Malta VFA to MiCA Transition in 2026: The Complete Guide

From VFA Act to MiCA CASP: why Malta still matters

Malta's Virtual Financial Assets Act (VFA Act, Chapter 590 of the Laws of Malta), in force since 1 November 2018, was the world's first comprehensive statutory framework for cryptocurrency businesses. For six years, it made Malta the pre-MiCA default for exchanges, wallet providers, brokers and ICOs that wanted an EU-anchored licence. The VFA Act stayed open to new applications until 30 December 2024, when MiCA Title V on CASPs started to apply.

Under the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta), enacted in 2024, Malta integrated MiCA and the associated regulatory technical standards into its national framework. Existing VFA service providers migrate into MiCA CASP authorisations by 1 July 2026, after which the VFA Act no longer serves as a standalone licensing regime for crypto-asset service providers.

Three structural advantages keep Malta relevant despite tougher MiCA harmonisation.

Malta was among the first EU jurisdictions to grant MiCA authorisations, including Crypto.com (Foris DAX MT), OKX (Okcoin Europe) and ZBX (Zillion Bits). As of early 2026, approximately six MiCA CASPs are authorised in Malta with more in the pipeline.

Article 143(6): the simplified transition procedure

MiCA Article 143(6) authorises Member States to apply a simplified authorisation procedure for CASPs that already held a national crypto licence before 30 December 2024. Malta uses this route for VFA holders.

• Reuse of existing documentation. MFSA accepts much of the original VFA authorisation file without re-verification, focusing only on the MiCA-specific deltas (market-abuse rules, Article 75 liability, Travel Rule, custody specifics).
• Simplified timeline. 2 to 4 months from complete file for a clean transition, versus 4 to 8 months for a de-novo CASP application.
• Reduced fees. 50% discount on MFSA application fees until 1 July 2026.
• No operational interruption. VFA holders continue to operate under the VFA Act until MFSA grants the MiCA CASP authorisation or refuses it, up to 1 July 2026.

The catch: Article 143(6) applies only to firms that were already licensed under the VFA Act before 30 December 2024. VFA firms authorised in 2024 have an easier transition than brand-new CASP applicants. Firms that missed the VFA window pay the full fee and run the full file.

The CASP file in Malta: what MFSA expects

MFSA has published a dedicated MiCA Rulebook (MFSA MiCA Rulebook Parts A, B and C) that details authorisation requirements, ongoing obligations and governance standards. The CASP file consists of:

1. Programme of operations. The combination of MiCA services (custody, trading platform, exchange, execution, placing, reception, advice, portfolio management, transfer) the firm plans to offer; target clients; supported crypto-assets.
2. Business plan. Three-year projections with stressed scenarios, revenue model, cost base, capital plan.
3. Governance arrangements. Management body, key function holders, four-eyes principle, collective suitability, local substance.
4. Custody policy. Hot vs cold storage, MPC or multi-signature design, key-ceremony procedures, withdrawal approvals, Article 75 liability framework.
5. ICT and cybersecurity framework. DORA-aligned. Architecture, cybersecurity controls, incident response, threat-led penetration testing, third-party ICT register.
6. AML/CFT framework. Institutional risk assessment, KYC, sanctions and PEP screening, ongoing monitoring, SAR workflow, Travel Rule implementation under Regulation (EU) 2023/1113.
7. Market-abuse surveillance. Required for trading platforms and execution services. Pre- and post-trade transparency, order-book integrity, trade-halt procedures.
8. Complaints handling and conflicts-of-interest.
9. Outsourcing register and DORA-aligned third-party oversight.
10. Capital evidence. Paid-up capital in a Maltese or EU bank account, Class 1 (EUR 50k), Class 2 (EUR 125k) or Class 3 (EUR 150k) as per Annex IV of MiCA.
11. Fit-and-proper for management and qualifying shareholders.

