Malta Gaming License Masterclass: Obtain an MGA License for Online Gambling in 12 Months – Comprehensive Roadmap Covering All Compliance Requirements

I see it every day: entrepreneurs reach out to me asking about a gaming license. Most have already wasted months.

The reason? They massively underestimate the complexity of an MGA license.

Here’s the truth:

A Malta Gaming Authority license is not a “quick” tax optimization project. It’s a strategic 12-month venture with clear milestones.

But—and this is crucial—if you do it right, you unlock a market of over 500 million EU citizens. Legally and fully in compliance.

In the next 4,500 words, I’ll show you exactly how this works. Not as a theoretical treatise, but as a hands-on, battle-tested roadmap.

You’ll learn which license you really need. You’ll also get a realistic cost breakdown and a month-by-month checklist.

Ready for a deep dive? Let’s start with the foundations.

Yours, RMS

Malta Gaming License 2025: What You Need to Know About the MGA License

The Malta Gaming Authority (MGA) has been Malta’s official gambling regulator since 2001. It is considered one of the strictest and most respected gaming authorities worldwide.

What does this mean for you in practice?

With an MGA license, you can legally offer online gambling in all EU member states. The reason is the EU’s freedom to provide services—Malta is a full member of the European Union.

Why Malta for Gaming Licenses?

Malta has deliberately positioned itself as a gaming hub. The country offers a unique combination of strict regulations and business-friendly tax legislation.

The benefits at a glance:

• EU Passport: Access all EU markets with a single license
• Tax Advantages: Effective tax rate between 5–35% depending on your structure
• Legal Certainty: Established legal system based on the British model
• Reputation: MGA licenses command high trust from players and payment providers
• Support: Dedicated gaming infrastructure and know-how on the ground

MGA vs. Other Gaming Jurisdictions

Let me be frank: Malta isn’t the cheapest option. But it’s often the best.

Bottom line: if you’re serious about operating in the EU market, Malta is hard to beat.

Current Developments 2025

In recent years, the MGA has continuously tightened its requirements. Since 2024, stricter capital requirements and extended compliance obligations apply.

The process has also been digitalized. That means faster processing but also higher transparency requirements.

For you as an applicant, this means: Solid preparation is even more crucial.

Applying for an MGA License: The 4 License Types at a Glance

Here’s where it gets specific. The MGA distinguishes four main license types, each with its own requirements and permissions.

Choosing the right one determines your success—and your costs.

Class 1 License: Remote Gaming

This is the most popular license for online casino operators. It allows you to offer:

• Online casino games (slots, table games)
• Live casino services
• Virtual sports betting
• Poker tournaments and cash games

Minimum capital: €40,000 paid-up capital
License fee: €25,000 per year
Processing time: 6–9 months

This license is your standard entry into online gaming.

Class 2 License: Gaming Supply

Perfect for software vendors and game developers. It covers:

• Casino software development
• Provision of gaming platforms
• White-label solutions
• Gaming-as-a-Service offerings

Minimum capital: €20,000
License fee: €15,000 per year
Processing time: 4–6 months

Class 3 License: Gaming Promotion

For marketing firms and affiliate networks in the gaming space:

• Gaming affiliate marketing
• Lead generation for casinos
• Gaming ad networks

Minimum capital: €10,000
License fee: €5,000 per year
Processing time: 3–5 months

Class 4 License: Gaming Support Services

For specialized service providers:

• Payment processing for gaming
• Hosting services for gaming platforms
• Technical gaming infrastructure

Minimum capital: Depending on service €20,000–€100,000
License fee: €10,000–€40,000 per year

Which License Fits Your Business Model?

Most of my clients need a Class 1 license. Why? They want to operate a fully-fledged online casino.

But warning: think carefully about what you actually want to do. A Class 2 may suffice for tech service providers—saving you €10,000 per year in license fees.

My tip: Start conservatively. Licenses can be upgraded later, but not easily downgraded.

Malta Gaming License Costs: Complete Investment Planning

Let’s get down to numbers. I’ll show you the real costs of an MGA license—with no hidden surprises.

