A B2C remote gaming licence in Malta requires an EU/EEA entity, a €5,000 non-refundable application fee, a €25,000 annual fee for standard operators, and ongoing technical and AML/CFT oversight. Type 4-only operators pay €10,000 annually, but the MGA regime remains a substantive licensing process, not a simple registration.
You may be at the point where your product is built, investors want a launch date, and your team is comparing Malta with other jurisdictions. The uncomfortable question isn't whether you can submit forms. It's whether your company, platform, people, controls, and evidence will withstand the MGA's scrutiny before you accept a revenue-generating player.
That distinction drives every serious MGA licensing project. The regulator tests corporate suitability, operational planning, technical integrity, and financial crime controls through separate review stages. A polished front end and a well-funded launch won't compensate for weak source-of-wealth evidence, unclear infrastructure ownership, incomplete change records, or a platform that can't produce reliable compliance evidence.
Table of Contents
- Why MGA Licensing Requirements Are a Strategic Gate, Not a Formality
- MGA Licence Types, Eligibility, and Fee Bands
- The MGA Application Journey From Fit-and-Proper to System Review
- Technical Infrastructure, Hosting, and Change Control Obligations
- Mapping MGA Requirements to Platform Capabilities
- Ongoing Compliance, AML/CFT Scrutiny, and Post-Approval Governance
- Planning Checklist for an MGA-Ready Launch
Why MGA Licensing Requirements Are a Strategic Gate, Not a Formality
A Series A-funded gaming team might shortlist Malta alongside Curaçao and the Isle of Man. Its commercial priorities are familiar: launch quickly, access established suppliers, support casino and sportsbook products, and keep enough flexibility for future markets. The team may initially treat the MGA application as a jurisdictional choice followed by an administrative filing.
That approach creates problems quickly. The Malta Gaming Authority doesn't just record an operator and issue permission to trade. It examines whether the applicant is suitable to own and manage a gaming business, whether the proposed model is financially and operationally credible, and whether the technology can protect players and preserve regulatory evidence.
Practical rule: Treat every statement in the application as a future audit question.
The cost of the licence itself is only one part of the commitment. The applicant needs clear ownership records, documented governance, competent key personnel, a defensible business plan, supplier oversight, reliable player protection controls, and technical documentation that matches the live platform. An operator that describes one architecture in its application and deploys another at launch has created a regulatory problem before its first marketing campaign.
The MGA's own licensing data shows why this is a gate rather than a formality. In 2025, the MGA received 38 applications for new gaming licences and issued 19 licences, a figure published in its 2025 annual report and financial statements. The same report states that, by the end of 2024, 315 companies held 323 gaming licences, confirming both the scale of the regulated base and the fact that one company can hold multiple licences.
This doesn't mean an applicant should chase approval statistics. It means the team should plan for review, questions, remediation, and evidence production. A launch plan built around how to open a casino is incomplete unless it also accounts for the regulatory operating model behind the brand.
The right decision is therefore strategic. Choose Malta if you want a recognised European regulatory framework and are prepared to operate with disciplined governance. Don't choose it because the published fee appears manageable.
MGA Licence Types, Eligibility, and Fee Bands
Start by defining the activity, not by selecting a fee. Under Malta's current remote gaming framework, a B2C Gaming Service Licence is required for a Maltese or EU/EEA entity that wants to offer gaming services from Malta, to Maltese persons, or through a Maltese legal entity. The MGA's current application route is described in its remote gaming services guidance.
The historical structure used four remote gaming classes. Class 1 covered operators managing their own risk on repetitive games such as casino-style games and online lotteries. Class 2 covered remote betting on events based on a matchbook. Class 3 covered promoting or abetting remote gaming in or from Malta. Class 4 covered hosting and managing other remote gaming operators.
