Malta VFA to MiCA Transition in 2026: The Complete Guide

From VFA Act to MiCA CASP: why Malta still matters

Malta's Virtual Financial Assets Act (VFA Act, Chapter 590 of the Laws of Malta), in force since 1 November 2018, was the world's first comprehensive statutory framework for cryptocurrency businesses. For six years, it made Malta the pre-MiCA default for exchanges, wallet providers, brokers and ICOs that wanted an EU-anchored licence. The VFA Act stayed open to new applications until 30 December 2024, when MiCA Title V on CASPs started to apply.

Under the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta), enacted in 2024, Malta integrated MiCA and the associated regulatory technical standards into its national framework. The transitional measures for existing VFA service providers (Article 143(3) MiCA, implemented through Article 66 of the VFA Act) expired on 30 June 2026. In its letter of 25 June 2026 the MFSA told VFA firms with clients that they needed a CASP licence before that date, and that firms unable to meet it must wind down in an orderly way. Since 1 July 2026, VFA licence holders without a MiCA authorisation can no longer provide crypto-asset services.

Three structural advantages keep Malta relevant despite tougher MiCA harmonisation.

Malta was among the first EU jurisdictions to grant MiCA authorisations, including Crypto.com (Foris DAX MT), OKX (OKX Europe Limited) and ZBX (Zillion Bits). As of 7 October 2026, the ESMA interim MiCA register lists 23 firms with Malta as their home Member State.

Article 143(6): the simplified transition procedure

MiCA Article 143(6) authorises Member States to apply a simplified authorisation procedure for CASPs that already held a national crypto licence before 30 December 2024. Malta uses this route for VFA holders.

• Reuse of existing documentation. MFSA accepts much of the original VFA authorisation file without re-verification, focusing only on the MiCA-specific deltas (market-abuse rules, Article 75 liability, Travel Rule, custody specifics).
• Simplified timeline. 2 to 4 months from complete file for a clean transition, versus 4 to 8 months for a de-novo CASP application.
• Reduced fees. VFA firms applying between 30 December 2024 and 1 July 2026 paid 50% of the MFSA application fee. That window has closed.
• Transition over. VFA holders could keep operating under the VFA Act while their application was pending, but only until the transitional measures expired on 30 June 2026. Without a MiCA authorisation, they can no longer provide services and are expected to wind down.

The catch: Article 143(6) applies only to firms that were already licensed under the VFA Act before 30 December 2024. VFA firms authorised in 2024 have an easier transition than brand-new CASP applicants. Firms that missed the VFA window pay the full fee and run the full file.

The CASP file in Malta: what MFSA expects

MFSA has published a dedicated MiCA Rulebook (MFSA MiCA Rulebook Parts A, B and C) that details authorisation requirements, ongoing obligations and governance standards. The CASP file consists of:

1. Programme of operations. The combination of MiCA services (custody, trading platform, exchange, execution, placing, reception, advice, portfolio management, transfer) the firm plans to offer; target clients; supported crypto-assets.
2. Business plan. Three-year projections with stressed scenarios, revenue model, cost base, capital plan.
3. Governance arrangements. Management body, key function holders, four-eyes principle, collective suitability, local substance.
4. Custody policy. Hot vs cold storage, MPC or multi-signature design, key-ceremony procedures, withdrawal approvals, Article 75 liability framework.
5. ICT and cybersecurity framework. DORA-aligned. Architecture, cybersecurity controls, incident response, threat-led penetration testing, third-party ICT register.
6. AML/CFT framework. Institutional risk assessment, KYC, sanctions and PEP screening, ongoing monitoring, SAR workflow, Travel Rule implementation under Regulation (EU) 2023/1113.
7. Market-abuse surveillance. Required for trading platforms and execution services. Pre- and post-trade transparency, order-book integrity, trade-halt procedures.
8. Complaints handling and conflicts-of-interest.
9. Outsourcing register and DORA-aligned third-party oversight.
10. Capital evidence. Paid-up capital in a Maltese or EU bank account, Class 1 (EUR 50k), Class 2 (EUR 125k) or Class 3 (EUR 150k) as per Annex IV of MiCA.
11. Fit-and-proper for management and qualifying shareholders.

