Mica CASP Authorisation in Malta, Requirements, Process, Costs and Faqs

Securing a MiCA CASP authorisation Malta is now the central regulatory milestone for any crypto-asset business seeking a compliant, passportable foothold inside the European Union. Since the Markets in Crypto-Assets Regulation (MiCA) became fully applicable to crypto-asset service providers, Malta has repositioned its respected but national Virtual Financial Assets (VFA) regime beneath a single, harmonised EU licensing framework administered by the Malta Financial Services Authority (MFSA). This guide, published by Global Law Experts, is written for founders, compliance officers, exchange operators, custodians, fintech advisers and in-house counsel who need a practical, source-backed roadmap to the MiCA CASP authorisation in Malta, covering eligibility, the step-by-step MFSA application, costs, timelines, prudential standards and EU passporting under Article 65.

Legal status of crypto trading in Malta (brief)

Crypto trading is legal in Malta. Crypto-asset services now fall within the EU-wide MiCA framework, meaning platforms offering in-scope activities must be authorised rather than merely registered. The MiCA Regulation (EU) 2023/1114 establishes the authorisation obligation, with the MFSA MiCA Rulebook setting out Malta-specific procedural detail.

Why Malta for a MiCA CASP authorisation?

Malta was among the earliest European jurisdictions to build a dedicated crypto regulatory regime through its VFA framework, giving the MFSA years of supervisory experience with crypto-asset firms before MiCA arrived. That institutional memory is a genuine asset for applicants: the MFSA understands custody architecture, exchange matching engines and token mechanics, which can streamline the technical dialogue during review. Malta also offers a mature financial-services ecosystem, banking relationships, audit firms, IT security specialists and multilingual compliance talent, clustered in a single English-speaking jurisdiction with EU membership.

Crucially, a MiCA CASP authorisation Malta obtained from the MFSA is passportable across all EU and EEA member states under Article 65 of MiCA, allowing a single licence to support cross-border service provision without separate national authorisations. Following a 2025 ESMA fast-track peer review, the MFSA has sharpened its supervisory and documentation expectations, meaning well-prepared applicants who anticipate those standards can move efficiently, while weak applications face extended queries. Malta remains an attractive domicile precisely because it combines commercial pragmatism with a now visibly rigorous supervisory posture.

Quick overview, What is MiCA CASP authorisation?

A MiCA CASP authorisation is the single EU licence that permits a legal entity to provide one or more crypto-asset services to clients within the European Union. Under MiCA, a “crypto-asset service provider” must be authorised by a competent authority, in Malta, the MFSA, before offering regulated services. The authorisation specifies exactly which services the firm may provide, and the firm’s governance, capital and compliance obligations scale with that activity scope. A malta crypto license mica authorisation therefore replaces the national VFA licence as the gateway to the EU single market.

Scope of services covered

MiCA defines a list of crypto-asset services, each of which may be included within a single authorisation. The principal services are:

• Custody and administration: safeguarding crypto-assets or the means of access (private keys) on behalf of clients.
• Operation of a trading platform: running an exchange or multilateral venue that matches buy and sell orders.
• Exchange services: converting crypto-assets against fiat currency or against other crypto-assets.
• Execution of orders: executing client orders for crypto-assets.
• Placing of crypto-assets: marketing newly issued crypto-assets to purchasers.
• Reception and transmission of orders, advice, portfolio management and transfer services: ancillary and advisory activities that each require authorisation where offered.

Which firms must apply

Two broad populations need a crypto-asset service provider Malta authorisation: existing VFA-licensed firms transitioning into the MiCA regime, and new market entrants establishing crypto operations in the EU for the first time. Existing VFA firms must migrate within the transitional window set by Malta’s implementing legislation, while new entrants apply directly for a MiCA CASP authorisation. Any firm providing in-scope services to EU clients, whether an exchange, custodian, brokerage or advisory business, falls within the authorisation requirement.

Who needs a CASP authorisation in Malta? / Scope and exclusions

Any person providing one or more crypto-asset services on a professional basis to clients in the EU requires authorisation. This captures centralised exchanges, custody wallet providers, OTC brokerages, order-execution venues and firms offering advice or portfolio management in crypto-assets. Firms established in Malta and serving EU clients will typically apply to the MFSA as home regulator. Certain activities fall outside MiCA’s scope, for example, fully decentralised services provided without any intermediary, and crypto-assets that qualify as financial instruments already regulated under MiFID II, which remain under the existing securities framework. Non-fungible tokens that are genuinely unique and non-fungible are generally excluded, though the MiCA Regulation cautions that NFTs issued in large series or fractionalised may be treated as fungible crypto-assets.

