Malta VASP vs. Malta CASP: A Guide to Transitioning from VFA to MiCA

Malta has long been recognised as a pioneer in the regulation of digital assets. With the introduction of the Virtual Financial Assets (VFA) Act in 2018, the island nation earned the title of the ‘Blockchain Island’, establishing a robust framework for what were then commonly known as Virtual Asset Service Providers (VASPs). 

However, the regulatory landscape in Europe has evolved significantly with the introduction of the Markets in Crypto-Assets (MiCA) regulation. This shift marks a transition from a national framework to a harmonised European Union standard, introducing the concept of Crypto-Asset Service Providers (CASPs).

For businesses operating in or considering Malta as a jurisdiction, understanding the nuance between the legacy VASP status and the new CASP designation is critical. This guide from LegalBison experts explores the transition from the VFA regime to MiCA, highlighting the operational, financial, and compliance differences that define the future of the crypto business in Malta.

The regulatory shift: VFA Act vs. MiCA

The Virtual Financial Assets Act (VFA Act) was Malta’s national answer to the unregulated nature of the crypto industry in 2018. It provided legal certainty at a time when most jurisdictions offered none. However, as a national law, its reach was limited to the Maltese islands. The MiCA regulation, on the other hand, is a European Union regulation that is directly applicable in all Member States, harmonising the rules for the crypto industry across the bloc.

From VFA to MiCA 

Malta has proactively aligned its national framework with MiCA to ensure a smooth transition. The Markets in Crypto-Assets Act (MiCA Act) in Malta was implemented to enforce the EU regulation and repeal conflicting national laws. The full application of MiCA for CASPs began on 30 December 2024, marking the official shift from the VFA regime to the CASP regime.

Removal of the VFA agent 

One of the most distinct features of the old VFA framework was the mandatory requirement to appoint a VFA Agent. This agent acted as a gatekeeper between the license applicant and the Malta Financial Services Authority (MFSA). Under the new MiCA framework, this requirement has been removed to streamline the licensing process. 

The legislation explicitly states that for issuers seeking to register a white paper or persons applying for a CASP license, the appointment and services of a VFA agent are no longer required. This change allows businesses to engage directly with the regulator or through legal consultants like LegalBison, reducing an administrative layer that existed under the old regime.

Related: 7 Reasons Why Malta is Great for Crypto Exchange Platform

Request a free consultation with our experts

Critical differences: VASP (VFA) vs. CASP (MiCA)

While both frameworks aim to regulate intermediaries in the crypto space, the scope and benefits differ significantly. The transition from VASP to CASP is not merely a change in terminology but an upgrade in market access and operational standards.

Geographical scope and passporting 

The most significant advantage of the CASP license over the legacy VFA license is the geographical scope.

• VASP (VFA): A license under the VFA Act was valid only within Malta. To offer services in other EU countries, a VASP typically had to comply with the individual national regimes of each Member State, which was a costly and fragmented process
• CASP (MiCA): The CASP license benefits from EU passporting rights. Once authorised in Malta, a CASP can provide crypto-asset services throughout the Union, either through the right of establishment (setting up a branch) or through the freedom to provide services (remote cross-border activity). This grants access to a market of 27 countries and hundreds of millions of consumers with a single authorisation

License categorisation

The VFA Act historically categorised licenses into four distinct classes based on the activity and risk level. MiCA adopts a service-based approach, defining specific crypto-asset services, such as custody, operation of a trading platform, and exchange of crypto-assets for funds. 

For capital requirement purposes, these services are generally grouped into three classes in the MFSA Rulebook and MiCA Annexes:

• Class 1: Includes execution of orders, placing of crypto-assets, reception and transmission of orders, advice, and portfolio management;
• Class 2: Includes all Class 1 services plus custody and administration of crypto-assets, and exchange of crypto-assets for funds or other crypto-assets;
• Class 3: Includes all Class 2 services plus the operation of a trading platform for crypto-assets.

Consumer protection and custody 

MiCA introduces rigorous standards for consumer protection that exceed general FATF VASP guidelines. A key difference lies in the custody requirements. CASPs are mandated to segregate clients’ crypto-assets from their own holdings, ensuring that client assets are held separately on the distributed ledger. 

