Step-by-step Mica Authorisation Process in Malta (2026): Prepare, Documents, Timeline & Technical Readiness

The MiCA authorisation process in Malta (2026) is the procedural gateway every crypto-asset service provider must now navigate to operate lawfully within the European Union. Since 1 July 2026, the Markets in Crypto-Assets Regulation (MiCA) is fully enforceable across all EU Member States, meaning any entity offering crypto-asset services, custody, exchange, transfer, advisory or portfolio management, must hold a valid Crypto-Asset Service Provider (CASP) authorisation or cease operations. In Malta, the Malta Financial Services Authority (MFSA) administers this process under both the directly applicable EU regulation and the domestic Markets in Crypto-Assets Act (Cap. 647).

This guide maps each stage of the CASP authorisation process, from eligibility assessment through post-authorisation obligations, aligned with the MFSA’s Circular to the Industry on the Authorisation Process for MiCA Applicants issued on 10 December 2024.

Overview of the MiCA Authorisation Process and Who It Applies To

MiCA establishes a single EU-wide licensing framework for crypto-asset service providers. Before its enforcement, Malta operated under its own Virtual Financial Assets (VFA) framework. That national regime is now superseded by MiCA for services falling within its scope. Any firm wishing to provide one or more of the ten categories of crypto-asset services listed in the regulation must obtain CASP authorisation from the competent authority of its home Member State, in Malta, the MFSA.

The MiCA requirements in Malta apply to entities that provide services such as the operation of a trading platform for crypto-assets, exchange of crypto-assets for funds or other crypto-assets, custody and administration of crypto-assets on behalf of clients, execution of orders, placement of crypto-assets, and advice on crypto-assets. Token issuers offering asset-referenced tokens or e-money tokens face separate authorisation requirements under MiCA’s Title III and Title IV provisions, which are outside the scope of this CASP-focused guide.

The MFSA oversees MiCA readiness from a supervisory perspective through its Crypto-assets division. Applicants should reference the MFSA’s dedicated crypto-assets page and the December 2024 circular as the primary procedural authorities. ESMA’s peer review work has also highlighted supervisory expectations that national competent authorities, including the MFSA, are expected to follow, a factor that shapes the depth of evidence Malta now demands from applicants.

Eligibility and Prerequisites for MiCA Authorisation in Malta

Eligibility checklist

Before initiating the CASP authorisation process, applicants must confirm they meet the following baseline MiCA requirements in Malta:

• Legal entity in Malta. The applicant must be a body corporate incorporated or registered in Malta, or a branch of an EU or third-country firm established in Malta. A foreign company cannot apply directly without a Maltese corporate presence, it must incorporate a subsidiary or register a branch.
• Minimum initial capital. MiCA prescribes minimum own-funds requirements that vary by service category, with the MFSA expecting applicants to demonstrate capital adequacy at the point of submission. The precise threshold depends on the services sought (e.g., custody-only versus full-service exchange).
• Fit and proper management. All members of the management body, qualifying shareholders, and the designated Money Laundering Reporting Officer (MLRO) must satisfy fit-and-proper assessments. The MFSA evaluates reputation, competence, governance experience, and absence of criminal convictions.
• AML/KYC framework. A fully documented anti-money laundering and counter-terrorism financing framework must be in place before application, including customer due diligence procedures, transaction monitoring mechanisms, and suspicious transaction reporting protocols.
• IT resilience and custody arrangements. The applicant must demonstrate operational resilience, including system architecture documentation, cybersecurity controls, and, where custody services are offered, a clearly defined custody model with segregation safeguards.
• Business continuity plan. A documented plan addressing service disruption, data recovery, and orderly wind-down scenarios is required.

Transition from VFA to MiCA

Existing holders of a VFA Services Licence issued under Malta’s former framework face a specific transition path. The MFSA Circular (10 December 2024) requires VFA licence holders to submit a Board resolution confirming their intent to apply for CASP authorisation and to initiate the formal surrender of the VFA licence once MiCA authorisation is granted. The transition from VFA to MiCA is not automatic, a full application is required. Entities that fail to obtain CASP authorisation by the enforcement date must cease providing crypto-asset services.

Step-by-Step CASP Authorisation Process in Malta

The following eight steps map the end-to-end CASP authorisation process as aligned with MFSA procedural expectations and the December 2024 circular. Each step identifies who is responsible and the principal deliverables.

