Malta CASP License – 2026 Guide

The Markets in Crypto-Assets (MiCA) regulation is the EU’s regulatory framework for crypto assets regulation, setting out comprehensive rules for the crypto industry. A CASP license (also referred to as a service provider CASP license or MiCA license) is required for companies providing crypto-related financial services in Malta and across the EU under MiCA regulations. 

Under MiCA, a CASP is any legal person whose business involves providing one or more crypto-asset services to third parties on a professional basis. All crypto businesses operating in Malta must transition from their existing Malta Financial Services Authority (MFSA) VFA registration to a CASP license to continue operating legally within the EU. MiCA compliance is essential for regulatory adherence within the crypto industry.

The primary regulatory body overseeing CASPs in Malta is the Malta Financial Services Authority (MFSA). Under the Markets in Crypto-Assets (MiCA) framework, the MFSA enforces strict compliance standards to ensure investor protection and market integrity for any license in Malta.

The license authorises a broad spectrum of activities, including:

• Operating a crypto exchange;
• Custody and administration of digital assets;
• Portfolio management and execution of orders on behalf of clients;
• Transfer services for crypto assets.

• EU Passporting & Reputation: As an EU member state, Malta’s MiCA-compliant license offers a clear route to operate across the Union with a prestigious international reputation;
  
• Attractive Tax Incentives: While the base CIT is 35%, Malta’s full imputation system can reduce the effective corporate tax rate to between 0% and 10%;
  
• Simple Substance Requirements: Economic substance is currently focused on having a registered office in Malta and at least one Executive Director based in Malta;
  
• Banking Access: Malta offers a relatively simple and fast process for opening bank accounts for licensed entities;
• Grandfathering Rights: Existing Virtual Asset Service Providers (VASPs) registered before December 30, 2024, have until July 1, 2026, to finalise their transition to CASP status.

Companies striving to register as CASPs in Malta must go through a multi-step preparatory procedure, as per the MiCA compliance requirements.

Corporate Entity

Applicants must first establish a Limited Liability Company (LLC) with a registered address in Malta. Corporate structuring is a key step in establishing a compliant corporate entity for a CASP license in Malta.

Share Capital

Minimum capital requirements depend on the license class as stipulated by MiCA. This capital must be deposited into a local bank account.:

• Class 1: 50,000 EUR;
• Class 2: 125,000 EUR;
• Class 3: 150,000 EUR. 

In addition to meeting the initial capital requirement for each license class, CASPs must maintain ongoing prudential safeguards, including capital adequacy and internal controls, to ensure financial stability and compliance. CASPs are required to maintain prudential safeguards at all times, equal to the higher of the minimum capital requirement or 25% of the previous year’s fixed overheads.

Local Presence

• Registered Office: The company must maintain a physical registered address in Malta;
• Governance Structure: A board of directors, senior managers, and key function holders – including Compliance Officer, Risk Manager, MLRO, and Internal Auditor – are required. Compliance officers and the internal auditor play crucial roles in anti-money laundering (AML), risk management, and internal audits, ensuring regulatory compliance and strong internal controls;
• Four Eyes Principle: CASPs in Malta must follow the ‘four eyes’ principle, which requires at least two experienced and reputable individuals to direct the business effectively, providing independent oversight and sound corporate governance;
• Separation of Roles: The beneficiary and the director must be two separate individuals, and at least one Executive Director must be based in Malta. 

Fit-and-Proper & Documentation

• Identity Documents: Required for all beneficiary owners, directors, and shareholders;
• Business Plan: A short outline of activity, business strategy, and potential risks;
• Operational Policies: Detailed procedures for risk management, internal audit, AML/KYC controls, and complaint handling.