iGaming License in Malta: MGA License Cost & Requirements 2026

MGA issues B2C (Business-to-Consumer) licenses under four game type categories. A single operator can hold licenses for multiple types simultaneously:

Companies that provide software, platforms, RNG engines, or other critical gaming infrastructure to licensed operators need a B2B (Critical Gaming Supply) recognition notice from MGA. This covers:

• Gaming software providers — slot developers, live dealer studios, game aggregators
• Platform suppliers — turnkey iGaming platforms, player account management systems
• RNG providers — random number generator certification and supply
• Payment processing — gaming-specific payment solutions integrated into operator platforms

B2B annual fees range from €3,000 to €35,000 depending on the scope of services and revenue generated.

• EU membership — as an EU member state, Malta-licensed operators can offer gaming services across the entire European Economic Area (450+ million consumers) without additional licenses in each country (subject to local market regulations).
• Regulatory credibility — the MGA is one of the most respected gaming regulators globally. An MGA license signals to players, payment providers, and partners that your operation meets the highest compliance standards. This directly impacts player trust and conversion rates.
• Favourable tax regime — Malta offers a 5% effective corporate tax rate through its dividend refund system (35% statutory rate with a 6/7 refund to shareholders). Gaming tax is 5% on revenue from Malta-based players only. Revenue from international players is not subject to gaming tax.
• 10-year license validity — MGA licenses are valid for 10 years (extended from the previous 5-year term), providing long-term operational stability and reducing renewal overhead.
• English-speaking jurisdiction — English is an official language of Malta, making business operations, legal proceedings, and regulatory communication straightforward for international operators.
• Mature iGaming ecosystem — Malta hosts a deep pool of experienced iGaming professionals, from compliance officers and MLRO specialists to marketing experts and platform developers. Major industry events (SiGMA, iGaming NEXT) are held in Malta annually.
• Strong player protection framework — MGA’s Player Protection Directive mandates responsible gaming measures, self-exclusion tools, and dispute resolution mechanisms — building player trust and reducing regulatory risk for operators.
• First EU state to regulate online gambling — Malta introduced remote gaming legislation in 2004, giving the jurisdiction over two decades of regulatory maturity and institutional knowledge that newer jurisdictions cannot match.

• Gaming Act 2018 (Cap. 583) — the primary legislation governing all gaming activities in Malta. Establishes licensing categories, regulatory powers, compliance requirements, and enforcement mechanisms. Replaced the previous Lotteries and Other Games Act.
• Player Protection Directive 2018 — mandates responsible gaming measures including self-exclusion, deposit limits, reality checks, and cooling-off periods. Operators must provide clear information about odds, risks, and problem gambling resources.
• Gaming Compliance and Enforcement Directive — sets out the compliance monitoring framework, audit requirements, reporting obligations, and sanctions for non-compliance. Empowers MGA to conduct both scheduled and unannounced audits.
• AML/CFT obligations — gaming operators are designated as “subject persons” under Malta’s Prevention of Money Laundering Act (PMLA), implementing EU Anti-Money Laundering Directives. This requires customer due diligence, transaction monitoring, suspicious transaction reporting, and appointment of an MLRO.

The Malta Gaming Authority is responsible for:

• Licensing — evaluating and issuing B2C and B2B gaming licenses
• Supervision — ongoing monitoring of licensed operators through audits, inspections, and regulatory returns
• Enforcement — imposing sanctions, fines, license suspensions, or revocations for non-compliance
• Player protection — overseeing dispute resolution, responsible gaming standards, and self-exclusion systems
• Policy development — publishing guidance, directives, and regulatory updates for the industry

In 2021, MGA conducted 54 on-site audits and 230 desktop reviews, covering 65.5% of all licensees — demonstrating the Authority’s active enforcement posture.

MGA operates a risk-based supervision model. Each licensee is assigned a risk profile based on revenue volume, player base geography, complaint history, and the complexity of the gaming offering. Higher-risk operators face more frequent and more intensive scrutiny; lower-risk operators are reviewed less often but are never exempt from checks.

Desktop Reviews vs. On-Site Audits

MGA uses two primary compliance tools:

• Desktop reviews — the most common form of oversight. The MGA’s compliance team requests specific documentation remotely: AML transaction monitoring reports, player complaint logs, responsible gaming metrics, financial statements, or marketing materials. The operator has a set deadline (usually 5–10 business days) to submit everything. Desktop reviews can be triggered by a schedule, a player complaint, or an anomaly the MGA flags in its own monitoring systems.
• On-site audits — a team from MGA visits the operator’s Malta office. They interview key function holders, review internal processes first-hand, inspect player fund segregation, verify that the physical office is genuinely operational, and test system access controls. On-site audits can be announced (typically 2–4 weeks’ notice) or unannounced. An audit usually lasts 1–3 days on-site, followed by a written report with findings and required remedial actions.

