## Regulating bodies The Malta Gaming Authority (the “MGA”) is the main regulatory authority. The Financial Intelligence Analysis Unit (the “FIAU”) is the AML/CFT supervisory authority. Commercial Communications Committee and Malta Broadcasting Authority are additional advertising authorities together with the MGA. The Office of the Information and Data Protection Commissioner is the national supervisory authority responsible for monitoring and enforcing the provisions of the GDPR and the Data Protection Act. Malta Competition and Consumer Affairs Authority is the national authority that has among its main functions to safeguard consumers’ interests and enhance their welfare. ## Supervision by Regulator The Gaming Act provides for enforcement measures whether the breach is a case of a reported or suspected breach of the laws and regulations or whether the breach is identified through an ad hoc investigation. The third schedule to the Gaming Act lists which breaches shall be deemed to be of a criminal nature. Other breaches which are not listed under this schedule will be considered to be administrative breaches which will be converted into criminal breaches should the administrative remedy fail to be satisfied by the respective gaming operator. Through the regulatory framework overhaul, the supervisory powers of the MGA have been restructured to strengthen its investigative powers and bolster regulatory efficacy. The MGA can require a licensee to take any necessary measures or to provide any information to prove that the company complies with all relevant regulations. The MGA may conduct a review of the actions and/or of the operations by the licensee. If the licensee is not adhering to the regulations set in place, the MGA will give adequate time for the licensee to remedy this.If the MGA is still not satisfied after such period, it may launch a formal investigation. At the end of the formal investigations, the MGA will provide the licensee with a report setting out its findings and any resulting measures. The MGA enforces via the Gaming Compliance and Enforcement Regulations (S.L. 583.06). Tools include administrative penalties under Article 25(3). The MGA may carry out the following enforcement measures: Issue an order to the licensee to do or to cease doing something in order to be compliant with all the regulations; Issue a warning to do, or refrain from doing, something in the future; Adding, removing or amending conditions attached to the authorisation held by the relevant licensee; In the case of a breach which is not an offence against the Gaming Act, imposing an administrative penalty; In the case where the breach is an offence against the Gaming Act, it may start criminal proceedings; and, or Suspending or cancelling the licence. Enforcement is risk-based. This cycle illustrates a more active AML/CFT supervisory environment, with the FIAU making use of its enforcement powers in a manner that gives operators clearer practical guidance on expected customer-due-diligence, reporting and screening standards, including an administrative penalty of EUR69,000 against a Malta-licensed bank, EUR225,730 (plus a EUR2,000 daily penalty) against a gaming operator for customer-due-diligence and reporting failures, and a further administrative penalty of EUR80,907 against another gaming operator in relation to player screening and investigation, including PEP-related controls. The MGA has also issued public notices disclaiming unauthorized operators, including operators linked to surrendered MGA licences. Legal Notices 82 of 2026 further expands the FIAU's toolkit through enhanced administrative penalties, settlement powers and a temporary settlement window. Cross-border, the dominant theme remains Article 56A litigation rather than domestic punitive action against MGA licensees themselves.
Malta · Question 10 of 11
Enforcement: How hard does the regulator enforce?
Mixed · Probable · Expert approved text · Not reviewed · data updated since review · 6 post-review updates · Not reviewed · In expert review scope · Back to full Malta report →
Key section parameters
| Jurisdiction | Malta (MT) |
|---|---|
| Regulator | MGA |
| Favourability | Mixed |
| Confidence | Probable |
| Review status | Expert approved text · Not reviewed · data updated since review · 6 post-review updates · Not reviewed · In expert review scope |
| Last collected | 18 Oct 2026 |
Summary answer
## Regulating bodies The Malta Gaming Authority (the “MGA”) is the main regulatory authority. The Financial Intelligence Analysis Unit (the “FIAU”) is the AML/CFT supervisory authority. Commercial Communications Committee and Malta Broadcasting Authority are additional advertising authorities tog…
The Malta Gaming Authority cancelled Oddsfly Limited's authorisation on 14 July 2025 for unpaid fees, following a Notice of Cancellation dated 29 May 2025 issued under S.L. 583.06 reg. 9(2)(a), which affords an authorised person a twenty-day period to show cause before the Authority proceeds with the enforcement measure; €104,814.52 was at issue. Separately, secondary press reporting (not yet corroborated by a primary Authority text) describes the Authority cancelling Winzon Group Limited's B2C licence (MGA/B2C/717/2019), retroactive to 11 March 2026, with penalties of €147,080 and unpaid fees of €46,693.23. The Authority's own thematic review of governance and key-function assurance across licensees found common themes of over-reliance on a limited number of senior decision-makers and insufficient evidence of challenge and impact assessment, a structural governance finding distinct from the two cancellations. Taken together, these indicate continuing supervisory intensity rather than an isolated incident. Confirmation of the Winzon action from the Authority's own primary sources remains outstanding.
