B2C operators
Online casino, sportsbook, poker, and hybrid brands that directly onboard players, hold balances, manage responsible gaming controls, and need a recognised regulatory base.
Updated for 2026
A Malta gambling license is a high-compliance authorisation issued by the Malta Gaming Authority under the Gaming Act, Chapter 583. The real Malta online gambling license cost is not just the official MGA fee schedule: founders must separate application and annual licence fees, compliance contribution, minimum capital, technical audit, AML staffing, accounting, banking, and substance costs. An MGA licence is a strong regulatory credential for B2C and B2B iGaming businesses, but it is not an automatic right to target every EU market.
Market access depends on the law of each target country. Tax outcomes depend on structure, substance, and current rules; this page is informational, not legal or tax advice.
A Malta gambling license is a Maltese regulatory authorisation for remote gaming businesses supervised by the Malta Gaming Authority, not a blanket EU consumer-facing permit. Since the 2018 reform under the Gaming Act, Chapter 583, the framework is built around B2C Gaming Service Licences and B2B Critical Gaming Supply Licences, with business activity still mapped through the familiar Type 1–4 classification. In practice, Malta is best suited to operators and suppliers that can sustain a serious compliance function, withstand deeper source-of-funds review, and benefit from stronger banking and counterparty credibility.
The jurisdiction makes strategic sense for online casino brands, sportsbooks, poker networks, fantasy or controlled skill models, platform providers, game studios, RNG-related suppliers, and infrastructure businesses that expect partner due diligence from PSPs, investors, and regulated-market counterparties. It is less suitable for founders seeking the cheapest launch, the lightest reporting burden, or a structure built around weak governance and heavy opacity.
The most common mistake in the market is to treat the Malta gambling license cost as a single number. The real first-year budget is better expressed as a formula: Year-1 budget = setup + application fee + annual fee + compliance contribution + capitalisation + audit/testing + staffing + accounting/tax + banking/payment onboarding + substance overhead.
Online casino, sportsbook, poker, and hybrid brands that directly onboard players, hold balances, manage responsible gaming controls, and need a recognised regulatory base.
Platform providers, game studios, critical software vendors, and infrastructure businesses whose clients or payment partners expect a stronger compliance profile.
Decision-makers comparing Malta against lower-cost jurisdictions and needing a realistic view of fees, timelines, market access limits, and post-approval burden.
An MGA licence authorises gaming activity from Malta under Maltese law. It does not by itself legalise B2C targeting in every EU or EEA country; local market-entry analysis remains mandatory country by country.
Typical applicants include B2C operators holding player relationships and funds, and B2B suppliers providing critical gaming components such as platforms, games, RNG-linked software, or other regulated supply elements.
The jurisdiction is often selected for regulatory credibility, stronger banking narratives, better PSP acceptance, investor comfort, and a mature compliance ecosystem around MGA, FIAU, MBR, CFR, and data protection obligations.
Official fees are only one layer. Delays often come from unready AML controls, weak financial projections, under-scoped technical audits, poor outsourcing maps, or governance gaps around key functions and incident reporting.
A licence or authorisation issued by the Malta Gaming Authority under the Maltese gaming framework. In practice, the term is used commercially as shorthand for a Malta gambling license or Malta gaming license.
The B2C authorisation used where the licensee offers gaming services to players, manages player onboarding, handles responsible gaming duties, and is directly exposed to player-facing compliance obligations.
The B2B authorisation used for suppliers of critical gaming components. Scope analysis matters because not every vendor is treated identically; the regulator focuses on whether the supplied element is operationally critical to licensed gaming activity.
The activity logic commonly used to classify gaming verticals: Type 1 for games of chance played against the house determined by RNG, Type 2 for fixed-odds betting, Type 3 for peer-to-peer or commission-based models, and Type 4 for controlled skill games.
A regulatory assessment of integrity, competence, financial soundness, and overall suitability of shareholders, UBOs, directors, senior managers, and key function holders. It goes beyond criminal record checks and includes source-of-wealth and governance credibility.
Ultimate beneficial owner. Maltese gaming applications require transparent disclosure of beneficial ownership, and complex holding chains without a clear narrative often slow down due diligence.
