Licensing and regulation: Can we get a licence?

Standard licences run 10 years. The licensing framework operates on an open-access basis with no numerus clausus for MGA gaming licences. The National Lottery is subject to a separate exclusive concession. The Gaming Act, Chapter 583, received assent and partial commencement on 1 August 2018 for preliminary/administrative provisions, but the operative licensing regime (the substantive licence categories and conditions) came into force on 1 January 2019 under Legal Notice 226 of 2018 — this phased commencement corrects an earlier single-date characterisation. The MGA issues a single licence framework, under which licences are classified by activity as either a Gaming Service Licence (B2C) or Critical Gaming Supply Licence (B2B). Multiple game types may be offered under the same licence, subject to the relevant approvals. Four service types are recognised: Type 1 (casino/RNG), Type 2 (fixed-odds betting), Type 3 (peer-to-peer/poker/exchange), Type 4 (controlled skill games). By way of further explanation: Type 1 games – games of chance played against the house, the outcome of which is determined by a random generator, and shall include casino type games, including roulette, blackjack, baccarat, poker played against the house, lotteries secondary lotteries and virtual sports games; Type 2 games – games of chance played against the house, the outcome of which is not generated randomly, but is determined by the result of an event or competition extraneous to a game of chance, and whereby the operator manages his or her own risk by managing the odds offered to the player; Type 3 games – games of chance not played against the house and wherein the operator is not exposed to gaming risk, but generates revenue by taking a commission or other charge based on the stakes or the prize, and shall include player versus player games such as poker, bingo, betting exchange, and other commission based games; Type 4 games – controlled Skill Games. In addition, the following are the exempt games, which do not require a licence: a game of skill which does not require a stake to enable participation, and, or does not envisage the possibility of a prize; a game of skill which requires a stake to enable participation and offers the possibility of a prize, unless the MGA issues a ruling determining that such a game of skill is a controlled skill game; a game of chance which does not require a stake to enable participation, and/or does not envisage the possibility of a prize, unless otherwise determined by the MGA in a binding instrument; a de minimis game, provided that cumulatively is a lottery or raffle type game, the stake does not exceed €1, the prize does not exceed €100, and the outcome is not based on the outcome of another game is considered to be a game exempt from licensing or permit requirements; and a licensable game organised on board any vessel flying or entitled to fly the flag of Malta, or registered in Malta, whilst said vessel is navigating outside the territorial waters of Malta. ## Application timeframe and phrases The application process realistically takes between six to twelve months from the submission of the application to obtaining of the license, however, this depends on the quality of the application and the readiness of the applicant to reply to the MGA’s queries. Upon the satisfactory review of the documentation submitted, the MGA gives the applicant 60 days to set up a technical infrastructure, which will then undergo a system audit which would review the test environment against the proposed application. If upon completion of the system audit, there are no material issues, the MGA will proceed to issue the license. List of documents & type of information needed to support application Acquiring a gaming license in Malta involves a rigorous process wherein applicants are required to submit detailed documentation providing sufficient and clear information relating to their proposed gaming operations. Applicants are required to submit the requested documentation to the MGA through the MGA online portal https://portal.mga.org.mt/ . The list of the documentation required to be submitted is encompassed in the MGA System Documentation Checklist available at https://www.mga.org.mt/system-documentation-checklist-update/ , which has been revised in March 2022 by the Authority and includes a business plan with three-year projections, policies and procedures, technical documentation, due diligence documents and contractual arrangements. Importantly, among the amendments introduced by the MGA is the exemption to submit technical policies and procedures where the gaming operator holds relevant ISO Certificate. Moreover, certified hard copies of due diligence documents, as well as originally signed declarations, are required to be provided. All this documentation will be subject to the review and scrutiny of the MGA. The MGA may require from the applicant any information, documentation and assurances as may be necessary and relevant for it to conduct a statutory review as well as the required probity checks and carries out an in-depth analysis of the applicant’s business plan and technical documentation submitted. ## Geographical cover The MGA does not impose territorial limitations on the use of its licence. Nevertheless, it is an obligation of each and every B2C licensee to exercise due care in selecting markets in which to pursue their activities and advertising, ensuring that the activity is underpinned by justifiable arguments. With respect to B2B licence