In Malta, blockchain and other distributed ledger technologies (DLT) are being adopted and explored across both the private and public sectors, with the strongest activity concentrated in fintech, namely payments and digital assets. In this space, the island has managed to develop an established ecosystem and has managed to attract internationally recognised names. The ecosystem currently has [22] licensed crypto-asset services providers, including major international operators. The presence of these operators reflects Malta’s attractiveness as an EU regulatory base for firms seeking to operate within a regulated European framework.

A significant factor in the development of the sector has been Malta’s early decision, back in 2018, to establish a dedicated framework for virtual financial assets, well before the introduction of the harmonised Markets in Crypto-Assets Regulation 2023/1114 (“MiCA”). The Virtual Financial Assets Act (Chapter 590 of the Laws of Malta), now repealed, rendered Malta one of the first European jurisdictions to introduce a dedicated regulatory regime for the sector – which framework provided the Malta Financial Services Authority (“MFSA”) with years of experience in assessing, authorising and supervising virtual financial asset businesses. The VFA Act was superseded by MiCA and the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta), and was repealed on 3 July 2026. The scale of Malta’s regulated crypto-asset ecosystem is also reflected in the ESMA MiCA register, making it the [fifth]-largest home Member State in the EU by number of crypto-asset service providers (“CASPs”). As regards electronic money tokens (“EMTs“), [two] issuers, which under MiCA must be authorised as credit institutions or electronic money institutions, have notified crypto-asset white papers to the MFSA.

Besides the digital asset space, the distributed ledger technology has also found practical applications within the Maltese public sector. One established example is the use of blockchain-based digital certificates (Blockcerts) for a range of educational and professional credentials, including school-leaving certificates and other qualifications which can be cryptographically verified and shared digitally. The Government has also implemented a number of other blockchain/DLT projects, including the use of DLT for the registration and verification of industrial property records, including trademarks, designs and patents.

Malta has a relatively developed legal and regulatory framework for blockchain and distributed ledger technology (DLT), reflecting the country’s early policy decision to establish a dedicated framework for innovative technologies. The current framework should be understood as comprising both technology-specific legislation and EU financial-services legislation, with the applicable regime depending on the nature of the blockchain or DLT activity concerned.

The principal legislation governing crypto-assets and related services is the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta), which complements and gives effect at national level to Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA). MiCA is directly applicable in Malta and establishes the substantive EU framework for crypto-asset issuers and CASPs. The Maltese legislation, among other things, designates the MFSA as the competent authority and provides for national supervisory powers, enforcement, offences, confidentiality and related matters. The framework is supplemented by the Markets in Crypto-Assets Act (Fees) Regulations (S.L. 647.01), the MFSA’s MiCA Rulebook and applicable EU regulatory technical standards, implementing technical standards and ESMA/EBA guidelines.

The MFSA is therefore the principal regulator for the financial-services aspects of blockchain and crypto-assets. It is responsible for the authorisation and supervision of CASPs and relevant crypto-asset issuers falling within MiCA and the national implementing framework. The MFSA’s role is supplemented, depending on the activity and structure concerned, by other competent authorities and legislation applicable to financial institutions, payment services, electronic money, investment services, anti-money laundering and counter-terrorist financing, data protection and other regulated activities.

Alongside the financial-services framework, Malta has a specific technology framework through the Malta Digital Innovation Authority (“MDIA”) Act (Chapter 591 of the Laws of Malta). The MDIA Act established the Malta Digital Innovation Authority in 2018 as Malta’s specialised authority for innovative technology. The Act gives the Authority functions relating to innovative technology and related services and provides the institutional and legal basis for the Authority’s functions in promoting standards, trust, innovation and regulatory oversight in the technology sector. In the DLT field, the MDIA continues to participate in initiatives such as the European Blockchain Regulatory Sandbox and the European Blockchain Partnership, while its wider responsibilities include areas such as cybersecurity and other emerging technologies.