Enforcement attention this period centres on the European Commission's infringement procedure INFR(2025)2100 against Article 56A of the Gaming Act, the provision requiring Maltese courts to refuse recognition of certain foreign judgments against Malta-licensed operators. The Commission issued a letter of formal notice on 18 June 2025, finding the provision's systematic public-policy refusal mechanism incompatible with Regulation (EU) 1215/2012. Malta replied at the end of September 2025, and the Commission's analysis of that reply was ongoing as at a February 2026 statement attributed to Commissioner McGrath; no reasoned opinion or Court referral has been identified as at October 2026. This sits alongside Case C-683/24, where Advocate General Emiliou's Opinion of 23 April 2026 found a provision of this kind contrary to EU law if the underlying reference is admissible, a tension sharpened by a Maltese court's 11 January 2024 decree declining to refer questions on Article 56A to the Court of Justice. No enforcement events against individual operators were evidenced this period.
The Malta Gaming Authority suspended Condor Malta Limited's authorisation effective 16 September 2026, disclosed 28 September 2026, citing four provisions of the Gaming Compliance and Enforcement Regulations together with compliance and financial issues; the Authority directed continued player account access for visibility purposes, and Condor Malta's separate UK remote licence remains unaffected. Earlier, under regulation 10(2)(b) of the same Regulations, the Authority cancelled Winzon Group Limited's B2C gaming service licence with immediate effect, applied retroactively to 11 March 2026, with a EUR 147,080 penalty, as part of a wider shutdown of an associated network of over 40 websites; the Regulations' special proviso was invoked to bypass the usual 20-day show-cause period. The Authority also published a further notice in September 2026 identifying multiple unauthorised URLs impersonating licensed operators, continuing a recurring anti-impersonation pattern. Together these actions evidence a sustained, assertive enforcement posture spanning suspension, cancellation with financial penalty, and public disclaimer of impersonating sites, rather than an isolated event.
The Malta Gaming Authority cancelled Winzon Group Limited's business-to-consumer authorisation (MGA/B2C/717/2019) retroactively to 11 March 2026, acting under regulation 10(2)(b) of Subsidiary Legislation 583.06, with outstanding fees of EUR 46,693.23 and administrative penalties of EUR 147,080 recorded on the Authority's own enforcement register. This is a live demonstration of the regulator's power to cancel authorisations with retroactive effect and impose material financial penalties under its compliance-enforcement subsidiary legislation. Separately, the Authority's 2026 Supervisory Engagement Efforts add thematic reviews of cash and cash-equivalent and crypto-asset internal controls, athlete and esports betting-integrity reviews, and enhanced oversight of operator monthly alternative dispute resolution reporting as named 2026 priorities. These are forward-looking supervisory-attention signals rather than new statutory obligations, and indicate where the next enforcement or inspection activity is most likely to concentrate. No new enforcement instrument beyond the Winzon cancellation was identified this cycle.
This cycle's central enforcement finding is the MGA's cancellation of Winzon Group Limited's B2C gaming service licence, applied with immediate effect and retroactively to 11 March 2026, under regulation 10(2)(b) of the Gaming Compliance and Enforcement Regulations. The regulator invoked a special proviso to bypass the standard twenty-day show-cause period, and imposed an administrative penalty of EUR 147,080 plus EUR 46,693.23 in outstanding fees. This claim is Probable, not Confirmed: it rests on a single Tier 3 report, and no MGA-published enforcement-register cross-check was located this cycle to corroborate it at Tier 1. The procedural mechanism itself is not durability-rated in the evidence base. Read at face value, the use of an expedited-bypass proviso against a licensee is a Probable indicator that MGA is willing to move faster than its routine enforcement cadence where it assesses acute risk, a posture shift the Interpreter itself flags only at Probable confidence. No enforcement events beyond Winzon were sourced this cycle, and no cross-border or extraterritorial enforcement mechanism was evidenced. The civil-law-family enforcement theory for unregulated operators cannot be populated for Malta this cycle for want of an MT-specific claim; this is recorded as a gap rather than inferred.
Enforcement is the highest-conviction tightening signal in Malta's 2026 cycle. The FIAU fined Stanleybet Malta Limited two hundred twenty-five thousand seven hundred thirty euro plus a two thousand euro daily penalty for customer due diligence failures, a probable-confidence, tier-three-sourced action consistent with a longer, confirmed trend: FIAU supervisory interventions rose from fifty-five in 2018 to eight hundred seventy cumulative across 2019 to 2024, and fines rose from nine hundred ninety thousand euro in 2018 to more than twenty-nine and a half million euro since 2019, with the Constitutional Court repeatedly affirming the FIAU's underlying penalty powers even while striking aspects of its prior fine procedure. A new settlement mechanism under Legal Notices 82 and 83 of 2026 softens the procedure for contesting fines without reducing the underlying compliance lift required to avoid them, and is best read as a fragile, ministerial-notice-level adaptation layered onto a mixed-durability statutory base. Separately, the MGA's March 2026 Supervisory Priorities, an uncertain-confidence, single-source signal, flag continued focus on crypto-asset internal controls, ADR reporting quality, and sports-betting integrity as forward enforcement priorities, though none has yet crystallised into an enacted requirement.