The shift away from that legacy class structure matters. It reflects movement toward a more unified authorisation model with clearer activity scopes and fee bands. Don't use old class terminology as though it automatically determines the licence you need today. Map your actual products, risk model, and delivery role to the current application route.
| Licence Type | Eligible Activity | Application Fee | Annual Fee |
|---|---|---|---|
| Standard B2C remote gaming service | Gaming services offered by an eligible Maltese or EU/EEA entity | €5,000 | €25,000 |
| Type 4-only activity | Solely Type 4 gaming services | €5,000 | €10,000 |
The MGA identifies the €5,000 application fee as one-time and non-refundable, while the standard annual licence fee is €25,000 and the annual fee for operators providing solely Type 4 services is €10,000. These are published regulatory charges, not a complete launch budget. You still need to fund compliance staff, legal work, testing, supplier due diligence, security, reporting, and platform operations.
Eligibility also goes beyond incorporation. The applicant must present transparent ownership, directors and key persons who can pass fit-and-proper scrutiny, and an operating model that the regulator can understand and supervise. For a B2B provider, don't assume the lower commercial visibility of a supplier removes the need for substance analysis. The MGA maintains a separate application route for game providers and back-office providers, and the business must establish which authorisation or recognition route applies before building its launch plan.
The MGA Application Journey From Fit-and-Proper to System Review
The application should be managed as a sequence of gates. Passing one gate doesn't guarantee passage through the next, and weaknesses discovered late in the process usually cost more to fix than weaknesses identified during preparation.
Gate one tests who controls the business
The fit-and-proper assessment examines shareholders, ultimate beneficial owners, directors, and other relevant key persons. Prepare complete identity, ownership, professional history, regulatory history, litigation, insolvency, and source-of-wealth evidence. Inconsistencies between corporate records, personal declarations, and financial documents create avoidable delays.
The MGA's process includes a fit-and-proper assessment, business-plan review, operational and statutory review, and system review, as set out in its application materials. Each stage asks a different question. Suitability asks whether the people are acceptable. The business review asks whether the model is credible. The system review asks whether the live technical environment can deliver what the application promises.
Gate two tests whether the model can operate
Your business plan must explain target markets, products, customer journeys, payments, suppliers, revenue logic, responsible gaming, and compliance ownership. The operational review then tests whether those statements connect to actual policies and accountable people.
Prepare the following before filing:
- Ownership file: Keep corporate charts, beneficial ownership records, identification documents, and wealth evidence consistent.
- Operating model: Document products, target markets, payment flows, suppliers, staffing, and governance.
- Compliance design: Show how KYC, AML/CFT, player protection, complaints, and reporting work in practice.
- Technical pack: Provide architecture diagrams, system specifications, security controls, and testing evidence.
Gate three tests the system, not the presentation
A system review is where many attractive applications become operationally uncomfortable. The MGA needs confidence that the platform can identify players, enforce jurisdictional restrictions, calculate balances correctly, preserve logs, manage risk, and support supervisory access. Supplier certifications help, but they don't replace responsibility for the integrated operating environment.
The operator should also expect iterative remediation. Build a controlled response process for MGA questions, assign owners to every finding, and preserve the final answer with supporting evidence. A team that treats each query as a legal writing exercise will struggle. A team that treats it as a control test can respond with configuration records, screenshots, policies, and audit evidence.
Vendor governance is part of this picture. A vendor management framework for gaming operators should connect supplier contracts, due diligence, service ownership, incident escalation, and technical dependencies to the application narrative.
Technical Infrastructure, Hosting, and Change Control Obligations
The MGA expects the applicant to disclose its full technical infrastructure footprint before licensing. That includes a network schematic, hardware and virtual machines, internal addressing information, and the exact geographic locations of premises where gaming systems, control systems, and regulatory data are hosted, as stated in the technical infrastructure and hosting directive.
This requirement has a practical consequence. Your infrastructure diagram must describe the environment that will run the business, not an aspirational cloud design prepared for the application. Hosting locations must meet a high level of information security and remain subject to an Information Security Management System for the entire licence term. Security governance therefore continues after approval.
