Malta Gaming Authority
MGA Malta Operator Guide — B2C and B2B Licensing, Key Positions, and Market Entry
The Malta Gaming Authority (MGA) is one of the world’s most established and internationally-recognized iGaming regulators. Operators licensed by the MGA can access substantial regulated markets across Europe and other jurisdictions that recognize MGA licenses, benefit from Malta’s mature iGaming ecosystem, and operate under a regulatory framework that has evolved through nearly two decades of practical application. This guide covers what operators need to know about MGA licensing: the regulatory framework, license categories, key positions requirements, application process, capital and operational costs, taxation, ongoing compliance obligations, and realistic expectations for building operations under MGA authorization.
⚠️ Note on regulatory currency: MGA regulations have undergone substantial updates through recent years, most notably following the 2018 Gaming Act reform. This guide reflects the framework as of early 2026, but operators should verify current specific regulatory status with Maltese iGaming counsel before making commitments.
Malta and MGA in context — Tier-1 EU gaming regulation
Malta occupies a specific position in global iGaming regulation:
Established regulatory maturity. Malta’s iGaming regulation has evolved since the early 2000s. The MGA (originally the Lotteries and Gaming Authority, later renamed and restructured) has accumulated substantial regulatory precedent, well-developed enforcement patterns, and international recognition.
EU membership advantages. Malta is an EU member state, meaning MGA licenses provide certain advantages under EU freedom-of-services provisions. However, individual EU member states may still require additional local licensing for operating in their jurisdictions — an MGA license doesn’t automatically authorize operations across all EU countries.
iGaming ecosystem concentration. Malta hosts one of the highest concentrations of iGaming companies globally. A substantial ecosystem includes operators, suppliers, service providers (legal, compliance, technical, marketing), and a skilled workforce with iGaming expertise.
International recognition. MGA licenses are widely recognized in international B2B contexts. Payment providers, banking partners, technical suppliers, and other counterparties broadly recognize MGA authorization.
Tier-1 EU regulated market positioning. MGA licenses signal to sophisticated players and B2B partners that operators meet substantive regulatory standards — this positioning matters in premium and B2B contexts.
Substantial competition. Malta’s ecosystem concentration means substantial competitive intensity. Operators launching under MGA face established competition and need clear market differentiation.
The MGA regulatory framework
MGA regulation operates under several key structures:
The Malta Gaming Authority (MGA)
The regulatory body responsible for gaming supervision, licensing, enforcement, and player protection. Operates as an independent statutory authority with substantial resources and technical capacity for regulatory oversight.
The Gaming Act (2018)
The primary statutory framework as substantially reformed through the 2018 Gaming Act. The reform consolidated previous regulations, updated license categories, and modernized the regulatory approach. Various regulations, directives, and MGA guidance implement the Act’s provisions.
Player Protection Framework
- Responsible gaming tools — mandatory session limits, deposit limits, self-exclusion tools
- Age verification — 18+ minimum age with meaningful verification requirements
- Advertising restrictions — specific content, placement, and targeting restrictions
- Complaint resolution — mandatory operator complaint procedures
- Player fund segregation — mandatory segregation of player deposits from operator working capital
Anti-Money Laundering (AML) Framework
- KYC procedures — mandatory customer identification and verification
- Transaction monitoring — ongoing suspicious transaction detection
- Source of funds — verification for higher-value activity
- Beneficial ownership — identification of ultimate beneficial owners
- Ongoing screening — sanctions, PEP, and adverse media screening
Technical Standards
- Game fairness and RNG certification — approved testing laboratories
- System integrity — security requirements, audit obligations
- Data protection — GDPR compliance requirements
- Reporting and audit — mandatory operator reporting to MGA
- Data storage — Malta-based data storage requirements for certain data types
License categories — B2C, B2B, and specific gaming types
The 2018 Gaming Act consolidated MGA licenses into a streamlined structure:
B2C License (for operators)
For operators providing gaming services directly to players. B2C licenses cover:
- Type 1 — Casino-type games with random outcomes (slots, roulette, blackjack, etc.)