Most articles gloss over the side costs. That’s how you end up with nasty surprises six months in.

Direct MGA Costs (Class 1 License)

That’s already €97,000 in the first year. But there’s more to it.

Inevitable Advisory Costs

You simply won’t get an MGA license without specialized advisers.

• Legal advice: €15,000–€30,000 for the application process
• Compliance consulting: €10,000–€20,000 to develop policies
• Technical certification: €8,000–€15,000 for software testing
• Accounting/audit: €5,000–€12,000 for financial statements

Budget an extra €40,000–€80,000 for professional support.

Operational Start-up Costs

In parallel to your license application you’ll need to set up your business:

Realistic Total Investment

For a serious launch, plan for:

Minimum scenario: €250,000–€300,000
Comfort scenario: €500,000–€750,000
Premium scenario: €1,000,000+

Sound like a lot? It is. But remember: the EU gaming market is worth over €100 billion per year.

Ongoing Annual Costs

Once licensed, ongoing costs include:

• MGA fees: €32,000 (license + compliance)
• Audit and compliance: €15,000–€25,000
• Legal consulting: €10,000–€20,000
• Software licenses: €60,000–€200,000
• Staff and operations: €150,000–€500,000

Budget €270,000–€780,000 annually for running costs.

Translation: you need a robust business case. Without a sustainable business model, an MGA license is a bottomless pit.

My advice: Develop your business model first. Then apply for the license, not the other way around.

MGA License Requirements: Understanding Compliance Basics

Now we get to the crux: what does the MGA really expect?

The requirements are extensive—but don’t worry, I’ll explain each one in practical terms.

Corporate Structure and Governance

You must set up a Maltese company or an EU company with a Maltese branch.

Minimum requirements:

• Registered office in Malta with genuine premises
• At least two directors (one resident in Malta)
• Compliance Officer with MGA-recognized qualification
• Money Laundering Reporting Officer (MLRO)
• Dedicated Customer Support in the Maltese time zone

In short: you need real presence in Malta. Shell companies won’t work.

Financial Requirements

The MGA wants to see that you’re financially sound:

You also have to show where your capital comes from. Source of Funds documentation is mandatory.

Technical and Operational Standards

Your gaming platform must meet strict technical requirements:

Software Certification:
All gaming software must be certified by MGA-accredited test labs. This includes random number generators (RNGs), return-to-player rates (RTPs), and game integrity.

Data Protection and GDPR:
You must be fully GDPR-compliant. This means:

• Data Protection Impact Assessment (DPIA)
• Privacy Policy and Terms of Service
• Cookie Policy and Consent Management
• Data Breach Response Procedures

Anti-Money Laundering (AML):
Comprehensive AML policies are required:

• Customer Due Diligence (CDD) procedures
• Know Your Customer (KYC) processes
• Suspicious Activity Reporting
• Transaction Monitoring Systems

Responsible Gaming Requirements

The MGA places great emphasis on player protection:

Personnel Qualifications

Your key people must prove specific qualifications:

Compliance Officer:

• ACAMS certification or equivalent
• 3+ years gaming compliance experience
• Maltese or EU residency permit

MLRO (Money Laundering Reporting Officer):

• Specialized AML training
• Registration with Financial Intelligence Analysis Unit (FIAU)
• Ongoing professional development

In short: you can’t simply “recycle” current staff. You need real specialists.

Business Plan and Financial Forecasts

The MGA expects a detailed 5-year business plan:

• Detailed revenue forecasts by product segment
• Customer acquisition strategies with realistic conversion rates
• Competitive analysis of target markets
• Risk assessment and mitigation strategies
• Compliance budget and resource planning

This is where many fall short. Vague plans will be rejected.

My tip: Invest time in a professional business plan. This is your application for a license worth millions.

12-Month Roadmap: Your Structured Path to a Gaming License

Here it is—the practical roadmap that saves you months. I’ve refined this schedule through over 20 successful MGA applications.

Important: Phases overlap in parts. Parallel progress is crucial for success.

