How to get an MGA licence in 2026: requirements, costs and timelines

The Malta Gaming Authority remains the benchmark jurisdiction for online gaming regulation in 2026. As scrutiny of offshore licences intensifies globally, operators, investors, and suppliers are revisiting Malta’s framework with fresh urgency.

New supervisory priorities, an overhauled tax framework taking effect in October, a proposed AI Gaming Charter, and record application volumes all signal that the MGA is entering a more demanding phase.

This guide covers what you need to know to apply for an MGA licence under the Gaming Act 2018 framework, stay compliant once you hold one, and assess whether Malta is the right jurisdiction for your business.

What is the Malta Gaming Authority?

The Malta Gaming Authority is the regulatory body responsible for licensing and supervising all gaming activities in or from Malta. It operates under the Gaming Act (Chapter 583 of the Laws of Malta), which came into force in August 2018 and consolidated the country’s entire gaming sector under a single legislative framework.

The 2026 licensing environment is built on that same 2018 foundation, updated through directives, policies, and the MGA’s annual supervisory engagement plans. Malta is an EU member state, which means MGA-licensed operators benefit from the legal stability and institutional recognition that come with EU membership.

The licence is accepted by major payment processors, banks, and industry partners across Europe and beyond. As of 2025, Malta is home to hundreds of online gaming companies, with the MGA overseeing a significant share of the world’s iGaming operators.

The Authority combines licensing, compliance, enforcement, and policy functions within one institution. Its mandate, set out in the Gaming Act, covers fairness and transparency, crime prevention, and the protection of vulnerable players.

A brief history of MGA regulation

Malta’s leadership in online gaming regulation stretches back to the early years of the internet. In 2001, the Lotteries and Gaming Authority, as the MGA was then known, was established as one of the first regulatory bodies of its kind in the industry.

2004 was the defining year. Malta joined the EU and became the first member state to enact comprehensive legislation for the remote gambling sector, with the Remote Gaming Regulations. This gave operators a credible EU base from which to serve international markets.

The framework remained largely intact until 2017, when the Authority announced a wholesale overhaul. The aim was to move away from the old multi-licence class system and create a more flexible, risk-based structure.

The Gaming Act 2018 delivered on that ambition. It consolidated all gaming categories under a single licence framework, extended licence validity from five to ten years, and introduced the B2B/B2C distinction that operators work with today.

In 2015, the Lotteries and Gaming Authority was formally renamed the Malta Gaming Authority, reflecting the body’s expanded international role.

Since 2018, the MGA has continued to develop its supervisory approach, introducing thematic reviews, a risk-based compliance model, and formal supervisory engagement plans published annually.

MGA licence types: which one do you need?

The 2018 Gaming Act simplified the licensing structure into two primary categories. Understanding which applies to your business is the first decision any applicant needs to make.

B2C: gaming service licences

A B2C (Gaming Service) licence is required by any operator offering gaming services directly to players. This covers online casinos, sportsbooks, poker platforms, and similar consumer-facing operations. The licence accommodates four game types:

• Type 1: Casino-style games based on a random number generator, including online slots, roulette, blackjack, baccarat, lotteries, and virtual sports.
• Type 2: Fixed-odds betting, including in-play betting.
• Type 3: Pool betting, betting exchanges, peer-to-peer poker, peer-to-peer bingo, lottery messenger services, and commission-based games.
• Type 4: Controlled skill games, including fantasy sports, where outcomes depend on aggregated statistical performance.

Operators do not need a separate licence for each game type. A single B2C licence can cover multiple types, with each additional vertical requiring prior MGA approval.

Compliance contribution rates and minimum share capital requirements are calculated per game type held.

B2B: Critical Gaming Supply licences in practice

A B2B (Critical Gaming Supply) licence is required for any company supplying material elements of a game, software to generate or manage essential regulatory records, or core technical infrastructure to MGA-licensed B2C operators. This includes game studios, RNG platforms, payment gateways, and back-office systems.

