Malta iGaming Snapshot 2026 — Quick Read
Malta is the EU's iGaming capital, with the Malta Gaming Authority (MGA) regulating 300+ Authorisation Holders under the Gaming Act, Chapter 583 of the Laws of Malta (2018). Operators can apply for a B2C license (Types 1-4: casino, sportsbook, peer-to-peer, controlled skill) or a B2B Critical Gaming Supply license for platform, RNG and game-studio supply. Application end-to-end takes 6-12 months; year-one all-in budget is typically €150K-€400K. Gaming tax is 5% of GGR from Maltese players only; corporate tax is effectively 5% for non-resident shareholders via the 6/7 refund. The Financial Intelligence Analysis Unit (FIAU) oversees AML/CFT under the PMLA. Substance is real: a Malta-incorporated company, a physical office, and Malta-resident key persons including a CEO, Compliance Officer, MLRO and Player Protection Officer.
1. The Malta Gaming Authority (MGA) — 2026 Overview
From the LGA to the Modern MGA
The Malta Gaming Authority (in Maltese: Awtorità Maltija għal-Logħob) is the country's single regulator for remote and land-based gaming. It traces its roots to the Lotteries and Other Games Authority (LGA), established in 2001 alongside Malta's pioneering Remote Gaming Regulations of 2004 — the first comprehensive EU framework for online gaming. In 2015 the LGA was renamed the MGA, and in 2018 the Authority was given its modern statutory backbone via the Gaming Act, Chapter 583 of the Laws of Malta, which consolidated land-based and remote regulation into a single technology-neutral framework.
The 2018 Gaming Act and its subsidiary legislation — the Gaming Authorisations Regulations, the Gaming Compliance and Enforcement Regulations, the Gaming Licence Fees Regulations, the Gaming Tax Regulations, the Player Protection Regulations, the Commercial Communications Regulations and the Gaming Premises Regulations — are the operational handbook of Malta iGaming in 2026. The MGA issues binding directives and policies under each regulation; together with the Authority's published policy notes, they form the body of "MGA Regulations" that operators must comply with daily.
The Five Powers of the MGA
- Licensing — issuing, renewing, varying and revoking B2C and B2B authorisations
- Supervision — ongoing prudential, technical and conduct supervision of every Authorisation Holder
- Compliance and enforcement — investigations, audits, administrative fines and suspensions
- Player protection — operating the centralised Player Protection Register
- Sector development — international representation, the MGA Sandbox for DLT assets, policy innovation
Who Is "Maltese Authorisation Holder"?
The Gaming Act uses the term Authorisation Holder in place of the older "licensee" terminology to capture both license holders and certificate holders. In 2026 the population of Maltese Authorisation Holders includes most of the world's largest publicly-listed online operators, a deep B2B platform-and-studio cluster, and a long tail of niche operators serving regulated EU markets. The MGA publishes a live register of Authorisation Holders, which counterparties and payment partners routinely check before contracting.
Malta Gaming Authority (MGA)
Established 2001 (as LGA), modernised under Gaming Act 2018 · Single regulator, technology-neutral
B2C License — Player-Facing Operator
Types 1, 2, 3, 4 · Casino, sportsbook, peer-to-peer, controlled skill · Direct to consumer
B2B License — Critical Gaming Supply
Platforms, RNGs, game studios, back-office providers · No end-user exposure
FIAU — Financial Intelligence Analysis Unit
Established under the PMLA · AML/CFT supervisor · goAML reporting portal
Gaming Tax + 6/7 Corporate Refund
5% GGR gaming tax (Maltese players) · 35% headline corp tax → effective 5% via refund
Player Protection Directive
Self-exclusion register · Deposit and session limits · Reality checks · Officer required
Ready to set up your Maltese iGaming structure?
Form the Maltese holding company, the gaming SPV and the affiliate sister company in a single Zunapro flow — substance, registered office, MLRO and Compliance Officer sourcing included.
2. B2C vs B2B License Types — The 2026 Map
The Move to Two License Classes
Before 2018 the Maltese framework used four numeric license classes (Class 1, 2, 3, 4) inherited from the 2004 Remote Gaming Regulations. The 2018 Gaming Act simplified this into two license classes: a B2C (Business-to-Consumer) Gaming Service License covering all player-facing operations and a B2B (Business-to-Business) Critical Gaming Supply License covering all upstream supply to licensed operators. Within the B2C license, the Authority distinguishes four game types that map to the old classes.