Months 1–2: Foundation Phase

Weeks 1–2: Business Model Finalization

• Finalize license class selection
• Target market analysis and competitive intelligence
• Revenue model and pricing strategy
• Initial capital planning and investor relations

Weeks 3–4: Legal Structure Setup

• Set up Maltese company or establish EU entity
• Lease business premises in Malta (real presence required)
• Initial consultations with MGA-specialized lawyers
• Preliminary compliance assessment

Weeks 5–8: Team Building

• Recruit Compliance Officer (Malta resident)
• Identify and qualify MLRO
• Fill key management positions
• Build HR structures and employment contracts

Milestone: Operational Maltese entity with core team

Months 3–4: Documentation Phase

Weeks 9–12: Business Plan Development

• 5-year financial plan in detail
• Market entry strategy with KPIs
• Risk assessment and compliance framework
• Technical architecture and platform strategy

Weeks 13–16: Compliance Documentation

• AML policies and procedures manual
• Responsible gaming framework
• GDPR compliance documentation
• Internal controls and audit procedures

Milestone: Full documentation for MGA application

Months 5–6: Technical Implementation

Gaming Platform Setup:

In parallel: Software Testing and Certification

• RNG testing by accredited labs
• Game integrity verification
• Platform security assessment
• Load testing and performance optimization

Milestone: Certified, operational gaming platform

Months 7–8: Application Submission

Weeks 25–28: Final Application Preparation

• Complete document review by legal counsel
• Financial statements and audited accounts
• Source of funds documentation
• Final business plan review

Weeks 29–32: MGA Application Submission

• Online application via MGA portal
• Pay €25,000 application fee
• Upload and sign all documents
• Await application acknowledgment

Milestone: Official MGA application submitted

Months 9–10: Review Process

Now it’s the MGA’s turn, but you’re not idle:

MGA Review Activities:

• Document review by MGA teams
• Background checks of key persons
• Financial due diligence
• Technical assessment of the gaming platform

Your parallel tasks:

• Prepare marketing campaigns
• Onboard additional game providers
• Build out customer support team
• Finalize operational procedures

Common MGA Inquiries:

• Clarifications on business model
• Additional financial information
• Enhanced due diligence for certain individuals
• Technical documentation updates

Respond to MGA inquiries within 5 business days. Delays prolong the process significantly.

Months 11–12: Final Approval and Launch

License Issuance Process:

• Final MGA board approval
• Download license certificate
• Payment of annual license fee
• Compliance monitoring setup

Go-Live Preparation:

• Final platform testing
• Launch marketing campaign
• Customer onboarding processes
• Ongoing compliance monitoring

Milestone: Live gaming operation with valid MGA license

Critical Success Factors

From over 20 projects, these are the most common causes of delays:

1. Incomplete documentation – adds 2–3 months
2. Weak compliance know-how – causes repeated queries
3. Unrealistic financial planning – requires full rework
4. Technical shortcomings – software must be re-certified
5. Personnel changes – triggers new background checks

My advice: Plan for a 15% time buffer. It’s better to start early than to scramble later.

Malta Gaming Authority Procedures: The Approval Process in Detail

Now let’s look behind the MGA’s doors. Here’s what really happens during those 6–9 months of processing time.

It helps you plan realistically and respond proactively.

Phase 1: Initial Assessment (Weeks 1–4)

After your application is submitted, the MGA conducts an initial review:

Administrative Completeness Check:

• Are all forms filled in correctly?
• Have all required documents been submitted?
• Has the application fee been received?
• Are all signatures and authentications present?

First-Level Review:

• Plausibility check of business model
• Appropriateness of licensing class
• Basic financial capability assessment
• Key personnel qualification check

If anything is missing, you’ll receive a Request for Information (RFI). Respond within 10 business days—or the application will be deemed withdrawn.

Phase 2: Detailed Due Diligence (Weeks 5–16)

This is where it gets intense. The MGA examines every aspect of your application in depth:

Financial Due Diligence:

Background Checks on Key Persons:

The MGA conducts extensive “fit and proper” checks:

• Criminal records (global)
• Regulatory history (other jurisdictions)
• Bankruptcy and insolvency records
• Verification of professional qualifications
• Character references from business partners

This often takes longest—especially if persons have an international background.

