Custodial wallet / SaaS in Malta
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Malta with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- SaaS provider (as VFA Service Provider / CASP) must conduct customer due diligence (CDD) under the Prevention of Money Laundering Act (Cap. 373) and PMLFTR, transposing 5th AML Directive 2015/849/EU
- Ongoing transaction monitoring and suspicious transaction reporting (STR) to the Financial Intelligence Analysis Unit (FIAU)
- Appointment of a Money Laundering Reporting Officer (MLRO) and independent AML audit function
- Comprehensive AML/KYC policies and procedures required as part of MFSA licensing application (mt.licensing.application-submission-file-form-with)
- White-label client obligations: The SaaS provider must ensure its white-label clients also meet AML/CDD obligations or the provider contractually flows down AML responsibilities, with ultimate supervisory accountability resting on the licensed entity
- Registration with Malta Tax and Customs Administration (MTCA) as a Registered Crypto-Asset Service Provider (RCASP) for DAC8 reporting by late 2025 (mt.licensing.malta-tax-and-customs-administration)
Key Restrictions
- Must be incorporated as a Maltese company (local entity required) to apply for a VFA Services Licence (mt.licensing.company-setup-incorporate-maltese-company)
- Must obtain a Class 4 VFA Services Licence covering safekeeping of VAs / custody (mt.licensing.custody-providers-eg-safekeeping-va)
- Must maintain client asset segregation under VFA Rulebook and VFAA (mt.custody.virtual-financial-assets-regulations-and)
- Pre-licensing consultation with MFSA required: submit Statement of Intent for feedback on business model (mt.licensing.pre-licensing-consultation-submit-statement-of)
- Post-licensing conditions include local office and governance requirements before commencement (mt.licensing.post-licensingpre-commencement-meet-governanceoperational-conditions-eg)
- MiCA (fully enforceable as of Dec 30, 2024) and Markets in Crypto-Assets Act (Cap. 647) will govern alongside VFAA; Bill 107 expected to transpose MiCA Title V for CASPs (mt.licensing.bill-107-currently-under-deliberation)
- Must comply with transparency and disclosure obligations (mt.licensing.compliance-with-transparency-and-disclosure)
- Proof of capital requirements as part of MFSA application (mt.licensing.application-submission-file-form-with)
Key Risks
- Dual regulatory framework (VFAA + MiCA/Cap. 647) creates transitional uncertainty; Bill 107 still under deliberation for CASP rules (mt.licensing.bill-107-currently-under-deliberation)
- Custody-specific capital and insurance requirements not fully detailed in provided facts — may need supplementary requirements from VFA Rulebook Chapter 3
- Accountability for white-label client compliance gaps may fall on the licensed SaaS provider as the regulated entity
- High licensing burden (Class 4) with multi-stage process: pre-licensing consultation → incorporation → application → fit/properness review → approval in principle → post-licensing conditions (mt.licensing.pre-licensing-consultation-submit-statement-of through mt.licensing.post-licensingpre-commencement-meet-governanceoperational-conditions-eg)
- Enforcement precedent limited in provided facts — MFSA supervisory posture on custody breaches not specified
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Virtual Financial Assets Act (VFAA), 2018: Core pre-MiCA framework (https://legislation.mt/eli/cap/647/eng – note: linked to Markets in Crypto-Assets Act).
Virtual Financial Assets Regulations and VFA Rulebook: Detail custody/segregation (MFSA-issued).
Markets in Crypto-Assets Act (Cap. 647): MiCA implementation (https://legislation.mt/eli/cap/647/eng).
Custody Providers (e.g., safekeeping VA, crypto wallets): Class 4 VFA Services Licence, emphasizing client asset segregation and security.
Company Setup: Incorporate Maltese company; conduct Financial Instrument Test; draft policies/business plan.
Application Submission: File form with MFSA, including Memorandum/Articles, audited statements (if applicable), proof of capital, AML/KYC policies.
Review/Due Diligence: MFSA assesses fit/properness, compliance.
Approval in Principle: Conditional license issued.
Post-Licensing/Pre-Commencement: Meet governance/operational conditions (e.g., local office); commence upon MFSA confirmation.
Pre-licensing Consultation: Submit Statement of Intent; confirm services, get feedback on model.
Virtual Financial Assets Act (VFAA), Chapter 590: https://legislation.mt/eli/cap/590/eng/pdf
VFA Rulebook (Chapter 3 on Service Providers): https://www.mfsa.mt/wp-content/uploads/VFA-Rulebook-issued-in-terms-of-VFAA-27.11.2018.pdf
MiCA (Markets in Crypto-Assets Regulation): Fully enforceable as of December 30, 2024, with Titles III and IV (covering stablecoins) effective from June 30, 2024
Markets in Crypto-Assets Act, 2024 (Cap. 647): The national implementing legislation
Bill 107: Currently under deliberation, aimed at transposing MiCA Title V on Crypto-Asset Service Providers (CASPs)
Compliance with transparency and disclosure obligations
Malta Financial Services Authority (MFSA): Supervises entities authorized under the Markets in Crypto-Assets Act (Cap. 647), including crypto-asset service providers (CASPs) and issuers offering crypto-assets to the public or seeking trading admission.
Malta Digital Innovation Authority (MDIA): Certifies Distributed Ledger Technology (DLT) platforms and ensures their credibility and governance under the MDIA Act.
Malta Tax and Customs Administration (MTCA): Handles crypto-asset tax reporting, with registration required for Registered Crypto-Asset Service Providers (RCASPs) under forthcoming DAC8 guidelines (transposition expected by late 2025).
Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta): Principal legislation transposing MiCA, effective 2024; governs issuers and CASPs, with MFSA powers for licensing, penalties, and subsidiary rules.
Virtual Financial Assets Act (VFAA) – The foundational legislation enacted in 2018 that first regulated cryptocurrency in Malta
Markets in Crypto-Assets Regulation (MiCA) – EU-wide regulation implemented in Malta through Act XIV of 2024, which integrated Titles III and IV concerning Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs)
Prevention of Money Laundering Act (Chapter 373, Laws of Malta) and associated PMLFTR regulations, which transpose the EU's 5th AML Directive 2015/849/EU
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS providers may operate in Malta only after obtaining a Class 4 VFA Services Licence from the MFSA (covering safekeeping of virtual assets), incorporating a Maltese company, and complying with both the VFAA and the new Markets in Crypto-Assets Act (Cap. 647 / MiCA), with full AML obligations under the Prevention of Money Laundering Act and PMLFTR; dual regime transition and pending Bill 107 add moderate uncertainty.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?