Crypto ATM / kiosk operator in Malta
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Malta with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Must comply with Prevention of Money Laundering Act (Chapter 373) and PMLFTR, transposing EU 5th AML Directive 2015/849/EU
- Must implement full AML/KYC policies covering cash-in/cash-out transactions at kiosks
- Customer due diligence required — including identity verification for any cash-to-crypto or crypto-to-cash transaction
- Ongoing transaction monitoring obligations under VFAA and MiCA/Markets in Crypto-Assets Act (Cap. 647)
- Suspicious Transaction Reports (STRs) must be filed with the Financial Intelligence Analysis Unit (FIAU)
- Cash transaction reporting thresholds (if any) follow the PMLFTR regime — likely €10,000 for cash transactions under EU AML framework
Key Restrictions
- Must incorporate a Maltese company (local entity required)
- Must obtain a Class 4 VFA Services Licence under VFAA / Markets in Crypto-Assets Act (Cap. 647)
- Subject to MiCA regulation for crypto-asset service provision (CASPs) — Title V transposition via Bill 107 pending
- Must undergo MFSA pre-licensing consultation, submit Statement of Intent
- Must meet governance/operational conditions including maintaining a local office before commencing operations
- Must comply with transparency and disclosure obligations under VFAA and MiCA
- DLT platforms may require certification by the Malta Digital Innovation Authority (MDIA)
Key Risks
- High AML risk profile of cash-to-crypto kiosks may attract heightened MFSA/FIAU scrutiny during fit-and-proper assessment
- Bill 107 (transposing MiCA Title V on CASPs) is still under deliberation — regulatory framework for CASPs may be incomplete or in flux
- Regulatory overlap between VFAA (Class 4 licence) and MiCA regime creates dual-compliance burden
- Cash-intensive business model may face additional AML compliance costs and potential enforcement action if thresholds or reporting are missed
- Tax reporting obligations via MTCA/DAC8 (expected late 2025) add administrative complexity
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchanges (e.g., crypto trading platforms, OTC, brokerage): Class 4 VFA Services Licence covering reception/transmission, execution of orders, and exchange services.
Custody Providers (e.g., safekeeping VA, crypto wallets): Class 4 VFA Services Licence, emphasizing client asset segregation and security.
Payment Processors (e.g., VA payment solutions): Class 4 VFA Services Licence for VA-to-fiat or VA transfers.
Pre-licensing Consultation: Submit Statement of Intent; confirm services, get feedback on model.
Company Setup: Incorporate Maltese company; conduct Financial Instrument Test; draft policies/business plan.
Application Submission: File form with MFSA, including Memorandum/Articles, audited statements (if applicable), proof of capital, AML/KYC policies.
Review/Due Diligence: MFSA assesses fit/properness, compliance.
Approval in Principle: Conditional license issued.
Post-Licensing/Pre-Commencement: Meet governance/operational conditions (e.g., local office); commence upon MFSA confirmation.
Virtual Financial Assets Act (VFAA), Chapter 590: https://legislation.mt/eli/cap/590/eng/pdf
VFA Rulebook (Chapter 3 on Service Providers): https://www.mfsa.mt/wp-content/uploads/VFA-Rulebook-issued-in-terms-of-VFAA-27.11.2018.pdf
MFSA Guidelines/MiCA: https://www.mfsa.mt/fintech/virtual-financial-assets/
Demonstration of ability to comply with MiCA and national implementing legislation
Compliance with transparency and disclosure obligations
MiCA (Markets in Crypto-Assets Regulation): Fully enforceable as of December 30, 2024, with Titles III and IV (covering stablecoins) effective from June 30, 2024
Act XIV of 2024: Transposes MiCA Titles III and IV into Maltese law
Markets in Crypto-Assets Act, 2024 (Cap. 647): The national implementing legislation
Virtual Financial Assets Act (VFAA), Chapter 590: https://legislation.mt/eli/cap/590/eng/pdf
Bill 107: Currently under deliberation, aimed at transposing MiCA Title V on Crypto-Asset Service Providers (CASPs)
Malta Financial Services Authority (MFSA): Supervises entities authorized under the Markets in Crypto-Assets Act (Cap. 647), including crypto-asset service providers (CASPs) and issuers offering crypto-assets to the public or seeking trading admission.
Malta Digital Innovation Authority (MDIA): Certifies Distributed Ledger Technology (DLT) platforms and ensures their credibility and governance under the MDIA Act.
Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta): Principal legislation transposing MiCA, effective 2024; governs issuers and CASPs, with MFSA powers for licensing, penalties, and subsidiary rules.
Subsidiary: S.L. 647.01 – Markets in Crypto-Assets Act (Fees) Regulations; L.N. 295 of 2024 – User Guidelines.
Virtual Financial Assets Act (VFAA) – The foundational legislation enacted in 2018 that first regulated cryptocurrency in Malta
Markets in Crypto-Assets Regulation (MiCA) – EU-wide regulation implemented in Malta through Act XIV of 2024, which integrated Titles III and IV concerning Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs)
Prevention of Money Laundering Act (Chapter 373, Laws of Malta) and associated PMLFTR regulations, which transpose the EU's 5th AML Directive 2015/849/EU
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operators in Malta require a Class 4 VFA Services Licence (under VFAA / Markets in Crypto-Assets Act Cap. 647), local incorporation, a local office, full AML/KYC programmes under the Prevention of Money Laundering Act and PMLFTR, and must navigate a dual regulatory framework (VFAA + MiCA) with Bill 107 still pending for CASP licensing.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?