Phase 3: Technical Assessment (Weeks 12–20)

In parallel with due diligence, the MGA reviews your technical infrastructure:

Gaming Software Evaluation:

• Review of RNG certification
• Verification of game RTPs
• Software integration security assessment
• Player data protection mechanisms
• Implementation of responsible gaming tools

Platform Security Review:

• SSL certificate and encryption standards
• Anti-fraud mechanisms
• Payment processing security
• Data backup and disaster recovery
• Vulnerability assessment results

A common pitfall: MGA often requests software updates or extra security features. Allow 2–4 weeks for revisions.

Phase 4: Compliance Framework Review (Weeks 16–24)

Your compliance documentation is scrutinized:

AML/CFT Procedures:

• Customer due diligence workflows
• Transaction monitoring thresholds
• Suspicious activity reporting
• Staff training programs
• Record-keeping requirements

Responsible Gaming Measures:

• Self-exclusion database integration
• Deposit limit enforcement
• Reality check mechanisms
• Problem gambling detection algorithms
• Player communication strategies

The MGA often tests your policies using sample scenarios. Prepare your team accordingly.

Phase 5: Final Review and Board Approval (Weeks 20–28)

MGA Board Presentation:

Your application goes before the MGA Board. These meet monthly.

Timing is key: if you finish mid-month, you wait for the next meeting.

Possible Board Decisions:

• Approval: License granted (70% of complete applications)
• Conditional approval: License granted with conditions (20%)
• Deferral: More information required (8%)
• Rejection: Application refused (2%)

Frequent Follow-ups and Delays

From experience, these come up in 80% of applications:

1. Enhanced Source of Funds Documentation
   • Full proof for funds over €100,000
   • Tax returns from the past 3–5 years
   • Proof of sale for business sales
2. Business Plan Clarifications
   • Detailed market size breakdowns
   • Customer acquisition cost assumptions
   • Evidence for your competitive edge
3. Technical Implementation Details
   • Additional software certifications
   • Payment provider due diligence
   • Data center security assessments

Pro tip: Anticipate these requests. Prepare extra documentation even if not explicitly required.

After License Issuance: First 90 Days

The license is only the beginning. The MGA closely supervises new licensees:

• Operational Readiness Review within 30 days
• Testing of customer protection measures with your first players
• Financial reporting monthly, not quarterly
• Compliance Officer check-ins every two weeks

Be ready for close supervision. It’s normal and reflects MGA quality standards.

Common Pitfalls When Applying for an MGA License

In 8 years of MGA consulting, I’ve seen every mistake possible. Most are avoidable—if you know them in advance.

Here are the biggest pitfalls, and how to avoid them:

Mistake #1: Incomplete Source of Funds Documentation

The problem:
You underestimate how thoroughly the MGA checks your capital origin. A simple bank statement won’t do.

What the MGA really wants to see:

• Full documentation for all money transfers over €25,000
• Tax evidence for personal income over the past 5 years
• For business sales: complete purchase agreements
• For inheritance: notarized executor’s statements
• For loans: loan agreements and collateral details

How to avoid it:
Start your source of funds documentation 6 months before you apply. Get all docs from banks and tax advisers before they become urgent.

Mistake #2: Unrealistic Business Plan Assumptions

The problem:
Many applicants copy templates or use unrealistic market penetration rates.

Typical unrealistic assumptions:

How to do it right:
Use industry benchmarks from established sources like H2 Gambling Capital or European Gaming & Betting Association (EGBA).

Mistake #3: Weak Compliance Expertise in the Team

The problem:
You appoint a general manager as Compliance Officer who lacks gaming-specific experience.

What happens:
The MGA asks detailed AML questions, and your “Compliance Officer” can’t answer. The application is delayed or rejected.