- Type 2 — Betting on real events (sports betting, other betting)
- Type 3 — Peer-to-peer betting or gaming (poker, exchanges)
- Type 4 — Skill games (fantasy sports, other skill-based games)
A single B2C license can cover multiple gaming types under one license structure. Operators offering multiple gaming categories typically obtain a single license covering their scope.
B2B License (for suppliers)
For suppliers providing gaming services to licensed operators. B2B licenses cover:
- Gaming supply — providing games (slots, live casino, etc.) to operators
- Platform supply — providing player-account platforms, back-office, related services
- Critical gaming supply — providing critical supply elements requiring specific licensing
SoftAPI operates under B2B licensing structures appropriate to the aggregator function.
Specific supplemental licenses
- Critical gaming supply — specific to certain supply elements
- Corporate licenses — for specific corporate structures
- Recognition notices — for cross-border service provision
Key positions and personal licenses
MGA distinctively requires personal licensing of individuals holding key positions in operator organizations:
Key positions requiring MGA-approved individuals
Personal license requirements
Individuals in key positions must:
- Pass MGA fit and proper assessment
- Provide detailed personal disclosure (background, financial, character)
- Demonstrate relevant expertise for the specific position
- Maintain personal license through ongoing conduct standards
- Complete continuing professional development where required
Practical implications
- Local hiring or key position relocation — many key positions require Malta-based presence
- Substantial personal disclosure — key position holders provide extensive personal information
- Ongoing conduct standards — misconduct affecting personal licenses can affect the operator license
- Turnover implications — key position changes require MGA approval processes
The key positions requirement is one of MGA’s distinctive features. Other regulators use different approaches; MGA’s personal licensing of key individuals creates specific operational requirements around personnel.
The application process
MGA licensing is substantial. Realistic expectations:
Pre-application preparation. Malta legal entity setup, local presence establishment, capital reserves preparation, technical infrastructure planning, MGA relationship development, legal counsel engagement, key position identification and personal license preparation.
Application preparation and submission. Detailed application documentation, business plan and financial projections, ownership disclosure, technical platform specifications, compliance and player protection framework, AML procedures, RG policies, key position personal license applications.
MGA review and evaluation. Internal review, background verification and fit-and-proper assessments, technical evaluation, key position personal license reviews, requests for additional information, final decision process.
Post-approval implementation. Platform go-live under license terms, regulatory relationship establishment, initial reporting and compliance operations, marketing and player acquisition launch.
Total time from decision to operational license for new MGA applications.
Experienced operators with clean structures and prepared key positions have moved faster; complex ownership structures, novel product elements, or key position complications extend timelines.
Capital requirements and operational costs
MGA licensing requires substantial capital commitment. Minimum share capital requirements vary by license type — Type 1 (casino games), Type 2 (betting), and combined licenses each have specific minimum share capital under specific rules. Verify current specific thresholds with Maltese iGaming counsel at time of application.
License fees
- Application fees — paid at license application
- License fees — paid at license grant and periodic renewals
- Compliance contribution — periodic contribution to MGA operational funding
- Gaming taxes — separate from license fees (see tax section)
Beyond formal capital requirements, budget for
- Operational reserves for extended pre-launch and initial ramp
- Malta presence infrastructure — offices, key position hires, ongoing operational costs
- Compliance infrastructure — legal, AML, RG teams
- Technical infrastructure — platform integration, MGA-compliant systems
- Marketing budget — MGA-licensed market marketing is competitive
- Professional services — Maltese legal, tax, accounting, compliance advisory
Total pre-launch investment for a serious MGA-licensed operation typically runs from mid-six figures to low seven figures depending on scale, product scope, and marketing ambition.
