Malta Gaming Authority (MGA) licence: types, fees and process

An MGA licence is the authorisation the Malta Gaming Authority grants under the Gaming Act (Cap. 583) to run a gaming business from Malta, either to players (a B2C gaming service licence) or to other operators (a B2B critical gaming supply licence). As of October 2026 it costs €5,000 to apply and €25,000 a year for most B2C operators, plus a monthly compliance contribution on gaming revenue, and once granted it is valid for 10 years.

What does the Gaming Act 2018 cover?

Malta’s Gaming Act (Cap. 583) came into force on 1 August 2018 and replaced the old multi-licence system, including the Remote Gaming Regulations of 2004, with two licences: a B2C gaming service licence and a B2B gaming supply licence. The same framework covers remote and land-based gaming, and the detail sits in subsidiary legislation and MGA directives.

Three subsidiary instruments matter most to an applicant. Licensing itself is governed by the Gaming Authorisations Regulations (Subsidiary Legislation 583.05), which set out who needs which authorisation and how licences are granted, suspended or cancelled. Money flows are fixed by the Gaming Licence Fees Regulations (Subsidiary Legislation 583.03): the application fee, the annual licence fee and the compliance contribution. A third instrument, the Gaming Tax Regulations (Subsidiary Legislation 583.10), charges the 5% gaming tax. On top of these, binding directives such as the Player Protection Directive and the Gaming Authorisations and Compliance Directive (Directive 3 of 2018) govern day-to-day conduct.

Any company incorporated in the EU or EEA may apply, according to MGA guidance, provided it meets the share capital and financial-statement requirements. A group can apply for a corporate group licence where the parent controls more than 90% of the other companies in the group, in which case the whole group is treated as the licensee.

What are the MGA game types 1 to 4?

The MGA classifies B2C gaming into four types. Type 1 is games of chance played against the house (casino, live casino, poker against the house, lotteries), Type 2 is fixed-odds betting, Type 3 covers peer-to-peer and commission-based games such as poker, pool betting and betting exchanges, and Type 4 is controlled skill games. Each type carries its own share capital and compliance contribution rules.

A company approved for several types must meet the share capital figures cumulatively, but the MGA caps the total requirement at €240,000. A sportsbook that also runs a casino, for example, needs €200,000 of paid-up capital, not just €100,000.

B2C or B2B: which MGA licence applies?

A B2C gaming service licence is needed by any Malta or EU/EEA company that offers gaming to players from Malta. A B2B gaming supply licence is needed by a company that provides a critical gaming supply, meaning a supply essential to the gaming service, such as the gaming system, game content or the platform that holds player accounts, to B2C operators.

The B2B licence lets studios, aggregators and platform providers serve MGA operators without each operator having to audit them from scratch. On the register these appear as “B2B – Critical Supply Licence”. A supplier whose services are not critical (for example a payment provider or an affiliate) does not hold a gaming supply licence, although the MGA still expects B2C licensees to perform due diligence on it. How suppliers fit into the wider chain is described on our iGaming supply chain page, and the independent test houses whose certificates the MGA accepts are listed under gaming testing labs.

How much does an MGA licence cost?

Under the MGA’s Licence Fees and Taxation guidance (December 2024 version), every applicant pays a one-time, non-refundable €5,000 application fee. A B2C licence then costs €25,000 a year (€10,000 if the operator offers only Type 4 skill games), paid in advance, plus a compliance contribution charged monthly on gaming revenue.

Two concessions soften the first year. New operators that do not qualify as start-ups are exempt from paying the full minimum compliance contribution in their first financial year, and companies that qualify under the MGA’s start-up directive get a 12-month moratorium on compliance contributions altogether.

How is the compliance contribution calculated?

The compliance contribution is a sliding-scale levy on gaming revenue, paid monthly by the 20th day of the following month. For Type 1 casino games the rate starts at 1.25% on the first €3 million and falls in steps to 0.40% on revenue above €30 million, with a yearly floor of €15,000 and a ceiling of €375,000 (MGA guidance, December 2024).

