In accordance with the Gaming Definitions Regulations (S.L.583.04), ’gaming’ means an activity consisting in participating in a game, offering a gaming service or making a gaming supply, and shall be construed accordingly depending on the context.

Enacted in 2018, the Gaming Act (CAP. 583) serves as the principal legal instrument governing all forms of regulated gaming in Malta. It establishes the functions and powers of the Malta Gaming Authority (MGA) and sets out the legal definitions, licensing requirements, compliance obligations, enforcement mechanisms, and administrative procedures applicable to operators, suppliers, and key persons involved in gaming activities.

The Gaming Act is supplemented by several Subsidiary Legislations (S.L.), each dealing with specific areas of gaming operations. The key regulations are:

• Gaming Authorisations Regulations (S.L. 583.05), outlining the licensing process, licence categories, duration and conditions for both business-to-consumer (B2C) and business-to-business (B2B) operators;
• Gaming Licence Fees Regulations (S.L. 583.03), providing the applicable licence and compliance contribution fees payable by licensees, based on business model and revenue tiers;
• Gaming Definitions Regulations (S.L. 583.04), offering legal clarity on various key terms used across the regulatory framework;
• Gaming Player Protection Regulations (S.L. 583.08), prescribing obligations related to responsible gaming, player fund protection, advertising and complaints handling.

The MGA also issued Directives and Guidance Notes which are binding on licensees.

The MGA is the single, central regulatory body for the gaming sector in Malta. It was established under the Gaming Act and operates as an autonomous public authority, regulating both remote gaming and land-based gaming.

Under Maltese law, gaming licences are issued by the MGA pursuant to the Gaming Act and Gaming Authorisations Regulations.

a. What is the duration of a licence?

A standard gaming licence is valid for 10 years.

b. What types of licences are available?

The MGA issues a single licence framework that can cover multiple game types and business models under one authorisation. However, the activity conducted under the licence determines whether it is classified as:

• Gaming Services Licence – a B2C licence offering games directly to players; or
• Critical Gaming Supply Licence – a B2B licence offering software, games, and/or back-office services to other licensed operators.

Entities forming part of the same corporate group as the licence holder, and which provide gaming services or critical gaming supplies, may apply for a Corporate Group Gaming Service Licence or a Corporate Group Critical Gaming Supply Licence, as applicable.

Whether a Gaming Service or Critical Gaming Supply Licence is required, licensees will be authorised to offer one or more of the following game types:

• Type 1 – games of changes played against the house, the outcome of which is determined by a random number generator (RNG), and shall include casino type games, including roulette, blackjack, baccarat, poked player against the house, lotteries, secondary lotteries and virtual sports games.
• Type 2 – games of chance played against the house, the outcome of which is not generated randomly, but is determined by the result of an event or competition extraneous to a game of change, and whereby the operator manages his or her own risk by managing the odds offered to the player.
• Type 3 – games of chance not played against the house and wherein the operator is not exposed to gaming risk but generates revenue by taking a commission or other charge based on the stakes or the prize, and shall include player versus player games such as poker, bingo, betting exchange, and other commission-based games.
• Type 4 – controlled skill games, comprising both elements of skill and chance. In line with the Controlled Skill Games Ruling (Directive 6 of 2018), currently only fantasy sports is considered a controlled skill game by the MGA.

c. Are there different types of licences for B2C and B2B operators?

A Gaming Service Licence authorises the offering of games directly to end-users (players), while a Critical Gaming Supply Licence authorises the provision of critical gaming supplies to other licensed operators. This includes game software, RNGs, platform services, and hosting environments.

d. Do software suppliers need to be licensed?

Software suppliers must obtain a Critical Gaming Supply Licence from the MGA if they (i) develop and provide game software involving RNGs or material game mechanics; (ii) supply back-end systems responsible for handling player data, bets, game outcomes, or transactional records; and (iii) provide and maintain the control systems or platforms on which such regulated functions operate.

Suppliers that do not manage such systems (e.g. subcontracted) may not require a licence, provided they are not involved in the active maintenance or regulatory elements of the gaming service.

It is unlawful to offer a gaming service or critical gaming supply without the appropriate licence from the MGA or another competent EU/EEA authority. Additionally, certain game types are excluded from licensing altogether, as listed in the Second Schedule of the Gaming Authorisations Regulations (S.L. 583.05). These include:

• games of skill without a stake or prize,
• games of chance with no stake or prize, and
• de minimis games as defined by the MGA.