Money Laundering Reporting Officer. The MLRO role is central to AML governance, suspicious reporting, escalation logic, and interaction with AML/CFT obligations relevant to gaming businesses.
A regulatory charge distinct from annual licence fees and distinct from corporate income tax. It is generally linked to licence class and revenue or GGR bands, which is why cost modelling must separate it from taxes.
A technical review stage focused on whether the gaming system, controls, records, integrations, and operational setup meet regulatory expectations before full commercial launch conditions are satisfied.
This is the Malta online gaming license used when the business contracts with players, operates player accounts, manages balances, applies KYC and AML controls, and carries direct responsible gaming and complaints-handling obligations. A B2C operator usually needs this route for an online casino Malta license, sportsbook, poker room, or a mixed consumer-facing brand. Decision logic matters: if your company owns the player relationship, handles player funds, or takes gaming risk, the B2C path is usually the starting point.
Online casino; sportsbook; poker network; bingo; fantasy or controlled skill model where the operator is consumer-facing; white-label structures where the real control and risk allocation must be analysed carefully rather than assumed from branding alone.
This is the MGA route for suppliers of critical gaming components rather than direct operators. It is used by platform providers, game developers, RNG-related suppliers, and certain infrastructure businesses whose products are integral to licensed gaming activity. The key practical question is not whether the company is 'software' in a general sense, but whether the supplied component is critical to regulated gaming operations and therefore falls into the licensed supply perimeter.
Game content; platform and PAM layers; RNG-linked modules; wallet or back-office elements that are core to gaming operations; selected hosting or infrastructure arrangements where the supplied function is operationally critical.
Type 1 covers games of chance played against the house where the outcome is determined by a random generator. In practical terms, this is the classic online casino Malta license profile: slots, roulette, blackjack, and similar RNG-based house games. A common classification error is to treat every casino-adjacent product as Type 1 even where the operator is actually facilitating peer-to-peer play or a skill-based format.
Slots; roulette; blackjack; baccarat; RNG-driven house casino products.
Type 2 is typically used for fixed-odds betting where the operator manages the book and bears betting risk. Sportsbook models usually sit here. The operational nuance is that pricing, risk management, event settlement logic, and suspicious betting controls become central to the compliance narrative, not just generic casino controls.
Sports betting; fixed-odds event betting; other bookmaker-style products.
Type 3 generally applies where the operator promotes or facilitates gaming and derives revenue by commission rather than by taking direct game risk. Poker networks and certain exchange-style or marketplace-like models are typical examples. Founders often misclassify hybrid products here without documenting who truly bears gaming risk and who controls player balances.
Poker networks; peer-to-peer gaming; commission-based facilitation models.
Type 4 is associated with controlled skill games. The practical issue is evidencing why the product qualifies as skill-based under the relevant framework rather than merely being a chance product with a skill overlay. Fantasy-style models often require especially careful legal mapping because marketing language and actual game mechanics may diverge.
Controlled skill games; selected fantasy-style formats where the legal qualification is supportable.
An MGA licence is a Maltese authorisation, not a universal EU gambling passport. That distinction matters more in 2026 than in older marketing copy because many European states maintain their own licensing, tax, consumer protection, advertising, and enforcement regimes for gambling.
The practical rule is simple: an MGA licence helps with credibility, structure, and counterpart due diligence, but local B2C legality must still be checked country by country. In many markets, direct consumer targeting requires a local licence, a local approval, or a separate legal analysis of whether the market is closed, monopolised, ring-fenced, or otherwise restricted.
This is where many pages on Malta gambling license cost become misleading. They imply that once the Malta licence is obtained, expansion across Europe becomes automatic. That is not how regulated gambling works. A serious launch plan must review:
For B2B suppliers, the market-access analysis is often more nuanced than for B2C operators because the supplier may not be directly consumer-facing. Even then, contract chain, product scope, and local law can still matter.
Fits businesses that want a serious regulatory base and understand that expansion requires separate market-entry work.
Does not fit founders looking for a single licence that automatically legalises pan-European B2C acquisition.
Freedom-to-provide-services arguments do not override national gambling restrictions. Consumer-facing gambling remains heavily localised across Europe.
It adds regulatory credibility, a recognised compliance framework, and a stronger base for PSP, banking, and partner due diligence.