Firms should map each product and service carefully against the MiCA definitions before concluding they are out of scope, because mischaracterisation is a frequent cause of supervisory challenge.

Key requirements & eligibility checklist, mica casp authorisation malta

The casp authorisation requirements under MiCA combine corporate substance, governance quality, prudential capital and robust compliance infrastructure. The MFSA assesses applications holistically: a technically sound business with weak governance will struggle, and vice versa. Below are the core pillars every applicant for a mica casp authorisation malta must satisfy, followed by a consolidated checklist.

Corporate form, local presence and management fit

Applicants must be a legal person with a registered office in the EU and, for an MFSA authorisation, meaningful presence and effective management in Malta. MiCA requires that at least one director is resident in the Union and that the firm’s place of effective management is within the EU. The MFSA expects genuine local substance, not a nameplate, including senior managers who are physically present and capable of running the business day to day. All members of the management body and shareholders holding qualifying stakes must pass fit-and-proper assessments covering reputation, knowledge, skills and experience. The ESMA peer review underscored that substance and the depth of local management are areas of heightened supervisory scrutiny.

Governance and internal controls

The firm must demonstrate a clear organisational structure with well-defined, transparent and consistent lines of responsibility. MiCA requires effective governance arrangements, sound administrative and accounting procedures, and robust internal control mechanisms. Key control functions, compliance, risk management and internal audit, must be established with sufficient authority, resources and independence appropriate to the firm’s size and complexity. The management body must collectively possess adequate knowledge of crypto-asset markets. Policies covering conflicts of interest, complaints handling, business continuity and record-keeping must be documented and operational. The MFSA will test whether these arrangements are actually embedded rather than merely drafted, often probing how decisions are escalated and how the board oversees risk in practice.

Prudential (capital) requirements by service type

MiCA sets minimum capital requirements that vary by the class of services provided, as prescribed in Annex IV of the MiCA Regulation. Broadly, three tiers apply: the lowest minimum applies to firms providing services such as execution, reception and transmission of orders, placing, advice and transfer; a middle tier applies to custody, administration and exchange services; and the highest minimum applies to operators of trading platforms. Firms must hold own funds at the higher of the applicable fixed minimum or one quarter of the preceding year’s fixed overheads. Capital must be genuinely available and verifiable, typically evidenced through audited accounts, banking confirmations and, where relevant, parent-company guarantees.

Applicants should confirm the precise threshold for each service class in the current MiCA Regulation text.

AML/KYC & compliance program expectations

CASPs are obliged entities under EU anti-money-laundering law. Applicants must present a documented AML/CFT programme covering customer due diligence, ongoing monitoring, the Travel Rule for crypto transfers, sanctions screening, suspicious-transaction reporting and the appointment of a qualified Money Laundering Reporting Officer. The MFSA, alongside Malta’s FIAU, expects risk-based procedures calibrated to the firm’s product mix and client base. Weak transaction-monitoring design is a recurring reason for extended review rounds.

Step-by-step process to obtain a MiCA CASP authorisation in Malta

The route to an mfsa casp authorisation is sequential and evidence-heavy. Early, structured engagement with the MFSA materially improves outcomes: the authority encourages pre-application dialogue to clarify scope and expectations, which reduces iterative queries later. The steps below map the full lifecycle, with indicative timelines and suggested response SLAs to keep the review on track.

