Malta Gaming Authority: Licence Types and Operator Obligations

The licence types the Malta Gaming Authority issues settled into their current shape in 2018, yet operator briefings still describe them in the language of the old class system. Malta now runs a two-tier authorisation model with four game types inside it, a ten-year term, and a reporting calendar that starts before a site goes live. The obligations attached run deeper than the published fee schedule suggests.

How the Gaming Act 2018 Reshaped Licensing in Malta

Malta’s Gaming Act 2018 (Cap. 583) replaced a fragmented set of instruments with a single technology-neutral statute, and it took effect on 1 August 2018. Two authorisations came out of that reform. A Gaming Service Licence covers business-to-consumer activity, meaning any operator that takes wagers from players directly. A Critical Gaming Supply Licence covers business-to-business activity, meaning platform providers, game studios and other suppliers whose failure would compromise a licensed operation.

The old classes disappeared with it. Under the Act an operator holds one licence and adds approved game types to it, so a casino and sportsbook combination no longer needs two separate authorisations. Licence terms also lengthened from five years to ten. Most operational detail sits below the statute, in the Gaming Authorisations Regulations (S.L. 583.05), the Gaming Licence Fees Regulations (S.L. 583.03), the Gaming Compliance and Enforcement Regulations (S.L. 583.06), and in binding directives issued by the Authority.

One boundary catches applicants out. The MGA supervises gaming, but anti-money laundering supervision for Maltese licensees sits with the Financial Intelligence Analysis Unit, which runs its own examination programme and receives suspicious transaction reports. GICNT-LS applies its licensing and legal status requirements to both relationships, because an operator can hold a valid Maltese authorisation while carrying an unresolved FIAU finding.

What Each Game Type Covers Under a Gaming Service Licence

The requirements attached to an MGA B2C licence vary by game type rather than by brand or turnover. Minimum share capital and the compliance contribution are both calculated per type, and an operator running several types pays cumulatively, with total capital capped at EUR 240,000. Anyone comparing licensing jurisdictions should read the table below as the entry cost of the vertical, not of the licence.

Game type	Verticals covered	Minimum share capital	Compliance contribution per year
Type 1	RNG casino games, live casino, roulette, blackjack, baccarat, poker played against the house, lotteries, secondary lotteries, virtual sports	EUR 100,000	EUR 15,000–375,000
Type 2	Fixed odds betting, including live betting	EUR 100,000	EUR 25,000–600,000
Type 3	Pool betting, betting exchange, peer-to-peer poker and bingo, lottery messenger services, other commission-based games	EUR 40,000	EUR 25,000–500,000
Type 4	Controlled skill games under regulation 8 of the Gaming Authorisations Regulations	EUR 40,000	EUR 5,000–500,000

Verticals inside a type still need individual approval before launch. Adding live casino to an existing Type 1 authorisation, or in-play markets to a Type 2, triggers a variation application rather than a new licence.

Fees, Share Capital and the Compliance Contribution

Three recurring lines make up the regulatory cost of a Maltese authorisation, and the MGA calculates the compliance contribution against gaming revenue rather than against a flat schedule. Application costs EUR 5,000 and is non-refundable. The fixed annual fee is EUR 25,000 for a standard B2C licence, EUR 10,000 where the operator holds Type 4 only, and EUR 25,000 to EUR 35,000 for B2B licensees depending on revenue. B2B holders pay no compliance contribution at all. A pre-launch system review by an MGA-approved auditor typically costs EUR 2,500 to EUR 7,500 on top.

Gaming tax works differently again, and it bites only on revenue from players resident in Malta. The rate has been 5% since the 2018 reform. Legal Notices 84 and 86 of 2026, published on 1 April 2026, replace it from 1 October 2026 with 15% on Type 1 revenue and 10% on Types 2, 3 and 4, while revenue from controlled gaming premises and lawfully classified junkets stays at 5%. The same reform merges the old device levy into the single rate and raises the studio broadcasting levy from EUR 500 to EUR 3,000. For an operator with no Maltese player base the change is neutral. For anyone preparing a gambling licence application with a domestic offering, it reprices the model.