Review local licensing, tax, AML, consumer, payments, and advertising rules before launch, not after obtaining the Malta licence.
The document set is broader than a basic company incorporation pack. The regulator expects a coherent evidentiary file showing who owns the business, how it is funded, how it will operate, who controls risk, and whether the platform and AML framework are actually workable.
Incorporation documents, group structure chart, shareholder and UBO disclosures, constitutional documents, registers, and any agreements needed to explain control. The practical test is narrative clarity, not just document volume.
Evidence supporting how the business is capitalised and how key persons accumulated wealth. Unexplained jumps in wealth, circular funding, or inconsistent banking trails are common red flags.
A realistic model covering product scope, revenue assumptions, target markets, payment flows, staffing, outsourcing, and liquidity. Projections should be operationally credible, not marketing optimism.
Risk assessment, customer due diligence procedures, enhanced due diligence logic, sanctions screening, transaction monitoring, suspicious reporting workflow, record retention, and escalation governance.
Policies and system logic for self-exclusion, deposit or loss controls, cooling-off, reality checks, vulnerable player handling, complaints, and player funds treatment where relevant.
System diagrams, hosting setup, access control model, audit logs, environment segregation, incident response, backup and disaster recovery, and evidence that the platform can support regulatory reporting and traceability.
MGA compliance is an operating system, not a filing exercise. The regulator reviews whether the business can actually run controlled gaming operations with traceable transactions, defensible AML decisions, reliable incident handling, and player protection tooling that works in production. This is where many applications lose momentum because founders submit policies before the platform, staffing model, and reporting architecture are mature enough to support them.
The most important practical point is that technical readiness and compliance readiness are linked. If the platform cannot produce clean audit trails, segregate environments, support role-based access, retain records properly, and feed transaction monitoring or player protection logic, the legal file will not rescue the application.
The gaming environment must support traceability, secure access control, change management, log integrity, backup, and disaster recovery. Where RNG or game fairness is relevant, testing and certification by appropriate providers becomes part of the readiness story. Production and test environments should be clearly segregated, and outsourced hosting arrangements must be mapped in a way the regulator can understand.
AML in gaming requires customer due diligence, ongoing monitoring, risk scoring, source-of-funds handling where appropriate, sanctions and PEP screening, escalation logic, and suspicious reporting workflows that can be evidenced. The MLRO function must be more than a name on an organigram; it needs authority, access to data, and procedures that match the product and payment flows.
B2C operators should be able to demonstrate self-exclusion, cooling-off, deposit or loss controls where relevant, reality checks, complaint handling, and treatment of player balances consistent with the operating model. Responsible gaming controls should be embedded into the product UX, not left as a policy appendix. Player fund handling is especially sensitive where the operator controls wallets or stored balances.
The regulator looks at directors, senior managers, MLRO, compliance roles, and other key functions through the lens of competence, integrity, and effective oversight. Outsourcing is not prohibited by itself, but the licensee must still retain control, accountability, and sufficient understanding of the outsourced function.
Gaming operators process identity data, payment data, behavioural data, and often sensitive risk indicators. GDPR-aligned governance, retention logic, access discipline, and incident response therefore sit alongside gaming compliance rather than outside it. This is where the IDPC dimension intersects with operational gaming controls.
Licensing in Malta is not handled by one authority in isolation. The MGA is central, but a serious operator or supplier also intersects with AML supervision, company registry obligations, tax registration, and data protection governance. Founders who understand the ecosystem usually prepare cleaner applications and avoid post-licensing surprises.
The Malta Gaming Authority is the primary gaming regulator responsible for licensing, supervision, compliance, and enforcement under the Gaming Act and subsidiary regulations. It is the core authority for Malta gambling license applications, ongoing reporting, and enforcement notices.
The FIAU is central to Malta's AML/CFT ecosystem. For gaming businesses, the AML dimension cannot be treated as a side note because customer due diligence, monitoring, suspicious reporting, and governance quality are core risk areas.
The MBR handles company registration and corporate records, including beneficial ownership disclosure and statutory corporate maintenance. Gaming applicants with messy ownership chains often run into friction here before or during licensing review.
The Commissioner for Revenue is relevant for tax registration, corporate tax administration, and the broader tax framework that founders often oversimplify when discussing Malta gaming structures.
