On 30 December 2024, the EU's Markets in Crypto-Assets Regulation — MiCA — became law across all 27 member states simultaneously. For the crypto industry, it was the moment that years of regulatory uncertainty resolved into something concrete: a unified European framework, a single licence that could passport across borders, and a clear standard for what it meant to operate a regulated crypto business in the EU.
For Malta, it was a moment of vindication — and transition. The island had been regulating crypto businesses since 2018, when the Virtual Financial Assets Act created the first comprehensive crypto licensing framework in the world. The VFA system built Malta's "Blockchain Island" reputation. MiCA replaced it. But the experience, the ecosystem, and the regulatory expertise that Malta developed during those six years did not disappear — they transferred into the new framework.
Here is the complete guide to crypto licensing in Malta under MiCA in 2026.
What Changed: VFA to MiCA
Under the old VFA framework, Malta issued four licence classes (Class 1–4) covering different levels of crypto service provision. Under MiCA, the classification system is service-based rather than class-based: you apply for the specific services you intend to provide, and the licence reflects that scope.
Existing VFA licence holders can continue operating during a grandfathering period until 1 July 2026, after which they must convert to MiCA authorisation or cease serving EU clients. Conversion is not automatic — it requires a formal application, documentation updates, and MFSA assessment.
MiCA CASP Licence: What It Covers
Under MiCA, the relevant entity is a Crypto Asset Service Provider (CASP). The services that require CASP authorisation include:
- Operating a trading platform for crypto assets
- Exchange of crypto assets for fiat currency or other crypto assets
- Custody and administration of crypto assets on behalf of clients
- Placing crypto assets (brokerage)
- Reception and transmission of orders for crypto assets
- Portfolio management of crypto assets
- Providing advice on crypto assets
Capital Requirements
| Service Scope | Minimum Capital |
|---|---|
| Advisory and order-routing (ex-Class 1) | €50,000 |
| Brokerage / dealing (ex-Class 2 & 3) | €125,000 |
| Exchange and custody operations (ex-Class 4) | €150,000 |
Capital must be paid in full before final MFSA approval. This is not a commitment or a letter of intent — it is real, deposited capital sitting on the company's balance sheet as regulatory reserves.
The Application Process
Step 1: Define your service scope. Precisely which MiCA services will you provide? This determines capital requirements, compliance obligations, and the depth of MFSA review. Broader scope means higher capital and more demanding oversight.
Step 2: Incorporate in Malta. Private Ltd, with shareholding and governance structure aligned to MiCA expectations. Two-mind management is mandatory — at least two executives based in Malta making day-to-day decisions.
Step 3: Prepare the compliance stack. AML/KYC manual and risk assessment, outsourcing policy, IT security framework (wallet segregation, incident response, penetration testing), complaints handling, best-execution policies (for trading platforms), and client asset segregation rules.
Step 4: Engage early with the MFSA. Pre-application meetings allow the MFSA to clarify its expectations before you file. This step is not mandatory but consistently reduces the number of Requests for Information (RFIs) during formal review.
Step 5: Submit and respond. File the complete application with all required documentation and fees. The MFSA issues RFIs during review — prompt, complete responses maintain momentum. Delays in responding extend the timeline proportionally.
Step 6: Capital and go-live. Pay the required capital in full, appoint all control functions, complete any system tests or security checks required by the MFSA, and receive final authorisation.
The EU Passporting Advantage
A Malta MiCA CASP licence provides EU passporting rights — the ability to offer regulated crypto services across all 27 EU and EEA member states under a single Maltese authorisation, with notification to host country regulators. This is MiCA's most significant practical advantage over pre-MiCA crypto licensing: one application, one compliance framework, 27-country market access.
Banking for Crypto Companies
Even with a Malta MiCA licence, banking remains the hardest operational challenge. Banks in Malta and across the EU classify crypto businesses as high-risk clients regardless of regulatory status. Enhanced due diligence, detailed transaction flow documentation, and proof of robust AML controls are expected before any account is opened.
EMIs — 3S Money, Moneybase, Bankera — provide faster onboarding for crypto businesses and are a practical first banking solution while traditional bank relationships are built over time. Crypto businesses that treat banking as an afterthought consistently discover they have a licence but cannot operate.