Malta is also actively examining the next generation of applications of distributed ledger technology within financial services. The MFSA has consulted on the tokenisation of financial instruments and real-world assets, seeking market feedback on areas including market readiness, appropriate asset classes, ownership and settlement arrangements, custody, market infrastructure and investor protection. This work reflects an increasing focus on how DLT can be applied to traditional financial assets and market infrastructure, rather than being limited to crypto-assets.

The MFSA has also expanded its focus to decentralised finance (DeFi). In June 2026, the MFSA published a discussion paper on DeFi examining the interaction between decentralised financial activities and the MiCA framework. The paper considers issues including decentralised governance, software-based organisational models, accountability, operational resilience and consumer protection. This represents an important area of regulatory development as Malta considers how existing financial-services and crypto-asset regulatory frameworks may interact with increasingly decentralised forms of financial activity.

The Maltese Government and regulatory authorities have adopted a very supportive but risk-based approach to blockchain and distributed ledger technology (DLT). The policy stance is to facilitate technological innovation where it can develop within an appropriate framework for market integrity, consumer and investor protection, financial stability and operational resilience. This is consistent with the MFSA’s broader objective of being a forward-looking regulator and its stated commitment to modernising its frameworks, processes and infrastructure in response to technological developments.

Malta has also consistently prioritised fintech in its policy agenda, taking early steps to position itself as an international centre for the innovative economy and introducing the MFSA’s dedicated FinTech Strategy to promote regulatory certainty, technology-enabled financial services, market integrity, financial soundness and investor protection. The proposed a regulatory sandbox through which established firms and new entrants could test the commercial and regulatory viability of technology-enabled financial innovations in a controlled financial-services environment, subject to conditions and limitations designed to contain risks. The MFSA also emphasised that its support for innovation would operate alongside effective investor and consumer protection, market integrity and financial soundness, with regulatory and supervisory responses calibrated by reference to the risks presented by the relevant business model, target audience, product or service. The FinTech Strategy therefore demonstrates a policy position which is supportive of blockchain and other innovative technologies, but within a structured, proportionate and closely supervised framework.

The MFSA’s 2025 Annual Report specifically identifies tokenisation of assets, the growth of crypto-asset service providers and the progressive digitisation of financial infrastructure as developments reshaping the financial-services sector. It describes the implementation of MiCA as a significant regulatory development and recognises the need to address the challenges associated with the evolving crypto-asset sector while maintaining competitiveness, consumer protection and financial stability.

The Authority’s approach is also reflected institutionally in its FinTech Supervision function, which is responsible for the authorisation and supervision of entities operating in the crypto-assets and financial-institutions sectors and provides cross-sectoral expertise on digital finance and FinTech policy. The function supervises entities under MiCA, leads the MFSA’s FinTech Strategy and Regulatory Sandbox, and monitors technological developments and emerging risks with the objective of keeping the regulatory framework responsive and future-focused.

The MFSA’s 2025 Annual Report notes that the Authority has strengthened its engagement with stakeholders and uses these interactions to obtain feedback and provide greater supervisory clarity.  At the same time, the authorities’ support for innovation is clearly subject to strong risk-management and supervisory expectations.

Malta does not have a separate national CBDC project. As a euro-area Member State, it participates in the Eurosystem’s digital euro project through the Central Bank of Malta (“CBM”) and the European Central Bank (“ECB”). The CBM has been actively involved in the project at national level. In November 2024, the CBM conducted a survey among Maltese households to assess awareness of the proposed digital euro and willingness to adopt it, with the results published in February 2025. The CBM has also undertaken awareness and stakeholder-engagement activities in Malta concerning the project. Accordingly, the current position in Malta with respect to CBDCs is best described as participation in the Eurosystem’s developing digital euro project, rather than the existence of a standalone Maltese CBDC. The project remains at the preparation/pilot-development stage, with potential issuance targeted for 2029 subject to the EU legislative process.

Malta’s current regulatory framework for crypto-assets is principally aligned with MiCA. The Maltese framework does not, at this stage, seek to gold-plate MiCA by imposing a separate or additional Maltese regulatory regime specifically for DeFi.

