The Malta Gaming Authority Licence types, fees and compliance
The MGA supervises the largest concentration of remote gambling licensees in the European Union. The Gaming Act 2018 modernised a framework that began in 2004, when Malta became the first EU member state to license online gambling. This profile covers the four game types, the two licence categories, the fees that follow, the obligations that hold a licence in good standing, and the supervisory direction set for 2026.
Who the Malta Gaming Authority is
The Malta Gaming Authority is the single regulator of all gaming and betting activity in the Republic of Malta. It was established in 2001 as the Lotteries and Gaming Authority under the Lotteries and Other Games Act, rebranded as the Malta Gaming Authority in July 2015, and given its current statutory footing by the Gaming Act 2018, which is codified as Chapter 583 of the Laws of Malta.
Malta was the first European Union member state to license remote gambling, with the Remote Gaming Regulations of 2004 establishing a framework that drew operators to the island in successive waves. The result is the largest concentration of remote gambling licensees in the European Union: 315 companies held 323 gaming licences at the end of 2024, and the gaming sector contributed gross value added of approximately 1.39 billion euros, around 12 percent of the Maltese economy.
The MGA is a hub regulator. It supervises a portfolio of operators that serve many markets, which forces it to think about player protection across jurisdictions and to coordinate with authorities outside Malta.
Editorial summary · MGA Annual Report 2024Governance sits with a board appointed by government, supported by an executive led by a chief executive officer and divided into operational directorates covering authorisations, compliance, legal, enforcement, technical, and player support. The MGA is funded primarily by licence fees and compliance contributions rather than the public purse, which mirrors the British model and aligns the regulator’s resourcing with the scale of the industry it supervises.
The Authority licenses two activity streams. Land based gaming covers the country’s small commercial casino sector, controlled skill games and lotteries inside Malta. Remote gaming covers business to consumer operators that serve players online and business to business suppliers that provide critical gaming services to those operators. The remote stream is by far the larger pillar and the focus of most of the MGA’s supervisory work.
Source. Gaming Act 2018 (Cap. 583); Remote Gaming Regulations 2004; MGA Annual Report 2024.
Three statutory objectives shape every rule
The Gaming Act sets three objectives that frame every authorisation, directive and enforcement decision. The MGA returns to them when it explains why a rule exists and how it has been applied.
Protect players, minors and vulnerable people
Player protection is set out in Directive 2 of 2018: identity verification, age verification, deposit and session limits, self exclusion, alternative dispute resolution, and complaint handling.
Ensure gaming is fair and transparent
Pre launch and periodic system audits, certified random number generators, technical infrastructure standards for remote gaming, and the Compliance Audit Manual that guides reviews.
Prevent crime, money laundering and corruption
AML and counter terrorist financing in partnership with the FIAU, sports integrity coordination, fit and proper checks on shareholders and key persons, and the gaming sector risk assessment.
What this means in practice. For 2026 the MGA has organised its supervisory work around three themes that map directly onto the objectives: compliance with a focus on cash and crypto asset controls, player protection with a focus on responsible gambling tools and alternative dispute resolution reporting, and sports betting integrity. The crypto thematic review responds to the 2023 National Risk Assessment, which flagged crypto assets as a higher risk payment method in an online gaming context.
Two licence categories, four game types
The Gaming Act folds the previous fragmented authorisation structure into a single matrix: two licence categories crossed with four game types. Most remote operators hold a Gaming Service authorisation that covers one or more of the four types, while their suppliers hold a Critical Gaming Supply authorisation. For a deeper comparison of the obligations, exemptions and enforcement patterns that distinguish the two, see our MGA B2C vs B2B licence guide.
Gaming Service (B2C)
A Gaming Service licence authorises a business to provide gaming directly to players. It is the consumer facing authorisation and it is what an operator running a casino site, a sportsbook or a poker room holds. The licence is granted for a term of up to ten years and is subject to ongoing supervision, periodic audit, the compliance contribution, and gaming tax on revenue from Maltese players.
Critical Gaming Supply (B2B)
A Critical Gaming Supply licence authorises a business to provide a service that is essential to the operation of licensed B2C gaming, typically games, gaming platforms, or back office systems. Game studios, platform providers, payment integrators and white label providers operate under this category. The licence is granted for up to ten years and is subject to compliance review proportionate to the criticality of the service supplied.
The four game types
Both licence categories are subdivided by game type. The classification dictates which directives, technical standards and compliance contribution scales apply, and an operator that adds a new type must extend its authorisation accordingly.
- Type 1
- Games of chance played against the house on a random number generator, including online slots, roulette, blackjack and live dealer.
- Type 2
- Fixed odds betting on events outside the operator’s control, primarily sports betting.