Betting carries heavier rates at the bottom of the scale. Type 2 starts at 4.00% on the first €3 million and Type 3 at 4.00% on the first €2 million, while Type 4 runs the other way, rising from 0.50% to 2.00% as revenue grows.

Worked example: a Type 1 casino at €10 million

Assume a casino licensee generates €10 million of gaming revenue in a full financial year, none of it from players in Malta.

1. First €3,000,000 at 1.25% = €37,500.
2. Next €4,500,000 at 1.00% = €45,000.
3. Remaining €2,500,000 at 0.85% = €21,250.
4. Compliance contribution = €103,750, within the €15,000 to €375,000 range.
5. Add the €25,000 annual licence fee: total recurring MGA charges of €128,750, or about 1.29% of revenue.

If the same operator also ran a sportsbook with €2 million of Type 2 revenue, that vertical would add 4.00% of €2 million, so €80,000, because each game type is assessed on its own scale. Players located in Malta would also trigger the 5% gaming tax on the revenue they generate.

How long does an MGA licence application take?

The MGA does not publish a fixed overall deadline. Its Application Process guidance sets two hard windows instead: an incomplete application is held open once for 60 days before it is rejected, and after the document review the applicant has 60 days to implement its systems on a technical environment and call for an independent system audit.

The stages, as the MGA describes them, run in this order:

1. Submission through the licensee portal. The company uploads every document listed in the System Documentation Checklist; each UBO, director and key person submits a Personal Declaration Form.
2. Fit and proper review. The MGA tests shareholders, UBOs and key persons and runs probity checks with other national and international regulators.
3. Funding review. The source of funds for the operation and the source of wealth of each UBO are examined to confirm they are legitimate and sufficient for the life of the licence.
4. Business plan and policies review. Forecast financials, marketing and distribution strategy, incorporation documents and operating procedures are analysed.
5. Technical set-up and system audit. The gaming and control system documentation is reviewed, the system is deployed on a staging environment within 60 days, and an MGA-approved third party audits it against the submitted procedures.
6. Clarifications. The file may go back to the applicant as “amendments required”. A change affecting more than 75% of equity, control or funding, or a new business plan, means filing a fresh application.
7. Decision. A successful applicant is issued a gaming licence valid for 10 years.

Applicants should budget for the system audit and for compliance audits later in the licence life, which the MGA can require periodically or ad hoc.

Who must hold an MGA key function certificate?

Every licensee must place named individuals in its key functions, and each of them needs an MGA Key Function certificate after a fitness and propriety assessment. For an online operator the relevant functions include the CEO or equivalent, management of operations, compliance, legal affairs, the data protection officer, the money laundering reporting officer (MLRO), technological affairs and internal audit.

The MGA charges €50 per key function role. One person may hold several roles, subject to the Authority’s conflict matrix, and anyone holding or applying for three or more key AML/CFT roles must file a time commitment declaration. Land-based roles such as pit management and gaming premises surveillance complete the MGA list but do not apply to remote operators.

What AML rules apply to MGA licensees?

Malta’s anti-money laundering regime for gaming is enforced by the Financial Intelligence Analysis Unit (FIAU) under the Prevention of Money Laundering Act (Cap. 373) and its regulations, with sector rules in the FIAU Implementing Procedures Part II for the remote gaming sector. Customer due diligence is triggered when a player’s stakes or winnings reach €2,000, including linked transactions, in line with Directive (EU) 2015/849, art. 11(d).

In practice MGA licensees appoint an MLRO approved as a key function, run a business risk assessment, monitor deposits and withdrawals for linked transactions, and report suspicious activity to the FIAU. The MGA and the FIAU coordinate inspections, and AML penalties are published by the FIAU rather than the MGA. The cross-jurisdiction view of these duties is on our AML and KYC compliance page.

What player protection and complaint rules apply?

B2C licensees must comply with the MGA’s player protection framework: age and identity verification, deposit and other limits players can set themselves, reality checks, self-exclusion and clear terms. Since 1 April 2019 the MGA’s Player Support Unit no longer rules on individual disputes; players complain to the operator first and then to an alternative dispute resolution (ADR) body such as eCOGRA.

