Malta got a head start on crypto regulation that no other EU state had, and it shows: OKX, Crypto.com, Gemini and Gate are all licensed from the island. But being first and fast drew scrutiny — in July 2025 ESMA's very first MiCA peer review singled out Malta's regulator for authorising a firm before its issues were resolved. Here is how the Malta route works, who took it, and what the record actually says.
Published: August 2026 · Data as of 12 August 2026 · Reading time: ~8 minutes
Key Takeaways
- The competent authority is the Malta Financial Services Authority (MFSA), which authorises and supervises crypto-asset service providers under Malta's Markets in Crypto-Assets Act (Chapter 647), the local transposition of MiCA.
- Malta earned its "Blockchain Island" name early: it passed the Virtual Financial Assets (VFA) Act in November 2018, years before MiCA existed. Existing VFA licence-holders had until 1 July 2026 to convert to a MiCA CASP authorisation.
- The register bears the legacy out: Malta hosts 22 authorised CASPs (5th in the EU) and 159 crypto-asset white papers (2nd, behind only Ireland).
- It is the EU's exchange island. OKX, Crypto.com, Gemini, Gate and Bitpanda are all authorised from Malta, and 3 of the EU's ~20 trading-platform licences sit there.
- The reputational catch: ESMA's first MiCA peer review (10 July 2025) found the MFSA had authorised a CASP with "material issues" unresolved. No Malta licence is at risk, but the review reset expectations for how thorough authorisation should be.
Blockchain Island: the head start
Most EU regulators met crypto for the first time when MiCA arrived. Malta did not. In November 2018 it enacted the Virtual Financial Assets Act, one of the world's first purpose-built legal frameworks for crypto-assets and distributed-ledger technology, and marketed itself aggressively as "Blockchain Island". Firms that wanted a licensed European base years before MiCA came to Malta.
That head start is why Malta enters the MiCA era with an established crypto industry rather than a standing start — and why so many recognisable names already sit on its register. The flip side, as the ESMA review below shows, is that a regulator used to moving quickly carried that habit into MiCA.
The MFSA and the Markets in Crypto-Assets Act
MiCA is an EU regulation, directly applicable, but each member state names its competent authority and passes the local law that plugs it in. In Malta:
- The MFSA is the single competent authority — it authorises CASPs, supervises them, and can enforce against them.
- MiCA is given domestic effect through the Markets in Crypto-Assets Act, Chapter 647 of the Laws of Malta.
- Once authorised, a Malta CASP holds a single licence passportable across the entire EU and EEA — the core promise of MiCA. A firm authorised in Valletta can serve clients in Berlin or Paris without a second licence.
The requirements are MiCA's, applied by the MFSA: fit-and-proper management and shareholders, a programme of operations, governance and internal controls, custody and client-asset segregation procedures, ICT and operational-resilience arrangements, and minimum capital scaled to the services requested (MiCA sets this between €50,000 and €150,000 by class). Firms operating a trading platform or providing custody face the heavier end of those obligations.
The VFA-to-MiCA transition
Malta's specific complication is what to do with the firms already licensed under the old VFA regime. MiCA does not grandfather them automatically.
VFA licence-holders were given a grandfathering window until 1 July 2026: they could keep operating while they converted, but conversion required a formal MiCA application — updated documentation and a fresh MFSA assessment, not a rubber stamp. After that date, a firm had to hold a MiCA CASP authorisation or stop serving EU clients. New entrants, meanwhile, have applied directly for a MiCA CASP licence since MiCA took effect on 30 December 2024.
The practical result is that Malta's 22 CASPs are a mix of converted VFA veterans and fresh MiCA authorisations — a deeper bench than most member states, precisely because of the 2018 head start.
Who licensed in Malta
The register makes Malta's position plain. It is not the biggest jurisdiction by licence count — that is Germany — but it is where the global consumer exchanges chose to base their EU operations.
| Metric | Malta | EU rank |
|---|---|---|
| Authorised CASPs | 22 | 5th |
| Crypto-asset white papers | 159 | 2nd |
| Trading-platform licences | 3 | — |
Names on the Malta register include OKX, Crypto.com, Gemini, Gate and Bitpanda. Three Malta firms — OKX, ZBX and Gate — hold the rare operation of a trading platform licence, the authorisation to run an actual order-book venue; only around 20 firms hold it across the entire EU, so Malta accounts for a meaningful slice. (For why that licence is so scarce, see only 20 of 324 MiCA firms can run a crypto exchange.)
Malta is also second in the EU for crypto-asset white papers, a marker of how much token-offering activity is notified through the island — the same jurisdiction-choice dynamic that puts Ireland first on that measure.
The ESMA review: first, fast, and flagged
Here is the part the licence-mill websites leave out. On 10 July 2025, ESMA published its first-ever MiCA peer review, and its subject was the MFSA's authorisation of a crypto-asset service provider.
The Peer Review Committee found that the MFSA had granted authorisation while material issues were still unresolved — including an inadequate risk assessment, and open questions on the firm's ICT infrastructure, Web3 usage and custody arrangements, alongside outstanding remediation from earlier enforcement. Its central concern was timing: the MFSA authorised the CASP ahead of other member states, and the committee's view was that the process should have been more thorough before the licence issued.
The MFSA's response was measured. Its CEO said the authority welcomed the recommendations and would incorporate them, and stressed that no Malta MiCA licence is at risk of revocation as a result. The review was a critique of process, not a finding against any specific firm.
For anyone weighing Malta, that is the honest picture: a jurisdiction with real depth and the biggest names, whose speed is both its selling point and the thing its EU supervisor has told it to slow down.
Frequently Asked Questions
Who issues MiCA CASP licences in Malta? The Malta Financial Services Authority (MFSA), under the Markets in Crypto-Assets Act (Chapter 647). A MiCA licence from the MFSA passports across the whole EU and EEA.
What happened to Malta's old VFA licences? Holders of a Virtual Financial Assets Act licence had until 1 July 2026 to convert to a MiCA CASP authorisation. Conversion was not automatic — it needed a formal application and a fresh MFSA assessment. After that date, firms needed a MiCA licence to keep serving EU clients.
How many crypto firms are licensed in Malta? 22 authorised CASPs as of 12 August 2026 — fifth in the EU — plus 159 crypto-asset white papers, second only to Ireland. Malta hosts OKX, Crypto.com, Gemini, Gate and Bitpanda, among others.
Is a Malta MiCA licence less credible after the ESMA review? ESMA's July 2025 peer review criticised the MFSA's authorisation process, not the licences themselves, and no Malta licence is at risk. But it did signal that early Malta authorisations were granted faster than ESMA thought appropriate.
Why did so many big exchanges choose Malta? Malta's 2018 VFA Act gave it a licensed crypto industry years before MiCA, so firms already based there converted, and its regulator was among the fastest to authorise under MiCA.
Sources
- MICA Watch snapshot of the ESMA CASP and white-paper registers, data as of 12 August 2026. Browse the Malta country profile, the CASP register, or our market analysis, Malta under MiCA: home to the world's crypto exchanges.
- MFSA — VFA licence and transition to CASP under the Markets in Crypto-Assets Act; authorisation process circulars. Regulator profile: MiCA regulators by country.
- ESMA, peer review of the MFSA's authorisation of a CASP under MiCA, published 10 July 2025.
- Regulation (EU) 2023/1114 (MiCA) — authorisation requirements and minimum capital by service class.