COREDO – EU Legal & Compliance Services Expert legal consulting, financial licensing (EMI, PSP, CASP under MiCA), and AML/CFT compliance across the European Union. Headquartered in Prague, we provide seamless regulatory solutions in Germany, Poland, Lithuania, and all 27 EU member states.
Nikita Veremeev
08.09.2025 | 6 min read
Updated: 14.10.2026
Regulation of cryptocurrency exchanges in Malta now rests on the EU-wide MiCA Regulation, and supervision lies with the MFSA (Malta Financial Services Authority). The Regulation has applied since 30 December 2024, and the transitional period for Maltese VFA licenses ended on 30 June 2026. A new crypto exchange therefore needs authorisation from the MFSA as a crypto-asset service provider (CASP). Below we explain what this means for your project: requirements, capital, procedure and access to the EU market.
The VFA Act: What Is Now History
Before MiCA, Maltese crypto companies operated under the Virtual Financial Assets Act (Chapter 590). Under it, the MFSA issued licenses for VFA services. Companies holding such a license on 30 December 2024 could continue only during a transitional period. The VFA Act was repealed on 3 July 2026, so a new project cannot be built on it.
COREDO's practice confirms: Proper token qualification at the stage of preparing the white paper and business model is key to successful licensing and reducing regulatory risks. Today the white paper is drawn up under MiCA rules, not under the VFA Act.
The Role of the MFSA and the FIAU in Cryptocurrency Exchange Regulation
The MFSA (Malta Financial Services Authority) is Malta's competent authority for all purposes of MiCA (Art. 4 of Chapter 647). Licensing of crypto exchanges in Malta now means CASP authorisation: the MFSA receives applications, grants authorisation and supervises. On AML matters the FIAU (Financial Intelligence Analysis Unit) is also involved: suspicious transactions are reported to it.
The COREDO team has repeatedly encountered situations where the integration of innovative technologies (for example, KYC automation through smart contracts) required approval from the MFSA. Under MiCA, such solutions are described already in the application, which includes the technical documentation of the ICT systems and security arrangements (Art. 62(2) MiCA).
Licenses for Cryptocurrency Exchanges in Malta
A license for a cryptocurrency exchange in Malta today means CASP authorisation under MiCA. Only a CASP authorised under Art. 63 MiCA, or a financial entity that has notified the regulator under Art. 60 MiCA, may provide crypto-asset services in Malta (Art. 26 of Chapter 647). A new crypto exchange with its registered office in Malta is authorised by the MFSA. An exchange usually combines several services from Art. 3(1)(16) MiCA: operating a trading platform, exchanging crypto-assets for funds or other crypto-assets, and custody of clients' crypto-assets.
CASP Classes under MiCA and Minimum Capital
| CASP class | Services | Recommended For | Minimum capital |
|---|---|---|---|
| Class 1 | Execution, reception and transmission of orders, placing, advice, portfolio management, transfer services | Brokers, advisers, portfolio managers | EUR 50,000 |
| Class 2 | Class 1 services plus custody and administration, exchange of crypto-assets for funds or other crypto-assets | Exchange services, custodians | EUR 125,000 |
| Class 3 | Class 2 services plus operation of a trading platform for crypto-assets | Cryptocurrency exchanges | EUR 150,000 |
A crypto exchange that operates a trading platform needs Class 3. Capital is the higher of two amounts: the minimum under Annex IV or one quarter of the previous year's fixed overheads (Art. 67 MiCA). It may be held as own funds, an insurance policy or a comparable guarantee.
Obtaining a Cryptocurrency License: Steps
Obtaining a cryptocurrency license in Malta is a multi-step process requiring strategic planning. In practice, COREDO recommends the following step-by-step approach:
- Defining the services under Art. 3(1)(16) MiCA and the capital class. For an exchange, this is usually Class 3.
- Preparing the documents under Art. 62(2) MiCA: programme of operations, governance arrangements, AML/KYC policies, ICT documentation, trading platform rules and custody policy.
- Submitting the application to the MFSA: it includes Due Diligence of the members of the management body and of shareholders with qualifying holdings, as well as proof of prudential safeguards.
- Review of the application: the MFSA assesses its completeness within 25 working days and decides within 40 working days of receiving a complete application (Art. 63 MiCA). The period is suspended while additional information is requested, but for no more than 20 working days.
