Malta Gambling License Guide: All You Need in 2026

A 10-year license is issued by the Malta Gaming Authority. Chapter 583 governs a €5,000 application and €25,000 annual fee; Type 4 alone costs €10,000. Qualifying Malta-linked gaming revenue pays 5% through 30 September 2026. From 1 October, Type 1 pays 15%; Types 2–4 pay 10%. Immediate supervisory access to operational data defines Malta’s technical model.

Applicants value the MGA license because the public register and EU/EEA eligibility support banking, payment, and supplier checks. Each operator still needs ownership, capital, player funds, hosting, and reporting aligned with the approved scope. A turnkey platform can map these controls before submission, reducing audit rework, but the file remains heavier than offshore alternatives.

Malta License Quick Facts

1. 01

   The Malta Gaming Authority (MGA) is the regulator responsible for issuing and supervising gaming licences in Malta.

2. 02

   The primary legislation is the Gaming Act, Chapter 583, which establishes the legal framework for licensed gaming activities.

3. 03

   A Malta gaming licence is generally issued for a 10-year term, subject to ongoing regulatory requirements.

4. 04

   The standard license application fee is €5,000 and is non-refundable.

5. 05

   Annual licence fees vary by activity: B2C licences cost €25,000, while Type 4-only licences cost €10,000. B2B fees generally range from €25,000 to €35,000.

6. 06

   Qualifying Malta-linked revenue is taxed at 5% through 30 September 2026. From 1 October 2026, the rate becomes 15% for Type 1 and 10% for Types 2–4.

7. 07

   Maltese companies are subject to a 35% headline corporate tax rate, although effective outcomes depend on the corporate and shareholder structure.

8. 08

   The MGA does not publish a fixed approval SLA. Operators should generally plan around 6–12 months for the full application process.

9. 09

   Applicants must operate through a company incorporated in the EU or EEA.

10. 10

    Gaming infrastructure may be hosted in Malta, another EEA country, or an approved third country, provided the MGA retains required real-time supervisory access.

11. 11

    Player funds must remain segregated and separately identifiable, with monthly reporting normally due by the twentieth day of the following month.

What Is the Malta Gambling License?

An applicant must be an EU/EEA company meeting the capital requirements and annual financial-statement duties. MGA tests whether the applicant is fit and proper and can fund the gaming business. The review also covers strategy, operating capacity, and obligations under the laws of Malta. Before approval, the proposed technical environment must match the submitted policies and procedures.

One authorization can contain several approved gaming activities, although each vertical remains visible in scope and may require added capital. That differs from Curaçao, where one B2C grant covers its permitted product set without per-vertical approval. Malta’s gaming regulator was formerly called the Lotteries and Gaming Authority; the current name has applied since 2015.

• Gaming Service license (B2C license) — authorizes a player-facing gaming service through remote, land-based, or approved combined channels.
• Type 1 — covers a random game of chance played against the house, including casino formats and lotteries.
• Type 2 — covers fixed-odds activity where the operator sets each bet and manages its own gaming risk.
• Type 3 — covers peer-to-peer or pool activity where the business earns commission without house exposure.
• Type 4 — covers controlled skill games approved under the applicable authorisation rules.
• Critical Gaming Supply licence (B2B license) — covers material game elements and software used to process essential regulatory records.

Why Operators Choose the Malta License

1. 01

   A ten-year term reduces renewal disruption.

   The authorization remains valid for 10 years after approval. Product, banking, and supplier planning can therefore use a longer regulatory horizon than annual offshore models.

2. 02

   Published capital thresholds make early budgeting clearer.

   Type 1 and Type 2 require €100,000, while Types 3 and 4 require €40,000. Multiple approvals accumulate only to a €240,000 cap.

3. 03

   Approved start-ups can receive a 12-month contribution moratorium.

   Qualifying undertakings do not pay the monthly contribution during that period. The relief does not remove annual fees, tax, audit, or operational spending.

4. 04

   Infrastructure is not restricted to one island.

   The architecture may run in Malta, another EEA state, or an approved third country. The binding condition is timely supervisory access, not a blanket relocation of every server.