The MFSA’s position is currently one of assessment and policy development rather than the introduction of a standalone DeFi regime. The MFSA’s 2026 Discussion Paper on Decentralised Finance expressly states that it does not set out the MFSA’s policy position on DeFi, but is intended to stimulate informed dialogue and support the development of a “proportionate and balanced regulatory approach”; the proposals contained in the paper are expressly non-binding and subject to further assessment following stakeholder feedback.

The Discussion Paper recognises that, under MiCA, services provided in a fully decentralised manner without an intermediary fall outside the scope of the Regulation. At the same time, where an identifiable entity provides, controls or materially influences a crypto-asset service, the activity may fall within MiCA notwithstanding the use of decentralised technology. In particular, the MFSA notes that decentralisation is likely to require a case-by-case assessment, taking into account factors such as governance arrangements, administrator or upgrade keys, concentration of control, custody of assets, the nature of the code and the marketing of the protocol.

The MFSA is also considering how the existing framework could accommodate emerging DeFi structures without necessarily imposing regulation merely because a technology is decentralised. It considers software-based organisational models and DAOs, Segregated Cell Companies as potential legal structures for DeFi projects, guardian agents as embedded risk-management and market-integrity mechanisms, and account abstraction. It also considers the application of AML/CFT principles to DeFi, including where persons exercise sufficient control or influence over a protocol.

Malta applies a risk-based AML/CFT framework to crypto-assets, principally through the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta), the Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01) (the “PMLFTR”), the FIAU’s Implementing Procedures – Part I, and the sector-specific Implementing Procedures – Part II for the Crypto-Assets Sector. Following the introduction of MiCA, the PMLFTR and the FIAU’s Implementing Procedures were updated to align the Maltese framework with MiCA, the recast Transfer of Funds Regulation 2023/1113 (“TFR”) (as supplemented by the Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113) and the relevant EU AML framework.

Issuers of EMTs and CASPs are treated as subject persons under the PMLFTR and are therefore subject to the full range of applicable AML/CFT obligations. The FIAU’s Part II provides sector-specific guidance on the application of the risk-based approach, including business and customer risk assessments, customer due diligence, enhanced due diligence, ongoing monitoring, transaction monitoring, suspicious transaction reporting and record-keeping. CASPs are expected to maintain a dynamic assessment of their ML/FT exposure and, in particular, to review their business risk assessment at least every six months. The framework expressly recognises the particular risks associated with crypto-assets and decentralised activity.

In particular, the FIAU identifies transactions involving self-hosted addresses, unregulated or inadequately regulated service providers and decentralised applications/DeFi arrangements as factors which may increase ML/FT risk. The FIAU therefore expects CASPs to take these factors into account when conducting their business and customer risk assessments and to apply proportionate mitigating measures. For self-hosted wallets, CASPs are subject to specific requirements under the TFR and the PMLFTR (e.g. assessing whether the self-hosted address is owned or controlled by the customer, obtaining additional information concerning the origin and destination of crypto-assets, and applying enhanced ongoing monitoring or other mitigating measures, where warranted by the risk.) EU sanctions apply directly in Malta irrespective of whether a transaction uses fiat currency, crypto-assets or a DeFi arrangement. Other applicable measures are implemented under the National Interest (Enabling Powers) Act (Chapter 653 of the Laws of Malta) with the Sanctions Monitoring Board acting as the national authority responsible for monitoring the implementation of sanctions.

The AML framework is expected to change further with the application of Regulation (EU) 2024/1624 (the “AMLR“), which will introduce a directly applicable, harmonised AML/CFT rulebook for obliged entities, including CASPs. The newly established EU Anti-Money Laundering Authority is also expected to directly supervise a limited number of high-risk cross-border obliged entities, which may include certain CASPs.

