MiCA CASP authorisation in Malta
Malta authorises crypto-asset service providers under MiCA through the Malta Financial Services Authority, which also ran the earlier national VFA regime. Since the EU transitional periods ended on 1 July 2026, only a full MiCA authorisation allows a firm to serve clients. ESMA's 2025 peer review of the MFSA asked for tighter authorisation assessments, so expect detailed questions on governance and substance.
Facts under review · last checked 2026-10-08 · confirm figures with the regulator before relying on them
Regulator · Malta Financial Services Authority (MFSA) ↗
Key facts
- Minimum own funds (permanent capital)
- €50,000, €125,000 or €150,000 depending on the class of crypto-asset servicesMiCA-Art-67as of 2026-10-08Source ↗
- End of transitional period (EU)
- 1 July 2026: only authorised CASPs may provide servicesMiCA-Art-143(3)as of 2026-10-08Source ↗
- Passporting
- Authorisation allows services across the EU/EEA after notificationMiCA-Art-65as of 2026-10-08Source ↗
- ESMA peer review of the MFSA
- July 2025: good resources and supervisory engagement, with areas for improvement in assessing authorisationsas of 2026-10-08Source ↗
Realistic timeline
Who does what, and how long each phase usually takes once work starts. The regulator’s share is outside anyone’s control.
- HartsizScoping and gap analysis2–4 weeks
- YouCompany set-up, hires and application pack6–12 weeksHartsiz drafts the pack; the client supplies people, capital and decisions
- RegulatorMFSA completeness check and assessment16–36 weeksOutside our control; depends on queue and the quality of answers
Estimated end to end: 6–12 months. Not a guarantee.
What the regulator expects to see
- Management body with sufficient good repute, knowledge and time commitment (MiCA Art. 68)
- Registered office in Malta, place of effective management in the EU and at least one EU-resident director (MiCA Art. 59(2))
- AML/CFT compliance function and MLRO under Maltese AML rules
- ICT risk-management framework under DORA
Questions we get
Can we keep operating while our application in Malta is pending?
No. Since 1 July 2026 the MiCA transitional periods have ended across the EU, so only an actual authorisation allows a firm to provide crypto-asset services.
Does a Maltese VFA licence count as MiCA authorisation?
No. VFA licence holders had to apply under the MiCA framework. With the transitional period over, only a MiCA authorisation allows a firm to provide crypto-asset services.
Changes affecting this route
- European Union · Crypto · high impact
MiCA transitional periods end across the EU
ESMA confirmed that the last MiCA grandfathering periods expire on 1 July 2026. From that date, any entity providing crypto-asset services to EU clients without MiCA authorisation is in breach of EU law and must have implemented its wind-down plan. Firms without a licence now need a new application or the acquisition of an authorised CASP.
Source ↗