5. 05

   Authorization status is publicly checkable.

   One of the advantages of a Malta authorization is a searchable register listing the entity, approved service, domains, and status. Banks and suppliers can verify scope without relying only on an applicant-provided certificate.

6. 06

   Player-fund supervision follows a measurable calendar.

   The Malta Gaming Authority ensures licensed operations follow published player-protection controls. Monthly returns are generally due by the twentieth day, turning reconciliation into a recurring control rather than a year-end exercise.

Malta Gambling License Costs in 2026

The cost model combines a fixed annual charge with revenue-linked compliance contributions for B2C activity. The fixed license fee does not increase with player count, domains, or headcount. Applicable B2B charges instead change by reported annual revenue band. The MGA fee guidance sets separate minimums and maximums for each license type.

Licence type	Annual fee or contribution	What it covers
B2C Type 1	€25,000, plus €15,000–€375,000 contribution	House-banked random games, lotteries, and approved Type 1 verticals
B2C Type 2	€25,000, plus €25,000–€600,000 contribution	Fixed-odds products and approved Type 2 verticals
B2C Type 3	€25,000, plus €25,000–€500,000 contribution	Peer-to-peer, pool, exchange, and commission-based products
B2C Type 4 only	€10,000, plus €5,000–€500,000 contribution	Controlled skill products without another approved type
B2B standard	€25,000 up to €5 million revenue; €30,000 to €10 million; €35,000 above	Supply and management of material game elements or regulatory-record systems
B2B back-office	€3,000 up to €1 million revenue; €5,000 above	Approved back-office software supply within the authorised scope

Outside the schedule, budgets cover substance, directors, legal work, testing, hosting, banking, audits, and PSP onboarding. A single-vertical B2C launch should reserve €90,000–€180,000 before payroll, marketing, and content revenue share. Financial requirements add €100,000 capital for Types 1–2 or €40,000 for Types 3–4. Capital is not a fee and remains available for needs.

How to Get a Malta Gaming License

The gaming licence application procedure is portal-led, not a fixed hearing calendar. MGA runs the Malta gaming license application process through completeness, fit-and-proper, funding, policy, technical, and audit reviews. Teams obtaining a gaming license should consult the official application guidance before filing. The document prescribes neither a mandatory pre-application meeting nor a public hearing.

• Select the B2C or B2B route and map every requested game type, channel, domain, and supplier.
• Incorporate an EU/EEA entity and fund the applicable share-capital threshold before submission.
• Map ultimate beneficial owners, directors, key persons, source of wealth, and source of funds.
• Prepare the business plan, forecasts, AML/CFT controls, player-protection procedures, and responsible gaming policies.
• Submit the license application through LRMS and pay the non-refundable €5,000 charge.
• Answer fit-and-proper, funding, strategy, and operating-policy questions in complete evidence batches.
• Stage the approved environment within 60 days and trigger an independent system audit.
• Resolve findings, pay the annual charge, receive approval, and file the go-live declaration before launch.

MGA publishes no fixed end-to-end SLA, so planning should allow 6–12 months. An incomplete file receives one 60-day correction window; the staged environment receives another 60 days. Delays follow fragmented ownership evidence, unexplained funding, revised markets, or changes affecting more than 75% of ownership, control, or financing. Teams seeking to obtain a Malta authorization should freeze decisions before submission.

Malta Hosting, Real-Time Replication, and Audit Evidence

The old claim that every production server must sit within Malta is incorrect. Critical architecture may run in Malta, another EEA state, or an approved third country. A primary stack outside Malta can therefore qualify, but the file must identify each geographic location. The technical infrastructure guidance expects live supervisory access and may require a replica located in Malta.

