Your starting point for crypto-asset regulation in Malta — from the island's pioneering DLT framework to the EU's MiCA regime, the VFA rules, and CASP licensing. Curated insights, plus the advisory team that helps crypto businesses get and stay licensed.
Malta was one of the first jurisdictions in the world to legislate for distributed ledger technology — earning the nickname "the Blockchain Island" — and has since aligned its regime with the EU's Markets in Crypto-Assets Regulation (MiCA). The result is a mature, EU-passportable framework spanning DLT legislation, the Virtual Financial Assets (VFA) Act, and the transition to MiCA's CASP licensing. This hub pulls together zeta.'s analysis of how that framework developed and where it stands today, alongside the regulatory and licensing advisory we provide to crypto-asset businesses.
A regulator that has supervised crypto-asset businesses since 2018 — now applying the EU-wide MiCA rulebook.
Discuss Your ProjectIn 2018, Malta enacted a package of legislation — including the Virtual Financial Assets (VFA) Act — that gave crypto exchanges, custodians and advisers a full licensing regime years before most of the world had one. That framework earned Malta its "Blockchain Island" reputation and, more importantly, gave the Malta Financial Services Authority (MFSA) sustained, practical experience supervising crypto-asset business models.
MiCA is now the primary framework governing crypto-assets across the EU, and every member state applies the same rulebook. What differs is the regulator behind it. Because Malta's VFA regime was broadly aligned with the principles MiCA later adopted, the MFSA approaches CASP applications with an established supervisory playbook — applicants deal with an authority that already understands custody arrangements, exchange operations and token classification questions.
With MiCA in force, Malta's VFA framework operates on a transitional basis and is being phased out as existing VFA service providers migrate to MiCA authorisation. New entrants no longer apply under the VFA Act — the route is a CASP authorisation directly under MiCA, with the MFSA as competent authority. Existing VFA licence holders benefit from transitional arrangements within a finite window, the details of which depend on their licence and timing — confirmed at consultation.
One harmonised regime for crypto-asset issuers and service providers — replacing a patchwork of national frameworks.
The Markets in Crypto-Assets Regulation governs crypto-assets — digital representations of value or rights that can be transferred and stored using distributed ledger technology — that are not already regulated as financial instruments. It sets authorisation, conduct, prudential and disclosure requirements for the businesses that issue them and the firms that provide services around them. In broad terms, MiCA covers:
Passporting is the commercial heart of the regime: a CASP authorised in Malta may, following a notification procedure through the MFSA, provide its licensed services across other EU and EEA member states without separate national licences.
Not everything with a token falls under MiCA — instruments that qualify as financial instruments remain under MiFID rules, and certain decentralised or unique assets may fall outside the regime altogether. Classification is fact-specific; we assess the perimeter question before anything else.
Anyone providing crypto-asset services professionally in or into the EU needs a CASP authorisation. In Malta, the application is made to the MFSA.
Start a Scoping CallWe map your intended services to MiCA's categories, confirm what actually requires authorisation, and assess your current setup against the requirements.
Business plan, target markets, financial projections, outsourcing arrangements and the operational detail the MFSA expects to see.
Governance and risk frameworks, AML/CFT policies, client-asset safeguarding, ICT resilience — and fit-and-proper key persons in place.
Submission of the full application pack, prepared so the regulator's completeness review starts from a strong position.
The MFSA assesses the application, raises queries and may seek refinements — we manage the responses and iterations.
On authorisation, the business can operate from Malta and notify passporting into other EU/EEA states as it expands.
Operators authorised under the VFA regime benefit from transitional arrangements while they migrate to MiCA — but the window is finite and the preparation is substantial. If you hold a VFA licence, the migration plan should already be in motion.
MiCA divides tokens into three broad categories, each with its own obligations. Classification comes first — it drives everything that follows.
ARTs aim to hold a stable value by referencing a combination of assets — currencies, commodities, crypto-assets or a basket of them. Issuers face the most demanding regime: authorisation, an approved whitepaper, and ongoing reserve, governance, redemption and risk management obligations, subject to the detailed requirements of the Regulation.
EMTs reference a single official currency and function as the digital cousin of e-money. They may only be issued by credit institutions or authorised electronic money institutions, must be redeemable at par, and carry safeguarding and reserve obligations — which is why an EMT project is often, in practice, also an EMI licensing project.
Utility tokens and other crypto-assets that are neither ARTs nor EMTs sit in a lighter regime: offering them to the public generally requires drawing up, notifying and publishing a whitepaper — a disclosure document covering the project, the rights attached, the technology and the risks — subject to exemptions for certain limited offers. Marketing communications and market-abuse rules apply regardless.
The same commercial idea can land in different categories depending on how the token is designed. We assess classification before drafting begins — restructuring a token after launch is far costlier than designing it correctly.
Behind every authorisation sits a Malta company with real substance. The corporate layer is where regulatory expectations become practical decisions.
Incorporation of the applicant entity, registered office, and the local presence and decision-making the MFSA expects of a licence holder — designed around the regulatory footprint from day one.
Company formation →Board composition, compliance and risk functions, MLRO appointment and fit-and-proper preparation for the individuals behind the venture.
Bank appetite for crypto ventures remains selective and varies by institution and business model. We prepare the file honestly, approach the right institutions — including EMI alternatives — and manage expectations from the outset.
Bookkeeping, financial reporting, payroll and tax compliance. Malta's full-imputation system — 35% corporate tax with shareholder refunds that can bring the effective rate to approximately 5% for qualifying trading income, subject to advice — applies to crypto ventures as to any Malta company.
Accounting & tax →zeta.'s analysis of how Malta's crypto framework developed and where it stands today — grouped by theme.
The EU's harmonised crypto-asset regime and what it means for businesses operating from Malta.
The Markets in Crypto-Assets Regulation (MiCA) became fully effective in December 2024, establishing harmonised crypto-asset rules across the EU.
Read article →MiCA aims to establish a unified EU regulatory framework for crypto-assets with licensing requirements and conduct standards.
Read article →ESMA released its initial consultation package for implementing MiCA, seeking feedback on proposed rules for crypto-asset service providers.
Read article →Under MiCA, any VFA provider wishing to continue offering in-scope crypto-asset services will need a CASP licence within the transitional window.
Read article →The MFSA published a circular on the new ESMA Q&As on the implementation of the DLT Regulation ('DLTR').
Read article →The Virtual Financial Assets Act and the rules that shaped crypto regulation in Malta.
Key changes including the elimination of VFA agent requirements and alignment with MiCA regulations.
Read article →The consultation paper on the rules governing Virtual Financial Assets in Malta.
Read article →The MFSA's rulebook governing virtual financial asset operations for agents, issuers, and service providers.
Read article →The MFSA consultation paper on classifying DLT assets, providing a two-stage test for categorisation.
Read article →How Malta built its pioneering distributed ledger technology framework.
Background reading and a real-world crypto licensing engagement.
Global calls for improved anti-money laundering policies in the cryptocurrency sector.
Read article →Coin Direct Limited listed as a designated business on the Isle of Man Financial Services Register, with zeta.'s support.
Read article →From reading about the rules to operating under them — our team helps crypto-asset businesses get licensed and stay compliant in Malta.
VFA, MiCA, and CASP licence applications, plus ongoing regulatory and AML/CFT compliance for crypto-asset businesses.
Learn more →Security token offerings, securitisation, and capital-raising structures within Malta's regulated framework.
Learn more →Set up the Malta company behind your crypto-asset venture, with the substance and governance regulators expect.
Learn more →Speak to our team about VFA, MiCA, and CASP licensing — we'll advise on the right route and handle the application end to end.
