Malta VFA Licence: Complete Step-by-step Application Guide (including Mica/casp Options)

Introduction

Malta remains one of the European Union’s most established jurisdictions for digital asset regulation, and obtaining a Malta VFA licence continues to be the primary route for firms seeking to offer crypto-asset services from the island. Whether you are launching an exchange, providing custody solutions, or offering portfolio management for virtual financial assets, understanding the Malta Financial Services Authority (MFSA) application process and how it now intersects with the EU-wide Markets in Crypto-Assets Regulation (MiCA) is essential for a successful market entry.

Who Should Read This

This guide is written for founders planning a Malta-based crypto venture, compliance officers preparing an application file, and corporate-services providers advising clients on the VFA licensing route. It is equally relevant to existing VFA licence-holders evaluating the MiCA CASP transition.

What This Guide Covers

From initial eligibility assessment through MFSA submission, post-licence obligations, fees, timelines, and the critical MiCA CASP vs Malta VFA decision, every stage is covered in practical detail. Sections below include downloadable checklists, comparison tables, and realistic budget ranges to help you plan with confidence.

What Is the VFA Act and Who It Applies To

Malta’s Virtual Financial Assets Act (Chapter 590) commonly called the VFA Act is the primary legislation governing the issuance of virtual financial assets, the registration of whitepapers, and the licensing and supervision of VFA service providers. Enacted in 2018, it was among the first comprehensive crypto-asset regulatory frameworks in the world and established the MFSA as the single supervisory authority for VFA activities in Malta.

The Act applies to any person who provides, or intends to provide, a VFA service including reception and transmission of orders, custody, exchange, dealing, and the operation of a DLT exchange from or within Malta. Importantly, the Act also created the Financial Instrument Test, which determines whether a DLT asset qualifies as a virtual financial asset (subject to the VFA Act) or as a financial instrument, electronic money, or virtual token under other legislation.

VFA Classes (1–4) Quick Summary

The MFSA categorises VFA service providers into four classes, each with escalating governance, capital, and operational requirements. The table below provides an authoritative mapping of each class to its permitted services and approximate MiCA CASP equivalent.

Who May Apply

Applicants must be legal persons established or intending to establish in Malta. The MFSA expects an appropriate corporate form (typically a limited-liability company), a registered office in Malta, and directors and qualifying shareholders who satisfy fit-and-proper standards. Sole traders and unincorporated partnerships are not eligible.

How to Obtain a Malta VFA Licence 10 Practical Steps

The MFSA VFA application follows a structured sequence. Below are ten numbered steps reflecting the typical journey from preliminary classification to post-licence obligations.

Step 1 Preliminary Classification and the Financial Instrument Test

Before any application, the asset(s) you intend to service or issue must be classified. The MFSA’s Financial Instrument Test determines whether a DLT asset is a virtual financial asset, a financial instrument, electronic money, or a virtual token. You must document the test outcome and submit it with the application. (See the dedicated FIT section below for a practical scoring approach.)

Typical documents: FIT analysis memo, token term-sheet, legal opinion on classification.
Estimated time: 2–4 weeks.

Step 2 Decide VFA Class and Business Model

Map your intended services to VFA Classes 1–4. If you plan to offer custody alongside exchange services, for example, you may need a Class 3 or Class 4 licence rather than a Class 1. Consider future product roadmap items upgrading licence classes later requires a fresh MFSA assessment.

Typical documents: business-model canvas, services mapping memo.
Estimated time: 1–2 weeks.

Step 3 Incorporate a Malta Entity

Establish a Maltese limited-liability company with an appropriate Memorandum and Articles of Association (MOA). The MOA should expressly permit VFA-related activities. Appoint initial directors, a company secretary, and secure a registered office in Malta.

Typical documents: MOA/By-laws, director appointments, proof of registered office.
Estimated time: 1–3 weeks.

Step 4 Appoint a Recognised MFSA VFA Agent

The VFA Act mandates that every applicant retains an MFSA-registered VFA Agent before filing. The Agent submits the application, acts as the single point of contact with the MFSA, and conducts pre-application consultations to ensure the file is complete. (See VFA Agent section below for engagement checklist.)

Typical documents: signed VFA Agent engagement letter, agent due-diligence pack.
Estimated time: 1–2 weeks.

Step 5 Build the Corporate Governance and Compliance Team

Appoint key personnel: AML Officer / Money Laundering Reporting Officer (MLRO), Compliance Officer, Risk Manager, and for higher classes a Chief Information Security Officer (CISO) or Technology Lead. Each appointee must satisfy MFSA fit-and-proper requirements. (See Governance section below.)