Step 1: Conduct a pre-application assessment and define service scope

The applicant’s legal and compliance team identifies which of MiCA’s ten service categories the business intends to offer. This scoping exercise determines the capital requirements, the technical evidence needed, and the specific conditions the MFSA will attach to the licence. During this phase, many applicants engage with the MFSA informally to clarify expectations and confirm interpretation of the regulation’s service definitions.

Step 2: Complete corporate and governance preparations

The applicant incorporates a Maltese legal entity (if not already established), appoints the management body, designates an MLRO, and passes a Board resolution confirming intent to apply for CASP authorisation. The MFSA Circular (10 December 2024) specifically mandates this Board resolution as a submission item. Qualifying shareholders must be identified and their personal questionnaires prepared for fit-and-proper assessment.

Step 3: Prepare the AML/KYC and compliance framework

The compliance function drafts the full suite of AML/CFT policies: customer due diligence procedures, enhanced due diligence triggers, transaction monitoring rules, suspicious transaction reporting workflows, sanctions screening protocols, and record-keeping policies. These documents must comply with both MiCA’s provisions and Malta’s Prevention of Money Laundering Act. The MFSA MiCA checklist expects these as stand-alone policy documents, not summaries embedded in the business plan.

Step 4: Achieve technical and security readiness

This is where many applications stall. The applicant must produce detailed evidence of IT architecture, cybersecurity controls, and, where applicable, custody model design. Key deliverables include system architecture diagrams, penetration test reports, an ISO 27001 certificate or equivalent attestation of information security management, hardware security module (HSM) documentation for cryptographic key management, and data protection impact assessments. The MFSA increasingly expects evidence of operational resilience aligned with ESMA’s supervisory focus areas, including incident response plans and recovery time objectives.

Step 5: Prepare the application pack and commission third-party reports

The applicant assembles all MiCA application documents into a structured submission. This includes the business plan, programme of operations, financial projections, audited financial statements (or opening balance sheet for new entities), smart contract audit certificates (where the service involves interaction with on-chain protocols), and all policy documents from Steps 2–4. External auditors and technical assessors produce their reports during this phase. The MiCA compliance checklist 2026 should be used to cross-reference every MFSA requirement against the assembled evidence.

Step 6: Submit the application to the MFSA

The complete application pack is submitted to the MFSA through the Authority’s designated submission channel. The applicable filing fee is payable at submission. Applicants should confirm the current fee schedule directly with the MFSA, as fee structures are subject to periodic revision. The MFSA will acknowledge receipt and confirm whether the application is complete or requires supplementary information before formal review begins.

Step 7: Respond to MFSA review queries and follow-up requests

The MFSA conducts a detailed review of the application and will issue queries, typically in writing, addressing gaps, ambiguities, or requests for additional evidence. Industry observers expect the MFSA’s inquiry cycles to be more rigorous in 2026, reflecting ESMA peer review findings that encourage national competent authorities to intensify scrutiny of governance and technical controls. Applicants should allocate dedicated compliance and legal resources to respond promptly; delays in responding can extend the overall MiCA timeline in Malta significantly.

Step 8: Receive the decision and fulfil post-authorisation obligations

If the MFSA is satisfied, it issues the CASP authorisation. The licence specifies which services the entity is permitted to provide. Post-authorisation obligations include ongoing capital adequacy reporting, IT incident notification to the MFSA within prescribed timeframes, annual compliance reports, maintenance of AML/KYC controls, and notification of material changes to governance, ownership, or service scope. For entities transitioning from VFA, the formal surrender of the VFA licence is completed at this stage.

Required MiCA Application Documents

The MFSA expects a comprehensive set of documents structured in a logical order that mirrors the regulatory requirements. The following table lists the principal MiCA application documents the MFSA requires, drawing from the December 2024 circular and the Authority’s crypto-assets guidance.

Applicants should treat this as a minimum list. The MFSA may request supplementary evidence during the review phase, particularly on technical assurance matters such as HSM key ceremony documentation, source code attestations, and data protection impact assessments. All documents should be submitted in English or Maltese and, where relevant, in PDF format with clear version control.

MiCA Timeline in Malta: Key Deadlines and Realistic Durations

Understanding the MiCA timeline in Malta is critical for planning. The entire process, from initial scoping through to authorisation decision, typically spans 6 to 12 months, depending on the complexity of the applicant’s service model, the completeness of the initial submission, and the volume of MFSA queries. The table below provides a detailed phase-by-phase breakdown.