Thematic Inspections

In addition to routine reviews, MGA runs thematic inspections — targeted campaigns focused on a specific compliance area across multiple licensees at once. Recent thematic priorities include:

• AML-focused reviews — examining customer due diligence processes, enhanced due diligence for high-risk players, source-of-funds verification, and suspicious transaction reporting to the FIAU. MGA checks whether the operator’s risk appetite and AML procedures match in practice, not just on paper.
• Player protection-focused reviews — auditing self-exclusion implementation, deposit limit enforcement, reality check frequency, and how the operator handles vulnerable player indicators. MGA may test systems directly to verify they work as documented.
• Advertising & affiliate compliance — reviewing marketing materials, affiliate agreements, and bonus terms for compliance with MGA advertising guidelines and consumer protection standards.

What Happens After an Inspection

After any review or audit, MGA issues a formal report. If deficiencies are found, the operator receives a remediation timeline (typically 30–90 days depending on severity). Non-compliance can result in:

• Formal warnings and mandatory corrective action plans
• Administrative penalties (fines up to €500,000 per breach)
• License conditions or restrictions (e.g., suspension of player onboarding)
• License suspension or revocation in serious cases

In practice, most operators resolve findings during the remediation window. MGA’s approach is firm but collaborative — the regulator prefers corrective action over punitive measures, provided the operator demonstrates genuine commitment to compliance.

• Malta-registered company: you must incorporate a limited liability company with the Malta Business Registry (or establish a branch of an EU company in Malta). Non-EU parent companies can own the Malta entity — there are no restrictions on foreign ownership.
• Physical office in Malta: MGA requires all licensees to maintain a genuine physical office presence in Malta. A virtual address or registered agent alone is not sufficient.
• Minimum share capital: €40,000 for Type 4 (skill games); €100,000 for Types 1–2 (casino, betting); €40,000 for Type 3 (poker). The exact amount depends on the scope of operations and MGA’s assessment of financial adequacy.
• Bank account: a corporate bank account with a Malta-based or EU-based financial institution is required for operational funds and player fund segregation.
• Player fund protection: MGA mandates that player funds be held in segregated accounts, separate from operational funds, to protect players in the event of operator insolvency.

MGA requires all licensees to appoint Key Function Holders (KFHs) who are personally vetted and approved by the Authority. All KFHs must pass MGA’s fit-and-proper assessment:

• Key Person (CEO / Managing Director) — overall responsibility for the gaming operation. Must be approved by MGA and at least one key person must be resident in Malta.
• Compliance Officer — ensures the company adheres to all MGA regulations, licence conditions, and internal policies. Responsible for regulatory reporting and internal audits.
• MLRO (Money Laundering Reporting Officer) — oversees AML/CFT compliance, conducts enhanced due diligence on high-risk players, and files suspicious transaction reports with the Financial Intelligence Analysis Unit (FIAU).
• Key Technical Person — responsible for the technical integrity of the gaming platform, including RNG certification, system security, and data protection.

• Completed MGA application forms for all directors, shareholders, and KFHs
• Certified copies of passports and proof of address for all beneficial owners
• Criminal record certificates from all countries of residence (last 10 years)
• Financial statements and source of funds documentation
• Detailed business plan with 3–5 year financial projections
• AML/CFT policies and procedures manual
• Responsible gaming policy and player protection measures
• Technical documentation: platform architecture, security protocols, RNG certification
• Data protection impact assessment (GDPR compliance)
• Game testing certificates from MGA-approved testing laboratories

• Gaming servers: servers must be hosted in Malta or within the EU/EEA in MGA-approved data centres. Co-location and cloud hosting arrangements must be pre-approved.
• RNG certification: all RNG-based games must be tested and certified by an MGA-approved independent testing laboratory (e.g., eCOGRA, BMM Testlabs, iTech Labs, GLI).
• Game testing: each game offered must be individually tested for fairness, return-to-player (RTP) accuracy, and compliance with MGA technical standards.
• Player protection systems: self-exclusion mechanisms, deposit limits, session time limits, reality check pop-ups, and cooling-off periods must be built into the platform.
• IT security: penetration testing, vulnerability assessments, data encryption, access controls, and incident response procedures are required.
• Player verification: age verification, identity verification, and geolocation systems to prevent access from restricted jurisdictions.

Beyond MGA fees, operators should budget for the following first-year costs:

Malta’s dividend refund system works as follows:

• The Malta company pays 35% corporate tax on profits
• Upon distribution of dividends, the shareholder (typically a holding company) claims a 6/7 refund from the Malta tax authorities
• The net effective tax rate is approximately 5% (35% × 1/7)
• The statutory deadline for the refund is 14 days from when the claim is filed, though in practice processing may take longer

This structure is fully compliant with EU law and has been upheld by the European Commission. Most operators use a Malta operating company owned by a holding company in a jurisdiction with a favourable double-tax treaty network.