- Obtaining CASP authorisation and starting operations. For other EU countries, notifying the MFSA under Art. 65 MiCA.
In COREDO's work, special attention is paid to capital requirements. Before MiCA, an exchange's capital was set by the VFA rules, and those amounts no longer apply. Today the minimum for a trading platform is EUR 150,000 under Annex IV MiCA, unless one quarter of fixed overheads is higher.
Requirements for Governance and Presence in Malta
To apply to the MFSA, a company needs a registered office in Malta. The application goes to the authority of the home Member State, which for a CASP is the country of its registered office (Art. 3(1)(33) and 62(1) MiCA). In addition, at least part of the services is provided in that country, the place of effective management is in the EU, and at least one director is resident in the EU (Art. 59(2)). The application describes internal control, risk management and regular financial monitoring for AML purposes.
A solution developed by COREDO provides for the automation of reporting, the integration of risk management tools, and the introduction of internal audits, ensuring compliance not only with Maltese but also European regulatory standards.
AML for Cryptocurrency Exchanges in Malta
AML for cryptocurrency exchanges in Malta is not a formality but a condition for keeping the authorisation. The MFSA must withdraw a CASP's authorisation if it lacks effective systems, procedures and arrangements to detect and prevent money laundering (Art. 64(1) MiCA). AML and KYC mechanisms also protect the business itself: they help build long-term trust among users and partners.
AML/KYC and Financial Monitoring: What It Is
In their letter of 25 June 2026, the MFSA and the FIAU reminded CASPs of their onboarding obligations: customer due diligence and national AML/CFT requirements. Special attention goes to clients moving from virtual asset service providers (VASPs) that are winding down. Suspicions of money laundering or terrorist financing are reported to the FIAU.
COREDO's experience shows that the best AML practices for cryptocurrency exchanges in Malta include integrating AI solutions for transaction analysis, personnel training, and constantly updating procedures. These updates follow the recommendations of FATF and the MFSA strategic plan.
The implementation of such measures not only enhances the efficacy in combating financial crime but also minimizes risks of legal violations, the responsibility for which we will consider further.
Liability for AML/KYC Violations
A breach of the national law transposing Directive (EU) 2015/849 is a ground for withdrawing CASP authorisation (Art. 64(2) MiCA). A CASP reports to the FIAU suspicious transactions that may involve financial crimes. That is why AML/KYC procedures are best checked before the application, not after the first MFSA inspection.
In COREDO's practice, there were cases where timely implementation of additional compliance procedures and the legal protection of crypto business allowed avoiding sanctions and maintaining client trust, even under tightened regulatory requirements.
MiCA and Crypto Asset Regulation in Europe
MiCA is Regulation (EU) 2023/1114 on markets in crypto-assets, which applies directly in all EU countries. It has applied since 30 December 2024, and its titles on asset-referenced tokens (ARTs) and e-money tokens (EMTs) since 30 June 2024 (Art. 149 MiCA). National law designates the supervisory authority and lays down procedures, supervisory powers and liability.
Harmonization of Malta's Legislation with MiCA
Malta implemented MiCA through the Markets in Crypto-Assets Act (Chapter 647). It was enacted by Act XXXVI of 2024 and amended by Act XI of 2025. The same Act added transitional articles to the VFA Act and repealed it on 3 July 2026. Companies licensed under the VFA Act on 30 December 2024 could operate until 1 July 2026 or until an earlier MFSA decision on their CASP application (Art. 58 of Chapter 647). Their applications filed between 30 December 2024 and 1 July 2026 followed a simplified procedure, but the MFSA verified compliance with MiCA's requirements for CASPs. VFA licenses ended with the decision on the CASP application, and the remaining ones automatically on 2 July 2026. In the ESMA list, Malta's transitional period is 18 months.
The MFSA and FIAU letter of 25 June 2026 drew the line: the transitional measures under Art. 143(3) MiCA, as implemented in Art. 66 of the VFA Act, expire on 30 June 2026. From 1 July 2026, VASP clients do not benefit from MiCA safeguards. The MFSA expects operational VASPs without CASP authorisation to wind down their activities in an orderly way. They may keep clients' crypto-assets in custody only for the period strictly necessary for an orderly exit.
The Impact of MiCA on the Operation of Cryptocurrency Exchanges
For a crypto exchange, MiCA means specific obligations. The platform operator adopts clear and transparent operating rules, does not deal on own account on its own platform and publishes the price, volume and time of executed transactions (Art. 76 MiCA). These compliance requirements are described already in the application under Art. 62(2).