B2C Game Types in 2026
- Type 1 — Casino games where the operator carries the risk (slots, table games, video poker, casino lotteries)
- Type 2 — Sports betting and risk-based games where the operator sets fixed or pool odds and carries the risk
- Type 3 — Peer-to-peer games including poker, betting exchanges and bingo, where the operator takes a rake or commission
- Type 4 — Controlled skill games including fantasy sports and skill-based tournaments
A single B2C Authorisation Holder can hold multiple game types under one license — the typical online-casino-plus-sportsbook operator is Type 1 + Type 2 on the same authorisation.
B2B — Critical Gaming Supply License
The Critical Gaming Supply license covers any party providing a "material" element of a gaming service to a B2C operator. The two main flavours are back-office / platform / RNG supply and game studio / content supply. The Critical Gaming Supply license carries no gaming tax — only the fixed annual license fee — because the B2B holder does not face end-users and does not receive GGR. Most of the world's biggest aggregator platforms and slot studios hold a Maltese Critical Gaming Supply license alongside their content distribution agreements.
3. The Application Process — 6 to 12 Months in 2026
The Four Statutory Stages
The MGA application is structured in four stages, each gated by a formal review meeting with the Authority. End-to-end, a well-prepared file closes in 6 to 9 months; first-time applicants and complex group structures typically land at 9 to 12 months.
Stage 1 — Fit and Proper (Months 1-3)
Detailed background checks on every UBO holding 10%+ shares, every director and every Key Function holder: personal declaration form, Maltese police conduct certificate, sworn declaration of assets and liabilities, source-of-funds and source-of-wealth evidence, two professional references. The MGA cross-references against sanctions lists, PEP databases and adverse media. Well-documented files clear Stage 1 in ~10 weeks.
Stage 2 — Business and Operational Plan (Months 2-4)
Five-year business plan, three-year financial forecast, marketing plan, proposed game portfolio, player-acquisition strategy (including affiliate channels), Maltese substance plan and organisational chart. The MGA tests commercial realism; pipe-dream forecasts are sent back. Stage 2 files typically run 60-120 pages plus supporting financials.
Stage 3 — Compliance, Systems and AML (Months 3-6)
The deepest stage. The applicant submits the full AML/CFT policy framework, the Business Risk Assessment (BRA), the Customer Risk Assessment (CRA), the Player Protection policy, Cybersecurity policy and ISMS, the System Documentation Pack and Disaster Recovery and Business Continuity plans. The proposed Compliance Officer and MLRO are interviewed by the MGA. Approval triggers the technical audit.
Stage 4 — System Audit and Go-Live (Months 5-12)
An MGA-approved independent auditor performs a System Audit against the published Technical Standards: back-office, RNG (where applicable), game-server architecture, player wallet, responsible-gaming controls and MGA seamless wallet API feeds. The Authority issues a provisional Authorisation for a 60-day soft launch, then converts to a full Authorisation.
💡 Read the full MGA application playbook
Stage-by-stage document pack, AML policy templates, sample Business Risk Assessment, System Audit scope and the Maltese SPV structure that minimises Stage 4 friction.
4. Application Fee, Annual License Fee and Compliance Contribution
The 2026 Headline Numbers
Malta's fee schedule is published in the Gaming Licence Fees Regulations (S.L. 583.03 of the Laws of Malta). In 2026 the headline figures are:
- Application fee — €5,000, non-refundable, payable on submission
- B2C annual license fee — €25,000, payable yearly in advance
- B2B Critical Gaming Supply annual fee — €25,000 for full-suite supply; €10,000 for limited-scope supply
- Renewal fee — typically waived within the standard 5-year license term subject to compliance
The B2C Compliance Contribution — Variable on GGR
On top of the fixed €25,000 annual fee, B2C operators pay a Compliance Contribution calculated as a small percentage of Gross Gaming Revenue (GGR), per game type, capped per year. The 2026 brackets are scaled to keep small operators light while ensuring larger operators contribute proportionally:
| Game Type | Minimum | Variable on GGR | Annual Cap |
|---|---|---|---|
| Type 1 — Casino | €15,000 | 0.40% - 1.25% sliding | ~€375,000 |
| Type 2 — Sportsbook | €25,000 | 0.25% - 4.00% sliding | ~€600,000 |
| Type 3 — Peer-to-Peer | €25,000 | 0.50% - 4.00% sliding | ~€500,000 |
| Type 4 — Controlled Skill | €5,000 | 0.50% - 0.85% sliding | ~€500,000 |
Reading the table: a small Type 1 casino with €2M annual GGR will pay roughly the €15,000 minimum plus a small variable contribution. A scaled multi-jurisdictional operator with €30M+ Maltese-player GGR can approach the cap. Because Type 2 (sportsbook) carries the steepest sliding scale, many large multi-product operators structure as a Type 1 + Type 2 hybrid and pay each game type's contribution separately.
