How to Get a Malta Gaming Authority (MGA) Licence in 2026

The Malta Gaming Authority licence is the standard against which many regulators, payment processors, and banking partners measure other licences. It is not the cheapest. It is not the fastest. But it opens doors that no other single licence can.

Malta was the first EU member state to regulate online gaming, back in 2004. The Gaming Act of 2018 modernised the framework into what operators work with today: a streamlined two-category system (B2C and B2B), a single licence that covers multiple game types without separate applications for each vertical, and a 10-year licence duration that gives operators long-term planning stability.

The MGA maintains one of the largest registers of licensed online gaming operators in Europe. Major payment processors, Visa and Mastercard acquiring networks, affiliate programmes, and institutional investors treat MGA licensees as meeting a recognised regulatory standard.

This guide covers the MGA licence as it works in 2026: who can apply, the licence categories and game types, exact fees from the MGA's official guidance note, the application process step by step, key function holder requirements, ongoing obligations, and a practical comparison with Curaçao for operators weighing both options.  

Who Can Apply

According to the MGA's published eligibility criteria, any entity established in the European Union (EU) or the European Economic Area (EEA) can apply for a licence, provided it meets the share capital requirements and annual financial statements reporting obligations.

Non-EU/EEA entities cannot hold the licence directly. They need to incorporate an EU/EEA company first. In practice, most operators set up a Maltese limited liability company, though an entity registered in any EU/EEA member state qualifies.

The MGA does not require directors, owners, or key function holders to reside in Malta. But they must be readily available for contact and, in practice, operators are expected to have demonstrable local presence. For larger operations, that typically means at least one director or key function holder based in Malta and a real operational office on the island, not just a registered address.

Corporate Group Licence. The MGA allows groups of companies to apply for a single corporate licence, provided the parent entity holds over 90% control of group members. Under this structure, a company can offer B2C services to players and provide in-house B2B services (platform, software, games) to its own group entities without needing a separate B2B licence. Services provided to third parties outside the group still require a standalone B2B licence.

Recognition Notice for EU/EEA-Licensed Operators. Operators already licensed by a gambling authority in another EU or EEA member state may apply for an MGA Recognition Notice instead of a full licence. This is a shorter process, typically taking 4 to 8 weeks, that allows the operator to offer services in Malta on the basis of its existing EU/EEA authorisation. It is a materially different route from the standard application and may suit operators expanding into Malta from an established regulated position elsewhere in Europe. 

Licence Types and Game Categories

The MGA issues two licence categories under the Gaming Act (Cap. 583).

B2C: Gaming Service Licence

This is for operators offering games directly to players. Under the B2C licence, the MGA classifies games into four types:

A single B2C licence can cover multiple game types. An operator already holding a licence who wants to add a new type does not need to go through the full application again. They apply to the MGA for vertical approval through the Licensee Portal.

If a game displays elements that fall under more than one type, the MGA has full discretion in categorising it based on what it believes most closely reflects the game's nature.

B2B: Critical Gaming Supply Licence

This is for companies that supply gaming infrastructure to licensed operators: platform providers, game developers, sportsbook software suppliers, RNG providers, and back-office system operators. B2B licensees can only provide services to operators licensed by the MGA or by other regulators within the EU/EEA (or jurisdictions the MGA deems equivalent).

Minimum share capital for B2B: €40,000, regardless of game type.

Fees

Verify current fees directly with the MGA before beginning your application, as guidance notes are updated periodically.

Application and Annual Licence Fees

The annual licence fee is paid upfront before the licence is issued, and then annually in advance. It is non-refundable.

Compliance Contribution

On top of the annual licence fee, B2C operators pay a monthly compliance contribution calculated on all gaming revenue generated under the MGA licence. The rates use a sliding scale that decreases as revenue increases. Here are the ranges for the two most common B2C types:

Type 1 (Casino, Slots, Lotteries, Virtual Sports):
Minimum €15,000 per year, maximum €375,000 per year. The rate starts at 1.25% on the first €3 million of revenue and slides down to 0.40% on revenue beyond €30 million.

Type 2 (Fixed-Odds Betting / Sportsbook):
Minimum €25,000 per year, maximum €600,000 per year. The rate starts at 4.00% on the first €3 million and slides to 0.40% on revenue beyond €40 million.

Start-up moratorium. New operators that qualify under the MGA's Directive on Start-Up Undertakings receive a 12-month exemption from compliance contributions. The full minimum amount is not due until a complete licence period has elapsed. This is a genuine cost advantage for first-year operators that most guides fail to mention.

Gaming Tax

Malta levies a monthly gaming tax on gross gaming revenue (GGR) generated from players physically located in Malta. From October 1, 2026, the tax is 15% for Type 1 gaming services and 10% for Types 2, 3, and 4, replacing the previous flat 5% rate. Revenue from players outside Malta is not subject to this tax. For most international operators, this line item is negligible.