Games involving stakes and prizes may be exempt if they are classified by the Authority as pure skill games. While Malta maintains a flexible and innovation-driven gaming regime, the MGA retains discretion to prohibit or exempt specific products or devices where necessary to uphold regulatory objectives and public policy considerations.

The application process is rigorous and typically takes a minimum of six months, depending on the complexity of the operation and responsiveness of the applicant.

The application process consists of four key stages:

Fit and Proper

The MGA conducts criminal probity screening on all qualifying individuals (shareholders with 10%+ direct or indirect interest, directors of the operating entity, key function holders) to assess their integrity, financial standing, and competence. This includes source of wealth reviews and international background checks.

Business Plan and Financial Forecasts

A detailed three-year business plan, including financial projections and marketing strategies, must be submitted. This allows the MGA to assess the viability and sustainability of the proposed operation.

Operational and Technical Documentation

Applicants must submit comprehensive documentation on the company structure, gaming system, games offered, and regulatory compliance procedures. The MGA also verifies the company’s issued share capital (€100,000 for Type 1 and Type 2 B2C operators; €40,000 for Type 3 and Type 4 B2C operators; and B2B operators require a minimum of €40,000 issued share capital, irrespective of the Game Type).

Systems Audit

Once initial approval is granted, the applicant has 60 days to deploy the technical setup and undergo a systems audit by a certified third-party auditor. This ensures that the live environment matches the approved application.

Upon successful completion, the MGA issues a ten-year licence. Any significant changes to the system or business model post-licensing require MGA approval.

Costs and fees are as follows:

Regarding local presence, applicants are not required to have directors, owners, or key function holders residing in Malta, as long as these individuals are readily available for contact by the MGA (e.g., via phone or email). The technical infrastructure (including regulatory data) must be hosted in Malta, the EEA, or in another jurisdiction approved by the MGA, with real-time replication in Malta if hosted outside of Malta.

Under the Maltese gaming regulatory framework, licensees must appoint approved individuals to perform the following Key Functions, each of which requires a Key Function Certificate from the MGA:

1. The chief executive role, or equivalent – responsible for the overall management and strategic direction of the licensee.
2. Day-to-day gaming operations – manages the operator’s daily activities, including financial obligations (tax and fee payments), player transactions, fraud prevention, and risk strategies.
3. Compliance – ensures compliance with regulatory obligations, including responsible gaming, player support, advertising rules, and—if applicable—sports integrity obligations.
4. Legal affairs – oversees contractual matters, legal disputes, and regulatory correspondence.
5. Data protection and privacy – ensures compliance with applicable data protection laws, including GDPR, and manages privacy-related risks. (Only mandatory for B2C licensees)
6. Anti-money laundering (AML) and counter-terrorist financing (CTF) – implements AML/CFT controls and monitors adherence to the applicable laws and the Financial Intelligence Analysis Unit (FIAU)’s requirements. Only mandatory for B2C licensees.
7. Technology and information security – oversees the gaming and control systems, including back-end infrastructure, regulatory data systems, and cybersecurity.
8. Internal audit – provides independent evaluation of the licensee’s internal controls, governance, and risk management processes.

Yes, advertising of gambling—referred to as commercial communications under Maltese law—is permitted but subject to strict regulation under the Gaming Commercial Communications Regulations (S.L. 583.09). Only licensed operators (or entities holding a valid recognition notice) may promote licensable games, and all commercial communications must be socially responsible, factually accurate, and must not mislead, encourage irresponsible gaming, or target minors¹ or vulnerable persons².

Advertising must not portray gaming as a solution to financial or personal problems, as socially attractive, or as an alternative to employment. Additionally, references to consumer credit, suggestions of peer pressure, or any appeal to self-esteem, status, or toughness are prohibited. Responsible gaming messages and clear disclosures about the operator and their licensing authority must be prominently included. Communications must also clearly state the minimum legal age for participation and must not target or feature minors.

Use of player data for marketing purposes must comply with data protection laws, and any unsolicited communications are prohibited. Advertising in public places in Malta is generally restricted, with limited exceptions for tourist areas, gaming premises, and industry-specific events. Promotional schemes must be transparent, clearly outlining wagering conditions and obligations.

Importantly, licensees remain responsible for the conduct of third parties who advertise on their behalf, and the MGA has enforcement powers to order the modification or suspension of non-compliant advertisements, including the imposition of administrative sanctions.