What the Year-One Budget Actually Looks Like
Realistic year-one stack for a Type 1 B2C launch: application fee €5,000, first annual license fee €25,000, compliance contribution from €15,000 minimum, legal and corporate setup €25K-€60K, minimum share capital deposit €100,000 (Type 1/2) or €40,000 (Type 3/4), System Audit €15K-€40K, substance (office, MLRO, Compliance Officer, key persons) €60K-€150K annually, platform integration, RNG cert and AML tooling €20K-€80K. An honest 2026 all-in year-one budget for a Type 1 B2C launch lands between €150,000 and €400,000. A pure B2B Critical Gaming Supply launch is cheaper — typically €120,000 to €250,000 — because there is no compliance contribution, no player-funds segregation and no Player Protection Officer required.
5. The 5% Gaming Tax — Lowest in the EU
The Gaming Tax Regulations
Malta's gaming tax is set by the Gaming Tax Regulations (S.L. 583.10) issued under the Gaming Act 2018. The rule is elegantly narrow: 5% of GGR generated from Maltese-resident players, on every game type. GGR from non-Maltese players — the vast majority of revenue for the average Authorisation Holder — is not subject to Maltese gaming tax.
How "Maltese Player" Is Determined
Player residence is determined at registration using IP geolocation, declared residence, payment-instrument BIN country and KYC documentation. Operators must keep an auditable chain; Zunapro stores the residence-evidence packet alongside each player record for MGA inspections.
Why 5% Is a Strategic Advantage
Compare Malta's 5% against EU comparators: Germany 5.3% on stake (effectively much higher on GGR), Italy 25% casino / 24% sportsbook GGR, France 55.6% on sportsbook GGR, Netherlands 30.5% on GGR, Sweden 22% on GGR, Spain 20% on GGR. Malta's 5%, narrowly applied to Maltese-player GGR only, is unmatched. Even when a multi-jurisdictional operator adds national licenses, the Maltese parent retains the 5% advantage on Maltese-player revenue and on all back-office and platform fees flowing through the Maltese SPV.
The Corporate-Tax Layer — Effective 5%
On top of the gaming tax, Malta's corporate income tax headline rate is 35% — but the full imputation system and the 6/7 tax refund mechanism for non-Maltese shareholders reduce the effective rate to 5% on trading profits distributed as dividends. The combination — 5% gaming tax on Maltese-player GGR, 0% gaming tax on non-Maltese GGR, 5% effective corporate tax on profits — is the structural reason 300+ operators chose Malta as their European base.
Tax stacking tip: the 6/7 refund applies six months after dividend distribution. Maltese gaming groups typically run a two-tier structure: a Maltese gaming SPV (operating company) wholly owned by a Maltese holding company, which receives the refund and then distributes to the ultimate non-Maltese parent. Plan your Malta structure →
6. Substance Requirements — Key Roles in Malta
Why Substance Is Non-Negotiable
The MGA does not accept brass-plate Authorisation Holders. The Gaming Authorisations Regulations require that the operational decision-making, the key function holders and a meaningful physical presence sit in Malta. Substance is checked at application, re-checked at annual renewal, and verified by routine on-site MGA inspections. Failure to maintain substance is a leading cause of MGA enforcement orders.
Mandatory Key Function Roles
- Chief Executive Officer (CEO) — strategic accountability, Malta-resident
- Compliance Officer — day-to-day regulatory compliance, MGA liaison, Malta-resident
- Money Laundering Reporting Officer (MLRO) — AML/CFT and FIAU reporting, FIAU-registered
- Key Function — Player Protection — responsible gambling, self-exclusion, complaints
- Key Function — Customer Support — first-line player communications
- Key Function — IT and Information Security — platform availability and cyber
- Key Function — Marketing and Commercial Communications — affiliate oversight
- Key Function — Finance and Player Funds Segregation — protected player accounts
Physical Office and Operations
Authorisation Holders must hold a Maltese-incorporated company (Companies Act Cap. 386) with a real registered office. The office must be capable of hosting the Compliance Officer, MLRO, customer-support function and inspection visits. Co-working arrangements are accepted by the MGA only when paired with dedicated, signed and inspectable space; pure virtual offices are rejected.
Outsourcing — What Can Leave Malta
The Gaming Authorisations Regulations allow outsourcing of non-critical functions (software development, payments, KYC vendor work, marketing creative) subject to a written outsourcing policy and register. Critical functions — compliance, AML reporting, player protection, player-funds management — must remain in Malta. Cloud hosting may be EU-based subject to GDPR.