Process and timeline

1. Statement of Intent. Even transition candidates go through a light SoI to confirm scope and no-objection.
2. Application submission. Full file filed via MFSA's online portal. Non-transition applicants pay full fee; VFA transition applicants pay 50% until 1 July 2026.
3. Completeness check. 25 working days per MiCA Article 62. MFSA runs this with a light touch for Article 143(6) candidates.
4. Substantive assessment. 40 working days statutory plus 20 extension. Real-world 2 to 4 months for transition, 4 to 6 months for new entrants.
5. Conditions precedent. Capital paid up, MFSA-approved custody infrastructure, AML and Travel Rule live, market-abuse surveillance operational for trading venues.
6. ESMA register. Malta-authorised CASP added to the consolidated ESMA interim register (weekly CSV until mid-2026, full IT system thereafter).
7. Passporting. MFSA transmits the file to host NCAs; services can start 15 calendar days later.

For a clean VFA-to-MiCA transition, budget 3 to 6 months. For a greenfield CASP applicant in Malta, 4 to 8 months.

Substance, fees and operational reality

• Local substance. Resident director, local compliance and risk staff, real office in Malta, decision-making in Malta. Letter-box arrangements refused.
• Application fee. Up to EUR 50,000 depending on class and service scope, reduced by 50% for VFA transition applications until 1 July 2026.
• Supervisory fee. Annual, tiered by revenue; typical range EUR 15k to EUR 80k.
• First-year all-in cost. EUR 200k to EUR 300k for a lean Class 2 CASP, per public Maltese market benchmarks. Class 3 trading platforms run higher.
• Corporate tax. Headline 35%, effective rate 5% to 10% for non-resident shareholders under the refund system.
• Banking onboarding. Maltese bank accounts take 3 to 6 months. Many Maltese CASPs safeguard client fiat with EU credit institutions outside Malta.

Common issues in Maltese CASP files

MFSA has published feedback from the first wave of CASP authorisations. Recurring issues:

• Custody documentation gaps. High-level policies without the specific key-ceremony, withdrawal-approval and emergency-access protocols that MFSA expects.
• Market-abuse surveillance for trading platforms. Under-specified detection rules and weak connection between surveillance alerts and SAR/market-abuse reporting.
• Travel Rule. Vendor integration in progress at file submission rather than live. MFSA wants go-live ready evidence.
• Outsourcing register and DORA ICT register. Not consolidated or missing key third parties.
• Fit-and-proper inconsistencies. CVs that do not match the job descriptions or board responsibilities as presented elsewhere in the file.
• Weak substance evidence. Office photos and payroll records not provided, which increasingly is required.

Transitioning VFA holders have a natural advantage: much of this evidence already exists from six years of VFA supervision. Fresh applicants need to build it from scratch.

After the transition: Malta's CASP roadmap

Malta's strategy is to remain a top-tier EU CASP jurisdiction by doubling down on supervisory quality, not fee competition. Expected developments for 2026 and 2027:

• Enhanced MFSA CASP supervision. More thematic reviews, onsite inspections, and alignment with ESMA peer-review recommendations.
• MiCA plus PSD integration. For CASPs offering EMT custody or transfer, combined MiCA + PSD2 (and later PSD3) supervision.
• AMLA interface. Coordination with the new EU AML Authority, which starts direct supervision of certain large CASPs from 2026.
• Product breadth. Malta remains the only EU jurisdiction with a mature combined ecosystem of CASPs, MiFID firms, gaming licensees, AIFs and insurance undertakings, enabling cross-licence product designs.

Ship a Maltese MiCA CASP product with Crassula

A CASP authorisation is the legal wrapper. The operational core is what MFSA reviews in detail and what customers actually use. Crassula delivers it as a MiCA-ready white-label platform pre-aligned with MFSA rulebook expectations.

For detail on MiCA scope, capital classes and cross-EU jurisdictions, see our MiCA CASP guide.

FAQ