iGaming License in Malta: MGA License Cost & Requirements 2026

MGA issues B2C (Business-to-Consumer) licenses under four game type categories. A single operator can hold licenses for multiple types simultaneously:

Companies that provide software, platforms, RNG engines, or other critical gaming infrastructure to licensed operators need a B2B (Critical Gaming Supply) recognition notice from MGA. This covers:

• Gaming software providers — slot developers, live dealer studios, game aggregators
• Platform suppliers — turnkey iGaming platforms, player account management systems
• RNG providers — random number generator certification and supply
• Payment processing — gaming-specific payment solutions integrated into operator platforms

B2B annual fees range from €3,000 to €35,000 depending on the scope of services and revenue generated.

• EU membership — as an EU member state, Malta-licensed operators can offer gaming services across the entire European Economic Area (450+ million consumers) without additional licenses in each country (subject to local market regulations).
• Regulatory credibility — the MGA is one of the most respected gaming regulators globally. An MGA license signals to players, payment providers, and partners that your operation meets the highest compliance standards. This directly impacts player trust and conversion rates.
• Favourable tax regime — Malta offers a 5% effective corporate tax rate through its dividend refund system (35% statutory rate with a 6/7 refund to shareholders). Gaming tax is 5% on revenue from Malta-based players only. Revenue from international players is not subject to gaming tax.
• 10-year license validity — MGA licenses are valid for 10 years (extended from the previous 5-year term), providing long-term operational stability and reducing renewal overhead.
• English-speaking jurisdiction — English is an official language of Malta, making business operations, legal proceedings, and regulatory communication straightforward for international operators.
• Mature iGaming ecosystem — Malta hosts a deep pool of experienced iGaming professionals, from compliance officers and MLRO specialists to marketing experts and platform developers. Major industry events (SiGMA, iGaming NEXT) are held in Malta annually.
• Strong player protection framework — MGA’s Player Protection Directive mandates responsible gaming measures, self-exclusion tools, and dispute resolution mechanisms — building player trust and reducing regulatory risk for operators.
• First EU state to regulate online gambling — Malta introduced remote gaming legislation in 2004, giving the jurisdiction over two decades of regulatory maturity and institutional knowledge that newer jurisdictions cannot match.

• Gaming Act 2018 (Cap. 583) — the primary legislation governing all gaming activities in Malta. Establishes licensing categories, regulatory powers, compliance requirements, and enforcement mechanisms. Replaced the previous Lotteries and Other Games Act.
• Player Protection Directive 2018 — mandates responsible gaming measures including self-exclusion, deposit limits, reality checks, and cooling-off periods. Operators must provide clear information about odds, risks, and problem gambling resources.
• Gaming Compliance and Enforcement Directive — sets out the compliance monitoring framework, audit requirements, reporting obligations, and sanctions for non-compliance. Empowers MGA to conduct both scheduled and unannounced audits.
• AML/CFT obligations — gaming operators are designated as “subject persons” under Malta’s Prevention of Money Laundering Act (PMLA), implementing EU Anti-Money Laundering Directives. This requires customer due diligence, transaction monitoring, suspicious transaction reporting, and appointment of an MLRO.

The Malta Gaming Authority is responsible for:

• Licensing — evaluating and issuing B2C and B2B gaming licenses
• Supervision — ongoing monitoring of licensed operators through audits, inspections, and regulatory returns
• Enforcement — imposing sanctions, fines, license suspensions, or revocations for non-compliance
• Player protection — overseeing dispute resolution, responsible gaming standards, and self-exclusion systems
• Policy development — publishing guidance, directives, and regulatory updates for the industry

In 2021, MGA conducted 54 on-site audits and 230 desktop reviews, covering 65.5% of all licensees — demonstrating the Authority’s active enforcement posture.

• Malta-registered company: you must incorporate a limited liability company with the Malta Business Registry (or establish a branch of an EU company in Malta). Non-EU parent companies can own the Malta entity — there are no restrictions on foreign ownership.
• Physical office in Malta: MGA requires all licensees to maintain a genuine physical office presence in Malta. A virtual address or registered agent alone is not sufficient.
• Minimum share capital: €40,000 for Type 4 (skill games); €100,000 for Types 1–2 (casino, betting); €40,000 for Type 3 (poker). The exact amount depends on the scope of operations and MGA’s assessment of financial adequacy.
• Bank account: a corporate bank account with a Malta-based or EU-based financial institution is required for operational funds and player fund segregation.
• Player fund protection: MGA mandates that player funds be held in segregated accounts, separate from operational funds, to protect players in the event of operator insolvency.

MGA requires all licensees to appoint Key Function Holders (KFHs) who are personally vetted and approved by the Authority. All KFHs must pass MGA’s fit-and-proper assessment:

• Key Person (CEO / Managing Director) — overall responsibility for the gaming operation. Must be approved by MGA and at least one key person must be resident in Malta.
• Compliance Officer — ensures the company adheres to all MGA regulations, licence conditions, and internal policies. Responsible for regulatory reporting and internal audits.
• MLRO (Money Laundering Reporting Officer) — oversees AML/CFT compliance, conducts enhanced due diligence on high-risk players, and files suspicious transaction reports with the Financial Intelligence Analysis Unit (FIAU).
• Key Technical Person — responsible for the technical integrity of the gaming platform, including RNG certification, system security, and data protection.