1. Pre-application scoping & regulatory mapping (weeks 1–4): Define precisely which crypto-asset services you will offer and map each against the MiCA service definitions to fix your authorisation scope. Prepare a preliminary business plan, group structure chart and a gap analysis against the MFSA MiCA Rulebook. Early scoping determines capital tier, governance depth and the documentation burden, so investing here avoids costly re-work.
2. Governance & compliance build-out (weeks 3–12): Draft and finalise the full policy suite, governance manual, compliance monitoring programme, risk framework, conflicts policy, complaints handling, AML/CFT programme and MLRO appointment. Recruit or confirm senior managers and control-function heads who meet fit-and-proper standards. The MFSA assesses whether these functions are genuinely resourced, so ensure appointments are real and documented.
3. Capital and prudential setup (weeks 4–12): Confirm the minimum own-funds requirement for your service class and arrange verifiable funding. Open banking arrangements, obtain audited or management accounts, and prepare the capital adequacy calculation showing own funds at the higher of the fixed minimum or one quarter of fixed overheads. Where client assets are held, document safeguarding and segregation arrangements in detail.
4. Technical readiness (weeks 6–14): Finalise custody architecture (key management, hot/cold wallet segregation), IT and operational resilience policies, cyber-security controls, business continuity and disaster recovery, and the outsourcing register with supplier due diligence. The MFSA probes technical resilience closely, especially for custody and trading-platform applicants, so prepare architecture diagrams and penetration-test evidence.
5. Submission to the MFSA, forms, application package and payment (weeks 12–16): Compile the complete application package using the MFSA’s prescribed forms and templates, including the programme of operations, governance and prudential documentation, personal questionnaires for all relevant individuals, and the AML framework. Pay the applicable application fee on submission. Completeness matters: the formal review clock is most efficient where the pack leaves few obvious gaps. A well-assembled submission closely tracks the structure in a Malta crypto licensing application checklist.
6. MFSA review, queries and interviews (months 3–6 after submission): The MFSA reviews the package and issues written queries, often in multiple rounds. Typical questions probe local substance, capital verification, custody controls, transaction-monitoring thresholds and conflicts management. Interviews with proposed senior managers and the compliance officer are common. Aim to respond comprehensively within 10–15 business days per query round; incomplete or delayed responses extend timelines and signal weakness. Anticipating ESMA peer-review themes in advance reduces the number of rounds.
7. Decision, conditions and post-authorisation duties (ongoing): On a positive assessment the MFSA grants the authorisation, frequently subject to conditions such as phased service roll-out or specific pre-launch confirmations. Post-authorisation, the firm must comply with continuous obligations: periodic prudential and AML reporting, notification of material changes (new services, key-personnel changes, qualifying-holding changes), incident reporting and ongoing fit-and-proper maintenance. Breaches of conditions or reporting duties can trigger supervisory action.

For firms building their MFSA interaction strategy, our MFSA engagement playbook sets out how to structure responses and evidence across review rounds.

Costs, fees and timelines

Budgeting for a mica casp authorisation malta requires modelling three cost layers: regulatory fees payable to the MFSA, minimum capital that must be held, and professional fees for legal, compliance and technical support. Costs scale significantly with service scope, a custody-only firm faces a very different profile from a trading-platform operator.

One-off application fees, MFSA supervisory fees and sectoral levies

The MFSA charges a one-off application fee on submission and recurring annual supervisory fees thereafter, both scaled by the class and number of services provided and, for ongoing fees, by revenue or activity metrics. The precise figures are set out in the MFSA’s fee schedule accompanying the MiCA Rulebook, and applicants should confirm current amounts directly against that schedule because fees are periodically revised. In addition to regulatory fees, applicants must fund the minimum own-funds requirement for their service class as prescribed in Annex IV of the MiCA Regulation, capital that is held rather than spent, but which must be demonstrably available from day one.

Trading-platform operators sit in the highest capital tier, custody and exchange services in the middle tier, and advisory or order-transmission services in the lowest tier. Firms should treat capital as a standing balance-sheet commitment and ensure it is maintained against the fixed-overheads test on an ongoing basis.

Typical professional fees

Professional costs typically span external legal counsel for the application and regulatory strategy, compliance consultants for the policy suite and AML framework, and IT/security specialists for resilience documentation and penetration testing. These vary with complexity and scope, and are generally higher for trading platforms and custodians than for advisory firms. Industry observers expect professional fees to remain a meaningful share of total set-up cost, particularly where multiple review rounds arise.

Timelines, realistic estimates

Preparatory work, scoping, governance build-out, capital arrangement and technical readiness, commonly runs from one to six months depending on the firm’s starting maturity. Once a complete application is submitted, the MFSA’s formal review typically takes in the region of three to six months, subject to the number and speed of query rounds. Well-prepared VFA firms migrating with existing documentation can move faster than new entrants building from scratch.

Operational & prudential requirements, governance, AML, IT resilience

Authorisation is the beginning, not the end, of regulatory obligation. The MFSA supervises CASPs on an ongoing basis, and the ESMA peer review has reinforced expectations around governance substance, resourcing and technical resilience. These operational standards are examined at application and then monitored throughout the licence’s life. Firms can explore these in depth through our governance and prudential requirements for CASPs resource.

Governance and internal control expectations

The management body must actively direct and oversee the business, with clearly allocated responsibilities and documented decision-making. Compliance, risk and internal audit functions must have sufficient standing, resources and independence. The MFSA expects boards to demonstrate genuine crypto-market knowledge and to evidence how risks are identified, escalated and mitigated in practice, not merely in policy. Regular board reporting, minuted oversight and periodic effectiveness reviews of control functions are expected.