Minimum qualifications for key roles:

Compliance Officer:

• CAMS (Certified Anti-Money Laundering Specialist) or equivalent
• At least 3 years’ gaming compliance experience
• Proven knowledge of MGA regulations
• Malta residency or EU work permit

MLRO (Money Laundering Reporting Officer):

• FIAU registration (Financial Intelligence Analysis Unit Malta)
• Specialized AML training with gaming focus
• Experience with suspicious activity reporting

Best approach:
Invest in real expertise. A qualified Compliance Officer costs €60,000–€100,000 per year, but will keep you from losing a license worth hundreds of thousands.

Mistake #4: Insufficient Technical Preparation

Common technical shortcomings:

1. Incomplete software certification
   • RNG tests done for some games only
   • No mobile gaming certification
   • Insufficient live gaming certification
2. Inadequate security infrastructure
   • Self-signed SSL certificates instead of commercial CA
   • No DDoS protection
   • Weak fraud detection systems
3. Poor player protection tools
   • No integrated self-exclusion database
   • Manual instead of automatic deposit limits
   • Missing reality check implementation

Best practice approach:
Work only with software providers experienced with the MGA—they know the specific requirements and save you weeks of rework.

Mistake #5: Underestimating Ongoing Operations

The problem:
You focus on licensing and forget about ongoing operations.

Frequently overlooked operational requirements:

• 24/7 customer support in the Malta time zone
• Monthly compliance reports to the MGA
• Quarterly financial statements (audited)
• Annual AML risk assessments
• Continuous staff training programs
• Regular IT penetration testing of systems

Hidden compliance costs:

Mistake #6: Poor Timing in Capital Planning

The problem:
You secure funding for licensing but forget about running the business.

Realistic capital timeline:

• Months 1–6: €100,000–€200,000 for prepping application
• Months 7–12: €150,000–€300,000 for acquiring license and setup
• Year 2: €300,000–€500,000 for operations and marketing
• Year 3+: €200,000–€400,000 per year for ongoing operations

My advice:
Secure at least 18 months’ funding from application date. Most projects fail not because of licensing, but due to thin liquidity in the start-up phase.

Mistake #7: Insufficient Market Research

The problem:
You assume an EU license grants automatic access to the entire EU market.

The reality:
Many EU countries have extra local requirements:

• Germany: Additional Interstate Gambling Treaty compliance required
• France: ARJEL license required for French market
• Italy: AAMS registration for local market
• Spain: DGOJ license for Spanish customers

Best approach:
Plan your market entry strategy country by country. The MGA license is the first step, not the finish line.

Those are the big seven. Avoid them, and your odds of MGA license success rise dramatically.

Remember: a rejected license doesn’t just cost you the €25,000 application fee. You also lose 6–12 months and must explain the rejection on any re-application.

Do it right from the very beginning.

After Getting Licensed: Ongoing Compliance Management

Congratulations—you’ve got your MGA license! But now the real work begins.

Many license holders underestimate the ongoing compliance requirements. That can get expensive fast.

The First 90 Days: Intense MGA Oversight

The MGA treats new licensees like learner drivers. They watch you very closely:

Weekly reporting requirements:

• Player registration statistics
• Deposit and withdrawal volumes
• Customer complaints and resolutions
• Technical issues and downtime reports
• AML alerts (even if zero)

Monthly deep-dive reviews:

• Financial performance vs. business plan
• Effectiveness of player protection measures
• Staff training record reviews
• Operational incident analysis

It’s time-consuming, but it shows the MGA you take compliance seriously.

Ongoing Financial Reporting Obligations

Your reporting obligations are extensive:

Key financial ratios monitored:

• Liquidity ratio: at least 1.2x monthly expenses
• Player funds coverage: 100% segregation at all times
• Regulatory capital ratio: Minimum 8% of gross gaming revenue
• Operational expense ratio: Max 85% of net gaming revenue

Ongoing AML and Player Protection

AML monitoring requirements:

Your AML duties go far beyond the application stage:

• Transaction monitoring: Auto-flag all transactions over €10,000
• Enhanced due diligence: For customers with monthly deposits over €2,000
• Suspicious activity reports: To FIAU within 72 hours
• Customer risk scoring: Ongoing review based on player behavior