Malta has not enacted a standalone tax regime or specific rules governing the tax treatment of crypto assets or decentralised finance (DeFi). The Malta Tax and Customs Administration (the “MTCA”) has, however, published separate guidelines setting out its position as regards the domestic income tax, VAT and duty treatment of transactions or arrangements involving DLT assets. The guidelines confirm that generally applicable income tax, VAT and duty rules (including, of course, pertinent jurisprudence and established practice and principles) should apply in respect of such transactions or arrangements. Any such transaction or arrangement should accordingly be considered in much the same way as any other transaction or arrangement against the applicable domestic income tax, VAT and duty rules – by reference, therefore, to the nature of the activity undertaken (principally with a view to verifying as to whether the same represents a trade/business or otherwise), the status of the relevant party/ies and the specific facts and circumstances.

As a result, for instance, transactions involving cryptocurrency (designed to be used as a means of payment and, therefore, representing the cryptographic equivalent of fiat currency) should be treated, for income tax purposes, in the same manner as transactions involving fiat currency. Profits derived from an exchange business and from the disposal of coins held as trading stock should accordingly represent taxable trading income. On the other hand, a disposal of cryptocurrency held as, and representing, a capital investment should fall outside the scope of Malta tax on capital gains in view that a cryptocurrency (like a fiat currency) would not represent a chargeable asset for the purposes of Malta tax on capital gains. The income tax guidelines also confirm that gains on revenue account from cryptocurrency mining should represent taxable income.

In addition, the VAT guidelines confirm, including in light of CJEU jurisprudence, that cryptocurrency having no utility other than as a means of payment is to be treated like traditional currency used as legal tender – such that prescribed exemptions in respect of transactions in currency and related services should likewise apply to transactions, including negotiation, in cryptocurrencies. The duty guidelines confirm that duty may be chargeable upon a disposal of DLT assets having the same intrinsic nature and effects as ‘marketable securities’ – that is, a holding of share capital in any company and any document representing the same.

Malta seeks to adopt a technology-neutral, proportionate and risk-based approach to tokenisation, with the MFSA planning to integrate tokenised financial instruments and real-world assets (“RWAs”) within the existing regulated financial-services framework rather than establish a separate regulatory regime for tokenisation. In its May 2026 Consultation Document, Tokenisation of Financial Instruments and Real-World Assets in Malta, the MFSA states that tokenisation does not inherently change the legal nature of an asset and is seeking views on whether tokenised financial instruments and RWAs can be deployed under the existing EU regulatory frameworks, or whether targeted interpretative guidance, national measures or EU-level developments are required.

The Consultation Document identifies a range of potential use cases, including tokenised bonds, securitisation interests, fund units, derivatives, equities and RWAs. The MFSA is considering the respective roles of investment firms, CASPs, custodians, fund administrators, crowdfunding service providers and market operators in supporting such markets. In its Position Paper on Tokenisation of Fund Units, the MFSA also permits tokenisation of units or shares of licensed AIFs, PIFs, notified AIFs, notified PIFs and UCITS. The MFSA expressly considers tokenised CIS shares or units to remain financial instruments and therefore outside the scope of MiCA and within the MiFID II framework. The tokenised format consequently does not displace the applicable conduct-of-business or distribution requirements.

The Position Paper also demonstrates the MFSA’s approach to the retail/investor-protection dimension. The Authority considers that technology neutrality supports the use of tokenisation by UCITS provided that the underlying regulatory objectives of liquidity, transparency and investor protection are preserved. It requires appropriate custody arrangements and places responsibilities on fund administrators in relation to the blockchain-based register, smart contracts and due diligence on wallets and wallet holders. For wholesale/institutional tokenisation, the May 2026 Consultation Document takes a broader market-infrastructure perspective wherein the MFSA is examining how tokenisation interacts with MiFID II, CSDR, UCITS, AIFMD and the EU DLT Pilot Regime.

There is no general prohibition on owning, using, mining or trading crypto-assets in Malta. Crypto-asset activities are permitted subject to the applicable EU and Maltese regulatory framework, principally MiCA and the Markets in Crypto-Assets Act (Cap. 647). Public offers and admission to trading of crypto-assets are subject to the applicable MiCA requirements, including the preparation and notification of a crypto-asset white paper, unless a specific exemption applies. The provision of regulated crypto-asset services, such as operating a trading platform or providing custody or exchange services, is subject to the relevant CASP authorisation requirements under MiCA.

