article oncorporate tax in Maltaand onMalta tax residency.

Russians and CIS applicants: what matters

For citizens of Russia and other CIS countries, a crypto license in Malta remains available only strictly within the legal field and with enhanced compliance. This isn't an obstacle, but a matter of correct preparation.

• Source of funds.Capital and financing undergo a thorough origin check - documents are prepared in advance.
• Sanctions perimeter.All operations are checked for compliance with the EU sanctions regime; there's no circumventing sanctions, and there shouldn't be.
• Beneficiary transparency.The ownership structure is fully disclosed.

A properly assembled package and a capital history are the guarantee that the application will be reviewed on the merits, not shelved at the checking stage.

Typical mistakes of crypto license applicants

Most failures and delays repeat from project to project. Knowing them in advance can save months.

• Formal substance.A «nominal» office and director with no genuine management from Malta is a direct risk both for the license and the tax regime.
• Weak AML.Template policies with no working KYC and monitoring procedures.
• Underestimating capital.Betting only on the minimum with no buffer for the risk profile.
• Rushing the filing.An incomplete package lengthens review and hurts the first impression with the regulator.
• Ignoring transition deadlines.Postponing the conversion of the previous license to CASP format.

It's always worth checking the current status of rules and deadlines on the regulator's website -MFSA.

Who a crypto license in Malta suits

Malta is a jurisdiction for those who need genuine European legitimacy and access to the EU market, not just a «checkbox» license.

• Crypto exchanges and exchangers,planning to work across the whole EU under one authorization.
• Custody services and wallets,who value the reputation of a regulated player.
• Fintech projectsembedding crypto services into a product and needing passporting.
• Mature teamsready for genuine substance, capital, and serious compliance.

If the goal is a fast and cheap start with no presence, Malta is unlikely to suit: its value lies exactly in strictness and recognition. The decision on where and how to set up the business always remains with the client - our job is to help implement it correctly.