Solvency became an explicit condition in 2025. The Capital Requirements Policy, published on 2 July 2025, obliges every licensee to hold a positive equity position for the whole licence term. A licensee closing its financial year in net liability must restore equity within six months of the year end, and the restoration must land positive even if further losses accrue during that window. For B2B licensees the duty triggers only once negative equity passes EUR 3 million. Holders licensed during 2025 had to comply in full by 30 June 2026; those licensed earlier can negotiate a restoration period running up to five years.

Operators Must Keep Player Funds Segregated and Identifiable

Malta treats player funds segregation as a proprietary regime rather than a bookkeeping preference. Under the Gaming Player Protection Regulations, balances held for players sit outside the assets available to satisfy the operator’s ordinary commercial liabilities, and the MGA can direct the transfer of control, possession and title of those funds to a person it designates where insolvency or a regulatory failure arises. The practical requirements:

• Player funds stay separate from the operator’s own money and remain separately identifiable at all times. Commingling breaches the requirement outright.
• Pooled accounts are permitted. A licensee may hold funds across several accounts provided its systems and records identify each player’s entitlement accurately, and every such account faces the same regulatory review.
• The Authority may exercise viewing rights over the common player funds account at its own discretion.
• Audited financial statements must show the Player Funds Account Balance separately under the Cash and Cash Equivalents note, and player funds separately under Trade and Other Payables.
• A player under self-exclusion or operator-imposed exclusion keeps the right to withdraw, and the withdrawal route must appear in the terms and conditions.
• Payment acquirer arrangements fall inside the definition. Where a PSP holds player money or prize float even briefly before settlement, that balance counts.

The monthly player funds report exists to test coverage. It captures month-end balances for player funds, open bets, pending withdrawals, jackpot funds and player-designated bank or PSP balances, with supporting statements attached, and the Authority reads it to establish whether the licensee holds a surplus or a shortfall against player dues. GICNT-LS reviews the same figures alongside the wider player funds segregation requirements that apply across certified markets.

Reporting Deadlines the MGA Enforces Through the Licensee Portal

Reporting obligations bind MGA licensees on a monthly, half-yearly and annual rhythm, and almost all of it moves through the Licensee Portal. Late or inaccurate filing recurs more often than any other theme in Maltese enforcement decisions, because the supervisory model depends on the visibility these submissions provide.

Submission	Who files it	Deadline
Gaming tax report	B2C licensees	20th day of the following month
Player funds report	All B2C licensees and B2B licensees managing pooled jackpots	20th day of the following month, whether or not the operation has gone live
ADR report	B2C licensees	20th day of the following month
B2B compliance report	B2B licensees	20th day of the following month
Industry Performance Return	All licensees	7 September for January to June, 28 February for July to December
Interim Financial Report	All licensees	Two months after the first six months of the financial year
Annual Financial Report	All licensees	Two months after the financial year end
Audited financial statements	All licensees	Six months after the financial year end
Auditor player funds and gaming revenue declarations	Remote B2C licensees	Nine months after the financial year end
Auditor’s management letter	All licensees	Nine months after the financial year end
Information security incident notification	All licensees	Within 72 hours of a qualifying incident
Go-live declaration	Newly authorised persons	At least two days before going live, within 90 days of the licence date

Two notification duties sit outside the calendar. Sports betting licensees report suspicious betting immediately under Article 43 of Directive 3 of 2018, using the Suspicious Betting Reporting Mechanism. Information security incidents carry a hard 72-hour window, and the trigger is broader than a data breach: any incident affecting the confidentiality of player information qualifies, and so does any incident that locks players out of their accounts for more than twelve hours. That second limb has no equivalent in GDPR, which is why the data protection and cybersecurity requirements under GICNT-DS treat availability failures as reportable events in their own right.