Crypto-asset trading is well established in Malta. Its significance, however, lies principally in Malta’s role as a home Member State for CASPs serving clients across the EU under the MiCA passport, rather than in the scale of the domestic retail market.

ICOs have taken place in Malta and have historically been subject to a local dedicated regulatory framework since the introduction of the Virtual Financial Assets Act (Cap. 590) in 2018. Under the former framework, an ICO involving a VFA was treated as an Initial VFA Offering and required, among other things, a registered whitepaper and technological safeguards. On its Financial Services Register the MFSA lists 5 IVFAOs, 3 of which have since been deregistered. Following the repeal of the VFA Act on 3 July 2026, new offerings fall exclusively under MiCA.

For crypto-assets other than asset-referenced tokens (“ARTs”) and EMTs, an offeror must generally be a legal person and must prepare, notify to the MFSA and publish a crypto-asset whitepaper, comply with the applicable marketing-communication requirements and comply with the obligations applicable to offerors under MiCA. The whitepaper must contain detailed information concerning the offeror, the project and token, the offer, the rights attached to the token, the underlying technology and the relevant risks.

The MFSA Financial Services Register currently records a significant number of notified issuers/offerors of crypto-assets other than ARTs and EMTs. In addition to the [two] EMT white papers notified by authorised issuers, the register shows [107] entries under the category Issuers/Offerors of crypto-assets other than ARTs or EMTs, all marked as Notified. MiCA does not require the competent authority to approve such white papers before publication. Notification should therefore not be read as MFSA approval of the relevant project, nor as evidence that each offer was completed or successful.

Currently, Malta has no bespoke private-law provisions relating to title to, or security over, crypto-assets. The analysis which would rest on Maltese civil law principles would depend on the rights embodied in the crypto assets, the contractual and technical arrangements, the location and identity of the relevant parties and assets, and any law governing the underlying property. Control of a private key may provide practical control but is not necessarily conclusive evidence of legal ownership. Custody, beneficial ownership and the rights of a token holder should therefore be stated expressly. In principle, a crypto asset cannot, merely through an on-chain transfer, override statutory formalities or a constitutive register applicable to the underlying asset.

Security over movable assets may in principle be structured through various collateral arrangements including a pledge, assignment by way of security or title transfer, or irrevocable mandate by way of security, depending on the asset and the transaction in question. Under the Maltese Civil Code (Chapter 16 of the Laws of Malta), the pledgee’s privilege arises in different ways depending on the nature of the asset pledged. Where a right is embodied in or evidenced by a document of title, such as a negotiable or bearer instrument, the pledge is typically perfected through delivery of that document to the pledgee. Crypto-assets, however, are not represented by any such document and a pledge over these assets would be treated as a pledge over a debt or other incorporeal right, and the privilege will only arise if the pledge is constituted by a public deed or a private writing and the person who owes the obligation in respect of the pledged right (the “debtor” of that right) must either be notified of the pledge by means of a judicial act served on it, or acknowledge the pledge in writing. In practice, where the crypto-assets are held through an intermediary, (e.g. a CASP authorised in Malta) it is the CASP that owes the client the obligation to hold and return the assets, and it is therefore the CASP that stands as the “debtor” for these purposes. Since service of a judicial act is a more formal and cumbersome route, the security arrangement should ordinarily be acknowledged in writing by the CASP holding the relevant assets. It is key to note that crypto-assets do not generally fall within the special regime under the Financial Collateral Arrangements Regulations (S.L. 459.01) merely by virtue of being crypto-assets. Accordingly, a pledge over crypto-assets or a wallet holding the same, should not automatically be assumed to benefit from the accelerated enforcement and other protections available under the financial collateral regime.