Footnote(s):

¹ A physical person under the age of eighteen (18) years.

² Individuals who are vulnerable to problem gambling due to personal, medical, or social factors – including self-excluded players, those diagnosed or in treatment, and those under the influence of alcohol or drugs.

Marketing affiliates are permitted under Maltese law and may be engaged by licensed operators to carry out promotional activities. Affiliates are allowed to solicit commercial communications and may compile and use their own mailing lists to distribute promotional material on behalf of the authorised person. However, affiliates are not licensed or directly regulated by the MGA.

That said, both the affiliate and the licensed operator may be held jointly responsible for any breach of the Gaming Commercial Communications Regulations.. Accordingly, operators are expected to exercise strong oversight over affiliate conduct and ensure that all marketing communications, including those disseminated through affiliates, remain fully compliant with the applicable rules on responsible advertising and player protection.

Offering, facilitating, or marketing unlawful gambling in Malta is a criminal offence under the Gaming Act, punishable upon conviction by a fine of between €10,000 and €500,000 or imprisonment of up to five years, or both; repeat offenders face harsher penalties of up to €1,000,000 in fines and 6 years’ imprisonment. Company officers may also be held personally liable, with the company jointly responsible. The MGA may impose administrative sanctions for breaches of the Gaming Commercial Communications Regulations, including ordering the suspension, modification, or removal of non-compliant advertising, even if carried out by third parties such as affiliates.

Furthermore, under the Criminal Code, individuals who participate in unlawful betting or wagering—unless authorised by law—may be guilty of a contravention against public order and subject to court-imposed penalties.

Licensed operators in Malta are subject to a range of ongoing legal, technical and operational requirements aimed at ensuring integrity, fairness and player protection. Key requirements include:

1. Regulatory Compliance – Licensees must continuously comply with the Gaming Act, subsidiary legislation, and binding directives issued by the MGA, including player protection, responsible gaming, and advertising standards.
2. AML/CFT Compliance – Licensees must implement robust anti-money laundering procedures in line with the FIAU Implementing Procedures – Part II for Remote Gaming, including transaction monitoring, risk assessments, and reporting obligations.
3. Technical Infrastructure – Operators must maintain systems that comply with MGA technical standards, including secure hosting of regulatory data, RNG certification, and system audit requirements.
4. Reporting and Notifications – Regular submissions are required, including monthly player funds reports, gaming tax returns, audited financial statements, and incident reports for breaches.
5. Player Protection – Operators must safeguard player funds, uphold responsible gaming tools (e.g. self-exclusion, limits), and ensure games are fair and transparent.
6. Internal Audit – B2C licensees must periodically conduct internal audits across operational areas and submit reports to the MGA.

Licensees must also ensure availability and responsiveness to the MGA, including during inspections, investigations, and audits.

Operators in Malta are considered subject persons under AML law and must comply with the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR), as supplemented by the FIAU’s Implementing Procedures – Part II for the Remote Gaming Sector. Key AML obligations include conducting a business risk assessment (BRA) and customer risk assessments (CRA) to identify and manage exposure to money laundering and terrorist financing risks. Licensees must perform customer due diligence (CDD) measures, including identity verification, ongoing monitoring of player activity, and source of wealth/source of funds checks, particularly for high-risk players or transactions.

Systems must be in place to detect suspicious patterns, such as unusual deposit behaviour, use of multiple payment methods, or limited gameplay with high cash movement. Any suspicious activity must be reported to the FIAU via a Suspicious Transaction Report (STR). Furthermore, licensees must appoint a Money Laundering Reporting Officer (MLRO), provide regular staff training, and maintain detailed records to demonstrate compliance. Failure to adhere to AML obligations may result in administrative sanctions or criminal liability.

Maltese-licensed gaming operators must implement a range of responsible gambling measures aimed at protecting players from gambling-related harm. Operators are required to provide clear and accessible tools for players to set limits on their deposits, losses, and playing time, and to enable temporary or indefinite self-exclusion. They must also display responsible gaming messages and provide access to help resources on their website. Regular reality checks must be triggered to inform players of session duration and allow them to take a break.

Operators are obliged to monitor player behaviour for signs of problem gambling and take appropriate action, which may include direct intervention or exclusion. Additionally, systems must be in place to prevent underage gambling and ensure that players are properly informed of the risks associated with gaming. These measures must be applied consistently across all platforms and integrated into the licensee’s overall compliance framework.