The application fee is a one-time non-refundable €5,000. Annual licence fees typically range from €10,000 to €35,000 depending on the scope and type of supply, with broader multi-vertical providers at the higher end.

B2B licensees are not subject to compliance contributions, but must demonstrate financial stability, technical robustness, and AML/KYC competence for their own operations.

B2B operators from other EU and EEA jurisdictions may also be able to supply into Malta via a Recognition Notice rather than a full licence, subject to the MGA’s equivalence assessment. In 2026, B2B-facing suppliers should treat the Critical Gaming Supply licence as the primary entry point to the Malta-regulated ecosystem.

Recognition notices

For companies already licensed in another EU or EEA jurisdiction, the MGA can issue a Recognition Notice rather than a full licence. This allows the holder to supply services to MGA-licensed operators based on their existing foreign authorisation, subject to the MGA assessing the home jurisdiction as offering broadly equivalent safeguards.

Recognition Notices are subject to annual renewal. In April 2026, the MGA launched a targeted consultation on proposed enhancements to the Recognition Notice framework, which may affect future eligibility criteria and ongoing monitoring obligations.

The Authority has not yet published finalised amendments. Operators relying on Recognition Notices or considering this route should monitor MGA communications closely for updates.

New rules in 2025/2026: what has changed

Several significant regulatory developments have shaped the compliance landscape entering 2026. Operators need to understand all of them before applying or reviewing their existing licence arrangements.

Risk-based supervisory framework formalised

In 2025, the MGA formally declared its commitment to a risk-based, evidence-led and outcomes-focused supervisory approach. The shift means operators are no longer treated identically.

Those processing high transaction volumes across multiple markets, or carrying elevated AML risk profiles, face more intensive scrutiny than smaller B2B providers. The Authority published its Supervisory Engagement Efforts for 2026 in March, setting out four priority areas: internal controls around cash and cash equivalents, crypto asset oversight, sports betting integrity, and player protection standards.

Minimum capital requirements policy

The Minimum Capital Requirements Policy, published in 2025, introduced new financial discipline obligations. Operators who find themselves in negative equity must restore their capital position to positive.

The policy sets specific parameters for how and when remediation must occur, reinforcing the MGA’s focus on the long-term financial stability of its licensee base.

Updated financial reporting

Revised financial reporting requirements for all licensees came into effect from 2025, including updated annual reporting obligations and more structured data submissions.

Operators should confirm current requirements directly with the MGA or their compliance advisers, as further development is expected under ongoing consultations on Directive 3 of 2018.

VAT and gaming tax reform, effective October 2026

The most significant structural change in the near term is the VAT and gaming tax overhaul, formalised under Legal Notices 84 and 86 of 2026, jointly led by the Malta Tax and Customs Administration and the MGA.

As we reported, Malta is consolidating its gaming tax structures and narrowing its VAT exemption, with both changes taking effect on 1 October 2026.

Legal Notice 86 amends the VAT exemption for gambling supplies, narrowing and clarifying the scope of the exemption. Legal Notice 84 amends the gaming-tax framework to consolidate rates and align them with the revised VAT treatment.

The aim is to establish a clearer place-of-consumption logic for VAT and to align gaming-tax obligations with the location of the player, though the precise impact depends on the nature of the gaming service and the applicable MTCA VAT guidelines. Operators should engage specialist tax advisers ahead of the October deadline.

MGA licence requirements

Satisfying the MGA’s requirements is the most demanding part of the application. The Authority applies a thorough fit-and-proper assessment to every applicant and every key individual connected to the business.

Corporate structure

Applicants must incorporate a Malta-registered entity. The MGA requires full disclosure of all shareholders holding 10% or more ultimate beneficial ownership (UBO), and the review traces every ownership layer until the natural persons behind the shareholding are identified.

You will need to submit the company’s Memorandum and Articles of Association, share certificates, director resolutions, and proof of paid-up capital.

Minimum share capital requirements, as published by the MGA, are as follows:

For entities holding multiple game types, the thresholds are cumulative up to a maximum of €240,000.

