Malta Crypto License (VFA / MFSA) — Requirements & Process 2026

Geneva old town swiss cantonal flags — Malta Crypto License: VFA Act & MFSA Framework 2026

Overview

Why Malta Is Europe's Pioneer for Crypto Regulation

The Malta Virtual Financial Assets Act (VFA Act, 2018) was the world's first comprehensive statutory framework for cryptocurrency businesses. The MFSA (Malta Financial Services Authority) licenses and supervises VFA Service Providers across 4 classes. Malta is an EU member state, offering MiCA compliance and passporting rights across all 27 EU member states.

Malta's corporate tax is nominally 35% but an effective 5% rate is achieved via a shareholder refund mechanism — making it highly tax-efficient for international holding structures. The VFA framework is being transitioned to MiCA, with grandfathering provisions for existing VFA licensees. Malta's English-language legal system, EU status, and established financial services sector provide a strong operational base.

Malta has particular strength in attracting crypto exchanges, token issuers, and DeFi platforms. The island's regulatory track record with virtual assets since 2018 means MFSA examiners have deep experience — unlike newer regulators in some other EU states.

MiCA transition note: Existing Malta VFA licensees are being transitioned to MiCA CASP authorizations. New applicants in 2025 may apply directly under MiCA via the MFSA. VFA Agent requirements continue to apply. Contact us for the current MFSA application pathway.

License Categories

Malta VFA — Class 1 to Class 4

The VFA Act establishes four license classes based on the nature and risk level of activities. Most crypto exchanges require Class 2 or Class 3; custodians typically need Class 4.

Class	Activities	Min. Capital
Class 1	Receiving and transmitting orders; investment advice — no client fund-holding	€50,000
Class 2	Execution of orders on behalf of clients	€125,000
Class 3	Dealing on own account, underwriting of VFAs	€730,000
Class 4	Custodian services, collective investment scheme management	€730,000

Requirements

Malta VFA License — Key Requirements

Entity

Maltese company required

Private limited liability company (Ltd.) incorporated in Malta

VFA Agent

Mandatory — MFSA-registered

Must co-sign application; acts as regulated intermediary with MFSA

Directors

Min. 2 Malta-resident directors (or 1 with approval)

Fit & proper assessment; relevant industry expertise required

MLRO & Compliance Officer

Both required

Malta FIAU AML/CFT framework compliance required

AML/CFT

PMLA and FIAU guidelines compliant

Malta-specific AML directives; FATF Travel Rule compliance

Whitepaper (if token issuer)

MFSA whitepaper registration

Required for all VFA token issuances; MFSA review required

Systems Audit

MFSA IT/technology assessment

Technology description and security controls required at application

Capital

€50,000 – €730,000 (by class)

Paid-up capital held in Malta; working capital additional

Process

How to Get a Malta VFA License — Step by Step

Engage a Registered VFA Agent

The mandatory first step is engaging an MFSA-registered VFA Agent (typically a law firm or specialized advisory firm in Malta). The VFA Agent reviews your business model, determines the applicable license class, and co-signs the application. Selecting an experienced VFA Agent is the single most important factor in application success and speed.

Week 1–2

Prepare Application Package

Working with the VFA Agent, develop the complete application: detailed business plan, AML/CFT policies per PMLA and FIAU guidelines, IT systems description and security architecture, financial projections, governance structure, and fit & proper documentation for all UBOs and directors. This is typically the longest preparation phase.

Weeks 2–10

VFA Agent Submits to MFSA for Review

The VFA Agent formally submits the application package to the MFSA. The MFSA acknowledges receipt and assigns a case officer. During the review period, MFSA may request clarifications — all responses are coordinated through the VFA Agent. Timely and comprehensive responses are essential to avoid delays.

4–8 weeks MFSA review

In-Principle Approval — Finalize Setup and Capital

Upon MFSA in-principle approval, complete the Maltese company incorporation (if not already done), inject the required minimum capital, establish the physical office, open a Maltese bank account, and appoint all required compliance personnel. Submit evidence to MFSA for final review.

4–8 weeks post-IPA

Full License Issued — Commence Operations

MFSA issues the full VFA Service Provider license. Commence operations. Ongoing obligations include: annual MFSA returns, audited financial statements, AML/CFT annual review, Travel Rule compliance, and immediate notification of material changes. The VFA Agent typically continues as ongoing regulatory liaison.

License issuance

Costs

Malta VFA License — Full Cost Breakdown

Item	Details	Approx. Cost
MFSA application fee	By license class (non-refundable)	€3,000–€15,000
VFA Agent fees	Annual retainer for ongoing compliance liaison	€10,000–€25,000/yr
Company formation	Malta Ltd. incorporation, constitutional docs	€2,000–€5,000
Office lease (Year 1)	Physical office in Malta (Valletta or Sliema)	€8,000–€20,000/yr
Legal & compliance preparation	Application package, AML/CFT framework, policies	€15,000–€40,000
Min. capital (Class 1)	Paid-up share capital retained in entity	€50,000+
Estimated Year 1 Total (excl. capital)	Setup, agent, regulatory fees, office, professional fees	€40,000–€120,000

FAQ

Malta VFA License — Common Questions

A VFA (Virtual Financial Assets) Service Provider license issued by the Malta Financial Services Authority (MFSA) under the VFA Act 2018. It authorises companies to provide crypto exchange, brokerage, custody, and advisory services in Malta and the EU. The VFA framework is transitioning to MiCA, and new applicants may apply directly under MiCA through the MFSA as of 2025.

