Crypto-asset regulation and tokenization in Malta

A business preparing a digital asset project in Malta must start from MiCA and its providers’ current authorization. The country’s VFA history is relevant background, but it no longer provides an alternative route for launching services after transition ended and that Act was repealed.

A second essential distinction concerns technology assessment and financial permission. Technical recognition or sandbox participation does not determine the investor’s rights or itself authorize asset issuance, custody or trading.

How MiCA replaced the VFA service route

Malta combines the directly applicable MiCA Regulation with the Markets in Crypto-Assets Act, adopted as Act XXXVI of 2024. The framework distinguishes crypto-asset offerings, ART and EMT issuers and crypto-asset service providers (CASPs). Malta came to MiCA with prior experience: the MFSA describes its 2018 VFA regime as similar to the European regulation, and the ESMA register lists Maltese CASP authorizations from 27 January 2025, among the first in the European Union. Tokenized financial instruments fall outside MiCA and require assessment of the corresponding securities, investment and infrastructure rules.

Article 58 provided a transition for previously licensed VFA providers, using the full eighteen-month maximum permitted by the European regulation. Its deadline was 1 July 2026, or the earlier grant or refusal of MiCA authorization. The Virtual Financial Assets Act was repealed on 3 July 2026. Historical experience under the VFA regime does not make it a second current authorization route alongside MiCA. The repeal was also complete: there is no evidence that Malta retains a national regime of its own for crypto-assets falling outside MiCA.

What the MFSA decides and what MDIA assesses

The Malta Financial Services Authority, MFSA, is the competent authority under the national MiCA framework. It publishes rules, forms and provider reporting obligations. The Financial Intelligence Analysis Unit, FIAU, acts in anti-money laundering and counter-terrorist financing. Their coordination does not remove providers' responsibility to demonstrate effective controls for their business and clients.

The Malta Digital Innovation Authority, MDIA, performs technology assessment functions. Its Technology Assessment Recognition Framework distinguishes levels of solution recognition and assurance. Assessment outcomes must be described within their technical scope. They are not financial services authorization, issuance approval or a guarantee that token holders can enforce rights over an asset.

Applying for current entitlement

Providers must identify their intended MiCA services and obtain the corresponding authorization or comply with Article 60 for certain financial entities. The MFSA transition documentation published in December 2024 required action and assessment from former VFA licensees too. Participation in that regime did not produce automatic conversion or remove European requirements.

Cross-border operations use MiCA procedures and remain limited to permitted services. The contracting entity, its authorization and covered activities must be identified. ART and EMT issuers follow distinct procedures; EMT issuance in particular requires the status and obligations prescribed for credit or electronic money institutions. A platform providing several services may need multiple regulatory assessments.

The MFSA operates a Regulatory Sandbox for innovative solutions requiring testing under defined conditions. Eligibility, readiness and user protection must be examined. Admission or supervisory dialogue must not be described as general approval for any product or as exemption from European rules applicable to the activity.

Distinguishing the token from its financial rights

Instrument classification precedes network or smart contract selection. Where a token represents shares, debt or another financial instrument, applicable issuance, offering, intermediation and custody obligations must be assessed. Technical system assessment and legal product classification answer different questions; neither replaces documentation of investor rights.

The EU DLT Pilot Regime provides specific permissions for trading and settlement infrastructures. Its availability alone does not authorize a Maltese company to operate an infrastructure. Real asset projects must connect tokens to identifiable rights, with transfer, security and enforcement arrangements. Control of a private key does not automatically establish ownership of the represented property or asset.

Operating requirements under supervision

Applications and operations must address governance, asset protection, conflicts, outsourcing and continuity. MFSA financial crime compliance material supports assessment of due diligence and controls. DORA and transfer information rules require analysis according to their applicable scope, as does the tax obligation to identify clients’ residence and report information on their transactions under the EU administrative cooperation directive for crypto-assets (DAC8), which Malta implemented through L.N. 162 of 2026 with effect from 1 January 2026. Outsourcing custody or technology infrastructure does not remove the authorized provider's own responsibilities.

The ESMA review of 10 July 2025 examined the authorization and early supervision of one Maltese CASP. It identified material matters not fully resolved at the time of authorization, while recognizing good resources, expertise and cooperation. For an applicant, the most useful part is the list of areas ESMA asks all national competent authorities to examine in detail: business plan and adequacy of resources for growth, conflicts of interest, governance and intragroup arrangements, ICT architecture in light of DORA, with attention to critical functions such as custody, and Web3 services, decentralized products and the promotion of unregulated services. In the Maltese file, ESMA found no evidence that the booking model, custody and certain money laundering risks, among other matters, had been adequately assessed.

The MFSA accepted the findings and committed to taking the recommendations on board; ESMA asked it to examine the material issues still pending in the authorized file. The review did not declare that authorization invalid and did not address other Maltese licenses.

Preparing a Maltese authorization application

The application should connect asset classification with the permission sought from the MFSA and the controls the firm can actually perform. Governance, custody, anti-money laundering and outsourcing documentation must describe the specific business rather than rely on the country’s regulatory history.

For tokenized securities, assess issuance and investment services, plus DLT infrastructure permission where applicable. MDIA recognition or sandbox admission can provide technology assessment, but must remain separate from financial authorization and the holder’s contractual rights. The ongoing European review should also be monitored: on 4 December 2025 the Commission put forward a proposal for a regulation, COM(2025) 943, that would transfer to ESMA the authorization and supervision of crypto-asset service providers, except credit institutions and Article 60 entities. It remains a proposal under negotiation and is not law in force.

To understand how this framework applies to your project, discuss your case with our team.