Centralized exchange in Malta
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Malta with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Customer due diligence (CDD) and ongoing monitoring under the Prevention of Money Laundering Act (Chapter 373) and PMLFTR, transposing EU 5th AML Directive
- Travel Rule obligations for all transfers of crypto-assets (follow FATF standards as implemented via MiCA/VFAA framework)
- Suspicious Transaction Report (STR) filing to the FIAU (Financial Intelligence Analysis Unit)
- Record-keeping obligations (at least 5 years under applicable AML law)
- Appointment of a Money Laundering Reporting Officer (MLRO) and compliance officer
- AML/KYC policies and procedures must be submitted as part of the licensing application and maintained ongoing
Key Restrictions
- Must be incorporated as a Maltese company (local entity required)
- Must obtain a Class 4 VFA Services Licence under VFAA (or MiCA CASP licence under the Markets in Crypto-Assets Act, Cap. 647) covering reception/transmission, execution of orders, and exchange services
- Must also hold Class 4 VFA Services Licence for custody/safekeeping of client virtual assets
- Must meet governance/operational pre-commencement conditions including maintaining a local office in Malta
- MFSA must confirm commencement before operations begin
- Compliance with MiCA transparency and disclosure obligations for listing and market conduct
- Travel Rule compliance required on all withdrawals/transfers
Key Risks
- MiCA implementation in transition: Bill 107 (transposing MiCA Title V on CASPs) is still under deliberation, creating a period of regulatory flux
- Parallel regimes (VFAA Class 4 licence vs. MiCA CASP licence) may cause uncertainty over which framework fully applies
- High licensing burden with multi-stage process: pre-licensing consultation, full application, in-principle approval, then pre-commencement conditions
- MFSA has a track record of rigorous fit-and-proper assessments and enforcement
- Tax treatment guidelines from Commissioner for Revenue may create reporting complexity under forthcoming DAC8 rules
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchanges (e.g., crypto trading platforms, OTC, brokerage): Class 4 VFA Services Licence covering reception/transmission, execution of orders, and exchange services.
Custody Providers (e.g., safekeeping VA, crypto wallets): Class 4 VFA Services Licence, emphasizing client asset segregation and security.
Pre-licensing Consultation: Submit Statement of Intent; confirm services, get feedback on model.
Company Setup: Incorporate Maltese company; conduct Financial Instrument Test; draft policies/business plan.
Application Submission: File form with MFSA, including Memorandum/Articles, audited statements (if applicable), proof of capital, AML/KYC policies.
Review/Due Diligence: MFSA assesses fit/properness, compliance.
Approval in Principle: Conditional license issued.
Post-Licensing/Pre-Commencement: Meet governance/operational conditions (e.g., local office); commence upon MFSA confirmation.
Virtual Financial Assets Act (VFAA), Chapter 590: https://legislation.mt/eli/cap/590/eng/pdf
VFA Rulebook (Chapter 3 on Service Providers): https://www.mfsa.mt/wp-content/uploads/VFA-Rulebook-issued-in-terms-of-VFAA-27.11.2018.pdf
MiCA (Markets in Crypto-Assets Regulation): Fully enforceable as of December 30, 2024, with Titles III and IV (covering stablecoins) effective from June 30, 2024
Markets in Crypto-Assets Act, 2024 (Cap. 647): The national implementing legislation
Bill 107: Currently under deliberation, aimed at transposing MiCA Title V on Crypto-Asset Service Providers (CASPs)
Malta Financial Services Authority (MFSA): Supervises entities authorized under the Markets in Crypto-Assets Act (Cap. 647), including crypto-asset service providers (CASPs) and issuers offering crypto-assets to the public or seeking trading admission.
Virtual Financial Assets Act (VFAA), 2018: Core pre-MiCA framework (https://legislation.mt/eli/cap/647/eng – note: linked to Markets in Crypto-Assets Act).
Virtual Financial Assets Regulations and VFA Rulebook: Detail custody/segregation (MFSA-issued).
Markets in Crypto-Assets Act (Cap. 647): MiCA implementation (https://legislation.mt/eli/cap/647/eng).
Virtual Financial Assets Act (VFAA) – The foundational legislation enacted in 2018 that first regulated cryptocurrency in Malta
Markets in Crypto-Assets Regulation (MiCA) – EU-wide regulation implemented in Malta through Act XIV of 2024, which integrated Titles III and IV concerning Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs)
Prevention of Money Laundering Act (Chapter 373, Laws of Malta) and associated PMLFTR regulations, which transpose the EU's 5th AML Directive 2015/849/EU
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange in Malta must obtain a Class 4 VFA Services Licence (covering both exchange and custody services) under VFAA or transition to a MiCA CASP licence under the Markets in Crypto-Assets Act (Cap. 647), incorporate locally, maintain a physical office, pass MFSA fit-and-proper review, and comply with travel rule and AML obligations under the Prevention of Money Laundering Act, with Bill 107 still under deliberation adding some transitional uncertainty.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?