Crypto License in Malta

1. Preliminary Consultation and Strategic Planning

1. Engage Local Experts:

• Start by consulting legal, tax, and compliance professionals familiar with Malta’s fintech regulations and the Virtual Financial Assets (VFA) Act.
• An early assessment of your business model ensures you choose the correct VFA license class (Class 1, 2, 3, or 4) and structure your operations in line with MFSA expectations.

2. Define Corporate Goals:

• Clarify the scope of your crypto activities, whether you aim to run a VFA exchange, brokerage, or crypto advisory firm.
• Consider future expansions, such as adding other digital asset services, which may affect licensing requirements.

2. Company Incorporation in Malta

1. Select a Legal Entity:

• Typically, you will need to establish a limited liability company in Malta or register a branch of an existing foreign entity.
• Ensure your Memorandum & Articles of Association reflect the crypto-focused objectives and comply with MFSA rules.

2. Secure Registered Office & Local Presence:

• A physical office in Malta is mandatory for all VFA license applicants.
• You must also appoint at least two directors who meet the “fit and proper” standards.

3. Determine VFA Class and Minimum Capital Requirements

1. Match Your Activities to VFA Class:

• Class 1: Execution or transmission of orders without holding client assets.
• Class 2: May hold or control client assets (no proprietary trading).
• Class 3: Can deal on your own account, including market-making.
• Class 4: Full crypto exchange license with the authority to store client funds and execute all VFA services.

2. Capital Considerations:

• Depending on the license class, you need to allocate capital ranging from relatively modest amounts up to EUR 730,000 (commonly for Class 4).

4. Compile Documentation and Internal Policies

1. Business Plan & Financial Projections:

• Draft a comprehensive plan detailing revenue models, market analysis, operational strategy, and crypto asset risk assessment.
• Include financial forecasts for at least three years.

2. AML/CFT Procedures:

• Implement robust anti-money laundering (AML) and counter-terrorism financing (CFT) systems.
• Outline processes for customer due diligence, transaction monitoring, and Know Your Customer (KYC) checks.

3. IT Infrastructure & Security Framework:

• Demonstrate how you will safeguard client data, wallets, and transaction records.
• Provide a cybersecurity policy addressing encryption, access controls, and data backups.

4. Compliance Manuals & Internal Controls:

• Prepare a compliance manual covering all relevant MFSA guidelines, including market abuse prevention and reporting obligations.
• Adopt clear roles and responsibilities for compliance officers and senior management.

5. Appointment of Key Personnel

1. Directors and Senior Management:

• You must have at least two fit and proper directors with the requisite experience in finance or fintech.
• Each director undergoes an integrity check and must adhere to MFSA conduct requirements.

2. AML/KYC Officer and Compliance Officer:

• These roles are crucial for ensuring ongoing adherence to MFSA and FIAU (Financial Intelligence Analysis Unit) standards.
• The officers must have relevant qualifications and be based in Malta or have a substantive presence.

3. Risk Management & IT Security Roles:

• Larger crypto firms often employ a dedicated risk manager and IT security officer to meet heightened oversight obligations.

6. Submit Your Application to the MFSA

1. Prepare Application Package:

• Consolidate your business plan, internal policies, financials, and all required forms.
• Include evidence of paid-up share capital and proof of local presence.

2. Pay Filing Fee:

• When applying for a crypto license (especially a Class 4), be prepared to remit an application fee up to EUR 24,000.
• Fees vary by license class and may be non-refundable.

3. Appoint a VFA Agent (Where Applicable):

• Under transitional rules, you may still require a VFA Agent authorized by the MFSA to handle communication with the regulator.
• As Malta aligns with MiCA, direct applications are increasingly common, but professional advisors remain essential.

7. MFSA Review and Due Diligence

1. Documentation Check:

• The MFSA will review your application for completeness, focusing on your governance, compliance procedures, and financial viability.
• Expect queries or requests for additional details, especially around AML/CFT controls and technical infrastructure.

2. Fit and Proper Assessment:

• MFSA evaluates the integrity and competence of beneficial owners, directors, and key officers.
• In-depth checks may include financial background scrutiny and criminal record verifications.

3. On-Site or Remote Inspections (if required):

• The MFSA or FIAU may inspect your office setup and IT systems to ensure alignment with regulatory, cybersecurity, and operational standards.

8. License Approval and Issuance

1. License Granting:

• Once satisfied, the MFSA will grant a VFA license subject to specific conditions regarding reporting, capital, and board composition.
• You must also pay the annual supervisory fee, typically starting around EUR 50,000 for a Class 4 crypto exchange license.

2. Public Register Listing:

• Your approved entity is listed on the MFSA’s register of licensed virtual financial assets service providers, boosting credibility and transparency.

3. Post-Licensing Obligations:

• Immediately implement market abuse monitoring systems, verify your AML/CFT framework is fully operational, and schedule internal and external audits.

9. Ongoing Compliance, Reporting, and Renewals

1. Annual Audits & System Reviews:

• Engage an external auditor to review financial statements and confirm robust IT security.
• Submit an auditor’s report to the MFSA at least once annually.

2. Regular Regulatory Reporting:

• Provide periodic updates on operations, risk assessments, and suspicious activity reports (SARs) as mandated by the FIAU.
• Any changes in business model, board composition, or ownership require prompt MFSA notification.

3. License Renewal or Upgrades:

• Licenses are subject to annual renewal and continuous compliance checks.
• If your business model evolves (e.g., adding new VFA services or crossing revenue thresholds), be ready to upgrade to a higher VFA class license.