The Malta Gaming Authority (MGA) is the regulatory body responsible for licensing and overseeing gaming in Malta. Established in 2001 (originally as the Lotteries and Gaming Authority), it became the first regulator in the EU to issue licences for remote online gaming, setting a template that other jurisdictions would later follow.
Today, the MGA licences approximately 400 remote gaming companies alongside four land-based casinos. Its reputation is built on a combination of rigorous player protection, transparent compliance requirements, and a legal framework that has kept pace with the evolution of the industry.
What the MGA Does
The MGA’s core mandate covers three areas: licensing, regulation, and player protection.
On the licensing side, it issues and manages gaming licences for operators and suppliers, sets the eligibility and compliance standards applicants must meet, and oversees the ongoing obligations of licensed entities. On the regulatory side, it monitors the market for criminal activity, enforces anti-money laundering obligations, and conducts audits of both operators and gaming systems. Player protection runs through both: the MGA sets minimum standards that all licence holders must meet when dealing with players.
The MGA’s objectives include: supporting industry stakeholders through a single integrated authority, providing a one-stop shop for licensing, investing in technology and innovation, overseeing the collection of gaming taxes, and ensuring that the sector’s contribution benefits Malta’s broader economy.
Protecting Players: The MGA’s Core Commitments
Protection of Minors
The minimum legal age for online gaming in Malta is 18. For land-based gaming, Maltese citizens must be at least 25 — the highest minimum age requirement in the EU. Any operator found in breach faces licence revocation. Winnings obtained by underage players are forfeited.
Protection of Vulnerable Individuals
MGA licence holders are required to operate a duty of care towards all players. This means monitoring gaming behaviour, identifying signs of problem gambling, and taking appropriate action. Malta operates a Player Self-Exclusion scheme, which allows individuals to voluntarily bar themselves from all licensed gaming establishments in Malta for a minimum of one year.
Safeguarding Personal Data
All MGA-licensed organisations must comply with data protection legislation. Operators are required to have certified software in place to protect player data and prevent unauthorised access. This obligation sits alongside GDPR requirements applicable across all EU member states.
Protection of Players’ Funds
Player funds — deposits and winnings — must be held in accounts separate from the operator’s operating funds. This segregation requirement protects players in the event that an operator faces financial difficulty.
The MGA Licence Framework: B2C and B2B
In 2021, the MGA replaced the previous licence class system with a cleaner, two-tier framework. Any reference to the old class structure in older articles or guides is no longer current.
B2C Gaming Service Licence (GSL)
The Gaming Service Licence is for operators providing gaming services directly to players. This covers online casino, sports betting, poker, and other player-facing gaming products. If your business involves offering games or betting to end users, a GSL is the licence you need.
Compliance requirements include: a compliance contribution calculated as a percentage of gross gaming revenue, a non-refundable annual licence fee, player fund segregation, and ongoing reporting obligations. Specific fee structures are set by the MGA and updated periodically. Verify current figures at mga.org.mt before finalising any business plan.
B2B Critical Supply Licence (CSL)
The Critical Supply Licence is for businesses that provide software, platforms, or other critical services to gaming operators, without engaging directly with players. Platform providers, game studios, and random number generator (RNG) suppliers typically hold a CSL.
B2B licence holders are not required to pay compliance contributions in the same way as B2C operators, though they remain subject to AML obligations and operational standards.
AML and Compliance Obligations
The MGA operates within the EU’s broader anti-money laundering framework. The Fifth Anti-Money Laundering Directive (5AMLD), transposed by EU member states in 2020, and the Sixth (6AMLD), which came into force in 2021, introduced significantly strengthened requirements for gaming operators. These include enhanced customer due diligence, more rigorous transaction monitoring, and expanded reporting obligations.
For MGA licence holders, this means: conducting risk assessments of players, maintaining detailed transaction records, reporting suspicious activity to the Financial Intelligence Analysis Unit (FIAU), and training staff on AML obligations. The MGA conducts compliance examinations of licence holders on a risk-based schedule.
How to Apply for an MGA Licence
The MGA application process has several stages. Here is a broad overview. Full requirements and current fee schedules are available at mga.org.mt.
- Pre-application eligibility check: Before submitting a formal application, review the MGA’s published eligibility criteria. The authority assesses the fitness and propriety of all key function holders, including directors, shareholders with qualifying holdings, and senior managers.
- Prepare your documentation: A complete application includes a detailed business plan, proof of share capital, corporate structure documentation, and information on the technical platform to be used. For B2C operators, the gaming system must meet MGA technical standards.
- Submit via the MGA’s online portal: Applications are submitted through the MGA’s Licensee portal. The authority has published guidance on the information required at each stage.
- Fit-and-proper assessment: The MGA conducts background checks on all key individuals, including criminal record checks, financial background assessments, and references. Any individual who does not meet the fit-and-proper standard can result in an application being rejected.
- Systems testing: For B2C operators, the gaming platform must pass an independent technical audit before the licence is activated. This covers game fairness, random number generation, and system security.
- Licence issued: Licences issued under the current framework are valid for 10 years. Ongoing compliance is monitored throughout the licence period.
Physical Presence in Malta
MGA licence holders are required to have a genuine physical presence in Malta. Key function holders must be based on the island, not simply available remotely. The MGA takes substance requirements seriously, particularly for operators managing player funds.
For companies setting up in Malta for the first time, having the right office space is part of the picture from day one. SOHO’s Private Office at The Strand in Gzira places gaming companies in the heart of Malta’s iGaming district. Fully serviced private offices from €600/month include meeting rooms, a gym, and 24/7 access.
If you’re at an earlier stage of planning, our guide to starting an iGaming business in Malta covers the full setup process: company formation, MGA application, staffing, and workspace.
Industry Integrity and Ongoing Oversight
Beyond the initial licence, the MGA maintains active oversight of all licence holders. Games and gaming devices are subject to independent audits and random testing. The authority can suspend or revoke licences for non-compliance, and it publishes public notices when operators are sanctioned.
The MGA also works closely with international regulatory bodies and law enforcement to share intelligence on criminal activity, match-fixing, and fraud. Malta’s position as a leading iGaming jurisdiction depends on the integrity of this oversight — and the MGA takes that responsibility seriously.
FAQ
How many companies are licensed by the MGA?
The MGA currently licences approximately 400 remote gaming companies, in addition to four land-based casinos. This figure is updated regularly. Check the public register at mga.org.mt for the current count.
What is the difference between a B2C and a B2B licence?
A B2C Gaming Service Licence (GSL) is for operators who offer gaming products directly to players, such as online casinos or sportsbooks. A B2B Critical Supply Licence (CSL) is for companies that supply software or critical services to those operators, without having direct contact with players. Both licences carry distinct compliance obligations.
How do I verify if an operator is MGA-licensed?
The MGA maintains a public register of all current licence holders on its website at mga.org.mt. You can search by operator name or by the licence number, which licensed operators are required to display on their websites.
Does the MGA regulate land-based casinos?
Yes. The MGA regulates four land-based casinos in Malta. The minimum age for Maltese citizens to enter a land-based casino is 25, the highest such requirement in the EU. Foreign visitors are subject to an 18-year minimum.