Ongoing operational costs to model
- License fees (annual and periodic)
- Gaming taxes
- Malta operational costs (offices, key positions, staff)
- Compliance costs (audits, reporting, RG tools)
- Marketing spend
- Professional services
- Technical infrastructure
Tax structure — gaming tax and corporate taxation
MGA tax structure has specific characteristics:
- Gaming tax — percentage of gaming revenue (specific rates vary by license type; historically 5% of gaming revenue for many gaming categories)
- Corporate income tax — Malta’s corporate tax system operates with specific effective rates through Malta’s refund system (nominal rate is 35% with substantial refunds bringing the effective rate lower for foreign shareholders under specific structuring)
- VAT — application to certain services (gaming services often exempt but supplementary services may attract VAT)
- License fees — separate from gaming tax
- Compliance contributions — supplementary contributions to regulatory funding
Distinctive Maltese corporate tax structure. Malta’s tax system uses a refund mechanism creating effective corporate tax rates lower than the nominal 35% rate for foreign-owned entities under specific structuring. This has historically been a significant Malta attraction for international operators. Verify current tax structure with Maltese tax counsel — the framework has evolved.
Practical implications
- Combined effective tax burden varies by structure
- Structuring for tax efficiency requires Maltese tax counsel expertise
- International tax considerations — where you’re taxed depends on structuring across multiple jurisdictions
- VAT complexity — some gaming-related transactions attract VAT with specific rules
Model your specific structure carefully with Maltese tax counsel. Malta’s tax structure has been subject to EU-level scrutiny and evolution over recent years.
Compliance requirements and ongoing obligations
MGA-licensed operators face substantial ongoing compliance obligations:
Responsible gaming
- Reality checks and mandatory session limits
- Player-configurable deposit limits with mandatory options
- Mandatory operator self-exclusion tools
- Participation in MGA-managed central self-exclusion register
- Meaningful age verification at registration and ongoing
- Proactive problem gambling identification and intervention obligations
- Strict prohibition on marketing to self-excluded players
AML compliance
- Customer identification and verification (KYC)
- Enhanced due diligence for higher-risk situations
- Ongoing transaction monitoring for suspicious patterns
- Source of funds verification for higher-value activity
- Suspicious Transaction Reports to Maltese authorities
- Substantial record retention requirements
- Regular AML training for staff
Data protection
- Full GDPR compliance (Malta is an EU member state)
- Data protection impact assessments for high-risk processing
- DPO designation required for many operators
- Cross-border data transfer restrictions for non-EU transfers
- Mandatory data breach notifications within regulatory timeframes
Reporting obligations
- Regular financial reports to MGA
- GGR reporting, player counts, other operational metrics
- Periodic third-party audit reports
- Periodic compliance attestations
- Timely reporting of specific incidents
Technical compliance
- All games certified by approved testing laboratories
- Operational systems certified
- MGA notification for significant system changes
- Malta-based storage for specific data types
- Disaster recovery and business continuity requirements
Marketing and player-facing requirements
MGA regulates operator marketing substantially:
Advertising standards
- Content restrictions — no misleading claims, no encouragement of excessive play, no targeting of minors
- Placement restrictions — restrictions on media placement and audience targeting
- Responsible gaming messaging — mandatory responsible gaming information in marketing
- Bonus advertising — specific rules around bonus and promotional advertising
- Endorsement rules — restrictions on celebrity and influencer endorsements
Player-facing standards
- Terms and conditions — clear T&Cs with specific mandatory disclosures
- Bonus terms — clear bonus terms including wagering requirements
- Withdrawal timeframes — reasonable withdrawal processing with specific expectations
- Complaint handling — clear complaint procedures and reasonable resolution timeframes
- Player fund segregation — mandatory segregation of player deposits
Ongoing marketing obligations
- Marketing to self-excluded players — strict prohibition
- Bonus offering to problem gamblers — prohibited
- Volume marketing to specific players — restrictions on high-frequency marketing
Content certification and technical standards
MGA sets substantial technical standards:
Game certification
- All games must be certified by approved testing laboratories (GLI, iTech Labs, BMM Testlabs, or other MGA-approved labs)
- Certification covers RTP verification, RNG certification, game logic verification, and feature compliance
- Certification is per game and per specific version — updates require re-certification
System certification
- Operator platforms must meet MGA technical standards
- Third-party integrations (aggregators like SoftAPI) require appropriate technical relationships
- Security certifications may be required
- Business continuity planning must meet MGA standards
Data storage
- Specific data types must be stored in Malta or at least within EU/EEA
- Player data retention requirements
- Financial transaction data retention
- Audit trail requirements
For operators using SoftAPI’s aggregator: SoftAPI’s B2B certification structures accommodate MGA operator licensing requirements. Verify specific integration considerations during operator onboarding.