Malta's nominal corporate tax rate is 35%, but foreign shareholders receive a 6/7 refund on dividends, resulting in an effective 5% tax rate. This makes Malta one of the lowest-tax EU jurisdictions for international businesses. The refund mechanism requires proper dividend distribution — specialist Maltese tax advice is essential to structure this correctly.

Yes. Under MiCA, Malta-licensed crypto asset service providers can passport their services across all 27 EU member states without needing separate licenses in each country. This is Malta's key competitive advantage. Passporting requires notification to the MFSA and the host member state regulator — the process is procedural, not a new application.

A VFA Agent is an MFSA-registered intermediary (law firm or advisory firm) required to sponsor all VFA applications. The VFA Agent co-signs the application, verifies compliance, and acts as the regulated interface between the applicant and MFSA. Appointing a qualified VFA Agent is mandatory — no application can be submitted without one. VFA Agent fees typically run €10,000–€25,000/year for the ongoing retainer.

The process takes 6–12 months from engagement of a VFA Agent to receipt of the full license. MFSA review of complete applications typically takes 4–8 months. Well-prepared applications with experienced VFA Agents can complete in 6 months. Applications with incomplete documentation or novel business models will take longer — the MFSA is thorough and does not rush reviews.

Initial application costs typically range from EUR 3,000-5,000 in professional fees, with the MFSA application fee at EUR 2,000. Annual compliance and maintenance costs average EUR 8,000-15,000 depending on your VFA Agent fees, auditing requirements, and operational scale. These figures should be factored into your first-year budget alongside setup costs for compliance infrastructure.

Malta VFA licensees must implement full Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) controls under the Financial Intelligence Analysis Unit (FIAU) regulations, including customer due diligence (CDD), Know Your Customer (KYC) procedures, and suspicious transaction reporting. You must conduct enhanced due diligence for high-risk customers and file Suspicious Transaction Reports (STRs) with FIAU within five working days of detection. Regular AML training for staff and independent audits are mandatory, typically conducted annually.

Yes, Malta VFA licensees can operate globally, but you must avoid high-risk jurisdictions on FATF grey lists and comply with sanctions lists including OFAC (US) and EU sanctions regimes. Certain jurisdictions like Iran, North Korea, and Syria are strictly prohibited, while others require enhanced scrutiny. Your VFA Agent and compliance officer should maintain an updated geographical risk assessment as part of your ongoing licensing obligations.

Malta VFA licensees can open business accounts with Maltese and EU banks, though increasingly they partner with crypto-friendly banks like Mizuho Bank Malta or fintech-specialized providers. Bank selection is stricter in 2026 due to enhanced regulatory scrutiny; most banks require MFSA license confirmation and robust AML documentation. Many VFAs also utilize international payment processors and stablecoin settlement networks to mitigate traditional banking friction.

A VFA license covers virtual asset service providers including exchanges and custodians, while a DLT Provider license applies to blockchain infrastructure operators issuing or managing digital ledger technology. VFA licenses are more common for cryptocurrency exchanges and wallet services, whereas DLT licenses suit blockchain projects and infrastructure platforms. The regulatory pathway, capital requirements, and compliance obligations differ significantly between the two, so early consultation with the MFSA is essential to determine which applies to your business model.

The MFSA can issue a Notice of Non-Compliance requiring corrective action within 30-90 days, depending on severity. Continued breaches may result in fines up to EUR 250,000, public reprimands, operational restrictions, or full license revocation. Minor infractions typically trigger remediation periods with mandatory corrective action plans, while serious violations involving AML failures or fraud can lead to immediate enforcement action and criminal referrals.

Annual submissions include audited financial statements, AML/CFT compliance reports, Board minutes confirming governance reviews, beneficial ownership updates, and a Compliance Officer's report detailing regulatory adherence. You must also file any material changes to your business model, key personnel, or risk management framework within 30 days. The MFSA may request additional documentation during supervisory reviews, which occur annually for newly licensed entities and biennially for established licensees.

Compare European Licences

Related European Crypto Jurisdictions

EU passportAll 27 states

🇬🇮

Gibraltar

4–8 monthsGFSC

◆ KEY METRICS

Malta VFA License Requirements

€50,000

Minimum Capital (Class 2)

8–12 weeks

Average Processing Time

€2,000–€5,000

Annual License Fee

Corporate Income Tax Rate

MFSA

Regulator (Malta Financial Services Authority)

EU MiCA Ready

Framework Compliance & Alignment

◆ PROCESS

Licensing Timeline

Week 1–2

Pre-Application Consultation

Engage MFSA, determine license class, prepare compliance roadmap

Week 3–6

Application Package Assembly

Draft AML/CFT policies, governance docs, technical architecture, financial projections

Week 7–8

Formal Submission to MFSA

Lodge complete application, pay submission fee (€300–€500)

Week 9–10

Initial Review & Q&A Phase

MFSA conducts completeness check, requests clarifications and supplementary documentation

Week 11–12

Final Approval & License Issuance

MFSA grants VFA license; commence regulated operations in Malta and EU

Malta Crypto License: VFA Act & MFSA Framework 2026