AML/KYC and transaction monitoring specifics

CASPs must operate risk-based customer due diligence, enhanced due diligence for higher-risk relationships, ongoing monitoring and effective suspicious-transaction reporting. Crypto-specific obligations include compliance with the Travel Rule for transfers of crypto-assets, blockchain-analytics screening and sanctions filtering. The MFSA and FIAU scrutinise the calibration of monitoring thresholds and the adequacy of MLRO resourcing; thin or templated AML frameworks frequently draw supervisory challenge.

IT, cyber, outsourcing and operational resilience

CASPs must maintain secure ICT systems, resilient access protocols and robust custody key-management controls, supported by business continuity and disaster-recovery planning. Outsourcing of critical functions requires documented due diligence, written agreements and retained accountability, the firm cannot outsource responsibility. Incident management is central: firms must detect, respond to and report significant ICT and security incidents to the relevant authorities within applicable timeframes, maintaining an incident log and remediation record. For custody and trading-platform operators, penetration testing, segregation of duties and robust key-management governance are areas of particular supervisory focus.

VFA licence vs MiCA CASP authorisation, comparison & migration

Understanding the vfa to mica transition malta is essential for incumbent firms. While Malta’s VFA regime was a well-regarded national framework, MiCA is a pan-EU regulation offering single-market passporting that the national VFA licence never provided. The MFSA has communicated migration expectations and timelines to VFA licence holders, and firms should treat migration documentation as a substantive re-authorisation exercise rather than a formality. Where migration is not completed within the applicable transitional window, continued provision of services may no longer be permitted. Our VFA-to-MiCA migration guide addresses the practical sequencing in detail.

Passporting to the EU, Article 65 & documentation expectations

One of the strongest commercial reasons to pursue a mica casp authorisation malta is EU passporting. Under Article 65 of the MiCA Regulation, an authorised CASP intending to provide services cross-border notifies its home competent authority, the MFSA, which transmits the information to host-state authorities, after which services may be provided across the Union without separate national licences. This mica passporting eu mechanism converts a single Maltese authorisation into genuine EU market access. Our EU passporting for CASPs, Article 65 explained resource provides the full notification workflow.

Notification process and documentation posture post-2026

The Article 65 notification must identify the member states targeted, the services to be provided and the intended start date, accompanied by the documentation the home authority requires. Following the ESMA peer review and subsequent MFSA communications, the authority has signalled a stricter documentation posture, expecting fuller substance evidence, clearer service descriptions and robust compliance and AML arrangements before transmitting a notification. Applicants should prepare passporting documentation to the same standard as the original authorisation file.

Common passporting pitfalls and how to avoid them

Firms are most often delayed by incomplete service descriptions, insufficient demonstration of local substance, mismatches between the notified scope and the actual authorisation, and weak AML coverage for the target markets. Avoid these by aligning the notification precisely with the authorised scope, maintaining genuine Malta substance, and preparing host-market-aware compliance arrangements before filing.

Comparison: Malta vs other EU jurisdictions

Because MiCA harmonises the substantive rules, differences between member states now turn largely on supervisory posture, processing efficiency and local ecosystem rather than on the underlying legal standard. The snapshot below is indicative; applicants should verify current fee schedules and processing practice with each authority.

Malta’s competitive edge lies in combining deep crypto supervisory experience with an English-speaking EU ecosystem, balanced against a now demonstrably rigorous review standard that rewards thorough preparation.

Practical next steps & recommended preparations

Firms targeting a mica casp authorisation malta should act on several fronts in parallel to compress overall timelines. The following immediate actions position an applicant for an efficient MFSA review:

• Fix scope early: map each service against MiCA definitions to determine capital tier and documentation.
• Build real substance: confirm Malta-based senior management and resourced control functions.
• Secure capital: arrange verifiable own funds for the relevant service class.
• Prepare documentation: assemble governance, AML and IT-resilience evidence to supervisory standard.
• Engage the MFSA early: use pre-application dialogue to clarify expectations and reduce query rounds.

Sources

• MFSA, MiCA Rulebook (2025)
• ESMA, Fast-track peer review on CASP authorisation and supervision in Malta (2025)
• EUR-Lex, Markets in Crypto-Assets Regulation (EU) 2023/1114
• MFSA, Notices and Communications
• European Commission, Crypto-assets policy overview