The MGA still takes complaints as intelligence for its supervision, and it can act against a licensee whose complaint handling falls short. How Malta’s tools compare with those required by market regulators is set out under responsible gambling obligations.

What is Article 56A, the “Bill 55” amendment?

Article 56A of the Gaming Act, introduced through Bill 55 and in force since June 2023, directs Maltese courts, as a matter of public policy, to refuse recognition or enforcement of foreign judgments against MGA licensees where the claim rests on the illegality of gaming services abroad that are lawful under Maltese law. Its main targets were player claims in Germany and Austria for the return of stakes.

The provision has drawn sustained EU scrutiny. In June 2025 the European Commission opened infringement proceedings against Malta with a letter of formal notice. A related judgment followed on 16 April 2026, when the Court of Justice ruled in case C-440/23 that member states may prohibit online casino games or tie them to their own permit, so a Malta licence does not replace a German one. One week later, on 23 April 2026, Advocate General Emiliou found an Austrian reference about Article 56A (case C-683/24, Spielerschutz Sigma) inadmissible, but said that, if the Court disagreed, such a provision is manifestly incompatible with the Brussels I bis Regulation. As of October 2026 the Court had not ruled on Article 56A itself.

For operators, the practical point is that an MGA licence gives no protection in markets that require a local licence. Regulatory exposure in individual EU states is covered under European gambling markets, and recent sanctions are tracked on our enforcement page.

How do you verify an MGA licence?

An MGA licence is verified on the Authority’s own authorisation portal at authorisation.mga.org.mt, which is where every genuine MGA seal on an operator’s website should link. The record shows the licensee company, licence number (in the form MGA/B2C/123/2017 or MGA/B2B/…), licence type, status and approved game types.

1. Note the operating company named in the website’s terms, not the brand.
2. Click the MGA seal and check that the address starts with https://authorisation.mga.org.mt; any other domain means the seal is not genuine.
3. Confirm the company name and licence number match the terms and that the status is active.
4. Check the game types: a Type 2 betting licence does not authorise a casino lobby.
5. For B2B partners, confirm the record says “B2B – Critical Supply Licence” for the service they provide.

A valid MGA record says nothing about whether the operator is allowed in the player’s own country. That depends on the local regime, which is compared country by country in our licensing regimes comparison, and Malta’s main offshore alternative is weighed in MGA vs Curaçao.

Frequently asked questions

How long is an MGA gaming licence valid?

Ten years. The MGA’s Application Process guidance states that a successful applicant is issued a gaming licence valid for 10 years, subject to annual fees, compliance contributions and continued compliance with the Gaming Act and MGA directives.

What is the minimum share capital for an MGA B2C licence?

€100,000 for Type 1 (casino) or Type 2 (fixed-odds betting) and €40,000 for Type 3 or Type 4. Companies approved for several types add the figures together, up to a cap of €240,000.

Does an MGA licensee pay 5% tax on all revenue?

No. The 5% gaming tax applies only to gaming revenue from players physically present in Malta. Revenue from other countries carries the MGA compliance contribution instead, which is banded by game type and capped, for example at €375,000 a year for Type 1.

Can a non-EU company get an MGA licence?

The MGA’s guidance says any company incorporated in the EU or EEA is eligible to apply. Groups based elsewhere usually set up a Maltese or other EU/EEA subsidiary as the licensee, which must then meet share capital, key function and reporting requirements.

Will the MGA resolve a dispute with a licensed casino?

Not directly. The MGA’s Player Support Unit stopped ruling on individual disputes on 1 April 2019. A player complains to the operator first and then to an ADR body such as eCOGRA; the MGA uses complaints as supervisory intelligence.

Does an MGA licence allow an operator to serve Germany or Sweden?

No. Germany, Sweden and other EU markets require their own licence, and the CJEU confirmed in case C-440/23 on 16 April 2026 that member states may impose that requirement. Spelinspektionen banned Claymore Malta from offering gambling in Sweden without a Swedish licence on 8 January 2026.