The critical deadline that overshadows the entire process is 1 July 2026, the date from which MiCA is fully enforceable. Entities providing crypto-asset services without authorisation after that date are operating unlawfully. For VFA licence holders, the transition from VFA to MiCA must be completed before the VFA framework ceases to have effect. The likely practical effect of compressed timelines in 2026 is that the MFSA may process a higher volume of applications, potentially extending review windows. Applicants are strongly advised to initiate the process as early as possible and to validate expected timelines directly with the MFSA during pre-application engagement.

Costs, Fees, and Financial Considerations

The cost of obtaining CASP authorisation in Malta comprises MFSA filing fees, external professional costs, and ongoing operational expenditure. The MFSA publishes its fee schedule separately and applicants should verify the current filing fee directly with the Authority before submission, as fee levels are subject to revision.

Industry observers expect total all-in costs for a straightforward single-service CASP application to range from approximately €100,000 to €250,000 including the first year of operational expenditure, rising considerably for multi-service platforms with complex custody models.

What Changes in 2026 for the MiCA Authorisation Process in Malta

Three developments converge in 2026 to reshape the regulatory landscape for crypto-asset service providers seeking authorisation in Malta.

Full MiCA enforcement from 1 July 2026. The Markets in Crypto-Assets Regulation is directly applicable across all EU Member States from this date. Entities that have not obtained CASP authorisation, or that are not covered by a transitional arrangement, must cease providing crypto-asset services. This is not a soft deadline; enforcement action is available to the MFSA from day one.

MFSA Circular (10 December 2024) introduces Malta-specific submission requirements. The circular sets out the MFSA’s procedural expectations for MiCA applicants, including the mandatory Board resolution confirming intent to apply, the formal VFA licence surrender procedure for transitioning entities, and enhanced technical assurance evidence. These items supplement MiCA’s own application requirements and reflect the MFSA’s interpretation of its supervisory obligations under the new framework.

ESMA peer review sharpens supervisory scrutiny. ESMA has identified opportunities to strengthen MiCA authorisation processes across Member States, with particular focus on the quality of governance assessments, AML controls, and technical resilience evidence. Early indications suggest that national competent authorities, including the MFSA, are responding by intensifying inquiry cycles and demanding more granular documentation on custody arrangements, HSM key management, and operational resilience testing.

The combined effect for applicants is a compressed preparation window, higher documentation standards, and less tolerance for incomplete submissions. Firms that began the transition from VFA to MiCA before mid-2025 will have a significant advantage; late entrants face the risk of processing backlogs and potential service interruptions.

Common Pitfalls and How to Avoid Them

• Incomplete AML/KYC framework. Submitting summary-level AML policies rather than stand-alone, fully detailed procedural documents is a frequent reason for MFSA queries. Draft each policy as a complete, auditable document before submission.
• Weak or missing technical evidence. Applicants that cannot produce a current penetration test report, ISO 27001 certificate, or detailed system architecture diagram face delays. Commission these deliverables early, they often have lead times of 4–8 weeks.
• Omitting the Board resolution or VFA surrender letter. The MFSA Circular (10 December 2024) makes the Board resolution a mandatory submission item. VFA licence holders must also initiate the surrender process. Missing either document will halt the application.
• Underestimating response time to MFSA queries. The MFSA’s review generates detailed follow-up questions. Allocate a dedicated team to draft responses within days of receipt; delays of even 2–3 weeks per query round can add months to the overall timeline.
• Insufficient smart contract audit scope. Where the service interacts with on-chain protocols, a cursory code review is inadequate. The audit must cover logic errors, reentrancy vulnerabilities, access control, and economic attack vectors.
• Failing to validate timelines with the MFSA. Published estimates are indicative. The only reliable way to understand the current processing queue is to engage with the MFSA during the pre-application phase.

Sources

1. Malta Financial Services Authority, Circular to the Industry on the Authorisation Process for MiCA Applicants (10 December 2024)
2. Malta Financial Services Authority, Crypto-Assets
3. EUR-Lex, Markets in Crypto-Assets Regulation (MiCA)
4. European Commission, Markets in Crypto-Assets (MiCA)
5. European Securities and Markets Authority (ESMA), MiCA Authorisations Peer Review
6. Malta Government Legislation, Markets in Crypto-Assets Act (Cap. 647)