Typical documents: CVs, personal questionnaires, compliance policy manuals.
Estimated time: 2–4 weeks (recruitment and vetting).

Step 6 Prepare Technical, Legal, and Operational Files

Compile a comprehensive business plan, whitepaper (if issuing a VFA), technology and ICT security arrangements (with attention to DORA alignment), AML/CTF policies, custody and client-asset segregation arrangements, and disaster-recovery plans.

Typical documents: business plan, AML/CTF manual, IT security policy, custody procedures, whitepaper draft.
Estimated time: 4–8 weeks.

Step 7 Financial Projections, Capital Proofs, and Audited Accounts

Prepare three-year financial projections, evidence of minimum regulatory capital or prudential safeguards, and audited or pro-forma accounts. The MFSA expects clear proof that the applicant can meet ongoing obligations from day one.

Typical documents: audited/pro-forma accounts, capital injection evidence, shareholder source-of-funds declarations.
Estimated time: 2–4 weeks.

Step 8 Submit the MFSA Application via Your VFA Agent

The VFA Agent files the complete application through the MFSA’s online portal, accompanied by all required forms, the document checklist, and the applicable application and supervisory fees. Ensure every exhibit is cross-referenced to the MFSA’s own checklist to minimise queries.

Typical documents: MFSA application forms, fee payment receipts, completed document checklist.
Estimated time: 1 week (submission only).

Step 9 MFSA Review, Queries, and Interviews

The MFSA conducts a detailed review and will typically issue one or more rounds of queries. Common areas include shareholder source-of-funds, IT-security controls, AML procedures, and governance arrangements. The Authority may also conduct interviews with proposed directors and key function holders. Prompt, well-documented responses are critical to maintaining momentum.

Estimated time: 2–6+ months (class- and complexity-dependent).

Step 10 Granting, Conditions, and Post-Licence Obligations

Upon approval, the MFSA grants the Malta VFA licence, potentially subject to conditions. Post-licence obligations include annual returns, supervisory-fee payments, notification of changes to controllers or directors, ongoing compliance reporting, and regular AML audits.

Typical documents: MFSA licence certificate, condition-compliance plan, annual reporting schedule.
Ongoing: continuous.

The Financial Instrument Test Framework and Practical Scoring Approach

When the FIT Applies

The Financial Instrument Test must be completed whenever a DLT asset’s classification is uncertain essentially for any token that could be characterised as either a virtual financial asset or a financial instrument under MiFID II. Issuers and service providers alike must perform the test before filing their Malta VFA licence application.

Core Questions to Assess

• Transferability: Is the asset recorded on a distributed ledger and transferable between holders?
• Rights conferred: Does the token confer profit-sharing, voting, or equity-like rights?
• Economic features: Does the token derive its value from an underlying asset, index, or benchmark?
• Governance: Are there issuer-side obligations resembling those of securities issuers?
• Underlying assets: Is the token backed by tangible or financial assets that may trigger Prospectus Regulation requirements?

Worked Examples

• Security-like token: A token conferring profit-sharing rights in a real-estate fund typically classified as a financial instrument, falling outside the VFA Act and into MiFID II / Prospectus Regulation territory.
• Utility token: A token granting access to a specific software platform with no transferable value beyond platform use generally classified as a virtual token (exempt from VFA licensing).
• Stablecoin: A token pegged to a fiat currency may qualify as electronic money or, under MiCA, as an asset-referenced token; the FIT and MiCA classification interact here.

Output and Consequences

The FIT outcome determines the regulatory regime. If classified as a financial instrument, the Prospectus Regulation and MiFID II apply. If classified as a VFA, the VFA Act and the Malta VFA licence regime apply. Applicants must include the completed FIT documentation in their MFSA submission, and the VFA Agent is expected to verify its accuracy before filing.

VFA Agent Appointment, Role, and Engagement Checklist

Who Can Be a VFA Agent

Only MFSA-registered practitioners may act as VFA Agents. Their mandatory duties include filing licence applications on behalf of the applicant, acting as the single point of contact with the MFSA, submitting whitepapers for registration, and providing ongoing compliance support for the duration of the licence.