Under Maltese law, smart contracts are not subject to a standalone statutory regime. A smart contract may constitute a legally valid contract where the ordinary requirements of contract law are satisfied. Malta’s Electronic Commerce Act (Chapter 426 of the laws of Malta) provides that an electronic contract cannot be denied legal effect, validity or enforceability solely because it is in electronic form. The eIDAS Regulation (Regulation (EU) No 910/2014) also plays a significant role by recognising electronic signatures and other electronic actions as legally equivalent to traditional paper-based actions. Nevertheless, the ordinary requirements for a valid contract under Article 966 of the Civil Code (Chapter 16 of the Laws of Malta) must be satisfied, namely the capacity of the parties, their consent, a certain object and a lawful causa. Particular issues may also arise in establishing the identity of the parties and in demonstrating valid consent, and where contractual terms exist primarily in computer code that is not readily comprehensible in natural language.

Enforceability issues specific to smart contracts may arise from their automated and code-based operation. It remains necessary to determine, on a case-by-case basis, whether a particular smart contract itself constitutes the legally binding agreement or merely performs functions ancillary to a traditional contract. In particular, smart contracts may give rise to issues that are less prevalent in traditional contracts concerning identification of the contracting parties, proof of consent, interpretation of computer code, attribution of actions performed through private keys, and the relationship between the code and any accompanying natural-language contractual terms. This is particularly relevant where execution is automatic and irreversible, or where the smart contract operates on a decentralised network without a clearly identifiable counterparty or administrator.

There may also be practical difficulties where the outcome produced by the code differs from the parties’ intended contractual outcome, including in cases of coding errors, unforeseen circumstances or reliance on an external oracle. Accordingly, there is no general rule under Maltese law that smart contracts are unenforceable. Rather, the ordinary principles of Maltese contract law apply, while the technological characteristics of smart contracts create additional questions concerning formation, interpretation, attribution and remedies. In practice, these risks can be mitigated by using a natural-language agreement alongside the smart contract, clearly defining the parties’ rights and obligations and specifying the relationship between the legal terms and the underlying code.

Furthermore, where smart contracts are deployed to automate data-sharing agreements under the EU Data Act (Regulation (EU) 2023/2854), additional enforceability and design constraints apply. Under Article 30 of the Data Act, commercial deployers of such smart contracts must ensure they meet essential requirements regarding robustness, access control, and safe termination. Crucially, the Data Act mandates that smart contracts must incorporate mechanisms to safely interrupt or terminate execution, directly addressing the traditional blockchain challenge of absolute immutability and ensuring that automated terms remain legally compliant and manageable under EU law.

Malta has no legislation that recognises DAOs as a distinct legal form, gives them legal personality, or sets out bespoke rules for them. DAOs are therefore treated under general Maltese private law and under the applicable EU financial services framework. How a DAO is treated depends on how it is structured, whether it uses a legal wrapper, and what it actually does.

Malta’s 2018 legislative package included also the Innovative Technology Arrangements and Services Act (now repealed) (Chapter 592 of the laws of Malta) which law was often cited as having addressed DAOs. The ITAS Act created a voluntary certification regime for innovative technology arrangements such as smart contracts and DLT-based software. The ITAS Act was repealed by Act XIX of 2024, which is the Malta Digital Innovation Authority (Amendment) Act. The amended MDIA Act now covers the full range of “innovative technology” as defined in the First Schedule: artificial intelligence, distributed ledger technology, and the internet of things. Technology recognition and certification now sit with the MDIA under Cap. 591. This remains a technology-assurance regime and does not create a vehicle for DAOs.

A DAO that operates without a legal entity would not have legal personality under Maltese law. Depending on the facts at hand, a Maltese court would likely look at the underlying relationships between participants. The DAO could be characterised as an unregistered association, or as a civil or commercial partnership, which could expose members, token holders with governance rights, or active contributors to personal, and potentially joint and several, liability for the DAO’s obligations.

From a regulatory perspective, Recital 22 of MiCA states that crypto-asset services provided in a fully decentralised manner without any intermediary fall outside MiCA’s scope. Services performed, provided or controlled by identifiable persons, including where part of the activity is decentralised, remain in scope. The MFSA has said that whether an arrangement is “fully decentralised” requires a case-by-case assessment.