Architecture item	Submission expectation	Operational consequence
Network topology	Hardware, virtual machines, internal IPs, and every hosting location	The production diagram becomes an audit-controlled record
Critical components	RNG, jackpot, player, financial, and gaming database services	Changes need impact assessment and evidence before release
Cloud model	Private cloud or accepted virtual private cloud with a documented risk assessment	Shared-tenancy controls must prove isolation and integrity
Malta replica	Physical location, rack number, IP addresses, and data ownership	The replica needs monitored availability and controlled administrator access
Connectivity	Security protocols linking live and replicated environments	Encryption, authentication, and failure alerts become reportable controls
Replicated data	Player, financial, and gameplay records, transmission frequency, and measured lag	Data pipelines need replay, reconciliation, and exception handling
Supervisory access	Immediate and unhindered physical or electronic access	Access procedures must work without engineering intervention
Supply boundary	Critical gaming supply license scope, contracts, and data responsibilities	Each gaming platform dependency needs an accountable control owner

The May 2025 audit procedure gives the approved auditor 60 days from engagement to submit its report. A further 60-day remediation extension may be requested when findings arise. Gaming systems, policies, and evidence should use matching identifiers in numbered virtual-data-room folders. Providers delivering critical gaming supply services should also document where their responsibility ends and the licensed entity’s control begins.

Player Funds, Positive Equity, and the October 2026 Tax Cutover

Player money must remain segregated and separately identifiable, with monthly submissions due by the twentieth day. Remote B2C authorised entities submit annual AUP reporting within nine months after the first-year exemption. Current reporting requirements for license holders also impose a 72-hour deadline for confidentiality incidents. Account-access outages lasting more than 12 hours are separately reportable

Control	Numeric rule	System consequence
Type 1 or Type 2 capital	€100,000 each	Treasury and accounting records must preserve paid-up capital continuously
Type 3, Type 4, or B2B capital	€40,000 each	Additional approvals may require a capital increase before activation
Multiple approvals	€240,000 cumulative cap	Finance must map capital by approved type without exceeding the cap
Positive equity	General rule: restore within 6 months; solely B2B: action once the deficit exceeds €3 million, unless MGA intervenes earlier	Forecasting needs an early-warning threshold before statutory accounts close
Monthly player-funds return	By the 20th day of the following month	Wallet, bank, PSP, jackpot, and bonus ledgers need automated reconciliation
Annual AUP declarations	Within 9 months of financial year-end	Archived transaction evidence must remain reproducible for the practitioner
Go-live	Within 90 days; declaration at least 2 days beforehand	Release management needs an approval gate tied to the declared date
Security incident	Notify within 72 hours; account outage threshold is over 12 hours	Monitoring must preserve timestamps, impact scope, and escalation ownership

From 1 October 2026, Legal Notice 84 of 2026 changes gaming tax for Type 1 to 15%. Types 2–4 move to 10% on the same date. For remote gambling, nexus uses the player’s establishment, permanent address, or usual residence rather than physical presence. The ledger must retain game type, residence evidence, taxable revenue, corrections, and period cutover logic.

Positive equity remains a continuing condition, not an incorporation checkpoint. B2C entities must restore a negative position within six months after year-end. Solely B2B entities instead act when negative equity exceeds €3 million, unless MGA orders earlier restoration. Budgets, intercompany balances, dividends, and player-liability coverage become supervisory evidence. Finance and product teams should use matching balance definitions before monthly close.

Technical Snapshot: Evidence Expected Before Launch

MGA supervision tests whether submitted policies can be reproduced from live records. The evidence set covers ownership, money flows, game versions, access, incidents, player protection, and tax outputs. Regulatory compliance therefore depends on exportable records across online gaming operations, not a document pack assembled once for approval. Each control needs an owner, source system, retention rule, and review cadence.