7. Anti-Money Laundering Compliance — FIAU and the PMLA
The FIAU as Joint Supervisor
The Financial Intelligence Analysis Unit (FIAU) is Malta's AML/CFT supervisor, established under the Prevention of Money Laundering Act (PMLA, Chapter 373). MGA-licensed operators are subject persons under the PMLA and the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR). The MGA and FIAU coordinate as joint supervisors: the MGA inspects from a gaming-conduct angle, the FIAU from an AML-effectiveness angle, and recent inspection cycles have featured joint MGA/FIAU site visits.
The Six AML Pillars Every Authorisation Holder Must Operate
- Business Risk Assessment (BRA) — written, reviewed annually, signed off by the board
- Customer Risk Assessment (CRA) — risk-rate every player at onboarding and re-rate dynamically
- Customer Due Diligence (CDD) — identification, verification, beneficial-ownership where applicable, ongoing monitoring
- Enhanced Due Diligence (EDD) — for PEPs, high-risk jurisdictions and high-value players
- Transaction Monitoring — real-time or near-real-time monitoring against rule-based and behavioural typologies
- Suspicious Transaction Reporting (STR) — via the FIAU's goAML portal, with no-tipping-off discipline
The FIAU's Implementing Procedures — Part II for Gaming
The FIAU publishes Implementing Procedures Part I (general) and a sector-specific Part II for the Remote Gaming and Land-Based Gaming Sectors. The Part II is operationally prescriptive: it lists the player-acquisition red flags, the source-of-funds thresholds at which EDD is triggered, the typology cases the regulator expects monitoring rules to detect, and the documentation standards for STRs. Operators that miss a typology in their rules engine routinely receive administrative remediation orders.
Enforcement — Real Penalties
The FIAU and MGA have imposed seven-figure fines on Maltese gaming operators for AML failures in recent enforcement cycles. The typical pattern of fault is weak source-of-funds verification on high-rollers, inadequate transaction-monitoring rules, and slow or missing STR filings. Compliance is not a paper exercise — the regulators read the case files.
📘 AML toolkit for MGA holders
Zunapro's Malta module ships a Maltese-tailored BRA template, CRA scoring engine, KYC vendor integrations, goAML STR helper and FIAU Implementing Procedures Part II checklists — built for the 2026 inspection cycle.
8. Player Protection Requirements — The Gaming Act 2018 Directive
The Player Protection Directive
The Player Protection Directive issued under the Gaming Act 2018 and the Player Protection Regulations (S.L. 583.07) set out the responsible-gaming obligations of every B2C Authorisation Holder. Compliance with the Directive is one of the MGA's top enforcement priorities — most public license suspensions in 2024-2026 have cited Player Protection failures alongside AML weaknesses.
The Eleven Mandatory Tools
- Self-exclusion — via the centralised Player Protection Register; portable across all MGA operators
- Deposit, wager, loss, session limits — player-set with cooling-off on any increase
- Reality checks — pop-ups summarising win, loss and time at intervals
- Time-out — short-term pause distinct from full self-exclusion
- Age verification — robust KYC barring under-18 play, repeated at trigger events
- Markers of harm — algorithmic detection with documented operator interventions
- Affordability checks — proportionate source-of-funds questions at deposit thresholds
- Complaints handling — acknowledged in 5 working days, resolved in 10 working days, with MGA Player Support Unit escalation
The Player Protection Officer (Key Function)
Each Authorisation Holder must appoint a Player Protection Officer as a Key Function role. The officer owns the responsible-gambling policy, the markers-of-harm rules, the customer-interventions register and the MGA reporting on player-protection metrics. The officer is Malta-resident and is interviewed by the MGA at application.
Commercial Communications and Advertising
The Commercial Communications Committee regulations restrict the content, channels and timing of gaming advertising. Bonus offers must be transparently described, no advertising can target minors, vulnerable populations or self-excluded persons. Affiliate marketing is squarely in scope — operators are responsible for the conduct of their affiliates and must hold them to the same advertising standards.
9. Malta as iGaming Hub — 300+ Licensed Companies
The Cluster Effect
Malta's iGaming dominance is not just about tax — it is about cluster density. A 316 km² island hosts 300+ Authorisation Holders, a deep bench of MGA-experienced lawyers, a panel of MGA-approved system auditors (Deloitte, BDO, RSM, KPMG, PwC), a gaming-friendly PSP/EMI cluster, an English-speaking bilingual workforce, the University of Malta's Institute of Gaming, and the SiGMA Malta / Malta Week conference circuit that imports operator deal-flow twice a year.