- Type 3
- Peer to peer games where the operator takes a commission, such as poker and betting exchanges.
- Type 4
- Controlled skill games of chance with a measurable skill component.
Most consumer operators carry Type 1 and Type 2 authorisations on a single Gaming Service licence. Type 4 has a lower compliance contribution scale and a discounted annual fee of 10,000 euros for Type 4 only operators, reflecting the narrower commercial footprint of controlled skill games.
From scoping to go live: the five-stage process
The MGA has harmonised the application into a single submission stage, but the underlying assessment still moves through five discrete streams. A clean application from a well prepared applicant is typically determined within four to six months.
Choose licence category and game types, incorporate the Maltese entity, identify key persons.
wk 0Business plan, financial projections, AML and RG policies, technical and operational manuals.
wk 1 – 6Vetting of shareholders, beneficial owners and key persons, with international regulator and law enforcement checks.
wk 4 – 14Pre launch audit of the platform, games and reporting by an MGA approved auditor against the technical infrastructure standards.
wk 12 – 20Licence issued for up to ten years, annual fee due, compliance contribution begins, post launch audit scheduled.
wk 20 – 26Fees, compliance contribution and gaming tax
The MGA cost stack has three recurring components. A fixed application fee and annual fee, a compliance contribution that scales by game type and gross gaming revenue, and a gaming tax on revenue from Maltese players. The variable contribution is by far the largest line for an established operator.
Application, annual and compliance contribution
2024 enforcement actions
The cost stack at a glance
- Application is fixed. A non refundable €5,000 paid on submission, regardless of licence type or projected revenue.
- Annual fee is light. €25,000 for the standard B2C Gaming Service licence (€10,000 for Type 4 only); €25k–€35k for B2B by revenue.
- Compliance contribution is the dominant line. It scales with gross gaming revenue and is paid monthly, €15k–€375k for Type 1 and €25k–€600k for Type 2.
- Gaming tax only on Maltese player revenue. 5 percent of GGR generated from Maltese resident players; B2C only, with no equivalent for B2B suppliers. Rises 1 October 2026 to 15 percent for Type 1 (casino) and 10 percent for Types 2, 3 and 4 under LN 84 and 86 of 2026.
Compliance contributions are calculated against gross gaming revenue with a minimum and maximum per game type. For the largest operators the contribution is the dominant compliance cost, dwarfing the annual licence fee. B2B suppliers pay an annual fee in the band of 25,000 to 35,000 euros depending on revenue and do not pay gaming tax. Key persons and directors pay 50 euros per person per role, a small but recurring line that scales with the size of an operator’s management team.
Source. Gaming Licence Fees Regulations 2018; MGA Guidance Note on Licence Fees and Taxation; MGA 2024 Annual Report.
Core operator obligations
Licensed operators are bound by the Gaming Act, the directives issued under it, and the technical and AML standards that flow from those directives. The two pillar texts are Directive 2 of 2018 on player protection and Directive 3 of 2018 on gaming authorisations and compliance.
Key takeaways
- Player protection is codified in Directive 2 of 2018. Identity and age verification, deposit and session limits, working self exclusion, and access to alternative dispute resolution.
- AML supervision is split. The MGA coordinates; the FIAU is the actual sector supervisor and the body that imposes AML financial penalties (~€185k across six licensees in 2024).
- Pre launch and periodic system audits are mandatory. Performed by MGA approved auditors against the Compliance Audit Manual scope.
- Operators are accountable for their affiliates. Marketing must not target minors or self excluded players, and that duty cannot be delegated to third parties.
- Monthly reporting and key event notifications are non negotiable. Late or inaccurate reporting is the single most cited compliance theme in MGA enforcement actions.
Player protection
Directive 2 of 2018 requires identity and age verification before deposit or gameplay, deposit and session limits available to players on demand, a working self exclusion process, mandatory responsible gambling messaging, and access to alternative dispute resolution. The directive defines minimum standards rather than a single national tool, so each operator maintains its own self exclusion register and its own responsible gambling controls within the directive’s parameters.
Anti money laundering
MGA licensees are subject persons under the Prevention of Money Laundering Act and the Prevention of Money Laundering and Funding of Terrorism Regulations. The Financial Intelligence Analysis Unit is the AML supervisor; the MGA coordinates closely on the gaming sector but does not itself impose AML financial penalties, which are issued by the FIAU. In 2024 the FIAU imposed administrative penalties totalling almost 185,000 euros across six licensees. AML expectations are elevated for crypto asset and cash equivalent payments under the MGA 2026 supervisory agenda. Operators preparing for FIAU scrutiny should pair this with our practical guide to source of funds documentation under UKGC and MGA.