Source: MGA FAQ — Minimum issued paid-up share capital. Figures correct as of May 2026. Check mga.org.mt for current requirements.

Fitness and probity

Every director, shareholder, UBO, and key function holder must pass the fitness and probity assessment. This requires clean criminal record certificates (no older than three months), notarised copies of passports, and detailed professional and financial history.

The MGA assesses integrity, competence, and financial soundness. Previous regulatory sanctions or adverse findings in any jurisdiction are material to the outcome.

Key function holders

All licensed operators must appoint individuals to hold key function licences as defined by the Gaming Act. The required functions vary by licence type but typically include compliance officer, money laundering reporting officer (MLRO), player protection officer, and technical key function roles.

Each key function holder is individually licensed by the MGA.

Technical standards

The proposed platform must meet MGA technical standards. Game software must be certified by an MGA-approved testing laboratory. Servers must be located in Malta.

The system must demonstrate compliant random number generation, transparent player fund segregation, and the technical capability to support all required responsible gambling tools. A system audit by an MGA-approved Audit Service Provider (ASP) is conducted before go-live.

AML and KYC

Operators must implement comprehensive Know Your Customer (KYC) procedures, including identity verification, source-of-funds checks, and ongoing transaction monitoring. A qualified MLRO must be appointed.

While Malta’s Financial Intelligence Analysis Unit (FIAU) serves as the primary AML supervisory body, the MGA has co-supervisory authority over gaming operators under Malta’s AML legislation. AML inspections focus on real transaction samples, not just internal policy documents.

Financial requirements

Applicants must demonstrate adequate financial standing for start-up and ongoing operations. This includes three-year financial projections, proof of legitimate funding sources, and bank references.

Following the 2025 Minimum Capital Requirements Policy, operators in negative equity must take corrective action within defined timescales.

Figures and framework details correct as of May 2026. Check the official Malta Gaming Authority website and Malta Tax and Customs Administration for current rates and implementation guidance.

The application process: step by step

The MGA operates an open window framework, meaning there is no quota on licences and no restricted application periods. Operators can apply at any time.

Step 1: Pre-application preparation

Establish the Malta entity, prepare all corporate and personal documentation, appoint key function holders, and conduct an internal readiness review against MGA requirements.

Step 2: Application submission

Submit the application via the MGA’s Licensee Portal, including the business plan, technical documentation, AML policy, responsible gambling framework, and all fit-and-proper materials. The non-refundable application fee of €5,000 is payable at this stage.

Step 3: MGA review

The Authority reviews all submissions and may request additional information at any point. Fit-and-proper checks on all key individuals run in parallel with the corporate review.

Step 4: System review

Once the MGA is satisfied with the documentation, the applicant moves to a system review conducted by an MGA-approved ASP. System audit fees are settled directly with the auditor; costs for a single B2B licence with one game type average around €2,500 to €3,500 (VAT inclusive) and rise with additional verticals.

Step 5: Licence issuance

If the system review passes, the MGA issues the licence for a period of ten years. The annual licence fee must be paid before the licence is released.

Step 6: Compliance audit

Within the first year of live operation, the operator must arrange a compliance audit conducted by an MGA-approved auditor. Compliance audit fees for a B2C operator holding a single game type typically range from €5,000 to €15,000 (VAT exclusive) depending on scope.

The realistic total timeline from full application submission to licence issuance, assuming clean documentation and no material queries, is typically 12 to 16 weeks, according to several compliance-advisory firms active in the Malta market. The MGA does not publish a binding processing timeframe, and delays can occur if additional information is requested or if fit-and-proper reviews extend.

Costs and fees

Understanding the full cost of an MGA licence is essential before committing to the jurisdiction. The fee structure combines fixed administrative charges, a variable compliance contribution, and gaming tax.

Application and licence fees

Source: Gaming Licence Fees Regulations (L.N. 409 of 2017), in force from 1 January 2018. Figures correct as of May 2026. Check the official MGA website for current rates.