By the Numbers — Malta iGaming in 2026
- 300+ Authorisation Holders active in 2026, split roughly 70% B2C and 30% B2B
- ~12% of Malta's GDP generated by gaming and adjacent services
- ~11% of the Maltese workforce employed in gaming, payments, compliance and platform roles
- Top 10 global online operators — almost all hold Maltese authorisations as their EU backbone
- 50+ MGA-licensed game studios — RNG slots, live casino and aggregator platforms
Why Operators Re-Locate to Malta
A typical 2026 relocation case combines five drivers: the 5% gaming tax on Maltese-player GGR, the 5% effective corporate tax via the 6/7 refund, the MGA license trust signal, the substance ecosystem (Compliance Officer, MLRO and Key Function holder reachable on a phone call), and the payments ecosystem. Against high-tax European jurisdictions the Maltese economics become structural. Malta was FATF grey-listed in June 2021 and removed in June 2022 after rapid AML reforms; since then MGA and FIAU enforcement intensity has been elevated, which serious operators treat as a feature, not a bug.
10. E-Commerce Affiliate + iGaming Synergy
Why Affiliates Are Strategic for MGA Operators
Affiliate marketing accounts for 30-60% of new-player acquisition at most MGA-licensed operators. The Commercial Communications Regulations require operators to vet, contract and monitor every affiliate — affiliate misconduct is operator misconduct in regulatory terms. Most Maltese operators run the affiliate stack in-house or through a sister affiliate management company.
The Sister-Company Pattern
The dominant 2026 group structure is:
- Maltese holding company — receives the 6/7 corporate tax refund and distributes upward
- Maltese gaming SPV — the MGA Authorisation Holder, ring-fenced, with player funds segregated
- Maltese affiliate / marketing services company — manages affiliates, ad creative, AdWords and the wider e-commerce affiliate stack
- Optional Maltese e-commerce or media company — runs non-gaming e-commerce, content sites or comparison platforms under the same tax umbrella
All three operating companies sit under the holding company, each benefits from the 6/7 refund, and the gaming SPV's substance and AML obligations remain ring-fenced from the affiliate and e-commerce side.
Affiliates Pulled into the AML Perimeter
The FIAU Implementing Procedures Part II treats affiliate-introduced players as a risk vector. Operators must capture affiliate ID at registration, score affiliates by their players' downstream STR rate, and de-list affiliates introducing problematic source-of-funds profiles. Affiliate management that doesn't feed the AML scoring engine is a regulatory liability — Maltese operators expect a single panel linking affiliate, KYC and AML data.
Where Gaming Affiliates Meet General E-Commerce
Many Maltese affiliate companies started as gaming-only and have expanded into broader e-commerce verticals: fintech comparison, crypto-exchange referrals, broker comparison, SaaS B2B affiliates. The technology stack is identical, the legal substrate is the same and the corporate tax is unchanged — which is structurally why so many of Europe's largest comparison and affiliate networks are Malta-headquartered.
🌍 One Malta structure, three businesses
Set up the Maltese holding, the MGA gaming SPV and the affiliate/e-commerce sister company in one Zunapro flow — substance, MLRO, Compliance Officer, FIAU registration and 6/7 refund optimisation included.
Maltese Legal Framework 2026 — What Authorisation Holders Must Know
The Statutory Hierarchy
Maltese iGaming law is built on a clean hierarchy: primary law is the Gaming Act, Chapter 583 of the Laws of Malta (2018); subsidiary legislation includes the Gaming Authorisations Regulations, Gaming Compliance and Enforcement Regulations, Gaming Licence Fees Regulations, Gaming Tax Regulations, Player Protection Regulations and Commercial Communications Regulations; the MGA issues binding directives and policies that operationalise the regulations; the FIAU framework adds the PMLA Cap. 373 and the FIAU Implementing Procedures Part I and Part II. Adjacent law — Companies Act Cap. 386, Income Tax Act Cap. 123, Data Protection Act Cap. 586 — completes the substrate.
The 2026 Compliance Calendar
- Monthly — Compliance Contribution payment (B2C), gaming tax report, Player Protection Register sync
- Quarterly — Player Protection metrics report to the MGA, Key Function self-attestations
- Annually — Annual license fee, BRA refresh, CRA recalibration, MBR financial-statement filing, Compliance Officer and Player Protection Officer reports, ISMS review
- Event-driven — STRs via goAML, material change notifications to the MGA, incident reports for system outages
Cross-Border Recognition
An MGA license does not grant unrestricted EU-wide market access — gambling regulation is reserved to EU member states under Article 56 TFEU jurisprudence. However, the MGA license is the universal baseline trust signal for banks, PSPs and platform partners; most operators run the Maltese MGA platform as the upstream technology, then layer national B2C licenses (Germany GGL, Italy ADM, Spain DGOJ, Netherlands KSA, Sweden Spelinspektionen, Denmark Spillemyndigheden) on top.
