# Crypto-asset regulation and tokenization in Malta

> **Is crypto legal in Malta?** Yes. Businesses have regulated routes to operate with crypto-assets, under predictable rules. The MFSA applies MiCA and CASP authorizations are evidenced. In the Metlabs Regulatory Index it scores 95/100 and ranks 6 of 76 countries assessed (assessed October 3, 2026).

- **Author:** Javier Yáñez López, Legal & Regulatory at Metlabs
- **Last reviewed:** 2026-10-15
- **Latest regulatory change:** 2026-07-03
- **Metlabs Regulatory Index:** 95/100, rank 6 of 76 countries assessed
- **Web version:** https://metlabs.io/en/blockchain-regulation/malta/

Malta applies MiCA through the Markets in Crypto-Assets Act and MFSA supervision. The VFA transition ended in July 2026 and the former act was repealed. Financial authorization must be distinguished from MDIA technology assessment programs. Previous supervisory experience is considered alongside ESMA’s 2025 review of one particular authorization.

A business preparing a digital asset project in Malta must start from MiCA and its providers’ current authorization. The country’s VFA history is relevant background, but it no longer provides an alternative route for launching services after the transition ended and that Act was repealed.

A second essential distinction concerns technology assessment and financial permission. Technical recognition or sandbox participation does not determine the investor’s rights or itself authorize asset issuance, custody or trading.

## How MiCA replaced the VFA service route

Malta combines the directly applicable [MiCA Regulation](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica) with the [Markets in Crypto-Assets Act](https://www.parlament.mt/media/130887/act-xxxvi-markets-in-crypto-assets-acts.pdf), adopted as Act XXXVI of 2024. The framework distinguishes crypto-asset offerings, ART and EMT issuers and crypto-asset service providers (CASPs). Malta came to MiCA with prior experience: the MFSA describes its 2018 VFA regime as similar to the European regulation, and the ESMA register lists Maltese CASP authorizations from January 27, 2025, among the first in the European Union. Tokenized financial instruments fall outside MiCA and require assessment of the corresponding securities, investment and infrastructure rules.

Article 58 provided a transition for previously licensed VFA providers, using the full eighteen-month maximum permitted by the European regulation. Its deadline was July 1, 2026, or the earlier grant or refusal of MiCA authorization. The [Virtual Financial Assets Act](https://legislation.mt/eli/cap/590/eng/pdf) was repealed on July 3, 2026. Historical experience under the VFA regime does not make it a second current authorization route alongside MiCA. The repeal was also complete: there is no evidence that Malta retains a national regime of its own for crypto-assets falling outside MiCA.

## What the MFSA decides and what MDIA assesses

The [Malta Financial Services Authority, MFSA](https://www.mfsa.mt/our-work/crypto-assets/), is the competent authority under the national MiCA framework. It publishes rules, forms and provider reporting obligations. The Financial Intelligence Analysis Unit, FIAU, acts in anti-money laundering and counter-terrorist financing. Their coordination does not remove providers' responsibility to demonstrate effective controls for their business and clients.

The Malta Digital Innovation Authority, MDIA, performs technology assessment functions. Its [Technology Assessment Recognition Framework](https://mdia.gov.mt/services/technology-assessment-recognition-framework/) distinguishes levels of solution recognition and assurance. Assessment outcomes must be described within their technical scope. They are not financial services authorization, issuance approval or a guarantee that token holders can enforce rights over an asset.

## Applying for current entitlement

Providers must identify their intended MiCA services and obtain the corresponding authorization or comply with Article 60 for certain financial entities. The [MFSA transition documentation published in December 2024](https://www.mfsa.mt/wp-content/uploads/2024/12/Circular-to-the-Industry-on-the-Authorisation-Process-for-MiCA-Applicants.pdf) required action and assessment from former VFA licensees too. Participation in that regime did not produce automatic conversion or remove European requirements.

Cross-border operations use MiCA procedures and remain limited to permitted services. The contracting entity, its authorization and covered activities must be identified. ART and EMT issuers follow distinct procedures; EMT issuance in particular requires the status and obligations prescribed for credit or electronic money institutions. A platform providing several services may need multiple regulatory assessments.

The MFSA operates a [Regulatory Sandbox](https://www.mfsa.mt/fintech/regulatory-sandbox/) for innovative solutions requiring testing under defined conditions. Eligibility, readiness and user protection must be examined. Admission or supervisory dialogue must not be described as general approval for any product or as exemption from European rules applicable to the activity.

## Distinguishing the token from its financial rights

Instrument classification precedes network or smart contract selection. Where a token represents shares, debt or another financial instrument, applicable issuance, offering, intermediation and custody obligations must be assessed. Technical system assessment and legal product classification answer different questions; neither replaces documentation of investor rights.

The [EU DLT Pilot Regime](https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/dlt-pilot-regime) provides specific permissions for trading and settlement infrastructures. Its availability alone does not authorize a Maltese company to operate an infrastructure. Real asset projects must connect tokens to identifiable rights, with transfer, security and enforcement arrangements. Control of a private key does not automatically establish ownership of the represented property or asset.

## Operating requirements under supervision

Applications and operations must address governance, asset protection, conflicts, outsourcing and continuity. [MFSA financial crime compliance material](https://www.mfsa.mt/our-work/financial-crime-compliance/) supports assessment of due diligence and controls. DORA and transfer information rules require analysis according to their applicable scope, as does the tax obligation to identify clients’ residence and report information on their transactions under the EU administrative cooperation directive for crypto-assets (DAC8), which Malta implemented through [L.N. 162 of 2026](https://legislation.mt/eli/ln/2026/162/eng/pdf) with effect from January 1, 2026. Outsourcing custody or technology infrastructure does not remove the authorized provider's own responsibilities.