Realistic Total First-Year Cost

Adding up application fees, annual licence fees, compliance contributions, share capital, company incorporation, Key Function holder appointments, office setup, legal counsel, and systems audit costs, and based on experience supporting operators through MGA applications, total first-year costs typically run between €100,000 and €200,000+, depending on operational complexity. Year two onwards normalises as one-off setup costs drop away.

The Application Process

All applications go through the MGA Licensee Portal. The portal provides real-time status tracking and tutorial videos for common requests.

The MGA evaluates applications across four main areas, which run largely in parallel:

1. Fit and Proper Assessment

The MGA conducts background checks on all shareholders, directors, ultimate beneficial owners (UBOs), and key function holders. This covers criminal records, regulatory history, financial integrity, and professional competence. The MGA works with international law enforcement and regulatory partners to verify information.

This step assesses whether the individuals behind the operation are suitable to hold a gaming licence. Incomplete or unclear disclosures here are one of the most common causes of application delays.

2. Business Plan and Financial Review

The MGA reviews the applicant's business plan, financial projections, marketing strategy, HR structure, and source of funds. Share capital compliance is verified at this stage. The Authority checks whether the operation is genuinely viable and adequately capitalised.

3. Technical Documentation and Systems Audit

The applicant must complete the MGA's System Documentation Checklist (SDC) and submit all supporting technical documentation through the portal. This covers the gaming platform architecture, RNG certification, information security measures, disaster recovery, business continuity, and data protection.

After initial approval, the applicant has 60 days to deploy the technical setup and undergo a systems audit by an MGA-approved third-party auditor (GLI Europe, iTech Labs, RSM Malta, among others). The audit verifies that the live environment matches the approved application. If the 60-day window passes without completion, the application is dropped.

4. Regulatory Compliance Review

This covers AML/CFT procedures, data protection (GDPR), responsible gaming policies, player terms and conditions, commercial agreements, outsourcing arrangements, and advertising compliance. B2C applicants must have a fully appointed Anti-Money Laundering Reporting Officer (MLRO) and Data Protection Officer (DPO) before the licence is granted. These two roles cannot be held by the same person.

Timeline

The MGA does not publish an official fixed timeframe. Industry experience points to the following:

• Well-prepared application, clean corporate structure: 6 to 9 months from submission to licence grant
• Complex ownership, incomplete documentation, due diligence complications: 12 to 18 months
• After initial approval: 60 days to complete systems audit and technical deployment

The most common cause of delays is not regulatory slowness but applicant unpreparedness. Incomplete UBO disclosures, generic AML policies that read as copy-paste templates, and missing technical documentation all add months to the process.

Licence Duration

The MGA issues licences for a 10-year period, renewable. Any material changes to the system, ownership, or business model after licensing require prior MGA approval.
 

Key Function Holders: The Requirement Most Operators Underestimate

Every MGA-licensed entity must appoint individuals to perform specific Key Functions, each requiring a personal Key Function Certificate from the MGA. This is not a box-ticking exercise. The MGA expects real people with real expertise who are actively exercising oversight.

The mandatory Key Functions include:

Each Key Function holder must pass the MGA's vetting process based on academic qualifications, relevant experience, and personal integrity. They are also subject to Continuous Professional Development (CPD) requirements to remain certified.

If a Key Function holder cannot exercise their duties due to extenuating circumstances, a temporary replacement (without a certificate) may step in for up to one calendar month, but the MGA must be notified within 24 hours.

For operators who do not yet have the right people in-house, sourcing and onboarding qualified Key Function holders, particularly for compliance and AML roles, is a significant piece of pre-application work. Trying to fill these positions mid-process creates delays that are entirely avoidable.

Ongoing Obligations After Licensing

Getting the licence is the beginning, not the finish line. The MGA operates a risk-based supervisory model that scales scrutiny based on the operator's size, risk exposure, and product offering.

Reporting

Licensees must submit:

• Monthly regulatory returns (gaming tax, compliance contribution calculations)
• Monthly player funds reports
• Annual audited financial statements (within 2 months of year-end for the enhanced AFR, or 9 months for standard)
• Annual Agreed Upon Procedures (AUPs) report on player funds and gaming revenue (by a certified auditor)
• Incident reports as required

The MGA introduced interim financial reporting (IFR) in 2025 alongside the enhanced Annual Financial Report requirements, reflecting a shift toward more frequent financial oversight.

Player Fund Protection

Operators must hold player funds in segregated accounts separate from operational funds. The MGA audits this through the AUP process. Failure to properly segregate player funds is one of the most serious compliance violations and can lead to licence suspension.

Technical Infrastructure

Critical gaming components (RNG, jackpot servers, player database, financial database, gaming database) must be hosted in Malta or any EEA member state. The data centre must be ISO/IEC 27001 certified. Payment processors handling card data must be PCI DSS Level 1 compliant.

Unlike Curaçao, which requires a server specifically in Curaçao, the MGA allows hosting anywhere within the EU/EEA. This gives operators more flexibility in choosing data centre providers and optimising latency for their target markets.