Practical Engagement Terms

When contracting a VFA Agent, the engagement mandate should clearly specify deliverables and milestones, fee structure and payment schedule, response-time obligations, confidentiality and data-protection provisions, and conflict-of-interest management. Applicants are advised to interview multiple registered agents and request detailed proposals before appointment, as the quality and responsiveness of the VFA Agent relationship significantly influences overall application timelines.

Key Governance Roles and Organisational Model

Board Fit and Proper, Independence, and Record-Keeping

The MFSA requires each director of a VFA service provider to satisfy fit-and-proper criteria covering competence, integrity, and financial soundness. Board composition should include at least one independent non-executive director. Minutes, resolutions, and conflict registers must be maintained and made available to the MFSA on request.

Required Roles

• AML Officer / MLRO: Responsible for the firm’s AML/CTF framework, filing suspicious-transaction reports, and liaising with the Financial Intelligence Analysis Unit (FIAU).
• Compliance Officer: Monitors adherence to the VFA Rulebook, manages regulatory reporting, and oversees internal policies.
• Risk Manager: Identifies, assesses, and mitigates operational, financial, and technology risks; produces risk registers and board-level risk reports.
• CISO / Technology Lead: Oversees ICT security, cybersecurity testing, incident management, and alignment with the Digital Operational Resilience Act (DORA) requirements.

Outsourcing, Technology Arrangements, and ICT Security

Where critical functions are outsourced such as cloud hosting, wallet infrastructure, or AML screening the MFSA expects documented outsourcing agreements, business-continuity plans, and regular third-party audits. Firms must demonstrate that outsourcing does not impair supervisory oversight. ICT security arrangements should align with MFSA rulebook guidance and the EU’s DORA framework.

Ongoing Reporting, AML Obligations, and Record-Keeping

VFA licence-holders must submit annual compliance reports, audited financial statements, and AML audit findings to the MFSA. Client records, transaction logs, and communications must be retained for a minimum period as prescribed under Maltese law and the VFA Act.

Complete MFSA Application Document Checklist

The following checklist summarises the key exhibits typically required for a Malta VFA licence application. A fillable PDF version “VFA Application Checklist” is available for download to streamline your preparation.

• Company documents: Certificate of incorporation, MOA/By-laws, share register, beneficial-ownership declarations.
• Board and key function-holder appointments: Director resolutions, personal questionnaires, CVs, fit-and-proper declarations.
• Business plan: Three-year projections, target markets, product roadmap, revenue model.
• AML/CTF policies: Business risk assessment, customer due-diligence procedures, suspicious-transaction reporting framework.
• IT and security documentation: System-architecture diagrams, cybersecurity policy, penetration-testing reports, disaster-recovery plan.
• Client-asset segregation policy: Custody arrangements, omnibus vs. segregated wallet structures, reconciliation procedures.
• Financial records: Audited or pro-forma accounts, capital-injection evidence, shareholder source-of-funds declarations.
• FATCA/CRS details: Tax-reporting classifications and registrations.
• Whitepaper (if applicable): Draft whitepaper conforming to VFA Act First Schedule requirements.
• VFA Agent contract: Signed engagement mandate, agent registration confirmation.
• Financial Instrument Test: Completed FIT analysis and legal opinion.
• Licences in other jurisdictions: Copies of any existing authorisations held elsewhere.

MFSA Fees, Expected Capital, and Realistic Budget

Sample MFSA Application and Supervisory Fees

The table below provides indicative MFSA fee entries sourced from the VFA Regulations and fee schedules. All figures are approximate applicants should confirm current rates with the MFSA or their VFA Agent before filing.

MiCA CASP Capital Thresholds (Comparison)

Under MiCA (Regulation (EU) 2023/1114), minimum initial capital requirements for CASPs are set at EU level and vary by service type. The Annex IV thresholds are:

• €50,000: For advisory, order-execution, and placement services.
• €125,000: For custody and administration of crypto-assets on behalf of clients.
• €150,000: For exchange and trading-platform operations.

Estimated Operational Budget Ranges

The following are indicative estimates based on market observations. Actual costs vary significantly depending on licence class, technology choices, and whether functions are in-house or outsourced.

Note: These operational cost figures are indicative estimates and should not be relied upon without a detailed cost model tailored to your specific business. Budgeting via a prepared financial model is strongly recommended.