Compliance contribution (B2C operators)

B2C compliance-contribution bands are set by the Gaming Licence Fees Regulations (Subsidiary Legislation 438.12). Minimum and maximum annual amounts per game type, consistent with current regulations and widely cited by Maltese-based compliance firms, are as follows:

Source: Gaming Licence Fees Regulations (S.L. 438.12), as summarised by compliance advisory firms active in the Malta market. Figures correct as of May 2026. Check the official MGA website for current rates.

New operators are exempt from the minimum compliance contribution until their first full financial year of operations has elapsed. Qualifying start-ups may benefit from an additional 12-month moratorium under the Directive on Start-Up Undertakings.

Exact eligibility and timescales should be confirmed with the MGA or a locally qualified adviser. B2B Critical Gaming Supply licensees are not subject to compliance contributions.

Gaming tax

A 5% gaming tax is levied on gross gaming revenue generated from players physically resident in Malta, assessed monthly. For operators whose primary markets are outside Malta, this element of the tax burden is typically modest.

The October 2026 VAT reform will affect how this tax interacts with place-of-supply rules. Operators should model the impact ahead of implementation.

Malta levies corporate tax at 35% on company profits, though the country’s imputation and tax-refund system can reduce the effective rate significantly for qualifying operators, with a de facto rate often cited at around 5% by advisory firms active in the Malta market.

Malta’s tax position vs Cyprus and the Isle of Man

For operators comparing jurisdictions on pure financial grounds, the tax structures across Malta, Cyprus, and the Isle of Man diverge in ways that materially affect long-term operating costs.

Malta imposes a 5% gaming tax on gross gaming revenue from Malta-resident players only, with no gaming tax on non-Malta-resident GGR. The gambling VAT exemption has historically applied to cross-border B2C bets and many B2B gaming services, though Legal Notice 86 of 2026 narrows that exemption from 1 October. Corporate tax is nominally 35%, but the refund and imputation system can reduce the effective rate to around 5% for qualifying operators.

Cyprus taxes gaming operators primarily through corporate income tax at 12.5% as of 2026, with additional gaming-tax components applicable to betting-licence holders at rates that vary by game type and tax residency. The VAT treatment for gaming services in Cyprus does not carry the same broad historic exemption as Malta, which can increase effective costs for operators whose structures previously relied on Malta-style VAT relief.

The Isle of Man takes a different approach entirely. There is no corporate income tax on gaming profits for IoM-licensed operators; the model is based instead on licence fees and local economic levies rather than a percentage-of-GGR gaming tax. That makes the IoM attractive on a pure tax basis, but it sits outside the EU and offers no passporting benefits, which limits its utility for operators primarily targeting European regulated markets.

In summary: Malta provides EU status with a relatively low effective gaming-tax burden. Cyprus offers a lower nominal corporate rate but narrower gaming-specific reliefs. The Isle of Man provides the lowest gaming-tax exposure of the three but without EU access.

Operators should model the October 2026 VAT changes carefully before drawing conclusions about Malta’s comparative cost position from year-end 2026 onward.

Compliance obligations after licensing

Obtaining a licence is the beginning of the compliance journey, not the end. The MGA’s 2026 supervisory priorities signal an intensifying focus on how operators run their businesses day to day.

Ongoing reporting

Licensed operators must submit monthly ADR (Aggregate Data Returns) covering player activity, transactions, and responsible gambling indicators. The quality and consistency of these reports is a specific supervisory focus for 2026.

The MGA has flagged ADR reporting as an area where standards have been uneven across the licensee base. Annual financial reporting is also required by all licensees under the updated requirements effective from 2025.

Compliance and system audits

The MGA conducts full-scope compliance audits on a scheduled and risk-weighted basis. In the first half of 2025, the Authority carried out seven full-scope compliance audits and 87 thematic reviews across its entire licensee base, according to the MGA.