System area	Implementation requirement	Evidence the regulator asks for
Ownership and governance	Approved UBOs, directors, key persons, and controlled role permissions	Declarations, approval records, organisation chart, and access matrix
Player wallet	Segregated real-money, bonus, jackpot, pending, and withdrawal balances	Daily reconciliations, adjustment audit trails, and bank or PSP matching
Game integrity	Certified gaming content, approved RNGs, and version-controlled releases	Test certificates, hashes, deployment records, and round reconstruction
Payments and AML	Anti-money laundering screening, transaction monitoring, and source-of-funds escalation	Decision history, alerts, case notes, and linked payment identifiers
Player protection	Age checks, limits, exclusions, complaints, and intervention workflows	Account history, communications, tool settings, and case outcomes
Infrastructure	Geographic inventory, cloud risk assessment, recovery design, and replica monitoring	Network schematic, contracts, logs, failover tests, and measured replication lag
Security and access	Least privilege, multifactor access, vulnerability handling, and incident response	Administrator logs, review records, test results, and incident chronology
Reporting and tax	Scheduled player-funds, fee, contribution, and tax calculations	Portal-ready extracts, reconciliations, sign-offs, and correction history

The infrastructure guidance sets ISO/IEC 27001 as the expected security level. The current certification baseline is ISO/IEC 27001:2022; accredited transition from the 2013 edition ended on 31 October 2025. The ISMS scope must precisely match hosted assets and suppliers. Evidence should include asset inventories, access reviews, incident records, backup tests, supplier controls, and the Statement of Applicability.

Where card data is stored or processed, MGA guidance seeks PCI DSS Level 1 certification. PCI DSS v4.0.1 made 51 future-dated requirements effective on 31 March 2025. PSP-hosted fields and tokenization reduce scope, but browser payment pages remain controlled environments. Annual evidence should cover script authorization, integrity checks, tamper detection, and vulnerability handling.

How the Malta License Compares With Other Licenses

Within iGaming, headline price often hides the binding commercial constraint. Gaming companies should compare market scope, capital, substance, hosting, supplier recognition, and payments before comparing gaming licenses. The gambling industry often quotes annual fees without implementation costs. The gaming industry absorbs those costs through engineering, finance, and staffing. Supervised remote activity remains market-specific, even when one regulator is widely recognised.

• Isle of Man (GSC) — £5,250 application, then £36,750 per year. 10–12 weeks. Constraint: on-island registration and gameplay systems, two resident directors, and a Manx client account.
• Curaçao (CGA) — €4,592 application, then €47,450 per year for B2C. Up to 24 weeks of regulator time. Constraint: local company, physical office, local hiring, and supplier registration.
• Kahnawake (KGC) — US$35,000 CPA payment plus US$5,000 per proposed key person; CPA renewal is US$20,000. About 4–8 weeks. Constraint: regulator-directed equipment at the approved co-location facility.
• Tobique (TGC) — Current NuxGame benchmark: about €43,000 total setup, including advisory work. About 4–8 weeks. Constraint: the public page does not separate the regulator’s annual component from service costs.
• Anjouan — €17,828 at issuance and €17,828 at annual renewal. About 4–8 weeks on a clean file. Constraint: mandatory independent dispute resolution and narrower fiat-acquirer appetite.
• Costa Rica — No regulator-issued gaming approval or gaming charge; a practical first-year structure is about US$25,000–US$45,000. About 4–8 weeks. Constraint: the municipal data-processing permit provides no regulated market access.

Cost per market ultimately matters more than cost per document. Malta gives gaming operators a supervised base, but no automatic passport into every player country. Gambling operators still need local-law analysis, geoblocking, advertising controls, payment acceptance, and sometimes another approval. The UK offers a useful contrast: its operating permission remains domestic, while annual charges scale with gross gambling yield.

How NuxGame Helps With the Malta License

Applications stall at two points: ownership and funding evidence, or differences between policies and deployed systems. The legal team from NuxGame handles company registration, beneficial ownership, AML/CFT and RG policies, banking, PSP setup, and submission. It also coordinates regulator questions and document updates throughout review. A readiness review maps promised controls to a live export, workflow, or accountable supplier.

Deployment planning covers EEA hosting, a Malta reporting replica where required, and player-fund segregation. It also maps game-type approvals, residence-based tax fields, and monthly reporting outputs. The online casino platform keeps those controls in one operating model while contracts define B2B dependencies. This reduces ambiguity across operational workflows and separates licensed-entity duties from external software and service responsibilities.

Planning a filing or comparing structures? NuxGame legal services can review the corporate, financial, and technical scope before submission. The review identifies missing evidence and sequences the next steps.