In practice, most DAOs retain some of these features. Separately, a DAO’s governance or other tokens may qualify as financial instruments under MiFID II, as transposed by the Investment Services Act (Cap. 370), rather than as MiCA crypto-assets. A DAO that pools participants’ capital for investment may raise collective investment scheme considerations.

On 12 June 2026 the MFSA published Discussion Paper 03-2026 on Decentralised Finance. The consultation was open for stakeholder feedback until 10 July 2026. The paper suggests that legislative focus should be on a broader concept of “Software-based Organisations” (SBOs), with DAOs as one category within it, rather than on DAOs as a standalone legal concept.

The SBO option could initially be limited to entities engaged in financial services, with scope to extend it to other sectors later. The paper also asks whether segregated cell company structures should be made available for DeFi projects. It notes that such structures could weaken a project’s ability to rely on decentralisation-based exclusions. The paper expressly states that it does not represent MFSA policy, and its proposals are non-binding.

As of the date of this response, no feedback statement or draft legislation has been published. The MFSA has said that draft versions of any major amendments to the regulatory framework will be issued for public consultation. Developments at EU level, particularly the Commission’s MiCA review, will likely shape any Maltese initiative.

Yes, although enforcement in the sector has been limited in volume and has come principally from the anti-money laundering side. According to the MFSA’s Overview of the Enforcement Work Carried Out by the MFSA in 2025, the MFSA handled several investigations relating to the virtual financial assets sector in 2025. The report does not record any administrative penalty, licence cancellation or other enforcement measure imposed in that sector during that particular year, so these investigations should not in themselves be regarded as concluded enforcement actions.

Enforcement against crypto-asset businesses has instead come mainly from the Financial Intelligence Analysis Unit (“FIAU“), Malta’s financial intelligence unit and AML/CFT supervisor. The FIAU has imposed administrative penalties on crypto-asset businesses for AML/CFT failures, including deficiencies in risk assessment, customer due diligence and transaction monitoring. The MFSA had also concluded a settlement agreement with a crypto-asset operator under which an administrative penalty was levied. In addition, the MFSA regularly publishes warnings concerning purported or unauthorised crypto-asset businesses.

Assuming Maltese law applies, where personal data are processed through or stored on a blockchain technology, the GDPR and the Maltese Data Protection Act (Chapter 586 of the laws of Malta) would apply in the ordinary manner. Blockchain architecture can raise particular issues concerning the identification of controllers and processors, data minimisation, storage limitation, international transfers, and the exercise of data-subject rights, particularly rectification and erasure.

The European Data Protection Board’s Guidelines 02/2025 on processing personal data through blockchain technologies, adopted in July 2026, address these issues and recommend, as a general rule, avoiding the storage of personal data directly on a blockchain where this would conflict with data protection principles. They also emphasise data protection by design and the need to assess whether a data protection impact assessment is required.

Practitioners should also bear in mind that many blockchain-based applications are offered directly to retail users, so the ordinary consumer-protection framework will frequently apply alongside the financial-services rules discussed above. One should also consider the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) where blockchain-based services incorporate AI systems, for instance AI-driven trading or portfolio tools, customer-facing chatbots, or automated agents interacting with smart contracts. Depending on how the system is used, this may trigger transparency obligations towards users or, where it is used to assess the creditworthiness of natural persons, the more onerous requirements applicable to high-risk AI systems. In Malta, the MDIA has been designated as a competent authority under the AI Act.

Where contracts are concluded online or through an app, the rules on distance contracts will typically be relevant. In practice, this means that user terms, onboarding flows and product disclosures should be reviewed not only for regulatory compliance but also from a consumer-law perspective, including whether the risks of the product are adequately explained before the user commits, whether any terms could be challenged as unfair, and whether the arrangement preserves the rights consumers are entitled to by law. This is particularly relevant given the technical complexity and volatility of many crypto-asset products, which can make it harder for an average user to understand what they are acquiring.