From 2023, the MGA introduced system reviews, triggered by material changes to a licensee’s technical architecture, sitting between the initial system audit and a full compliance audit.

Player protection

Operators must integrate responsible gambling tools directly into their platforms. These include deposit limits, loss limits, self-exclusion mechanisms, reality checks, and affordability monitoring.

The MGA also launched a free self-assessment tool for players in 2025, signalling that it expects operators to actively support its player-protection infrastructure, not just meet minimum obligations. The MGA requires operators to exclude a player from all brands they operate if the exclusion relates to gambling harm, not just the specific brand where the exclusion was requested.

B2C marketing and player communications

B2C licence holders must comply with the Gaming Commercial Communications Regulations (S.L. 583.09).

All advertising and marketing materials must display the MGA licence number, a minimum-age statement, and clear responsible-gambling information, including a “Gamble Responsibly” message and a link to the MGA-approved alternative dispute resolution body.

Promotional and bonus terms must be written in clear, fair, and non-deceptive language. Any material conditions, including wagering requirements, time limits, qualifying markets, and maximum bet-per-spin restrictions, must be plainly visible before the player commits.

All terms and conditions, privacy policy, and dispute-resolution information must be readily accessible, typically via persistent footer links and on registration pages. Operators must also communicate material changes to terms to affected players in a timely way.

AML supervision

AML inspections under co-supervision with the FIAU are detailed and documentation-heavy. Reviewers examine real transaction samples rather than simply reviewing written AML policy.

Operators must maintain a current Business Risk Assessment and update it regularly. The MGA’s 2026 supervisory priorities include a specific thematic review of internal controls around crypto asset payments, meaning crypto-active operators should expect heightened scrutiny this year.

Enforcement

The MGA’s enforcement powers are significant. Administrative penalties range from a minimum of €10,000 to a maximum of €500,000 per breach under the Gaming Act. Enforcement actions are published on the MGA’s public register, creating lasting reputational consequences.

Licence suspension and revocation are available for serious or repeated breaches. In a recent example, the MGA cancelled Winzon Group’s B2C licence with immediate effect in March 2026, issuing over €193,000 in fines and outstanding fees, with further legal action confirmed if obligations are not met.

The MGA’s enforcement register, accessible at mga.org.mt, details all current and recent outcomes.

AI in iGaming: what MGA-licensed operators need to know

Artificial intelligence has moved from pilot projects to operational infrastructure across the iGaming sector. For MGA-licensed operators, that shift brings both compliance obligations under the EU AI Act and practical guidance from the MGA’s proposed AI Gaming Charter.

How AI is already being deployed

Francois Piccione, Chief Technology and Business Transformation Officer at the Malta Gaming Authority, said:

“The most immediate opportunities lie in operational intelligence and player protection. AI is already proving its value in areas such as fraud detection, AML, responsible gaming interventions, customer support, and recommender engines/systems. When deployed correctly, it allows operators to identify patterns and risks earlier, tailor interventions more effectively, and improve efficiency without compromising the player experience.”

The risks are equally tangible. Piccione flagged a specific concern regulators are watching closely:

“The most pressing concern is the use of AI in high-impact decision-making without adequate human oversight.”

Piccione was clear on what responsible AI looks like in operational terms:

“Responsible AI is far less abstract than it sounds. It means having clear internal accountability, knowing where AI is being used, for what purpose, how it is used, and with what potential impact on players.”

Operators should also be aware of what Piccione calls “AI-washing”: presenting systems as more intelligent or autonomous than they actually are. From a regulatory standpoint, this is treated as a transparency failure.

The EU AI Act and what it demands from operators

The EU AI Act is now a live compliance consideration, not a future-planning exercise.

Kinga Warda, Chief Officer for Policy and International Affairs at the Malta Gaming Authority, spoke to iGaming Republic about what operators must do now to prepare. She said the primary challenge is translating legislation into operational practice:

“The primary challenge is moving from legal interpretation to operational reality. The EU AI Act is intentionally principles-based, but operators need to translate those principles into system design, governance processes, and day-to-day decision-making.”