Supervisory Activities

The MGA's 2025-2026 supervisory model includes:

• Off-site monitoring through regulatory reporting
• On-site inspections (full-scope and targeted)
• Structured supervisory meetings
• Ad-hoc reviews triggered by specific risk indicators
• Mystery shopping to evaluate customer-facing practices
• Technical audits of gaming systems and RNG certification

The mystery shopping programme is worth noting. The MGA sends anonymous testers to evaluate how operators handle player complaints, responsible gaming tools, and customer support interactions. This is a practical enforcement mechanism that goes beyond paperwork review.

Capital Requirements

The MGA published a Capital Requirements Policy that sets minimum capital buffers: €40,000 for B2B, €100,000 for B2C Types 1-2 (cumulative cap of €240,000). Operators showing negative equity must restore it within 6 months or apply for an extended restoration plan of up to 5 years under MGA supervision.

MGA vs Curaçao: A Practical Comparison

Operators evaluating an MGA licence almost always compare it to Curaçao. The two serve different strategic purposes, and many larger operators hold both. Here is how they compare in 2026:

When Malta makes sense: operators targeting regulated European markets where MGA recognition opens commercial doors. Companies that need tier-1 banking and payment processor relationships. Operators building toward institutional investment or eventual public listing. Established businesses with the budget and team to support strict compliance obligations.

When Curaçao makes sense: operators focused on international markets outside the EU (Latin America, Africa, Asia). Crypto-native operators. Cost-conscious startups launching quickly. Companies that want a single licence covering all verticals without separate approvals.

The dual-licence strategy. Many established operators hold both. Curaçao handles the .com international operation. Malta covers regulated European markets. The two licences complement rather than compete with each other.

Getting the Infrastructure Right

An MGA licence authorises you to operate. It does not provide the platform, the games, or the payment infrastructure. The MGA requires that all gaming systems pass a systems audit by an approved third-party auditor before going live, and that games offered are certified for fairness and RNG integrity.

Digitain's full turnkey solution brings sportsbook, casino, virtual sports, payments, and CRM together in one platform, built to meet the technical and compliance standards the MGA requires. That means the 60-day systems audit window becomes significantly more manageable. The casino games aggregator connects operators to 40,000+ pre-certified titles from 280+ providers through a single API. And the sportsbook software powers 180,000+ live events monthly with 4000+ betting markets and an advanced in-house pricing engine.

Digitain holds its own MGA B2B licence alongside certifications across the UK, Belgium, Romania, Greece, Peru, Brazil, and Curaçao. You can see the full list on our licences and certifications page. 

Talk to our team. We will show you exactly how Digitain's infrastructure fits the MGA's technical requirements — and how to get through the 60-day deployment window without it becoming a bottleneck.

Frequently Asked Questions

How much does an MGA licence cost?

The application fee is €5,000 (non-refundable). The annual B2C licence fee is €25,000. On top of that, B2C operators pay a monthly compliance contribution based on gaming revenue (starting at 1.25% for Type 1). Total first-year cost, including company setup, Key Function holders, and systems audit, typically runs €100,000 to €200,000+.

How long does it take to get an MGA licence?

A well-prepared application with a clean corporate structure takes 6 to 9 months. Complex ownership structures or documentation issues can push the timeline to 12 to 18 months. After initial approval, applicants have 60 days to complete the systems audit.

Do I need a physical office in Malta?

The MGA expects demonstrable local presence. For most operators, that means at least one director or Key Function holder based in Malta and a real operational office. A registered address alone is not sufficient for a serious operation.

Can I hold an MGA licence and a Curaçao licence at the same time?

Yes. Many operators hold both. The MGA licence serves regulated EU markets. The Curaçao licence serves international markets. The two are complementary.

What is a Key Function holder?

A Key Function holder is an individual personally approved by the MGA to perform a specific oversight role within the licensed entity. Key Functions include the CEO role, compliance, legal affairs, AML, data protection, and day-to-day operations. Each requires an individual Key Function Certificate from the MGA.

Is there a start-up discount on MGA fees?

Yes. Start-ups that qualify under the MGA's Directive on Start-Up Undertakings receive a 12-month moratorium on compliance contributions. The full minimum contribution is not due until a complete licence period has elapsed.

What game types can I offer under a single MGA licence?

A single B2C licence can cover all four game types (casino/slots, betting, peer-to-peer, skill games). Adding a new game type requires a new licence application. The operator applies for vertical approval through the MGA portal.

How long is the MGA licence valid?

10 years, renewable. Material changes to ownership, systems, or the business model require prior MGA approval during the licence period.

Can a non-EU company get an MGA licence?

Not directly. Only entities established in the EU or EEA can hold an MGA licence. A non-EU company must incorporate an EU/EEA entity (typically in Malta) to apply. Alternatively, operators licensed in other EU/EEA jurisdictions can apply for an MGA Recognition Notice, which takes 4 to 8 weeks.

This article is for informational purposes only and does not constitute legal advice. Licensing requirements, fees, and regulations are subject to change. Always consult qualified legal counsel and verify current requirements directly with the Malta Gaming Authority before making licensing decisions.