The evidence must remain current
The MGA requires licensees to maintain updated documentation for the key technical setup. The record should cover hardware make and model, hardware location, virtual machine identifiers and hosting locations, network interconnections, firewall and router specifications, and applications installed on each component.
The same directive requires audit logs for changes to the key technical setup to be retained for at least two years, according to the Gaming Authorisations and Compliance Directive. Essential components also require additional safeguards to reduce operational risk.
| Obligation | What the MGA Expects | Evidence Required |
|---|---|---|
| Infrastructure mapping | A traceable view of gaming, control, and regulatory-data environments | Network schematic, hosting locations, system inventory |
| Security governance | Hosting locations governed by a high-level security framework and ISMS | Security policies, ISMS records, access controls, review evidence |
| Configuration management | Current technical details for hardware, virtual machines, network devices, and applications | Configuration register, ownership records, approval history |
| Change traceability | A preserved record of changes to key technical setup | Change tickets, approvals, implementation records, audit logs |
| Essential-component protection | Additional safeguards for components whose failure could create material operational risk | Resilience controls, monitoring, testing, incident records |
Change control is a licensing issue
A new game supplier, payment processor, wallet design, platform migration, or control-layer change can affect the regulated operating model. The operator must assess the change, identify whether MGA notification or approval is required, update technical and operational documentation, test the control impact, and preserve the decision trail.
Don't let engineering deploy first and ask compliance later. Put compliance review into the release process, with clear materiality criteria, approval authority, rollback planning, and evidence retention. That design protects the operator during audits and makes future expansion less disruptive.
Mapping MGA Requirements to Platform Capabilities
The most useful way to evaluate a gaming platform is to translate every regulatory obligation into a capability that staff can operate and auditors can verify. A policy saying that the business performs customer due diligence is weak evidence if the platform can't show when verification occurred, what data was checked, who approved an exception, and what happened afterward.
KYC must control the player journey
A credible KYC workflow should support identity-document collection, verification outcomes, escalation, sanctions and PEP screening, duplicate-account detection, and source-of-funds or source-of-wealth review where risk requires it. The important capability isn't merely uploading documents. It's enforcing decision points before the player reaches restricted activity.
A strong workflow also separates automated results from human overrides. Every override should record the decision-maker, reason, supporting evidence, and next review action. That creates a defensible trail for compliance teams and gives the regulator a coherent view of how risk decisions are made.
Location controls must enforce licence scope
Geofencing should combine player-location signals, IP intelligence, account information, payment indicators, and configurable jurisdiction rules. It should block or restrict activity when the available evidence conflicts, rather than relying on a single location field.
This capability belongs in the account, cashier, bonus, and game layers. If the front end blocks a player but an API or payment route still permits a restricted transaction, the control isn't complete. Test controls across registration, login, deposits, withdrawals, gameplay, promotions, and support interventions.
Logs and reporting turn operations into evidence
Immutable or tamper-evident audit logs should capture authentication, account changes, transactions, wallet movements, game events, risk decisions, responsible gaming interventions, and administrative activity. The log design should support search, export, timestamps, user attribution, and retention according to the applicable obligation.
NexGrate is one platform option that combines casino and sportsbook operations with player accounts, wallets, KYC/AML workflows, fraud controls, reporting, audit logs, geofencing, and responsible gaming features. The selection test remains operational: confirm that the configuration, integrations, ownership model, and evidence outputs match the licence application.
A regulator doesn't inspect your feature list. It inspects whether the control worked, who made the decision, and whether you can prove it.
Ongoing Compliance, AML/CFT Scrutiny, and Post-Approval Governance
Winning the licence changes the operating phase, not the standard. The MGA's supervisory activity demonstrates that AML/CFT remains an active area of scrutiny. Its 2025 interim report records 11 AML/CFT compliance examinations initiated during the first six months of 2025, which is evidence of supervisory engagement rather than a one-time application check. The report is available in the MGA 2025 interim report.