Where the fines actually come from. Compliance teams sometimes assume MGA action exhausts the AML risk. It does not. The FIAU runs a parallel supervisory cycle, can sanction the same licensee for the same conduct, and publishes its own penalty notices.
Gaming integrity and audit
Every operator is subject to a pre launch system audit and to periodic audits by MGA approved auditors. The Compliance Audit Manual sets the scope. Random number generators must be certified, game rules disclosed, and material change to gaming systems notified. B2B suppliers face their own audit cycle proportionate to the criticality of the service they supply.
Commercial communications
The Commercial Communications Committee Guidelines govern advertising, sponsorship and promotions. Marketing must not target minors or self excluded players, must include responsible gambling messaging, and must not be misleading about prizes, odds or bonus terms. Affiliates are treated as the operator’s responsibility, mirroring the British approach: the licensee remains accountable for the conduct of the affiliates that drive its traffic.
An MGA licence carries operational flexibility that other regulators do not match, but the trade off is that the operator is the system of record. Weak controls do not get caught by a national scheme; they get caught at audit, or they get caught after harm.
Editorial · drawn from the 2024 Annual Report and 2026 supervisory agendaReporting and key events
Operators submit monthly reporting on gross gaming revenue, payouts and self exclusion activity, and they notify the MGA of key events including changes in beneficial ownership, key persons, material technical change and significant incidents. Late or inaccurate reporting is a recurring theme in enforcement actions, because it deprives the Authority of the visibility on which the whole supervisory model depends.
Enforcement record
The MGA’s historical enforcement posture has been moderate by international standards, with most penalties measured in tens or low hundreds of thousands of euros. 2025 marked a step change: total financial penalties for the year exceeded 2.8 million euros and four operator licences were suspended.
Administrative penalties by period
Two features of the model deserve attention. First, the MGA’s toolkit is broader than a fine. In 2024 it issued 35 warnings, 25 administrative penalties, two licence suspensions and eight cancellations, alongside three regulatory settlements. The cancellation and suspension powers are the most consequential outcomes in practice, and the public Enforcement Register names operators that have lost or had their authorisations suspended.
Second, the 2025 escalation was driven by both classical compliance failures and a sharper focus on unauthorised game offerings. The 2026 supervisory agenda signals continued intensity around crypto asset internal controls, alternative dispute resolution reporting quality, and sports betting integrity, which together suggest enforcement will remain elevated.
Source. MGA Enforcement Register; MGA Annual Report 2024; MGA Interim Performance Report H1 2025; MGA 2026 Supervisory Priorities (March 2026).
Reforms and direction of travel
Two arcs frame the MGA’s recent history. The first is the Gaming Act 2018 modernisation. The second is the post 2023 hardening of supervisory tools and the doctrinal experiment that is Article 56A.
Lotteries and Gaming Authority established
Set up under the Lotteries and Other Games Act as the single regulator of gaming in Malta, initially focused on lotteries and land based gaming.
Remote Gaming Regulations Foundational
Malta becomes the first EU member state to license remote gambling, setting the framework that draws operators to the island in waves through the 2000s and 2010s.
Rebrand to Malta Gaming Authority
The Lotteries and Gaming Authority is rebranded to better reflect the regulator’s remit across a maturing remote gaming sector.
Gaming Act 2018 takes effect Material
Chapter 583 consolidates the previous fragmented framework into a single technology neutral statute, introduces the B2C and B2B split, the four game types, the compliance contribution model and longer licence terms.
Directive 2 (Player Protection) and Directive 3 (Authorisations)
The two pillar directives under the Gaming Act are published, codifying RG, KYC, ADR, fit and proper, and the gaming authorisation regime in detail.
DLT and Virtual Financial Assets sandbox Innovation
Guidelines published for a regulated sandbox accepting virtual financial assets as a means of payment and the use of distributed ledger technology in gaming, opening for applications in January 2019. Operators in the sandbox are capped at 1,000 euros per player per month in VFAs.
Bill 55 enacted as Article 56A Doctrinal
An amendment to the Gaming Act requiring Maltese courts to refuse to recognise or enforce foreign judgments relating to gaming services lawfully provided under an MGA licence. Disputed by the German regulator and several EU bodies on compatibility with the Brussels I Recast Regulation.
Gaming sector contributes €1.39 bn GVA
Gaming gross value added grows 3.5 percent year on year. 315 companies hold 323 active gaming licences. B2B licences (164) overtake B2C licences (147) for the first time, reflecting the maturity of Malta’s supplier ecosystem.
Enforcement step change Material
Full year financial penalties exceed 2.8 million euros and four operator licences are suspended for compliance failures spanning AML deficiencies and unauthorised game offerings. Approximately 70 percent of new licence applications are rejected in H1.