Compliance is not optional in 2026. The MGA and FIAU are among the most active gaming regulators in Europe. Zunapro bundles a Malta compliance pack — BRA template, CRA scoring, goAML STR helper, Player Protection metrics dashboard, Key Function attestation workflow — alongside the structural setup. See compliance bundle →
How to Start an MGA Application — 2026 Step-by-Step
1. Decide Your License Class
- Player-facing online casino or sportsbook → B2C Type 1 + Type 2
- Poker room, exchange or bingo → B2C Type 3
- Fantasy sports or controlled skill → B2C Type 4
- Game studio supplying RNG slots or live casino → B2B Critical Gaming Supply
- Platform aggregator or back-office provider → B2B Critical Gaming Supply (full-suite)
- Affiliate / media business serving the sector → no MGA license; standard Maltese trading company with Commercial Communications compliance
2. Incorporate the Maltese Vehicles
Form the holding company and the gaming SPV with the Malta Business Registry (MBR). Minimum share capital is €100,000 for Type 1 and Type 2, and €40,000 for Type 3 and Type 4; capital must be deposited into a Maltese bank account before MGA filing. Companies Act Cap. 386 sets the corporate-governance framework. Allow 5-10 working days for MBR incorporation if all UBO due-diligence documents are clean.
3. Recruit the Key Function Holders
Source and contract the CEO, Compliance Officer, MLRO, Player Protection Officer and Customer Support lead before MGA filing — the Authority will interview the Compliance Officer and MLRO at Stage 3 and will not accept "to be appointed" placeholders. Allow 6-12 weeks for senior compliance recruitment in 2026's tight Maltese labour market.
4. Build the Policy Stack
- AML/CFT policy aligned to FIAU Implementing Procedures Part II
- Business Risk Assessment, Customer Risk Assessment
- Player Protection policy and Responsible Gambling policy
- Cybersecurity policy and Information Security Management System (ISMS)
- Outsourcing policy and outsourcing register
- Marketing and Commercial Communications policy
- Complaints handling policy with the 10-working-day SLA
5. File the MGA Application via the Authority's Portal
- Pay the €5,000 application fee
- Submit the Stage 1 fit-and-proper pack — UBO declarations, source-of-funds, police conduct certificates
- Submit the Stage 2 business plan — five-year P&L, three-year forecast, substance plan
- Submit the Stage 3 compliance and AML pack — full policy stack and Compliance Officer/MLRO interview booking
- Engage an MGA-approved auditor for the Stage 4 System Audit
- Receive provisional Authorisation and run a 60-day soft launch
- Convert to full Authorisation and pay the first €25,000 annual license fee
6. Connect via Zunapro — 10-Day Substance Setup
- Sign in to Zunapro and open the Malta module
- Select your license class — Zunapro proposes the matching holding + SPV + affiliate structure
- Engage the substance pack — Maltese office address, MLRO and Compliance Officer sourcing, registered office and company secretary
- Generate the policy stack — AML, Player Protection, ISMS templates auto-populated for your business plan
- File with the MGA — Zunapro pre-fills the Authority's portal templates with your structural and policy data
Form your Maltese iGaming structure in one panel
Holding + Gaming SPV + Affiliate company + Substance + MLRO + Compliance Officer + AML stack + Player Protection — Zunapro's Malta company-formation flow handles every layer of an MGA-ready setup.
🇲🇹 Form Your Malta Company →Malta MGA Licensing FAQ 2026
What is the Malta Gaming Authority (MGA) and why does its license matter in 2026?
The Malta Gaming Authority is Malta's single regulator for remote and land-based gaming, established in its modern form under the Gaming Act, Chapter 583 of the Laws of Malta (2018). The MGA succeeded the Lotteries and Other Games Authority (LGA) and inherits Malta's first-mover status as the EU's earliest comprehensive online-gaming jurisdiction (Remote Gaming Regulations, 2004).
An MGA license is recognised across the EU/EEA as a benchmark of regulatory quality and is held by 300+ Authorisation Holders in 2026 — including most of the world's largest online casino, sportsbook, poker and B2B platform operators. Payment partners, ad networks and banks routinely treat MGA authorisation as the baseline trust signal before onboarding gaming counterparties.
What is the difference between an MGA B2C and B2B license in 2026?