The most common comparison for operators starting out is Malta vs. Curaçao. The decision depends on your priorities:

• Choose Malta (MGA) if: your primary market is the EU, you want premium payment provider access (Visa, Mastercard, Apple Pay), you need regulatory credibility for partnerships, and you’re building a long-term brand.
• Choose Curaçao if: you need to launch quickly (2–4 months), your budget is limited, you serve non-EU markets (LATAM, Asia, Africa), and you plan to upgrade to an MGA license later.
• Choose both (dual-jurisdiction strategy): Many operators start with a Curaçao license to begin generating revenue quickly, then apply for an MGA license in parallel for EU market access and premium positioning.

• Self-exclusion system — operators must provide players with the ability to self-exclude for periods ranging from 6 months to permanent. Cross-operator self-exclusion is managed through MGA’s centralised system.
• Deposit limits — players must be able to set daily, weekly, and monthly deposit limits. Changes to increase limits must have a cooling-off period.
• Reality checks — automated pop-up notifications reminding players of session duration and spending at regular intervals.
• Problem gambling resources — operators must display prominent links to organisations like GambleAware and the National Council on Problem Gambling.
• Complaints handling — a formal complaints procedure must be in place, with unresolved disputes escalated to MGA’s dispute resolution service.

• Timeline (3–6 months) — while faster than many Tier-1 jurisdictions, the MGA licensing process is thorough. Operators who need to launch immediately may consider an interim Curaçao or Kahnawake license while the MGA application is processed.
• High upfront costs (€160,000+) — between company formation, share capital, compliance setup, technical audits, and Key Function Holder salaries, the first-year investment is substantial. Malta is not suitable for operators with limited budgets.
• Strict fit-and-proper checks — MGA conducts extensive background checks on all shareholders, directors, and KFHs. Undisclosed criminal history, financial difficulties, or connections to unlicensed gambling can result in application rejection.
• Physical presence requirement — unlike many offshore jurisdictions, MGA requires a genuine office and at least one Key Function Holder resident in Malta. This adds operational complexity and cost for remote-first teams.
• Ongoing compliance burden — the reporting and player protection obligations detailed above require dedicated compliance resources. Underinvestment in compliance is the most common reason for MGA enforcement actions.
• Restricted markets — while the MGA license provides broad market access, several major EU markets require separate local licenses (see detailed breakdown below).

An MGA license gives you a legal basis to operate in Malta and, under the EU principle of freedom of services, theoretical access to the entire EU/EEA. In practice, however, the largest European markets have established their own local licensing regimes. Operating with players from these countries on an MGA license alone carries significant legal and financial risk.

Category 1 — Local License Required

These markets actively enforce local licensing requirements. Accepting players without the relevant national license can result in fines, domain blocking, payment processing restrictions, and criminal liability:

Category 2 — State Monopolies (Market Closed)

These countries operate state monopolies where private online gaming operators are not permitted:

Category 3 — De Facto Open With MGA

These are markets where the MGA license is accepted de facto, either because there is no dedicated local online gambling regime or because the local regime does not actively block MGA-licensed operators:

Ireland, Luxembourg, Cyprus (partially), Slovenia (limited to local casinos), most Baltic states (Latvia and Lithuania — with nuances), and a wide range of non-EU markets: Canada, New Zealand, much of Latin America, Africa, and Asia — where the MGA license is recognised as a mark of quality and trustworthiness.

FATF Blacklist Restriction

Separately from market-specific rules, MGA prohibits operators from accepting players or conducting business with jurisdictions on the FATF (Financial Action Task Force) blacklist. This currently includes countries such as North Korea, Iran, and Myanmar. MGA updates this list periodically, and operators must maintain geolocation and IP-blocking systems to enforce these restrictions.

If you plan to operate for more than 2–3 years and expect to generate significant revenue, obtaining your own MGA license is almost always more cost-effective than paying 15%–40% revenue share to a white-label provider. However, a white-label can be a smart first step to validate your market before committing to a full license application.

• 500+ licenses obtained since 2016 — across 40+ jurisdictions, including Malta, Curaçao, Gibraltar, and Isle of Man. We know what regulators expect.
• End-to-end service — from company formation and compliance documentation to MGA application management, technical audit preparation, and ongoing regulatory support.
• Dedicated project manager — a single point of contact who manages your application timeline, coordinates with MGA, and keeps you informed at every stage.
• Key function holder network — we can source experienced Compliance Officers, MLROs, and other KFHs who are already MGA-approved and based in Malta.
• Transparent pricing — fixed-price packages with no hidden fees. You know the total cost before we start.
• Ongoing compliance support — we don’t disappear after license issuance. Monthly return preparation, annual audit coordination, and continuous regulatory advisory.