Substance must match the licence holder
A licence-only model is a poor assumption for a serious launch. Recent market guidance cited in the brief indicates that authorisation holders may need to demonstrate genuine economic substance in Malta, including a real office and Malta-resident key roles such as compliance, MLRO, player protection, customer support, and IT or security.
Treat substance as an operating design question. Decide which functions sit in Malta, who owns decisions, how deputies are appointed, how coverage works during absence, and how the board receives compliance reporting. A nominal title without practical authority will not strengthen the application.
AML/CFT controls need ownership and escalation
The MLRO must have access to relevant data, authority to escalate concerns, and a documented relationship with senior management and the board. The platform should support risk classification, transaction monitoring, alert investigation, enhanced due diligence, suspicious transaction escalation, and reliable case records.
Don't separate AML from payments and customer operations. A withdrawal review may depend on deposit history, chargebacks, bonus use, account links, device signals, and prior KYC decisions. If those records sit in disconnected systems, the operator creates manual reconciliation risk and slows every investigation.
Post-approval governance must control change
Notify or seek approval for relevant changes to ownership, key persons, material suppliers, systems, and operating arrangements before implementation where the MGA framework requires it. Keep the licence file, system inventory, policies, supplier register, risk assessments, and reporting templates aligned with the live business.
Use a compliance calendar, board reporting pack, incident runbook, and change register. The compliance reporting framework should connect regulatory submissions to source data, accountable owners, review dates, and evidence retention.
Planning Checklist for an MGA-Ready Launch
An effective launch plan produces evidence in the order the MGA needs to assess it. Don't begin with website design and leave governance for the application phase. Establish the corporate model, define accountability, map the system, and then prove that the controls operate together.
Milestone one establishes corporate readiness
Confirm the EU/EEA entity, ownership structure, directors, key persons, and substance footprint. Appoint the MLRO and define compliance, player protection, customer support, and IT or security responsibilities. Prepare the corporate records and personal due diligence files before the application team starts drafting.
Deliverable: a consistent ownership and governance pack that explains who controls the business and who performs each regulated function.
Milestone two assembles the application pack
Build the business plan around the actual product and target-market strategy. Include supplier contracts, payment flows, responsible gaming procedures, AML/CFT policies, complaints handling, financial information, and technical architecture. Make sure the contracts and diagrams agree with the operating narrative.
Deliverable: a submission pack in which every material statement has an owner and supporting evidence.
Milestone three proves platform readiness
Configure KYC and screening workflows, source-of-funds escalation, geofencing, wallet controls, responsible gaming tools, transaction monitoring, and audit logging. Test registration through withdrawal, including restricted-location scenarios, failed verification, suspicious activity alerts, self-exclusion, account closure, and administrative overrides.
Deliverable: test scripts, results, remediation records, configuration snapshots, and sample reports that demonstrate the platform can enforce policy.
Milestone four prepares the post-approval operation
Write the change-control policy before launch. Define how the team handles new games, suppliers, payment methods, platform releases, security incidents, data issues, and material control changes. Prepare recurring reporting templates and a post-launch review cycle so the first operational period doesn't become an improvised compliance exercise.
Deliverable: a live governance calendar, incident response runbook, change register, reporting schedule, and evidence repository.
Senior compliance view: File only when the business can demonstrate its controls. Promises about future capability make an application fragile.
Use the published fees as the starting point, not the budget. The application fee and annual fee are visible. Staffing, legal review, technical testing, security governance, supplier assurance, remediation, and ongoing supervision determine the operational cost. A platform can reduce integration and evidence fragmentation, but it can't replace accountable management or a credible substance model.
NexGrate provides a turnkey casino and sportsbook platform with integrated wallets, KYC/AML workflows, payments, geofencing, audit logs, reporting, and responsible gaming controls for operators preparing for regulated launches. Visit NexGrate to assess how its platform capabilities can support an MGA-ready operating model and ongoing compliance governance.