A B2C (Business-to-Consumer) Gaming Service License authorises an operator to offer Type 1 casino, Type 2 sportsbook, Type 3 peer-to-peer (poker, exchanges, bingo) or Type 4 controlled-skill games directly to players. B2C holders pay the €25,000 annual license fee, a variable compliance contribution scaled to GGR per game type, and 5% gaming tax on Maltese-player GGR.
A B2B (Business-to-Business) Critical Gaming Supply License authorises platform providers, game studios and RNG vendors to supply licensed B2C operators without facing end-users. B2B holders pay the €25,000 fixed annual fee and no gaming tax on their B2B revenue. A single Maltese group often holds both — B2C for its operator brand, B2B for its in-house platform.
How long does the MGA application process take?
In 2026 the realistic end-to-end timeline is 6 to 12 months. Stage 1 (fit-and-proper due diligence on UBOs, directors and key persons) takes 2-3 months. Stage 2 (business and operational plan) takes 1-2 months in parallel. Stage 3 (compliance, systems and AML review) takes 2-3 months. Stage 4 (System Audit and go-live approval) takes 1-2 months.
Operators arriving with a fully prepared file — Maltese holding company already incorporated, key persons contracted, source-of-funds documentation clean, an MGA-experienced legal counsel and a pre-engaged System Auditor — close near the 6-month end. First-time applicants typically land at 9-12 months.
How much does an MGA license cost in 2026?
The headline application fee is €5,000 (non-refundable, payable at submission). The annual license fee is €25,000 for B2C and €25,000 for B2B Critical Gaming Supply (full suite; €10,000 for limited scope). On top, B2C operators pay a variable compliance contribution from €15,000 minimum per game type, scaling with GGR.
An honest 2026 all-in year-one budget — including legal, audit, share capital deposit, substance, MLRO and Compliance Officer, AML tooling and platform integration — typically lands between €150,000 and €400,000 for a B2C launch. Pure B2B Critical Gaming Supply launches are cheaper at €120,000-€250,000.
What is the Malta gaming tax rate in 2026?
Malta levies a 5% gaming tax on Gross Gaming Revenue (GGR) generated from Maltese-resident players. GGR from non-Maltese players is not subject to Maltese gaming tax. This is one of the lowest effective gaming tax rates in the EU and is a primary reason 300+ operators choose Malta as their licensing hub.
On top of gaming tax, the corporate income tax headline rate is 35% but is reduced effectively to 5% for non-Maltese shareholders via the Maltese full imputation system and the 6/7 corporate tax refund mechanism. Combined, the structure delivers a 5% gaming tax slice on Maltese-player GGR and a 5% effective corporate tax on trading profits.
What are the MGA substance requirements in 2026?
MGA Authorisation Holders must demonstrate genuine economic substance in Malta. In practice this means a Malta-incorporated company under Companies Act Cap. 386, a physical office on the islands (typically Sliema, St. Julian's, Ta' Xbiex or SmartCity Malta), and Malta-resident key function holders including the CEO, Compliance Officer, Money Laundering Reporting Officer (MLRO), Player Protection Officer, Customer Support Lead and IT/Information Security Lead.
The Authority does not accept brass-plate setups. Site inspections are routine and substance is reviewed annually. Outsourcing of non-critical functions (software development, payments, marketing creative) is allowed; outsourcing of critical functions (compliance, AML, player protection) is not.
How does FIAU anti-money laundering compliance work for MGA holders?
The Financial Intelligence Analysis Unit (FIAU) is Malta's AML/CFT supervisor, established under the Prevention of Money Laundering Act (PMLA, Cap. 373). MGA-licensed operators are subject persons under the PMLA and must apply Customer Due Diligence (CDD), Enhanced Due Diligence on PEPs and high-risk customers, transaction monitoring, a Business Risk Assessment (BRA), a Customer Risk Assessment (CRA), and Suspicious Transaction Reports filed via the goAML portal.
The FIAU and MGA conduct joint inspections. The FIAU's Implementing Procedures Part II is sector-specific to remote and land-based gaming; missing a published typology in your monitoring rules engine is a frequent finding. Recent enforcement actions have included seven-figure administrative fines.
What are the player protection requirements under the Gaming Act 2018?
The Player Protection Directive issued under the Gaming Act 2018 and the Player Protection Regulations (S.L. 583.07) require MGA licensees to operate self-exclusion via the centralised Player Protection Register, deposit limits, session limits, reality checks, time-outs, mandatory responsible gambling messaging, robust age verification, affordability checks, algorithmic markers-of-harm detection, transparent bonus terms and a complaints SLA of 10 working days.