Furthermore, the regulation imposes strict liability on custodians for the loss of crypto-assets resulting from incidents attributable to them, such as cyber-attacks or negligence. This level of accountability provides a higher degree of trust for institutional investors and retail clients compared to the earlier VFA standards.

Also read: Things to Consider Issuing a Stablecoin in Ireland

Still unsure? You can rely on legal experts, it’s free

Financial requirements comparison

Financial stability is a cornerstone of the MiCA framework. Malta has aligned its requirements with the EU regulation, which mandates that capital must be fully paid up and held on the balance sheet. The minimum capital requirements for CASPs are structured according to the complexity and risk of the services provided.

Minimum capital requirements 

The permanent minimum capital requirements under MiCA are set out in Annex IV of the regulation and are binding for all Maltese CASPs:

• Advisory / Order Routing (Class 1 equivalent): Entities providing investment advice, portfolio management, or execution of orders on behalf of clients must maintain a minimum capital of €50,000
• Brokerage / Dealing / Custody (Class 2 equivalent): Entities providing custody and administration of crypto-assets on behalf of clients, or exchanging crypto-assets for funds/other crypto-assets, must maintain a minimum capital of €125,000
• Exchange / Trading Venues (Class 3 equivalent): The highest requirement is reserved for operators of trading platforms, who must maintain a minimum capital of €150,000

Prudential safeguards 

In addition to the fixed minimum capital, CASPs are required to maintain prudential safeguards at all times. This amount must be equal to the higher of the permanent minimum capital requirement (listed above) or one-quarter of the fixed overheads of the preceding year. This ensures that the CASP has sufficient operating runway to manage risks or wind down in an orderly fashion if necessary.

Application fees 

While capital requirements are harmonised across the EU, administrative fees are set by national authorities. In Malta, the application fees for new CASP entrants are established by the Markets in Crypto-Assets Act (Fees) Regulations. Applicants should anticipate application fees generally ranging from €8,000 to €30,000 depending on the license class and complexity, with annual supervisory fees also applicable.

The transitional period (Grandfathering)

To prevent market disruption, the Maltese legislation includes transitional provisions, often referred to as grandfathering, for companies that were already operating under the VFA Act.

Rules for existing license holders 

Entities that held a valid license under the Virtual Financial Assets Act on 30 December 2024 are granted a grace period. These Grandfathered VASPs may continue to provide their services in accordance with the VFA Act until 1 July 2026, or until they are granted or refused a CASP authorisation under MiCA, whichever comes first. This 18-month window is designed to allow existing businesses to upgrade their compliance frameworks to meet MiCA standards without ceasing operations.

New applicants 

It is important to note that the door for the old VFA license has closed. As of August 2024, the competent authority ceased accepting new applications under the VFA Act. Any new business wishing to enter the Maltese market today must apply directly for a MiCA CASP license and comply fully with the new regulation from day one.

Action required for grandfathered entities 

Existing VFA license holders cannot simply wait for the deadline. They must actively undergo a simplified authorisation procedure to convert their VFA license into a CASP license. This process involves demonstrating compliance with MiCA’s enhanced governance, prudential, and consumer protection requirements. Failure to secure a CASP license by 1 July 2026 will result in the automatic cancellation of the VFA license, forcing the entity to cease operations.

Conclusion

The transition from the VASP (VFA) framework to the CASP (MiCA) framework represents the maturation of the crypto industry in Malta. While the VFA Act served its purpose by establishing Malta as a regulated hub early on, MiCA offers the scalability and prestige of an EU-wide license.

The key takeaways for businesses are clear:

• Market Access: The CASP license unlocks the entire European Union via passporting, a massive upgrade from the Malta-only VFA license
• Streamlined Process: The removal of the mandatory VFA Agent simplifies the application process, allowing for more direct engagement with the regulator
• Deadline: For existing operators, the clock is ticking. The transition period ends on 1 July 2026, and early engagement with the migration process is essential to avoid business interruption

Navigating the shift to MiCA requires a deep understanding of both the legacy rules and the new EU standards. At LegalBison, we are equipped to guide your project through this transition, ensuring you meet the new capital, governance, and operational requirements. 

Whether you are an existing VFA license holder needing to migrate or a new entrant seeking to capitalise on Malta’s crypto-friendly ecosystem, securing a CASP license is the definitive step toward long-term success in the European crypto market.

Contact us