title: Malta — Technical compliance: What must the platform meet? | advennt.io canonical: https://advennt.io/jurisdictions/malta/technical/ [Jurisdictions](https://advennt.io/jurisdictions/) [Malta](https://advennt.io/jurisdictions/malta/) Technical compliance Malta · Question 08 of 11 # Technical compliance: What must the platform meet? Favourable · Probable · Expert approved · In expert review scope · [Back to full Malta report →](https://advennt.io/jurisdictions/malta/) Key section parameters | Jurisdiction | Malta (MT) | |---|---| | Regulator | MGA | | Favourability | Favourable | | Confidence | Probable | | Review status | Expert approved · In expert review scope | | Last collected | 18 Oct 2026 | Summary answer ## Infrastructure The key technical setup shall be located in Malta or in another Member State of the EU or the EEA. Nevertheless, the MGA may, on a case by case basis, allow the placement of the key technical setup in other geographical locations where it is reasonably satisfied that such other lo… ## Full section analysis ## Infrastructure The key technical setup shall be located in Malta or in another Member State of the EU or the EEA. Nevertheless, the MGA may, on a case by case basis, allow the placement of the key technical setup in other geographical locations where it is reasonably satisfied that such other location, taking all the relevant circumstances into account, offers equivalent safeguards to those offered by locations in the EEA. Key technical setup means the technical infrastructure of the licensee, including all the hardware and virtual machines in operation with the respective internal IP addresses, including all the geographic locations and addresses of premises where the essential components are located. Hardware forming part of the key technical setup may only be located in premises which adhere to a high level of information security. In addition, the licensees are obliged to maintain a live or real-time mirror server for essential regulatory data in Malta, being at all times accessible to the MGA upon request. ## Integrations Currently, there is no general requirement for licensees to maintain a specific integration with the MGA; however, the legislation provides that the MGA may, at any time, require a licensee, a specific category of licensees or all licensees to connect any of its systems or a system operated by the MGA, and to maintain such connection at all times. ## Software certification There is not a specific list of testing labs, however any random number generated games need to be tested for their randomness and an RNG certificate is required to be provided to the MGA as part of the licensing process. Once all the documents provided to the MGA as part of the application process are to their satisfaction, the MGA will inform the applicant that the application was successful and will invite the applicant to implement the operation onto a technical environment in preparation to go live. The applicant will be allowed 60 days to complete this technical roll-out, after which the application will be considered as cancelled and subject to re-application. At any stage within those 60 days, the applicant may appoint a Service Provider approved by the MGA to carry out a system audit. The systems audit will verify the live environment against the proposed application. Following the publication of the revised MGA System Documentation Checklist, in November 2022 the MGA also published a revised version of the System Audit Checklist, which comes into force for any System Audits as of 01 January 2023. In addition, a new System Review Checklist was issued, which will be used after licence issuance, to verify that the implemented systems operated by the Licensee reflect the information submitted to the Authority, as well as being in line with the requirements emanating from the Gaming Act and any other relevant subsidiary legislations. System Reviews will generally be required one year after issuance of a new licence, or within a shorter time frame if a system audit was not required at licence issuance stage. System Reviews will also be carried out by the approved Service Providers. The System Review in essence substitutes the Compliance Audit, based on the Compliance Audit Manual, which will now be undertaken on an ad-hoc basis for long standing licensees, or in instances where the MGA decides upon. In 2024, and with further clarification in 2025, the MGA has introduced minor updates to the Audits section of its portal, outlining revised procedures for System Audits, System Reviews, and Compliance Audits. Approved Audit Service Providers must submit reports electronically within 60 days for System Audits/Reviews or 90 days for Compliance Audits. Any non-compliance identified must be promptly addressed by the licensee, with follow-up checks marked as 'Resolved at Audit Stage' or 'Partially Compliant'. A one-time extension may be requested to resolve unresolved issues, subject to MGA approval. The Authority may reject audit reports if significant unresolved non-compliance prevents a conclusive outcome.