Gaming-specific AI applications add further complexity. Many systems used for fraud detection, player protection, and marketing personalisation may fall into the Act’s high-risk or sensitive categories, requiring formal risk assessments, transparency measures, and documented human oversight.

Warda identified a structural gap that many operators have yet to address:

“There’s a skills and governance gap: ensuring that compliance, technical, and operational teams are aligned and equipped to implement these requirements consistently across the organisation.”

The AI Gaming Charter: what it is and why it matters

The MGA is among the driving forces behind a proposed AI Gaming Charter, designed to translate broad EU AI Act principles into sector-specific, actionable standards. The Charter is principles-based and voluntary rather than prescriptive, and aligns with wider EU AI Act codes of practice to help operators future-proof their AI strategies.

Warda described its purpose:

“The AI Gaming Charter is intended to act as a bridge between regulation and implementation. While the EU AI Act sets out horizontal requirements, the Charter translates those into sector-specific guidance tailored to the realities of gaming.”

Piccione explained how standardisation and innovation can coexist under the Charter model:

“By standardising how AI risks should be approached through impact assessments, documentation, monitoring, and accountability, rather than which technologies should be used, the Charter creates consistency without stifling innovation.”

Warda’s message for operators approaching AI compliance as a burden was direct:

“Responsible innovation should be seen as a competitive advantage, not a constraint.”

What operators must do now

For operators that have not yet mapped their AI systems against the EU AI Act’s risk categories, Warda’s starting point was clear:

“The first step is understanding your AI landscape. Operators should identify where AI is being used across their organisation and assess those systems against the EU AI Act’s risk categories.”

After that: governance structures, documentation, cross-functional alignment between legal, compliance, and technical teams, and staff training on both regulatory requirements and the ethical implications of AI deployment.

Piccione’s day-to-day building blocks cover transparency with players when they interact with AI-driven systems, ensuring AI outputs in responsible gaming or fraud detection are reviewable and subject to human intervention, maintaining proper data governance, and monitoring continuously for model drift or bias.

Malta vs Curaçao and other offshore licences

The MGA is frequently compared to offshore alternatives, particularly Curaçao, when operators are weighing licensing costs against market credibility. The comparison matters because the gap between them has widened, not narrowed, in 2025 and 2026.

Curaçao offers a faster approval process, lower annual fees, and no gaming tax on GGR. The 2023 to 2024 regulatory overhaul ended the old master-licence model and introduced a new framework under the Gaming Control Board of Curaçao. That reform was a step forward, but Curaçao has not yet achieved the Tier-1 market credibility that comes with MGA licensing, particularly in relation to EU-focused banking relationships, major payment processors, and regulated-market partnership terms.

Malta is EU-aligned, preferred by Tier-1 payment acquirers, and carries a compliance overhead that is itself a market signal. For operators targeting EU-regulated markets, building M&A-credible structures, or seeking serious banking relationships, the MGA licence is typically the stronger foundation. The cost and complexity premium is real. It is also the point.

Other offshore options, including Anjouan, Nevis, and similar lightweight jurisdictions, offer the fastest and cheapest route to a licence. They are best suited to MVP launches or very niche markets and carry minimal credibility with the payment processors and regulated-market partners that most growth-stage operators need.

In short, MGA-licensed operators are generally viewed as higher-compliance, higher-credibility entities than Curaçao-licensed or other offshore equivalents. That comes with a meaningful cost and complexity premium. For operators whose business model depends on market access, banking quality, or regulatory reputation, that premium is typically justified.

Is an MGA licence still worth it in 2026?

For serious operators targeting regulated European markets, the MGA remains a Tier-1 choice. The case for Malta rests on several durable advantages: EU membership, a 25-year regulatory track record, acceptance by major payment processors and banks, and an established ecosystem of compliance advisers, technology suppliers, and skilled talent.