• Completed MGA application forms for all directors, shareholders, and KFHs
• Certified copies of passports and proof of address for all beneficial owners
• Criminal record certificates from all countries of residence (last 10 years)
• Financial statements and source of funds documentation
• Detailed business plan with 3–5 year financial projections
• AML/CFT policies and procedures manual
• Responsible gaming policy and player protection measures
• Technical documentation: platform architecture, security protocols, RNG certification
• Data protection impact assessment (GDPR compliance)
• Game testing certificates from MGA-approved testing laboratories

• Gaming servers: servers must be hosted in Malta or within the EU/EEA in MGA-approved data centres. Co-location and cloud hosting arrangements must be pre-approved.
• RNG certification: all RNG-based games must be tested and certified by an MGA-approved independent testing laboratory (e.g., eCOGRA, BMM Testlabs, iTech Labs, GLI).
• Game testing: each game offered must be individually tested for fairness, return-to-player (RTP) accuracy, and compliance with MGA technical standards.
• Player protection systems: self-exclusion mechanisms, deposit limits, session time limits, reality check pop-ups, and cooling-off periods must be built into the platform.
• IT security: penetration testing, vulnerability assessments, data encryption, access controls, and incident response procedures are required.
• Player verification: age verification, identity verification, and geolocation systems to prevent access from restricted jurisdictions.

Beyond MGA fees, operators should budget for the following first-year costs:

Malta’s dividend refund system works as follows:

• The Malta company pays 35% corporate tax on profits
• Upon distribution of dividends, the shareholder (typically a holding company) claims a 6/7 refund from the Malta tax authorities
• The net effective tax rate is approximately 5% (35% × 1/7)
• The statutory deadline for the refund is 14 days from when the claim is filed, though in practice processing may take longer

This structure is fully compliant with EU law and has been upheld by the European Commission. Most operators use a Malta operating company owned by a holding company in a jurisdiction with a favourable double-tax treaty network.

The most common comparison for operators starting out is Malta vs. Curaçao. The decision depends on your priorities:

• Choose Malta (MGA) if: your primary market is the EU, you want premium payment provider access (Visa, Mastercard, Apple Pay), you need regulatory credibility for partnerships, and you’re building a long-term brand.
• Choose Curaçao if: you need to launch quickly (2–4 months), your budget is limited, you serve non-EU markets (LATAM, Asia, Africa), and you plan to upgrade to an MGA license later.
• Choose both (dual-jurisdiction strategy): Many operators start with a Curaçao license to begin generating revenue quickly, then apply for an MGA license in parallel for EU market access and premium positioning.

• Monthly regulatory returns — submit to MGA by the 20th of the following month. Includes player activity data, revenue figures, bonus statistics, and responsible gaming metrics.
• Annual audited financial statements — must be filed within 180 days of the fiscal year end. Prepared by an MGA-approved auditor in accordance with International Financial Reporting Standards (IFRS).
• Annual compliance audit — an independent compliance review covering all regulatory obligations, internal controls, and MGA licence conditions.
• Suspicious transaction reports — filed with the FIAU (Financial Intelligence Analysis Unit) when AML/CFT concerns arise. No threshold — report immediately upon suspicion.
• Material change notifications — notify MGA immediately of any changes to ownership, directors, Key Function Holders, corporate structure, or business model. Prior approval is required for acquisitions of 10% or more of equity or control rights (qualifying interest).

• Self-exclusion system — operators must provide players with the ability to self-exclude for periods ranging from 6 months to permanent. Cross-operator self-exclusion is managed through MGA’s centralised system.
• Deposit limits — players must be able to set daily, weekly, and monthly deposit limits. Changes to increase limits must have a cooling-off period.
• Reality checks — automated pop-up notifications reminding players of session duration and spending at regular intervals.
• Problem gambling resources — operators must display prominent links to organisations like GambleAware and the National Council on Problem Gambling.
• Complaints handling — a formal complaints procedure must be in place, with unresolved disputes escalated to MGA’s dispute resolution service.

• Long timeline (6–12 months) — the MGA licensing process is thorough and cannot be expedited. Operators who need to launch quickly may need to consider an interim Curaçao or Kahnawake license while the MGA application is processed.
• High upfront costs (€160,000+) — between company formation, share capital, compliance setup, technical audits, and Key Function Holder salaries, the first-year investment is substantial. Malta is not suitable for operators with limited budgets.
• Strict fit-and-proper checks — MGA conducts extensive background checks on all shareholders, directors, and KFHs. Undisclosed criminal history, financial difficulties, or connections to unlicensed gambling can result in application rejection.
• Physical presence requirement — unlike many offshore jurisdictions, MGA requires a genuine office and at least one Key Function Holder resident in Malta. This adds operational complexity and cost for remote-first teams.
• Ongoing compliance burden — the reporting and player protection obligations detailed above require dedicated compliance resources. Underinvestment in compliance is the most common reason for MGA enforcement actions.
• Restricted markets — while the MGA license provides broad market access, some EU member states have their own local licensing requirements (France, Italy, Spain, Netherlands). An MGA license does not automatically authorise operations in locally regulated markets.

If you plan to operate for more than 2–3 years and expect to generate significant revenue, obtaining your own MGA license is almost always more cost-effective than paying 15%–40% revenue share to a white-label provider. However, a white-label can be a smart first step to validate your market before committing to a full license application.

• 500+ licenses obtained since 2016 — across 40+ jurisdictions, including Malta, Curaçao, Gibraltar, and Isle of Man. We know what regulators expect.
• End-to-end service — from company formation and compliance documentation to MGA application management, technical audit preparation, and ongoing regulatory support.
• Dedicated project manager — a single point of contact who manages your application timeline, coordinates with MGA, and keeps you informed at every stage.
• Key function holder network — we can source experienced Compliance Officers, MLROs, and other KFHs who are already MGA-approved and based in Malta.
• Transparent pricing — fixed-price packages with no hidden fees. You know the total cost before we start.
• Ongoing compliance support — we don’t disappear after license issuance. Monthly return preparation, annual audit coordination, and continuous regulatory advisory.