The [ESMA review of July 10, 2025](https://www.esma.europa.eu/press-news/esma-news/esma-identifies-opportunities-strengthen-mica-authorisations) examined the authorization and early supervision of one Maltese CASP. It identified material matters not fully resolved at the time of authorization, while recognizing good resources, expertise and cooperation. For an applicant, the most useful part is the list of areas ESMA asks all national competent authorities to examine in detail: business plan and adequacy of resources for growth, conflicts of interest, governance and intragroup arrangements, ICT architecture in light of DORA, with attention to critical functions such as custody, and Web3 services, decentralized products and the promotion of unregulated services. In the Maltese file, ESMA found no evidence that the booking model, custody and certain money laundering risks, among other matters, had been adequately assessed.

The MFSA accepted the findings and committed to taking the recommendations on board; ESMA asked it to examine the material issues still pending in the authorized file. The review did not declare that authorization invalid and did not address other Maltese licenses.

## Preparing a Maltese authorization application

The application should connect asset classification with the permission sought from the MFSA and the controls the firm can actually perform. Governance, custody, anti-money laundering and outsourcing documentation must describe the specific business rather than rely on the country’s regulatory history.

For tokenized securities, assess issuance and investment services, plus DLT infrastructure permission where applicable. MDIA recognition or sandbox admission can provide technology assessment, but must remain separate from financial authorization and the holder’s contractual rights. The ongoing European review should also be monitored: on December 4, 2025, the Commission put forward a proposal for a regulation, COM(2025) 943, that would transfer to ESMA the authorization and supervision of crypto-asset service providers, except credit institutions and Article 60 entities. It remains a proposal under negotiation and is not law in force.

## Key takeaways

- Former VFA licensing is not a current alternative to MiCA authorization. Following repeal of the VFA Act, there is no evidence of a national regime for crypto-assets outside MiCA.
- The MFSA supervises the financial framework; MDIA technology assessment serves a different purpose.
- ESMA’s 2025 review identified deficiencies in one application and recognized supervisory capabilities; it did not declare the authorization invalid.
- CASP authorization does not automatically permit tokenized securities services or EMT issuance.

## Regulatory milestones

- **2024-12-30** — General MiCA application. General application of the European services and offerings framework begins, with a limited transition for former VFA providers. (source: [ESMA · MiCA](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica))
- **2025-01-27** — First CASP authorizations in Malta. The MFSA grants its first MiCA authorizations to crypto-asset service providers, which are listed in the ESMA register. (source: [ESMA · Interim MiCA register of CASPs](https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv))
- **2025-07-10** — ESMA review of one authorization. ESMA publishes the findings of its fast-track review of a CASP application and early supervision. The improvement recommendations are addressed to all national competent authorities authorizing CASPs. (source: [ESMA · 2025 review](https://www.esma.europa.eu/press-news/esma-news/esma-identifies-opportunities-strengthen-mica-authorisations))
- **2026-07-01** — End of VFA transition. The transitional deadline for services under the former regime, set at the European maximum, expires. (source: [Malta · Act XXXVI 2024](https://www.parlament.mt/media/130887/act-xxxvi-markets-in-crypto-assets-acts.pdf), [MFSA · MiCA procedure](https://www.mfsa.mt/wp-content/uploads/2024/12/Circular-to-the-Industry-on-the-Authorisation-Process-for-MiCA-Applicants.pdf))
- **2026-07-03** — Virtual Financial Assets Act repealed. The repeal provided by Article 64 of the 2024 national act takes effect. (source: [Malta · Act XXXVI 2024](https://www.parlament.mt/media/130887/act-xxxvi-markets-in-crypto-assets-acts.pdf), [Malta · VFA Act repealed](https://legislation.mt/eli/cap/590/eng/pdf))

## Frequently asked questions

### Can a VFA license still be sought as an alternative to MiCA?

It is not a current route. The transition for former providers ended on July 1, 2026, and the Virtual Financial Assets Act was repealed on July 3. Current MiCA entitlement or the product’s applicable rules must be assessed.

### Does the ESMA review invalidate all Maltese authorizations?

No. The July 2025 review examined one authorization and early supervision case. It identified deficiencies and supervisory capabilities and made improvement recommendations. Its scope does not establish general license invalidity.

### Does VFA repeal erase earlier obligations?

Article 64 of Act XXXVI of 2024 sets repeal for July 3, 2026, without prejudice to anything done or omitted under the former Act. Earlier activity cannot be treated as if it had never been regulated. Malta · Act XXXVI 2024.

### Does MDIA recognition replace MFSA authorization?

No. The Technology Assessment Recognition Framework assesses technology solutions. Financial assessment and permissions still depend on the project’s assets and services. MDIA · TARF.

### Was converting a VFA license into MiCA automatic?

No. The MFSA circular distinguishes licensed firms from pending applicants and requires the relevant authorization process. Previous experience does not replace MiCA assessment. MFSA · MiCA procedure.

## How to cite this guide

Yáñez López, J. (2026, October 15). Crypto-asset regulation and tokenization in Malta. Metlabs. https://metlabs.io/en/blockchain-regulation/malta/