Frequently asked questions
What is the minimum capital required for a CASP licence in Malta, and does it depend on the services I offer?
Yes — the required minimum is determined by MiCA Article 67 and Annex IV. There are three cumulative classes: Class 1 (€50,000) covers advisory, reception and transmission of orders, execution, placing, portfolio management, and transfer services; Class 2 (€125,000) covers all Class 1 services PLUS custody and administration of crypto-assets on behalf of clients, and exchange services (for funds or other crypto-assets); Class 3 (€150,000) applies to operation of a trading platform. You pay the highest class that applies to your service scope — once, not cumulatively. You must also hold at least one quarter of your annual fixed overheads if that amount exceeds the class minimum. Important: if your business involves custody or transfer of e-money tokens (EMTs), you may also face PSD2 Article 7 initial capital requirements in parallel — the two regimes are not interchangeable.
Does the MiCA capital requirement have to be held as cash (CET1 own funds), or are there alternatives?
Own funds qualifying as Common Equity Tier 1 under Articles 26–30 of CRR (Regulation (EU) No 575/2013) is the most common route and the one most banks and institutional partners expect to see. However, Article 67(4) of MiCA expressly permits two alternatives — either individually or in combination with own funds: (b) an insurance policy covering the territories of the EU where services are provided, meeting the characteristics in Article 67(5) and (6); or (c) a comparable guarantee. The MFSA application under Commission Delegated Regulation (EU) 2025/305 requires you to specify which form(s) you are relying on and provide supporting documentation (bank certificate for own funds; signed insurance agreement for the insurance route).
How long does the MFSA CASP authorisation process take in 2026?
In practice, expect 6–9 months from formal application submission to final authorisation — materially faster than Germany (12–24 months) or France. The MiCA statutory timeline requires MFSA to acknowledge receipt within 5 working days and issue a decision within 25 working days of confirming completeness. However, every information request or clarification round resets or extends that clock by 4–6 weeks. Before formal submission, add 1–2 months for the pre-application Stage (Statement of Intent, legal opinion, MFSA meeting) and a further 1–2 months for document preparation. A well-prepared, complete file is the single biggest lever for a faster outcome.
Does a Malta CASP licence let me operate in all EU countries without further applications?
Yes — but it is not automatic. A Malta CASP authorisation covers all 30 EEA states (the 27 EU Member States plus Iceland, Liechtenstein and Norway) via the passporting mechanism in Article 65 of MiCA. You must notify the MFSA for each host state where you intend to provide services, using either the cross-border services route (Article 65(2)) or the branch establishment route (Article 65(4)). MFSA then forwards the notification to the host NCA within 15 working days. Passporting does not exempt you from local AML/CFT law or host-state consumer protection requirements in each target market. The Malta passport also does not extend to the UK, which requires separate FCA authorisation.
What are the ongoing obligations after receiving a CASP licence from the MFSA?
Once authorised, CASPs face continuous obligations including: maintaining ongoing own funds at the required level (re-calculated annually against the fixed overheads test); annual reporting to MFSA (audited financial statements, audited CFASP Return, IT audit report and external auditor's report — all due within six months of financial year-end); continuous AML/CFT compliance under FIAU oversight; Travel Rule compliance for crypto-asset transfers under Regulation (EU) 2023/1113; DORA digital operational resilience requirements; and notifying MFSA of any material changes to the business, governance, or qualifying shareholding before implementation. Key personnel changes (e.g. new Compliance Officer, MLRO) require prior MFSA approval.
Can a non-EU company obtain a CASP licence in Malta, and what substance does the MFSA require?
Yes — a non-EU firm can incorporate a Maltese company (a mandatory step) and apply for a CASP licence through that entity. MiCA requires the CASP to have its registered office in Malta and to conduct at least part of its crypto-asset services from that office. The MFSA expects demonstrable substance from the point of authorisation: a real operational presence, not a letter-box. In practice this means local staff in relevant functions (compliance, AML, IT oversight), active management in Malta, and at least one EU-resident director. The MFSA has stated it expects substance to be demonstrable at application submission, not planned for post-authorisation.