Player protection monitoring:

Technical Compliance and Updates

Mandatory technical audits:

The MGA requires regular IT reviews:

• RNG testing: Semi-annually for all active games
• Security penetration tests: Quarterly by certified testers
• Data protection audits: Annually, focused on GDPR
• Disaster recovery tests: Twice a year, with documented outcomes

Software update approval process:

Every software update must be reported to the MGA:

1. Minor updates: 10 days’ prior notice
2. Major updates: 30 days + testing requirements
3. New games: Full re-certification required
4. Payment systems: Enhanced due diligence on provider

Staffing and Training Requirements

Continuous training obligations:

Your team must be trained regularly:

• AML training: Quarterly for all customer-facing staff
• Responsible gaming: Twice yearly with outside trainers
• Data protection: Yearly, with GDPR updates
• Technical security: Ongoing for IT staff

Key personnel changes:

Changes in key positions must be pre-notified to the MGA:

Annual Compliance Review

Annual compliance attestation:

Each year you must file a full compliance statement, including:

• Detailed Compliance Officer report
• External audit findings and management responses
• Updated AML risk assessment
• Player protection effectiveness review
• Technical infrastructure assessment
• Business plan performance review

Ongoing Compliance Costs

Annual compliance costs (realistic):

These are direct compliance costs—personnel and IT expenses are additional.

Measuring Success: KPIs for Sustainable Operations

Compliance KPIs you should monitor:

• Compliance incident rate: Less than 2 per quarter
• MGA response time: All requests answered within 5 business days
• Player complaint resolution: 95% within 48 hours
• AML false positive rate: Under 15% of alerts
• Technical uptime: Minimum 99.5% monthly

An MGA license is a marathon, not a sprint. Plan your compliance resources for the long haul.

Do it right: you’ll build a sustainable, profitable gaming business. Do it wrong, and you risk losing your license and facing years of legal trouble.

The choice is yours.

Frequently Asked Questions About the Malta Gaming License

How long does it really take to get an MGA license?

Realistically, plan for 9–12 months from initial preparations to license issuance. The MGA quotes a 6–9 month processing time, but that refers only to complete applications. Preparation takes an extra 3–6 months.

Can I apply for an MGA license without a Maltese presence?

No, that’s not possible. You need a registered Maltese company with genuine offices and Malta-resident key personnel. Shell companies are consistently rejected.

What if my MGA application is refused?

The €25,000 application fee is lost. You can reapply after 12 months, but must address the reasons for rejection in detail. A rejection also complicates applications in other jurisdictions.

How much capital do I actually need for an MGA license?

The minimum is €40,000 for Class 1 licenses—but realistically you’ll need €250,000–€500,000 for a successful start. Add at least €100,000 in operating capital and liquidity for 12–18 months of operations.

Can I operate all over Europe with an MGA license?

In principle, yes—but many EU countries have additional local requirements. Germany, France, Italy, and Spain require separate local licenses or registrations for their markets.

What running costs can I expect after getting licensed?

Expect €135,000–€200,000 per year just for compliance (license fees, audits, advisory). Then budget €300,000–€800,000 annually for staff, software, and marketing.

Do I really need a Malta-resident Compliance Officer?

Yes, at least one key officer must reside in Malta. The Compliance Officer must also have specific gaming qualifications (CAMS or similar) and proven industry experience.

How closely does the MGA monitor new licensees?

Very closely. The first 90 days include weekly reports and monthly reviews. Even after, monthly financial reporting and quarterly compliance updates are mandatory. Violations result in swift sanctions.

What’s the difference between Class 1 and Class 2 licenses?

Class 1 entitles you to offer games directly to end users (B2C). Class 2 is for gaming software providers and B2B services. Class 1 costs €25,000/year; Class 2 only €15,000, but comes with limited business options.

Can I use my existing gaming software for Malta?

Only if it’s certified by MGA-accredited test labs. All RNGs must be tested; every game needs a fairness certificate. Non-certified software will result in license refusal. Budget €15,000–€30,000 for software testing.