A Player Protection Officer must be appointed as a Key Function role, Malta-resident, and is interviewed by the MGA at application. Failure to comply with the Directive is a primary trigger of MGA enforcement orders and license suspensions in 2024-2026.
Why is Malta the iGaming hub of Europe in 2026?
Malta hosts 300+ MGA-licensed Authorisation Holders in 2026, employs roughly 11% of its workforce in the gaming sector and generates around 12% of national GDP from gaming activities. The cluster effect concentrates legal, audit, AML, payments, platform, studio and affiliate talent on a 316 km² island — making Malta the densest iGaming ecosystem in the EU.
EU passporting recognition, the 5% gaming tax, the 5% effective corporate tax, the English-speaking bilingual workforce, gaming-friendly EMIs and the predictable regulatory cadence sustain the lead. The 2018 Gaming Act and FIAU's mature AML framework signal "serious operator" to banks, payment partners and secondary-market regulators.
How does the MGA license interact with e-commerce affiliate marketing?
MGA licensees rely heavily on affiliate marketing for player acquisition — typically 30-60% of new players. The MGA's Commercial Communications Regulations require affiliates to be vetted, contracted and monitored. Affiliates promoting MGA operators are subject to Maltese advertising standards, and operator misconduct includes affiliate misconduct.
The synergy with broader e-commerce affiliate networks is significant: Malta-domiciled affiliate management companies that handle both iGaming and e-commerce affiliate programmes benefit from the same 5% effective corporate tax and the same EU passporting backbone. This is why Malta hosts the largest concentration of affiliate and comparison networks in the EU.
Can I hold both an MGA gaming license and run an e-commerce business from the same Malta company?
Yes, but with structural care. An MGA Authorisation Holder is normally a single-purpose vehicle dedicated to the licensed gaming activity, for ring-fencing and player-funds segregation reasons. E-commerce or affiliate activities are typically held in a sister company under the same Maltese holding company.
Both companies benefit from the 6/7 corporate tax refund. The Malta Business Registry permits this group structure and the MGA accepts it provided the gaming entity's substance, key function holders and player-funds segregation are intact. Zunapro structures the holding + gaming SPV + affiliate/e-commerce sister company as a single onboarding flow.
What documents do I need to apply for an MGA license in 2026?
The core MGA application file in 2026 includes: a five-year business plan, a three-year financial forecast, source-of-funds and source-of-wealth evidence for every UBO holding 10%+ shares, fit-and-proper questionnaires for all directors and key persons, an AML/CFT policy aligned to FIAU Implementing Procedures Part II, a Business Risk Assessment (BRA), a Player Protection policy, a Responsible Gaming policy, a Cybersecurity policy and ISMS, a System Documentation Pack covering RNG and platform certification, the Maltese incorporation certificate, lease evidence for the Malta office and a draft Terms and Conditions for the proposed gaming domain.
Does an MGA license give EU-wide market access?
No single EU license gives unrestricted access to every member state because gambling regulation is reserved to member states under the Treaty on the Functioning of the European Union (Article 56 TFEU jurisprudence). However, an MGA license is recognised as a benchmark and is accepted as the baseline trust signal across the EU/EEA.
Operators wishing to target specific EU markets — Germany (GGL), Italy (ADM), Spain (DGOJ), France (ANJ), Netherlands (KSA), Sweden (Spelinspektionen), Denmark (Spillemyndigheden), Portugal (SRIJ), Romania (ONJN), Greece (HGC), Belgium (Kansspelcommissie) — must add the relevant local license. The MGA license provides the operational backbone, the platform substance and the corporate-tax efficiency for the entire hub-and-spoke architecture.
How long does Maltese company formation take with Zunapro?
Maltese company incorporation with the Malta Business Registry typically takes 5-10 working days once all UBO due-diligence documentation is provided. Zunapro pre-fills the MBR templates, sources the registered office, the company secretary and the substance pack, and coordinates with a Maltese tax advisor for the 6/7 refund optimisation.
The MGA application file (holding + gaming SPV + key person contracts + policy stack) is a separate workstream that runs in parallel. Plan on roughly 30-45 days from "yes I want a Maltese iGaming structure" to a filed MGA application, and 6-12 months to live authorisation. Zunapro's Malta module sequences both workstreams from one panel.
Form your MGA-ready Maltese structure today
Maltese holding · Gaming SPV · Affiliate / e-commerce sister company · Substance · MLRO · Compliance Officer · AML stack · Player Protection. One panel, 30-day filing, 5% effective tax — Zunapro's Malta company-formation flow is built for the 2026 MGA application cycle.
🇲🇹 Form Your Malta Company →Precisa de ajuda?
Serviço relacionado: App Móvel