The IDPC sits behind the data protection layer that intersects with gaming, AML, marketing, and player account management. Operators processing identity, behavioural, and payments-related data should treat privacy governance as part of operational compliance.
A Malta licence can improve the banking narrative, but it does not remove high-risk business friction. Banks, EMIs, acquirers, and merchant providers still assess ownership transparency, source of funds, target markets, chargeback profile, AML maturity, and the credibility of the operating model. In practice, payment onboarding often becomes easier when the licensing file, compliance controls, and market strategy are already coherent.
The MGA framework is recognised and generally stronger than many low-cost alternatives, which helps with due diligence. However, banks and PSPs still apply their own risk appetite and may reject businesses with weak target-market logic or unclear payment flows.
Expect requests for ownership documents, source-of-funds evidence, licence status, business plan, target countries, AML framework, chargeback controls, fraud controls, and details of payment routing, safeguarding logic, and outsourced providers.
Even where the legal structure is technically workable, banks and payment providers often prefer applicants with visible governance, named responsible officers, realistic staffing, and a credible explanation of where key decisions and controls are actually performed.
Banking and merchant onboarding should be planned alongside licensing, not after it. Related pages: /bank-account-opening/malta/, /bank-account-opening/business/high-risk/, /bank-account-opening/merchant/, and /accounting/malta/.
The realistic Malta licensing process in 2026 is usually measured in 6–12+ months, not in a universal four-month promise. The timeline depends on ownership transparency, document quality, source-of-funds readiness, business model complexity, technical maturity, and how quickly the applicant answers regulator queries. Most delays start before submission, not after it.
A practical way to view the process is in five stages: preparation, submission, due diligence, technical readiness, and launch conditions. Each stage can stall if the company submits generic AML documents, weak financial projections, inconsistent ownership narratives, or an unfinished platform stack.
Prepare the corporate structure, business plan, financial projections, AML/CFT framework, responsible gaming controls, outsourcing map, information security governance, and key-person documentation before filing. In practice, serious preparation often takes 6–12 weeks+ because founders underestimate the time needed to align legal, technical, and operational narratives.
Submit the application package with ownership, governance, financial, and operational materials aligned. A technically complete file is not the same as a persuasive file; the regulator will test whether the business model, control framework, and funding story are coherent.
This stage focuses on UBOs, shareholders, directors, senior management, source of wealth, source of funds, competence, and financial soundness. Weak answers to regulator questions create a delay multiplier because each inconsistency triggers follow-up review across related documents and persons.
Paper approval does not equal unrestricted launch. The gaming system, architecture, logs, access controls, integrations, backup and disaster recovery, and production readiness must support the regulatory model. If the build is still moving, the technical stage expands quickly.
Before and after launch, the licensee must satisfy reporting, incident notification, player protection, and ongoing compliance obligations. A frequent operational mistake is to treat go-live as the end of the project rather than the beginning of supervised operations.
Regulated United Europe OÜ (RUE) is a European legal consulting firm specializing in financial licensing, company formation, and regulatory compliance. Since 2016, we have helped hundreds of businesses obtain crypto, gambling, forex, and EMI/PSP licenses across 35+ jurisdictions.
With offices in four EU countries and a team of experienced lawyers, we provide end-to-end support — from initial consultation and company registration to license acquisition and ongoing compliance management.
500+
Clients Served
35+
Jurisdictions
Since 2016
Years in Business
4
EU Offices
Fully registered and regulated EU company with partnerships across major financial centers.
Our experts speak English, German, Russian, Chinese, and 12+ other languages for global client support.
From company registration to license acquisition and compliance — we handle the entire process end-to-end.
Personal consultant assigned to each client. Direct communication channels, no call centers.
The safest way to discuss Malta gambling license cost is to keep tax and regulatory charges in separate buckets. Competitor pages often merge them into one simplified number, which creates legal and commercial confusion. In Malta, the company-level corporate income tax framework, gaming tax rules, and MGA compliance contribution are different mechanisms with different bases and different practical outcomes.
The headline corporate income tax rate for Maltese companies is 35%. In some structures, shareholders may access refund mechanisms that reduce the effective tax burden, but that does not mean the company universally pays '5%' and it should not be marketed that way. Gaming tax is a separate concept under gaming rules, and compliance contribution is a regulatory charge linked to licensing class and revenue bands rather than a substitute for tax.
