Malta

Malta is one of the world's leading online gambling jurisdictions, hosting more licensed operators than any other single country. The Malta Gaming Authority (MGA) regulates all forms of remote gambling under the Gaming Act 2018 (Cap. 583), which replaced the earlier Lotteries and Other Games Act. Malta's EU membership provides passporting advantages for operators targeting EU markets. The jurisdiction offers a well-established regulatory framework, favourable tax regime, English-speaking workforce, and a deep ecosystem of support services (legal, compliance, payments, technology). The MGA is respected internationally and maintains mutual recognition arrangements with several jurisdictions.

The MGA issues two main licence types: B2C (operator) and B2B (supplier/platform). The B2C licence covers all gaming verticals under a single authorisation. Applications typically take 3-6 months. A local entity is required, along with at least one Key Official based in Malta. The MGA conducts fit and proper assessments on all beneficial owners and key personnel. The regulatory framework emphasises player protection, AML compliance, and responsible gambling.

Malta's marketing rules are moderate. Operators must comply with the MGA's Player Protection Directive which includes requirements for responsible advertising. Marketing must not target minors or vulnerable persons. Bonus terms must be clear and fair. Malta does not impose the same level of advertising restrictions as the UK — TV, digital, and affiliate marketing are all permitted with standard responsible gambling messaging requirements.

The MGA has increased its enforcement activity significantly since 2018. It regularly publishes cancellation and suspension notices, and has issued financial penalties and licence revocations. The MGA targets compliance failures in AML, player protection, and self-exclusion obligations. Enforcement is proportionate but increasingly active.

MGA licence fees are relatively moderate. The application fee is approximately EUR 5,000. Annual licence fees range from EUR 25,000 to EUR 35,000 depending on the licence type. Compliance contribution fees apply based on revenue. A bank guarantee of EUR 100,000 is required for B2C operators.

Malta levies a gaming tax of 5% of GGR (gross gaming revenue), which is one of the lowest rates among regulated jurisdictions globally. Corporate tax is nominally 35% but the effective rate for most gaming companies is approximately 5% due to Malta's full imputation system and shareholder refund mechanism. VAT applies to B2B gaming services within the EU under the reverse charge mechanism.

Malta's regulatory environment is stable with gradual tightening in line with EU-wide trends. The MGA continues to modernise its framework, with recent focus on crypto/DLT gambling frameworks and enhanced AML compliance. EU-wide regulatory harmonisation (if it materialises) could either strengthen Malta's position as the leading hub or reduce its competitive advantage. The jurisdiction's successful exit from the FATF grey list has restored its reputation.

Malta has one of the most developed payment ecosystems for online gambling in the EU, befitting its status as the pre-eminent European B2C gambling hub. The Malta Gaming Authority (MGA) has created a regulatory environment that PSPs are comfortable serving, and a large number of specialist gambling payment providers are headquartered in or have significant operations in Malta, including Nuvei, Trustly, Skrill (Paysafe Group), and Neteller. Card acceptance (Visa and Mastercard debit and credit) is widely available, as are bank transfers via SEPA and a full range of e-wallets. Open Banking adoption is growing. Settlement is in EUR, which simplifies operations for operators serving EU markets. Banking relationships for MGA-licensed entities are achievable, though some mainstream European banks remain cautious; specialist banking providers familiar with the MGA regime are readily accessible. The MGA requires operators to safeguard player funds (minimum segregation requirements), and payment method ownership verification forms part of KYC obligations. Credit card use for gambling is not banned under MGA rules, unlike the UK position, giving operators greater flexibility. Payment blocking against unlicensed operators is within the MGA's toolkit but not heavily deployed for domestic-facing unlicensed sites given Malta's primarily B2B and export-oriented market structure. Overall the payments environment is strongly supportive of operator entry.

The MGA sets comprehensive technical standards through its Technical Standards for Gaming Services (latest iteration aligned with MGA's ongoing regulatory modernisation). RNG certification is required from an approved test house; GLI, BMM Testlabs, eCOGRA, NMi, and iTech Labs are among those accepted by the MGA. Individual game certification is required for each game type placed on the market, which creates ongoing compliance overhead for operators with large game libraries. Geolocation is required to prevent service to blocked jurisdictions and is assessed as part of compliance reviews. Malta falls fully under the EU General Data Protection Regulation (GDPR) with the Information and Data Protection Commissioner (IDPC) as the national supervisory authority. There are no data localisation requirements — data may be stored outside Malta subject to GDPR adequacy and transfer mechanism requirements. Responsible gambling technology requirements are substantial: the MGA Player Protection Directive mandates deposit limits, loss limits, session limits, self-exclusion (connected to the national RGS self-exclusion system), reality checks, and cooling-off periods. Operators must integrate with the MGA's central Player Exclusion Register. The MGA has been progressively tightening its technical standards to align with modern expectations, and operators should monitor the MGA Technology Approval Framework for updates. AML system requirements are significant, with transaction monitoring expected at a level commensurate with risk profile.

Malta-licensed operators benefit from reasonable app store access. Both Apple App Store and Google Play permit real-money gambling apps from MGA-licensed operators, subject to each platform's standard gambling app policies including age-gating and jurisdiction restrictions. This positions MGA-licensed operators comparably to UKGC and AGCO-licensed operators for mobile distribution. Google Ads and Meta both allow advertising from MGA-licensed operators who have completed the respective platform gambling advertiser verification processes, though restrictions apply (for example, bonusing and free-play advertising is subject to specific policies). Programmatic advertising via DSPs is broadly available. Affiliate marketing is a major channel in the Malta-licensed space and is explicitly regulated: the MGA requires that affiliate agreements be in writing, that operators take responsibility for affiliate conduct, and that affiliate marketing materials comply with MGA advertising directives. The MGA Advertising Directive imposes substantive content rules on all marketing including affiliate content — bonus terms must be clearly presented, wagering requirements disclosed, and responsible gambling messages included. Malta does not require geo-gating for domestic Maltese players specifically, but operators must ensure they comply with the laws of all jurisdictions they serve; in practice, most MGA licensees use IP and payment method geo-restrictions for markets requiring a local licence. The broad availability of digital distribution channels is a material advantage of the MGA licence.

Malta is one of the most established and well-serviced entry points into regulated online gambling globally. The MGA has a large professional services ecosystem around it — specialist gaming lawyers, compliance consultants, accountants, and corporate service providers are abundant in Malta and familiar with the MGA application process. The MGA issues both B2C licences (Gaming Service Licence) and B2B licences (Critical Gaming Supply Licence), each with specific requirements. A Maltese company (or a company with a registered branch in Malta) is required for B2C licensees. At least one key function holder with EU residency is typically required; the compliance function must be adequately resourced and accessible to the MGA. Application timelines of 6-9 months are realistic for well-prepared applications, though complex group structures or applicants from higher-risk jurisdictions may experience longer timelines due to enhanced due diligence. The most common bottlenecks are beneficial ownership documentation (MGA expects full transparency through all layers), source of wealth for beneficial owners, and gaming system technical submission. Banking setup can be complex due to some European banks' caution around gaming, but specialist banks and EMIs operating in Malta are accessible. The MGA has a structured fee schedule (application fees, compliance contribution based on GGR), and operators should budget for these alongside adviser costs. The MGA licence carries significant international recognition, making it a common first licence for operators seeking to establish a credible regulatory pedigree before entering higher-friction markets such as Germany, the Netherlands, or the UKGC.