Any person acquiring a direct or indirect qualifying interest—defined as holding 10% or more of the equity or control rights in a licensee—must notify the MGA within 3 working days of the change and submit full documentation within 30 days. The MGA will assess the proposed shareholders’ fitness and propriety, including due diligence and source of funds checks.

Qualifying interest changes require submission of the updated corporate structure, transfer agreements, declarations, and personal or entity disclosure forms. Non-qualifying interest changes (i.e. those below the 10% threshold) must also be reported within 30 days but are subject to a lighter notification process.

The MGA has broad enforcement powers under the Gaming Act and related regulations to address non-compliance by licensees. These powers include issuing warnings, orders, or amendments to licence conditions, imposing administrative penalties, and, in serious cases, suspending or cancelling licences. For breaches constituting criminal offences, the MGA may either propose a regulatory settlement or refer the matter for criminal prosecution, with potential fines and imprisonment. The MGA also considers factors such as the seriousness and frequency of the breach, financial gain, impact on players, and cooperation during investigations. Penalties may be published, particularly where transparency serves the public interest. Administrative fines are calculated based on the nature and scale of the breach, adjusted for mitigating or aggravating factors, and may be reduced in cases of demonstrated financial hardship.

The MGA may act before investigations are concluded in urgent cases involving player protection, public policy, or Malta’s regulatory reputation.

B2C gaming operators must pay 5% monthly gaming tax on gross gaming revenue generated from players physically based in Malta, and monthly compliance contribution based on revenue, structure in tiered bands.

In July 2025, the MGA introduced a new Capital Requirements Policy, requiring licensees not only to meet minimum share capital thresholds but also to always maintain a positive equity position, with a transitional period granted for compliance.

The MGA is also proposing several amendments to the Gaming Authorisations and Compliance Directive and the Approved Audit Service Provider Policy to enhance the financial reporting obligations of licensees. These include mandatory interim and annual financial reports, stricter deadlines for audited financial statements, and enhanced declarations on player funds for B2C operators. Exemptions to some requirements may be granted on a proportionality basis. The proposed amendments aim to consolidate all key financial obligations under one directive and are expected to come into effect within the next 12 months.

The MGA is shifting towards a more risk-based and proportionate supervisory framework. In response to industry feedback, especially from foreign-registered operators, the MGA is refining its financial oversight model to balance compliance with operational feasibility. Key developments include simplified reporting formats, clearer exemption criteria for lower-risk licensees, and streamlined audit processes. The changes are part of a broader strategy to futureproof financial compliance in Malta’s gaming sector.

Concurrently, the MGA is rolling out a risk-based supervisory model which will result in more targeted audits and increased engagement with operators that present higher compliance risks. This shift will be accompanied by further updates in areas such as cybersecurity standards, RNG certification, and player protection mechanisms, reinforcing the MGA’s commitment to integrity and consumer safety in the remote gaming sector.

The MGA is shifting towards a more risk-based and proportionate supervisory framework. In response to industry feedback, especially from foreign-registered operators, the MGA is refining its financial oversight model to balance compliance with operational feasibility. Key developments include simplified reporting formats, clearer exemption criteria for lower-risk licensees, and streamlined audit processes. The changes are part of a broader strategy to futureproof financial compliance in Malta’s gaming sector.

Concurrently, the MGA is rolling out a risk-based supervisory model which will result in more targeted audits and increased engagement with operators that present higher compliance risks. This shift will be accompanied by further updates in areas such as cybersecurity standards, RNG certification, and player protection mechanisms, reinforcing the MGA’s commitment to integrity and consumer safety in the remote gaming sector.

Malta is a leading global hub for the online gambling industry, offering a stable, EU-compliant regulatory framework, established under the MGA—a well-respected regulator known for its robust yet pragmatic approach. Start-ups benefit from a clear licensing structure, passporting opportunities within the EEA, and access to a mature ecosystem of gaming specialists, advisors, and technology providers.

The jurisdiction is also attractive due to its flexible corporate setup, competitive tax regime, and no local residency requirements for directors, shareholders or key personnel, making it accessible to international founders. Additionally, the MGA’s ongoing shift toward risk-based supervision and proportional compliance obligations ensures that smaller or early-stage operators are not unduly burdened, enabling innovation and sustainable growth from the outset.