MiCA CASP authorisation in Malta (MFSA)

At a glance

Regulator: MFSA
Typical timeline: ~9 to 18 months including preparation
Transitional deadline: Open until 1 July 2026
Fees: Application around €8,000 to €30,000; annual supervisory fees around €6,000 to €30,000+ by class and volume
CASPs authorised so far: ~12 (among the most in the EU)
Pre-MiCA experience: VFA Act 2018, an early bespoke crypto regime

As of June 2026; figures drift and transitional dates trace to the ESMA grandfathering list. Capital is set EU-wide by service class (€50,000 / €125,000 / €150,000), not by country. Compare member states on the jurisdiction comparison and confirm exact dates on the deadlines page.

Why teams look at Malta

Malta moved early on crypto regulation. Its Virtual Financial Assets (VFA) framework, in force since 2018, gave the Malta Financial Services Authority (MFSA) years of supervisory experience before MiCA’s crypto-asset service provider regime began applying on 30 December 2024. That head start is the main reason Malta has been able to process CASP files quickly and why several large platforms chose it for early MiCA authorisation.

The trade-off is scrutiny. Speed at the national level attracts attention at the EU level, and a fast Maltese authorisation is not a lighter one in substance. Treat Malta as a credible, experienced route, not a shortcut.

This page is informational and does not replace legal, regulatory, or tax advice. Confirm current requirements, forms, fees, and timelines directly with the MFSA before acting.

The authorisation route

Malta uses the standard MiCA machinery. A firm that is not already an EU-authorised financial entity applies to the MFSA for authorisation as a CASP under Article 62. A firm already authorised under EU financial law (for example a credit institution or MiFID investment firm) may instead use the lighter Article 60 notification.

Two clocks run under Article 63: the MFSA has 25 working days to confirm the file is complete, then 40 working days to decide once it is complete. In practice the slow part is getting the file to complete. Most teams spend several months assembling it, and the MFSA expects substantive pre-application engagement rather than a cold submission.

What the MFSA expects

Local substance

A registered office in Malta and management effectively based there, per Article 59(2). A nameplate does not satisfy it. Expect questions on where decisions are actually made and who is resident.

Governance and fit-and-proper

The management body must have collective crypto-asset knowledge and dedicate sufficient time under Article 68. The MFSA runs detailed fitness-and-properness checks on directors and qualifying shareholders.

Custody and client assets

If you safeguard client crypto-assets or the means of access, Article 75 applies: segregation, reconciliation, a custody policy, and strict liability for loss. The MFSA looks hard at key-management architecture.

Prudential safeguards

Own funds, an insurance policy, a comparable guarantee, or a mix under Article 67, at the higher of the class minimum or one quarter of fixed overheads.

Capital and the Article 67 question

The minimum is set by which of the ten services you want authorised for: 50,000 euro, 125,000 euro, or 150,000 euro, or one quarter of the previous year’s fixed overheads if that is higher. The fixed-overhead test catches well-funded teams more often than the class minimum does. If you are weighing insurance against capital, build the evidence first: see the CASP insurance evidence pack and own funds vs insurance.

Coming from a VFA licence

Firms already licensed under Malta’s VFA Act do not get an automatic conversion. They move onto the MiCA CASP regime through a transition the MFSA manages, and Malta opted for a shorter transitional window than the MiCA maximum. If you hold a VFA licence or were relying on a national transitional period, confirm the current cut-off date and the exact transition steps with the MFSA, because the window is narrower than many teams assume.

Transitional dates have moved at the member-state level. Do not plan around a date you read here or anywhere else without confirming it against current MFSA guidance.

Speed and EU scrutiny

ESMA’s 2025 peer review of a national authority’s CASP authorisation process was a reminder that the EU watches fast national approvals closely. The practical lesson for a Malta applicant is not to avoid Malta, it is to make sure the file would survive review by someone other than your chosen regulator: clean substance, a defensible custody and controls story, and prudential safeguards you can evidence.

FAQ

Is a Malta CASP licence valid across the EU?

Yes. A CASP authorisation passports to all 27 member states under Article 65. You authorise in Malta and notify the host states before providing services there.

Does the MFSA still issue VFA licences?

The CASP regime is now the route for crypto-asset services that fall under MiCA. Confirm with the MFSA which framework applies to your specific activity, because some token and offering activity sits under other MiCA titles.

How long does it really take?

The legal decision clock is 40 working days after the file is complete, on top of a 25 working day completeness check. Preparing a complete file usually takes several months. The total depends on your custody model, governance, and how ready your evidence pack is.