The main advantage of MiCA is a single passport. A CASP authorised in Malta may provide services throughout the EU through a branch or under the freedom to provide services, without a physical presence in the host country (Art. 59(7) MiCA).
Regulation of Cryptocurrency Exchanges: Technology and Innovation
MiCA does not prohibit new technologies for crypto exchanges, but requires them to be described and controlled. The application includes the technical documentation of the ICT systems and security arrangements (Art. 62(2) MiCA). The balance between legal requirements and technological capabilities forms new rules for the crypto business.
Testing Technology Before the Application
New solutions, such as smart contracts for settlements or KYC, are best tested before the application. Then the description in the documents will match how the system really works, and the regulator will find it easier to assess.
In one of COREDO's cases, the integration of smart contracts for automating settlements and KYC procedures was successfully tested in the sandbox, accelerating licensing and reducing costs for platform launch.
AI and Technologies in Compliance and Oversight
AI helps analyse transactions, detect anomalies and automate reporting. But responsibility for decisions stays with the CASP, so models need to be built into the internal control and risk management system. Such technologies reduce the human factor in financial monitoring, but do not replace it.
COREDO's solutions employ hybrid models that combine machine learning and expert analytics, ensuring business sustainability and conformity to the strictest cryptocurrency regulation standards.
Cryptocurrency License in Malta: Advantages
A Maltese cryptocurrency license in the form of CASP authorisation opens access to the whole EU market. Its main advantages are uniform MiCA rules, a passport for other EU countries and clear capital requirements.
Let us start with taxes, where expectations are most often too high.
Taxes: What CASP Authorisation Does Not Provide
CASP authorisation is a permission from the financial regulator, and it does not by itself grant any tax benefits. The company's tax and payments to shareholders are governed by Maltese tax law. The effective rate for your structure is best calculated with a tax adviser before the exchange launches.
COREDO's practice shows that well-structured business planning allows not only optimizing taxation but also enhancing ROI for crypto businesses through investment incentives.
How to Scale the Business and Ensure Sustainability?
To operate in other EU countries, a CASP sends the MFSA a list of countries and services, the starting date and a list of its other activities (Art. 65(1) MiCA). The MFSA forwards this information to the host countries, ESMA and the EBA within 10 working days. The CASP may start once notified by the MFSA, and at the latest from the 15th calendar day after submitting the information.
The COREDO team supports projects at all stages: from piloting to scaling, implementing business risk management tools and ensuring transparency for investors.
Tokens and ICOs in Malta under MiCA
MiCA regulates the issuance of tokens and their admission to trading separately from CASP services. For crypto-assets other than ARTs and EMTs, a white paper is drawn up and notified to the MFSA where Malta is the home Member State (Art. 6 of Chapter 647). Such a white paper does not require prior MFSA approval (Art. 5 of Chapter 647).
Tokens, White Papers and the Former VFA Rules
Articles 3–13 of the VFA Act, including white paper registration under Art. 3(4), ceased to have effect as from 30 December 2024 (Art. 65 of the VFA Act as amended by Chapter 647). Crypto-assets that qualify as financial instruments fall outside Chapter 647 (Art. 3(3) of Chapter 647). That is why a token's qualification is checked before issuance.
COREDO's completed projects include obtaining licenses for investment exchanges and cryptocurrency service providers, allowing clients to legally issue and trade tokenized assets.
Investors' Rights Protection
MiCA protects clients through the obligations of the CASP itself. If it holds clients' crypto-assets, it must safeguard their ownership rights, especially in the event of its insolvency, and must not use those assets for its own account (Art. 70(1) MiCA). It places clients' funds with a credit institution or a central bank by the end of the next business day (Art. 70(3)).
COREDO's experience shows that timely implementation of legal support tools and continuous dialogue with the regulator helps minimize risks and increase investor trust.
Cryptocurrency License in Malta: How to Obtain
For an international company, obtaining a cryptocurrency license in Malta requires a clear strategy and staged compliance implementation. In practice, COREDO recommends:
- Conduct a preliminary audit of the business model: which services under Art. 3(1)(16) MiCA you provide and which capital class you need.
- Register the company in Malta and set up governance: the place of effective management in the EU and at least one director resident in the EU.