Process and timeline

1. Statement of Intent. Even transition candidates go through a light SoI to confirm scope and no-objection.
2. Application submission. Full file filed via MFSA's online portal. Applicants now pay the full fee; the 50% rate for VFA transition applications applied only to files submitted by 1 July 2026.
3. Completeness check. 25 working days per MiCA Article 63. MFSA runs this with a light touch for Article 143(6) candidates.
4. Substantive assessment. 40 working days statutory plus 20 extension. Real-world 2 to 4 months for transition, 4 to 6 months for new entrants.
5. Conditions precedent. Capital paid up, MFSA-approved custody infrastructure, AML and Travel Rule live, market-abuse surveillance operational for trading venues.
6. ESMA register. Malta-authorised CASP added to the consolidated ESMA interim register (CSV files updated weekly; ESMA planned to move the register into its IT systems by mid-2026, but the CSV files were still being updated in October 2026).
7. Passporting. MFSA transmits the file to host NCAs; services can start 15 calendar days later.

For a clean VFA-to-MiCA transition, budget 3 to 6 months. For a greenfield CASP applicant in Malta, 4 to 8 months.

Substance, fees and operational reality

• Local substance. MiCA requires at least one director resident in the EU; the MFSA MiCA Rulebook (R3-2.5.2) goes further and requires at least one executive director based in Malta, plus enough key function holders and staff there. Dual control by at least two people running the business, real office in Malta, decision-making in Malta. Letter-box arrangements refused.
• Application fee. EUR 10,000 (Class 1), EUR 20,000 (Class 2) or EUR 25,000 (Class 3) under S.L. 647.01. VFA transition applications filed by 1 July 2026 paid half; that reduction has ended.
• Supervisory fee. Paid on authorisation (prorated) and then every 30 July under S.L. 647.01: EUR 10,000 (Class 1), EUR 25,000 (Class 2) or EUR 50,000 (Class 3), counting only the highest class, plus EUR 2,000 for each authorised service, plus 0.05% of transaction volume capped at EUR 250,000.
• First-year all-in cost. EUR 200k to EUR 300k for a lean Class 2 CASP, per public Maltese market benchmarks. Class 3 trading platforms run higher.
• Corporate tax. Headline 35%, effective rate 5% to 10% for non-resident shareholders under the refund system.
• Banking onboarding. Maltese bank accounts take 3 to 6 months. Many Maltese CASPs safeguard client fiat with EU credit institutions outside Malta.

Common issues in Maltese CASP files

MFSA has published feedback from the first wave of CASP authorisations. Recurring issues:

• Custody documentation gaps. High-level policies without the specific key-ceremony, withdrawal-approval and emergency-access protocols that MFSA expects.
• Market-abuse surveillance for trading platforms. Under-specified detection rules and weak connection between surveillance alerts and SAR/market-abuse reporting.
• Travel Rule. Vendor integration in progress at file submission rather than live. MFSA wants go-live ready evidence.
• Outsourcing register and DORA ICT register. Not consolidated or missing key third parties.
• Fit-and-proper inconsistencies. CVs that do not match the job descriptions or board responsibilities as presented elsewhere in the file.
• Weak substance evidence. Office photos and payroll records not provided, which increasingly is required.

Transitioning VFA holders have a natural advantage: much of this evidence already exists from six years of VFA supervision. Fresh applicants need to build it from scratch.

After the transition: Malta's CASP roadmap

Malta's strategy is to remain a top-tier EU CASP jurisdiction by doubling down on supervisory quality, not fee competition. Expected developments for 2026 to 2028:

• Enhanced MFSA CASP supervision. More thematic reviews, onsite inspections, and alignment with ESMA peer-review recommendations.
• MiCA plus PSD integration. For CASPs offering EMT custody or transfer, combined MiCA + PSD2 (and later PSD3) supervision.
• AMLA interface. The EU AML Regulation (Regulation (EU) 2024/1624) applies from 10 July 2027. The new EU Anti-Money Laundering Authority (AMLA) selects the obliged entities it will supervise directly in 2027, including some CASPs, and starts direct supervision in 2028.
• Product breadth. Malta remains the only EU jurisdiction with a mature combined ecosystem of CASPs, MiFID firms, gaming licensees, AIFs and insurance undertakings, enabling cross-licence product designs.

Ship a Maltese MiCA CASP product with Crassula

A CASP authorisation is the legal wrapper. The operational core is what MFSA reviews in detail and what customers actually use. Crassula provides the software side of it as a white-label platform, while compliance towards the MFSA stays with you.

For detail on MiCA scope, capital classes and cross-EU jurisdictions, see our MiCA CASP guide.

FAQ