Common operator mistakes
MGA requires substantial capital commitment beyond the formal minimum share capital. Undercapitalized operators struggle through the extended pre-launch and initial ramp period.
Key position appointments require careful selection because personal licenses are consequential. Cheap or hasty key position choices create risk.
MGA’s substantive compliance requirements need substantive compliance infrastructure. Undersized compliance teams create operational risk.
AML compliance is substantial and requires meaningful infrastructure. Weak AML frameworks create regulatory and legal risk.
Marketing restrictions are substantive; violations create regulatory action. Marketing content must be systematically reviewed for compliance.
MGA has expectations around withdrawal processing timeframes. Slow withdrawals damage player relationships and create potential regulatory issues.
Responsible gaming tools must be genuinely functional and player-accessible. Superficial RG tool implementation creates regulatory risk.
MGA license doesn’t automatically authorize operations in all EU markets — individual member states often require additional local licensing. Verify per-market requirements.
MGA operations are expensive. Ongoing license fees, compliance costs, key position salaries, and Malta operational costs combine into a substantial annual burden.
GDPR compliance is substantive and requires meaningful infrastructure alongside gaming-specific requirements.
MGA is a substantive regulator with substantial enforcement teeth. Operators applying offshore-Curacao expectations to MGA operations encounter regulatory friction.
Timeline expectations
Realistic timelines for entering MGA-licensed operations:
14-30 months total. Pre-application preparation: 3-6 months · Application and MGA review: 9-18 months · Post-approval implementation: 2-4 months · Initial market operation: 3-6 months for meaningful traction
12-24 months total. Maltese entity and key position setup: 3-6 months · MGA licensing: 9-18 months · Platform reconfiguration: 2-4 weeks
May extend or shorten timelines. MGA regulations continue to evolve; operators should plan with buffer time.
Key position identification and preliminary vetting: 2-3 months · Personal license applications and MGA review: 6-12 months (parallel with operator license application) · Key position relocation and settling in Malta: variable
Plan your MGA Malta market entry with SoftAPI
MGA Malta remains one of the most established and internationally-recognized iGaming regulatory frameworks. Sandbox access lets you validate MGA-certified content across major studios before commercial commitment. Talk to our EU team for MGA-specific evaluation aligned with your licensing timeline.
Frequently asked questions
What is the MGA and why does it matter?
What license type do I need for online casino operations?
How long does MGA licensing take?
What are key positions and why do they matter?
Do I need to be physically in Malta?
What’s the tax burden for MGA-licensed operators?
Does an MGA license authorize me to operate throughout the EU?
How does MGA compare to UKGC?
What are the ongoing compliance obligations?
Do I need to segregate player funds?
How does the SoftAPI aggregator support MGA-licensed operators?
What’s the typical operator profile that gets MGA licenses?
Can I run MGA operations alongside Curacao or other offshore licensing?
What about the changing regulatory landscape?
How does customer support work for MGA-licensed operations?
How do I start evaluating SoftAPI for MGA-licensed operations?
Plan your MGA Malta market entry
MGA Malta remains one of the most established and internationally-recognized iGaming regulatory frameworks. Success under MGA licensing requires substantial capital commitment, key position infrastructure, compliance depth, and marketing sophistication matching the substantive regulatory framework and competitive Maltese ecosystem.