holders, they are obliged to offer critical gaming supply solely to persons or entities that are licensed by the MGA or the competent regulator in another jurisdiction within the EU or EEA, or in another reputable jurisdiction where the MGA has an agreement with the relevant regulator. ## Applicant considerations In order for a person to be eligible to hold an MGA licence, such person has to be established in the EEA. There is no specific requirement for a licensee to be an incorporated entity in Malta. Furthermore, persons who perform key functions for the business do not necessarily have to be present in Malta. They must however be available upon MGA’s request. Licence holders are also subject to minimum issued and paid-up share capital requirements, as follows: B2C - Gaming Service Licence: ## Type 1 – Minimum €100,000 ## Type 2 – Minimum €100,000 ## Type 3 – Minimum €40,000 ## Type 4 – Minimum €40,000 B2B - Critical Gaming Supply Licence: ## • Minimum €40,000 Companies with multiple type approvals are required to meet the above share capital requirements cumulatively up to a maximum required capping of €240,000. Companies having or applying for a Corporate Licence are required to have the minimum Share Capital in any one of the entities forming part of the Corporate Licence. In 2025, the MGA published a Capital Requirements Policy, introducing an obligation binding on all licence holders to maintain a ‘positive equity position’. If a licence holder is in a ‘negative equity position’, a licence holder shall be obliged to restore its equity position within 6 months of the respective financial year end. In the case of a B2B licence holder, the obligation to restore the negative equity position to a positive one shall only be triggered once the negative equity position exceeds EUR 3,000,000. Licence holders licensed in 2025 must comply by 30 June 2026, while earlier licensed operators have a transitory period of up to five years. Entities with significant negative equity as of 31 December 2024 must submit a detailed, MGA-approved recapitalisation plan by 30 November 2025. ## The Key Function Roles The Key Function Roles have to be appointed at different stages of the application. At the application stage, notification to the MGA must be made regarding those who will hold the roles of Chief Executive Officer, Compliance Officer, and if applicable, the MLRO. Later, within six months of the issuing of the licence, the MGA must be notified as to who has been appointed to exercise the remaining Key Function Roles. It should be noted that if there is no person that is approved by the MGA to fulfil the Key Function roles, the responsibility for the functions shall be vested in the directors of the company. Should there be a resignation of any of these roles, the licensee would need to notify the MGA by no later than three working days of such resignation. They would also be obliged to inform the MGA about the appointment of the replacement by no later than 15 working days after such resignation. In view of the changes to Directive 3 of 2018 published in October 2021, some Key Function Roles have been merged. The Key Function Roles required for B2Cs: ## CEO ## Key Gaming Operations ## Key Compliance ## Key Legal ## Key Data Protection ## Key AML & CFT ## Key Technology ## Internal Audit The Key Functions to be appointed by a B2B Licensees are: ## CEO ## Key Gaming Operations ## Compliance Officer ## Key Legal ## Key Data Protection ## Key Technology ## Internal Audit A fit and proper test on individuals taking on key roles within the gaming operations will also be carried out by the Authority. In doing so, the MGA seeks to examine and determine the suitability of the applicant to hold a licence, depending on the licence category and the type/s of games and/or services, and also to ensure that the applicant and all relevant persons having a qualified interest in the gaming operations satisfy the fit and proper requirements. Apart from the fact that individuals taking a Key Function role must be fit and proper, these individuals are required to show that they hold the necessary academic qualifications as well as professional experience in order to fulfil such a role. Furthermore, they must continue their training through Continuous Professional Development (“CPD”) which can come in the form of: ## Professional education activities ## Presentations ## Teaching/lecturing/presentations ## Publication of articles Professional examinations. The fulfilment of these courses must be verifiable and evidence of the relevance of the activity must be stated for the purpose of this requirement. This Policy came into force on the 20th October 2021, however, key functions certificate holders will need to adhere to the CPD requirements upon their renewal of their Key Function Certification. In line with the MGA’s Regulatory Oversight: Supervisory Engagement Efforts 2025, the Authority published the findings of its Governance Assurance Thematic Review on Key Functions on 29 July 2026. This review assessed governance arrangements across a sample of B2B and B2C Authorised Persons, with a particular focus on the effectiveness of the CEO, Compliance, Internal Audit and AML/ CFT functions. Lawyer guidance (pre-schema) indicates no major structural change is anticipated to this framework, with the MGA expected only to issue further clarificatory instruments; this is consistent with the MGA's targeted 2026 consultation on proposed enhancements to the Recognition Notice Framework, which represents a key forward-looking licensing development.