Self-custodial wallet / non-custodial software in Malta
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Malta without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML/CFT obligations attach to the software publisher under Maltese law because the publisher never holds, controls, or has access to user funds or private keys — the activity does not constitute a VFA Service under VFAA nor a CASP service under MiCA/Markets in Crypto-Assets Act (Cap. 647).
- Self-custodial wallet software publishing falls outside the scope of the Prevention of Money Laundering Act (Chapter 373) for VASP-related obligations, as there is no custody, transmission, or order execution of VFAs.
Key Restrictions
- The software must be genuinely non-custodial — the publisher must never hold, control, or have access to user private keys or funds. Any additional feature that involves receiving, transmitting, or safekeeping of VFAs would trigger Class 4 VFA Services Licence requirements under VFAA and/or CASP authorization under MiCA.
- The publisher must not offer any built-in exchange, brokerage, or order-execution functionality — those services would constitute a Class 4 VFA Service (exchange/custody) requiring a licence from MFSA.
- If the software is marketed directly to Maltese residents or available in Malta, it should comply with consumer-protection and transparency/disclosure obligations (mt.licensing.compliance-with-transparency-and-disclosure) and general Maltese/EU product liability laws for software.
Key Risks
- Regulatory boundary risk: If a Maltese court or MFSA interprets any ancillary feature (e.g., integrated swaps, fiat on-ramp referral fees, or proprietary RPC endpoints) as constituting a VFA service, the publisher could be deemed an unlicensed VFA Service Provider or CASP.
- MiCA classification risk: Under MiCA's broad definition of 'crypto-asset service', there is ongoing debate about whether non-custodial wallet software could be caught — the current Maltese transposition (Cap. 647, Bill 107 for Title V) likely excludes pure software publishers, but this has not been tested.
- DAC8 tax reporting risk: If the software provides any intermediary tax-reporting function or is reclassified as a 'reporting entity', future tax reporting obligations under DAC8 (transposition expected 2025) could attach via the Malta Tax and Customs Administration.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Exchanges (e.g., crypto trading platforms, OTC, brokerage): Class 4 VFA Services Licence covering reception/transmission, execution of orders, and exchange services.
Custody Providers (e.g., safekeeping VA, crypto wallets): Class 4 VFA Services Licence, emphasizing client asset segregation and security.
Payment Processors (e.g., VA payment solutions): Class 4 VFA Services Licence for VA-to-fiat or VA transfers.
Virtual Financial Assets Act (VFAA), Chapter 590: https://legislation.mt/eli/cap/590/eng/pdf
VFA Rulebook (Chapter 3 on Service Providers): https://www.mfsa.mt/wp-content/uploads/VFA-Rulebook-issued-in-terms-of-VFAA-27.11.2018.pdf
MiCA (Markets in Crypto-Assets Regulation): Fully enforceable as of December 30, 2024, with Titles III and IV (covering stablecoins) effective from June 30, 2024
Markets in Crypto-Assets Act, 2024 (Cap. 647): The national implementing legislation
Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta): Principal legislation transposing MiCA, effective 2024; governs issuers and CASPs, with MFSA powers for licensing, penalties, and subsidiary rules.
Virtual Financial Assets Act (VFAA) – The foundational legislation enacted in 2018 that first regulated cryptocurrency in Malta
Markets in Crypto-Assets Regulation (MiCA) – EU-wide regulation implemented in Malta through Act XIV of 2024, which integrated Titles III and IV concerning Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs)
Prevention of Money Laundering Act (Chapter 373, Laws of Malta) and associated PMLFTR regulations, which transpose the EU's 5th AML Directive 2015/849/EU
Compliance with transparency and disclosure obligations
Virtual Financial Assets Act (VFAA), 2018: Core pre-MiCA framework (https://legislation.mt/eli/cap/647/eng – note: linked to Markets in Crypto-Assets Act).
Virtual Financial Assets Regulations and VFA Rulebook: Detail custody/segregation (MFSA-issued).
Markets in Crypto-Assets Act (Cap. 647): MiCA implementation (https://legislation.mt/eli/cap/647/eng).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a publisher of genuinely non-custodial/self-custodial wallet software does not trigger VASP/CASP licensing or AML obligations under Maltese law (VFAA, MiCA/Cap. 647), provided it never holds, controls, or accesses user private keys or funds; however, any additional service feature crossing into custody, exchange, or transmission territory would require a Class 4 VFA Services Licence or MiCA CASP authorization, and general transparency/disclosure obligations apply.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?