MGA sets crypto and esports as 2026 supervisory priorities

• The Malta Gaming Authority has published its supervisory engagement plan for 2026, built around three pillars: compliance, player protection, and sports betting integrity.
• The regulator will conduct thematic reviews of internal controls around cash, cash equivalents, and crypto assets used by licensed operators.
• Focused integrity reviews will target athletes betting on their own sport and risks linked to esports markets.

The Malta Gaming Authority (MGA) has outlined its supervisory agenda for 2026, placing crypto asset controls, esports integrity risks, and player protection measures at the top of its regulatory watchlist.

Published on 12 March 2026, the authority’s Supervisory Engagement Efforts for 2026 document confirms the MGA will build on the risk-based, evidence-led framework refined during 2025.

The approach is designed to identify and assess regulatory risks more effectively, direct supervisory resources where they are most needed, and maintain a proactive and responsive regulatory environment.

Three core pillars

Supervisory efforts for 2026 are structured around three core regulatory themes: compliance, player protection, and sports betting integrity.

Within those pillars, the MGA has identified a set of targeted focus areas based on ongoing risk assessment, supervisory observations, and engagement with authorised persons.

The compliance pillar introduces two thematic reviews of internal control frameworks. The first examines the use of cash and cash equivalents within the online gaming industry. The second focuses on crypto assets, an area of growing importance as more MGA licensees integrate digital currencies into their payment flows.

The crypto framework in context

The MGA’s existing DLT policy, in force since 30 January 2023, already requires operators to obtain prior approval before accepting or using any crypto asset on their platform.

Under that framework, operators must classify each digital asset in accordance with the Virtual Financial Assets Act before the MGA will grant approval, and any operator wishing to accept VFA deposits via its own wallets must consult the authority and obtain sign-off before going live.

Critically, assets with inbuilt anonymisation functions that obscure transaction details including sender, receiver, or amounts transferred are prohibited outright under MGA rules.

The 2026 thematic review goes a step further, signalling that the authority intends to look beyond initial approval and assess whether the internal control frameworks operators have built around those crypto operations are sufficiently robust: including AML risk assessments, wallet management procedures, and the adequacy of player fund protections where digital assets are involved.

With the EU’s Markets in Crypto-Assets Regulation now in force, operators holding MGA licences face a dual compliance layer, satisfying both the authority’s gaming-specific DLT policy and the broader MiCA framework overseen by the Malta Financial Services Authority.

Integrity and player protection

On the sports betting integrity front, the MGA is directing attention towards two emerging risk areas. Focused reviews will examine cases of athletes betting on their own sport, a long-standing concern for betting regulators globally.

The authority will also assess integrity risks linked to esports markets, reflecting growing recognition of esports as a distinct and fast-expanding wagering vertical.

In the first half of 2025, the MGA conducted seven full-scope compliance audits and 87 thematic reviews across three areas: sports betting integrity, compliance, and player protection. The 2026 framework extends that supervisory activity with sharper focus on emerging risks within each of those categories.

Player protection also receives enhanced attention. The MGA will increase oversight of operator monthly ADR reporting, the alternative dispute resolution data that operators are required to submit, with particular emphasis on the quality and consistency of those submissions.

The move signals that the authority is not only monitoring whether operators have player protection measures in place but whether those measures are being applied and documented to a consistent standard.

What this means for operators

For the hundreds of operators holding MGA licences, the priorities published this week represent a clear set of compliance preparation signals.

Internal control frameworks around crypto onboarding, player fund handling, and cash management are likely to face heightened scrutiny in the months ahead. Operators active in esports betting markets or those with athlete-facing products should expect dedicated integrity reviews.

The MGA’s approach mirrors a broader tightening of supervisory standards across European jurisdictions. Operators looking to correct their compliance posture ahead of reviews would do well to document crypto asset controls, review ADR reporting processes, and assess their exposure to sports integrity risks.