The October 2026 tax reform and the tightening supervisory environment raise the cost and complexity of holding an MGA licence. This is deliberate. The MGA’s strategy is to maintain a compliant, accountable licensee base, not to maximise application volume.

Against Malta, the main alternatives at this level are Gibraltar and the Isle of Man, both offering Tier-1 credentials at broadly comparable cost, and the UKGC, which remains mandatory for any operator targeting UK players.

Malta’s regulatory stability also carries legal weight beyond the licence itself. In February 2025, Malta’s First Hall of the Civil Court blocked the enforcement of Austrian player-loss judgments against MGA-licensed operators, citing EU treaty principles and Malta’s Gaming Act. Austria’s exclusive online gambling licence is due for renewal in 2027, and potential market liberalisation could reduce the volume of future cross-border claims of this kind.

Malta is also positioning itself ahead of emerging regulatory categories. The government is actively exploring a dedicated framework for prediction markets, with Economy Minister Silvio Schembri confirming in March 2026 that Malta is examining how to govern the sector.

No EU member state has yet established specific rules for prediction markets, and Malta’s first-mover approach mirrors the regulatory leadership it demonstrated with blockchain services.

Who should choose Malta? Operators targeting multiple European markets from a single hub, B2B suppliers seeking broad operator-client access, and businesses for whom EU regulatory credibility directly affects their banking or partnership terms. Operators focused exclusively on one nationally regulated market may find a local licence more efficient.

The application volumes of 2025 suggest the market has already delivered its verdict: 28 new licence applications in the first six months of last year alone, with five of six renewal applications approved in that period.

Key takeaways

• The MGA operates under the Gaming Act 2018 and issues two primary licence categories: B2C Gaming Service licences and B2B Critical Gaming Supply licences. The 2026 framework updates that structure through directives and supervisory guidance, not a new licence regime.
• The non-refundable application fee is €5,000. Annual licence fees for B2C operators are €25,000 for Types 1, 2, and 3, and €10,000 for Type 4 only. B2B annual fees typically range from €10,000 to €35,000 depending on supply scope.
• Minimum share capital ranges from €40,000 (Types 3 and 4, B2B) to €100,000 (Types 1 and 2), with a cumulative cap of €240,000 for multi-type operators.
• A VAT and gaming tax reform takes effect on 1 October 2026, narrowing the gambling VAT exemption under Legal Notice 86 and aligning gaming-tax obligations with place of consumption. Specialist advice is required before implementation.
• The MGA’s 2026 supervisory priorities cover internal controls for cash and crypto payments, esports and athlete betting integrity risks, and the quality of monthly ADR player protection reporting.
• The EU AI Act is a live compliance obligation for MGA-licensed operators. The MGA’s proposed AI Gaming Charter will provide sector-specific guidance on responsible AI deployment, governance, and transparency. Operators should begin mapping their AI systems against the Act’s risk categories now.
• B2C licence holders must comply with the Gaming Commercial Communications Regulations, displaying the MGA licence number, minimum-age statements, and responsible gambling information across all marketing. Bonus and promotional terms must be transparent and non-deceptive.
• The realistic timeline from full application submission to licence issuance is typically 12 to 16 weeks, according to compliance advisory firms. Enforcement actions carry penalties up to €500,000 per breach and are published on the MGA’s public register.

Conclusion

The MGA’s direction in 2025 and 2026 is clear: higher standards, more targeted supervision, greater financial accountability, and a rising focus on how technology, particularly AI, is governed within licensed operations.

The October 2026 tax reform demands immediate attention. The EU AI Act and the emerging AI Gaming Charter will reshape compliance expectations for operators at every scale.

For those weighing jurisdiction options, Malta’s combination of EU status, established infrastructure, and credible enforcement record retains its appeal, provided they are prepared to invest in the compliance culture the licence genuinely requires.

Watch for the finalised AI Gaming Charter, outcomes from the Recognition Notice framework consultation, the October 2026 tax implementation, and any amendments to Directive 3 of 2018, all of which carry practical implications for both new applicants and existing licensees.