2026 supervisory priorities published Live
Three themes: compliance with a focus on cash and crypto asset internal controls, player protection with closer scrutiny of responsible gambling tools and ADR reporting quality, and sports betting integrity.
Looking ahead. Operators should treat 2025’s €2.8 million enforcement total as the new baseline rather than an anomaly. The 2026 agenda escalates oversight in three directions at once: crypto and cash-equivalent payment controls under AML, the quality and consistency of operator responsible gambling tools, and sports betting integrity. The licensees that fared best in 2025 had already moved from policy on paper to policy enforced at the system level.
How the MGA compares
An MGA licence is the European gaming industry’s standard hub authorisation. It carries less product prescription than the British model and less commercial constraint than the Ontario model, but the trade off is that the operator is the system of record for player protection.
| Dimension | MGA · Malta | UKGC · United Kingdom | AGCO · Ontario |
|---|---|---|---|
| Model | EU passport hub, open market | Point of consumption, open market | Closed market via iGO operator agreement |
| Headline annual cost | €25 k B2C standard licence + compliance contribution | £4.2 k → £793 k+ by GGY band | CAD 100 k per site per year |
| Statutory funding charge | Compliance contribution €15 k → €600 k by Type + 5 % gaming tax (rising 1 Oct 2026 to 15 % Type 1 / 10 % Types 2-4) | 40 % Remote Gaming Duty (from 1 Apr 2026) + 1.1 % statutory levy of online GGY; 15 % General Betting Duty on remote sports (rising to 25 % from 1 Apr 2027) | 20 % revenue share to province via iGO |
| Product limits | No hard caps; operator-set RG tools | Hard £5 / £2 slot stake caps | RGS-driven; no hard stake caps |
| Self-exclusion | Operator-level register; no national scheme | GAMSTOP (national, mandatory) | BetGuard (national, launched May 2026) |
| Enforcement posture | Step change in 2025 (€2.8 m); historically moderate | Aggressive; record £19.2 m | Growing; FanDuel $350 k, PointsBet suspension |
Frequently asked questions
Do I need an MGA licence to offer gambling to EU customers?
Not in every EU state. Several EU jurisdictions, including Germany, the Netherlands, Spain and France, require a local national licence. An MGA licence permits operation where the host state recognises it, and it remains a passport into smaller European markets and into many non-EU jurisdictions, but it does not override national licensing regimes. Operators should map target markets to local licensing requirements before relying on the MGA licence alone.
How long does an MGA licence application take?
Approximately 4 to 6 months for a clean application from a well prepared applicant. The MGA has harmonised the process into a single submission stage but still conducts a full fit and proper assessment, financial review and pre-launch system audit. Applicants with complex ownership, novel products or weak documentation should plan for 6 to 12 months.
What does an MGA licence cost?
A non refundable application fee of 5,000 euros, an annual licence fee of 25,000 euros for the standard B2C Gaming Service licence, and a compliance contribution that scales with gross gaming revenue: 15,000 to 375,000 euros per year for Type 1 casino games, 25,000 to 600,000 euros for Type 2 sports betting, with separate scales for Types 3 and 4. B2C operators also pay gaming tax at 5 percent of revenue from Maltese players, rising on 1 October 2026 to 15 percent for Type 1 (casino) and 10 percent for Types 2, 3 and 4 (sports, poker, bingo) under LN 84 and 86 of 2026. Key persons pay 50 euros per person per role.
What is the Gaming Act (Cap. 583)?
The Gaming Act 2018 is the Maltese statute that consolidated the previous fragmented gaming framework into a single, technology neutral and risk based regime. It introduced the four game types, the B2C and B2B licence split, the compliance contribution model, and longer licence terms. Most operational detail sits in the directives published under the Act, of which Directive 2 of 2018 (Player Protection) and Directive 3 of 2018 (Gaming Authorisations and Compliance) are the most consequential for licensees.
Is the Maltese jurisdictional shield (Bill 55) actually enforceable?
It is binding on Maltese courts, which is what Article 56A actually says: a Maltese court must refuse to recognise or enforce a foreign judgment relating to gambling services lawfully provided under an MGA licence. Whether courts outside Malta will respect that refusal is a different question. The German regulator and several EU bodies have publicly disputed the law's compatibility with the Brussels I Recast Regulation. Operators should treat the shield as protection inside Malta rather than as a general defence against foreign claims.
Key resources
Track every Maltese rule change as it happens
The Gaming Act directives, the technical infrastructure standards and the 2026 supervisory agenda move constantly. Explore the requirements in depth, compare jurisdictions, and stay current with enforcement.