- Prepare the document package under Art. 62(2) MiCA, including AML/KYC policies, ICT documentation, platform rules and custody policy.
- Ensure capital under Art. 67 MiCA and implement internal control procedures.
- Choose a reliable partner for the licensing process support and subsequent compliance.
Recommendations for Entrepreneurs
Regulation of cryptocurrency exchanges in Malta today means MiCA: CASP authorisation from the MFSA, capital under Annex IV and a single EU passport. For an exchange, plan for Class 3, an office in Malta and a full document package under Art. 62. A VFA license no longer gives the right to operate: the VFA Act was repealed on 3 July 2026.
COREDO's practice confirms: success in this jurisdiction requires not only knowledge of the regulatory framework but also the ability to establish effective corporate governance processes, integrate innovative technologies, and respond flexibly to changing regulatory environments.
Regulation and Licensing of Cryptocurrency Exchanges in Malta
What strategic advantages does the MFSA-issued cryptocurrency exchange license provide?
CASP authorisation from the MFSA allows operating in Malta and, after notification under Art. 65 MiCA, in other EU countries. It does not by itself grant tax benefits.
CASP authorisation from the MFSA allows operating in Malta and, after notification under Art. 65 MiCA, in other EU countries. It does not by itself grant tax benefits.
What are the key Stages for Obtaining a License (CASP Authorisation) for a Cryptocurrency Exchange in Malta?
Choosing services and capital class, registering the company in Malta, the package under Art. 62 MiCA, the MFSA application, the completeness check within 25 working days and the decision within 40 working days.
Choosing services and capital class, registering the company in Malta, the package under Art. 62 MiCA, the MFSA application, the completeness check within 25 working days and the decision within 40 working days.
What risks and challenges may arise when licensing a cryptocurrency exchange in Malta?
The main risks are an incomplete application, insufficient capital under Art. 67, weak AML/KYC procedures and a management body that does not meet the requirements of good repute and experience.
The main risks are an incomplete application, insufficient capital under Art. 67, weak AML/KYC procedures and a management body that does not meet the requirements of good repute and experience.
How does AML/KYC regulation in Malta affect the operational processes of a cryptocurrency exchange?
It requires the implementation of automated monitoring systems, regular staff training, and constant updating of internal policies.
It requires the implementation of automated monitoring systems, regular staff training, and constant updating of internal policies.
What tax advantages are available to cryptocurrency exchanges with a Maltese license?
CASP authorisation does not by itself grant tax benefits. The tax model of the company and its shareholders is calculated under Maltese tax law before launch.
CASP authorisation does not by itself grant tax benefits. The tax model of the company and its shareholders is calculated under Maltese tax law before launch.
What impact does MiCA integration have on a cryptocurrency exchange's business model?
The transitional period ended on 30 June 2026: crypto-asset services in Malta now require MiCA authorisation or a notification under Art. 60. In return, MiCA provides a single EU passport.
The transitional period ended on 30 June 2026: crypto-asset services in Malta now require MiCA authorisation or a notification under Art. 60. In return, MiCA provides a single EU passport.
How to ensure long-term sustainability and scaling of a cryptocurrency exchange under Maltese regulation?
Implement risk management tools, automate compliance, invest in innovative technologies, and maintain constant dialogue with the regulator.
Implement risk management tools, automate compliance, invest in innovative technologies, and maintain constant dialogue with the regulator.
What corporate governance requirements are imposed on a cryptocurrency exchange in Malta?
A registered office in Malta, the place of effective management in the EU, at least one director resident in the EU, a management body of good repute and experience, and internal control.
A registered office in Malta, the place of effective management in the EU, at least one director resident in the EU, a management body of good repute and experience, and internal control.
What risk management practices are recommended for Maltese cryptocurrency exchanges?
Using AI for transaction monitoring, regular stress testing of the business model, implementation of reporting automation tools.
Using AI for transaction monitoring, regular stress testing of the business model, implementation of reporting automation tools.
What are the consequences of violating AML/KYC requirements for a cryptocurrency exchange in Malta?
Withdrawal of authorisation under Art. 64 MiCA and loss of client trust.
Withdrawal of authorisation under Art. 64 MiCA and loss of client trust.
If your business is focused on international growth, transparency, and long-term sustainability, choosing Malta and strategic partnership with COREDO becomes the optimal solution for an effective entry into the digital assets market.