Realistic Timeline and Typical MFSA Queries

Typical Timeline by VFA Class

Application timelines for a Malta VFA licence vary widely based on class, complexity, and the quality of the initial submission. The following three-tier framework provides realistic expectations:

• Lean (fast-track) Class 1, well-prepared file: 3–4 months total (including 4–6 weeks MFSA preparation plus 6–10 weeks MFSA review). This assumes a complete file with minimal queries, an experienced VFA Agent, and a straightforward business model.
• Normal Class 2/3, standard complexity: 6–9 months total. Expect at least one round of substantive MFSA queries and a possible interview with key function holders. Technology and custody arrangements typically attract the most scrutiny.
• Complex Class 4 exchange or multi-asset platform: 9–18 months. Multiple MFSA query rounds are common; enhanced ICT audits, governance documentation, and client-asset segregation policies must meet higher thresholds. Regulatory data-processing lags may extend timelines further.

Common MFSA Queries During Review

Based on publicly available guidance and practitioner experience, typical MFSA queries during a VFA licence review include:

• Source of funds: Requests for additional evidence of shareholder source-of-wealth and capital-injection traceability.
• Governance gaps: Clarifications on board composition, independence of non-executive directors, and segregation of duties between compliance and commercial functions.
• AML/CTF framework: Detailed follow-up on business risk assessments, transaction-monitoring methodology, and FIAU liaison arrangements.
• IT security: Requests for updated penetration-testing reports, disaster-recovery drill evidence, and DORA-alignment statements.
• Financial projections: Sensitivity analysis, stress-testing assumptions, and clarity on break-even horizons.

Best Practices to Reduce MFSA Queries

Applicants who invest upfront in complete governance documentation, robust FIT analysis, professional technology audits, and a well-structured AML regime typically experience significantly shorter review cycles. Engaging a VFA Agent with a proven MFSA track record is equally important the Agent’s pre-filing quality checks are the single most effective lever to reduce delays.

MiCA CASP vs Malta VFA Options for New Applicants and Existing Licence-Holders

When to Apply Under VFA vs Directly Under MiCA CASP

With MiCA now in force across the EU, new applicants face a strategic choice. The decision depends on several factors:

• Passporting needs: MiCA CASP authorisation provides an EU-wide passport; a Malta VFA licence alone does not.
• Whitepaper obligations: MiCA imposes its own whitepaper requirements that differ from the VFA Act First Schedule.
• Capital thresholds: MiCA’s minimum capital floors (€50,000–€150,000) may exceed or differ from VFA class-specific requirements.
• Business timeline: Applicants already advanced in the VFA application process may complete faster under the existing framework and transition later.

Transition Steps for Existing VFA Licence-Holders

Existing Malta VFA licence-holders seeking MiCA CASP authorisation must undertake a modification or re-authorisation process through the MFSA. Industry observers expect the MFSA to implement streamlined transition procedures, and Maltese implementing legislation provides for transitional measures to facilitate migration. Applicants are advised to consult MFSA guidance and ESMA supervisory convergence materials for the latest timeline and procedural updates.

Capital and Permission Mapping

The comparison table in the VFA Classes section above maps VFA Classes 1–4 to their closest MiCA CASP equivalents. Key practical implications include the need to top up regulatory capital to meet MiCA floors (where current VFA requirements are lower) and the requirement to align governance, disclosures, and reporting with MiCA’s harmonised standards. Founders evaluating both routes will benefit from a detailed decision guide MiCA CASP vs Malta VFA: which route for your business? which explores these trade-offs in depth.

Conclusion Immediate Checklist

Securing a Malta VFA licence remains one of the most credible paths to regulated crypto-asset operations in the EU, particularly when combined with a clear MiCA CASP transition strategy. The process is demanding but navigable with thorough preparation, the right VFA Agent, and a governance framework that anticipates MFSA scrutiny.

Suggested Immediate Next Steps

• Complete the Financial Instrument Test for your token(s) and document the outcome before engaging a VFA Agent.
• Map your services to VFA classes and compare requirements against MiCA CASP thresholds to determine the optimal licensing route.
• Download the VFA Application Checklist and begin compiling corporate, governance, and technology documentation in parallel with your Malta entity incorporation.

Sources

• Legislation.mt Virtual Financial Assets Act (Chapter 590), consolidated text
• MFSA Virtual Financial Assets: overview and Financial Instrument Test
• MFSA VFA Rulebook and Rules
• MFSA VFA Regulations FAQs and VFA Agent Guidance (PDF)
• MFSA VFA Regulations Consultation Document and Fee Schedules
• MFSA Fintech Regulations (VFA fee schedules)
• EUR-Lex Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation MiCA)
• ESMA MiCA Supervisory Convergence and Digital Finance