How Player Complaints Move From the Operator to an ADR Entity

The licence conditions the MGA attaches oblige operators to give players a documented complaints procedure, published in the terms and conditions, with a stated timeframe for settling a dispute or escalating it. Every B2C licensee must also appoint an approved alternative dispute resolution entity and make it available from the day it goes live.

Directive 5 of 2018 changed where escalation leads. Since it came into force on 3 December 2018, licensees have been instructed not to point players towards the Authority; complaints procedures must name the engaged ADR entity instead. From 1 April 2019 the MGA’s Player Support Unit stopped ruling on the merits of individual disputes. It still accepts reports that an aspect of a gaming service is unlawful, unfair or opaque, and examines those as a compliance matter rather than as a claim for money.

ADR conclusions bind both parties, though referring a dispute does not remove a player’s right to sue in a competent court. The monthly ADR report closes the loop: licensees file the nature of each dispute, a description and the ruling, and the Player Support Unit reviews those filings for patterns. An operator whose ADR volume spikes around withdrawal refusals will be asked about it, which is one reason the player protection requirements under GICNT-PP examine complaint records rather than complaint policies.

What MGA Enforcement Looks Like in Practice

The Authority publishes every enforcement action in a public register, and its toolkit runs from warnings through administrative penalties to suspension and cancellation. The Winzon Group case shows the severe end of that range:

• The MGA cancelled the B2C licence held by Winzon Group Limited, reference MGA/B2C/717/2019, with retroactive effect from 11 March 2026. Notice followed on 7 April 2026.
• The Authority relied on regulation 10(2)(b) of the Gaming Compliance and Enforcement Regulations, which let it bypass the standard 20-day show-cause period and order an immediate halt.
• It imposed administrative penalties of EUR 147,080 and ordered payment of outstanding fees of EUR 46,693.23.
• Winzon had to notify players of the cancellation by email and on its websites for 30 days, refund all legitimate balances, and supply transaction reports and bank statements evidencing the refunds.
• The operator was ordered to strip every reference to MGA authorisation immediately. Its network spanned more than 40 approved sites.

An authorised person that disputes a decision may appeal to the Administrative Review Tribunal within 20 days of publication under Article 43(1) of the Gaming Act, and the authorisation is treated as suspended while the appeal runs. Reading the register alongside broader regulatory fines in iGaming gives a clearer picture of where Maltese supervision is heading than any single decision does. For 2026 the Authority has structured its supervisory work around compliance, player protection and sports betting integrity, with thematic reviews of internal control frameworks covering cash and cash equivalents and, separately, crypto assets.

How GICNT-LS Treats a Malta Licence During Certification

Verifying an MGA licence takes more than reading a footer. GICNT-LS runs licence validation as an annual review, and the Maltese checks follow a fixed order:

1. Search the Licensee Register by company name, authorisation status, URL and gaming service. A brand absent from the register holds no Maltese authorisation, whatever its footer claims.
2. Open the dynamic seal from the operator’s own site and confirm it resolves to the Authority’s verification page rather than to a static image.
3. Match the approved game types against the products actually offered. Unauthorised game offerings drove part of the 2025 enforcement escalation.
4. Check the Enforcement Register for prior warnings, penalties, suspensions or cancellations against the licensee and its group.
5. Cross-check the Unauthorised URLs list. The MGA publishes notices on sites impersonating licensed operators, including domains that quote licence numbers belonging to surrendered authorisations.
6. Distinguish a Recognition Notice from a licence. A Recognition Notice carries an annual fee of EUR 5,000 and recognises a foreign authorisation as equivalent for defined purposes; it is not a Maltese licence and the Authority can revoke it separately.

Certification and licensing answer different questions, and GICNT draws the line firmly on certification versus licensing. A valid MGA authorisation is the precondition GICNT-LS tests, not the outcome it certifies. An operator can satisfy every Maltese requirement and still fail the player protection, AML or advertising domains, and a lapsed or cancelled Maltese licence invalidates certification regardless of performance elsewhere.