Substance matters in tax and banking analysis. The more aggressive the tax simplification, the more carefully founders should review governance, management location, outsourcing, permanent establishment risk, and the expectations of banks, PSPs, and counterparties.
Corporate income tax applies at company level under Malta's tax framework. The headline rate is 35%, while shareholder-level refund mechanics may reduce the effective burden in some structures. The actual outcome depends on facts, structure, and current tax treatment.
Gaming tax is a separate charge under gaming rules and should be analysed based on the actual activity, revenue base, and territorial context. It should not be confused with corporate income tax or with annual MGA fees.
Compliance contribution is an MGA-related regulatory cost generally based on licence class and revenue or GGR bands. It is part of ongoing regulatory burden, not a tax substitute.
For planning purposes, use separate lines for annual licence fee, compliance contribution, gaming tax exposure, corporate tax exposure, accounting, audit, and payroll or outsourced compliance functions. This avoids the most common founder budgeting error.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
A realistic planning range is 6–12+ months in 2026, not a universal four-month promise. Timing depends on ownership transparency, source-of-funds evidence, document quality, business model complexity, technical readiness, and how efficiently the applicant answers regulator questions. Preparation alone often takes 6–12 weeks+ before filing.
The cost starts with the official MGA application fee, commonly referenced at €5,000, plus annual licence fees and compliance contribution. The real Malta online gambling license cost also includes company formation, legal and compliance drafting, minimum capital, technical audit or testing, accounting, MLRO or compliance staffing, banking and merchant onboarding, and substance-related overhead.
They are different categories. Malta gambling license cost includes regulatory fees and operating setup costs. Gaming tax is a separate tax concept under gaming rules. Corporate income tax is another separate layer. Founders should never collapse annual licence fee, compliance contribution, gaming tax, and corporate tax into one simplified percentage.
No, that statement is too simplistic and often misleading. Malta's corporate income tax headline rate is 35% at company level. In some structures, shareholder refund mechanisms may reduce the effective burden, but that is not the same as saying every gaming company pays only 5%, and it should not be presented that way without proper tax analysis.
This should be answered cautiously and case by case. The real issue is not a marketing-style yes or no, but whether the structure, governance, outsourcing model, and operational substance are acceptable to the regulator and workable for banks and PSPs. Registered office, management presence, and local substance expectations should be reviewed against the actual business model.
No, not automatically. An MGA licence is a Maltese authorisation, not a blanket EU consumer-facing permit. Many European countries have their own gambling licensing, tax, consumer, and advertising rules. Local legal review is required before targeting players in each market.
A consumer-facing online casino usually falls within the B2C Gaming Service License framework and is commonly associated with Type 1 activity where the player plays against the house and outcomes are determined by RNG. Exact classification still depends on the real product mechanics and risk allocation.
A B2B supplier of critical gaming components typically looks at the Critical Gaming Supply License. The key issue is whether the supplied element is operationally critical to licensed gaming activity. Platform providers, game studios, and RNG-related suppliers are common examples, but scope should be checked against the actual service stack.
The commonly cited benchmarks are €100,000 for Type 1 and Type 2 activities and €40,000 for Type 3 and Type 4 activities. These are baseline capital references, not a substitute for full launch budgeting, liquidity planning, or proof of financial standing.
The most common causes are weak source-of-funds narratives, opaque ownership chains, generic AML documentation, unrealistic financial projections, unclear outsourcing control, and an unready platform stack. In practice, regulator questions multiply when the legal, technical, and commercial story does not align.
A Malta gaming license is usually the right choice for businesses that need a recognised regulatory base, can support a serious compliance function, and are planning for bankability, PSP acceptance, and long-term credibility rather than the cheapest possible launch. In 2026, founders should budget for 6–12+ months, separate fees from taxes, and model the real first-year cost rather than relying on headline numbers.
If your business model is B2C, payment-sensitive, investor-facing, or built for regulated-market expansion, Malta may justify its higher cost. If the priority is a lighter budget and faster launch, another jurisdiction may be more practical.
Our specialists will analyze your specific case, recommend the optimal jurisdiction and license type, and provide a detailed roadmap with timeline and costs.