Malta gaming licence (MGA) explained

The MGA says its job is to regulate the gaming sectors that fall under it by keeping gaming fair and transparent, preventing crime and protecting minor and vulnerable players. Its powers rest on the Gaming Act, published in English and Maltese, and on regulations made under it.

Further regulations cover commercial communications, definitions, premises, licence fees, gaming tax, the Social Causes Fund and retention of data. Directives sit beneath them:

• Directive 2 of 2018, the Player Protection Directive, in force from 1 August 2018 and issued under article 7(2) of the Gaming Act.
• Directive 3 of 2018, the Gaming Authorisations and Compliance Directive, in force from 1 August 2018.
• Directive 4 of 2018, on the calculation of the compliance contribution.
• Directive 5 of 2018, the ADR Directive, in force from 3 December 2018.

Recent changes to the regime

Some dated announcements from the regulator, newest first:

• 1 October 2026: revised VAT and gaming tax frameworks for the gaming sector came into effect, announced on 30 September 2026.
• 18 September 2026: the MGA and the Malta Digital Innovation Authority (MDIA) launched an AI Gaming Charter.
• 12 March 2026: the MGA published its Supervisory Engagement Efforts for 2026, setting out its supervisory priorities.
• 2 July 2025: the MGA published its Capital Requirements Policy.
• 2 May 2025: changes to the System Audit, System Review and Compliance Audit procedures were communicated.

The MGA issues two kinds of licence, and a casino that takes players holds the first.

Gaming Service licence

This is a business-to-consumer licence to offer or carry out a gaming service.

Critical Gaming Supply licence

This is a business-to-business licence to supply and manage the material elements of a game, or to supply and manage software that generates, captures, controls or processes any essential regulatory record. It covers suppliers to operators, not the casino a player signs up to.

Game types

A separate licence is not needed for each type of game. A licensee that wants to offer another type applies for approval through the Licensee Portal. A game needs a licence when it has a stake, chance predominates and the prize is money or money's worth.

Term, capital and going live

A licence, original or renewed, runs for ten years. Renewal depends on the licensee having complied with the Act, the regulatory instruments and other laws during the previous term. After issue, a licensee has 90 days to go live, but licence fees, compliance contribution and gaming tax are due from the issue date. Gaming tax is based on revenue from end customers located in Malta and is paid monthly.

Recognition notice

A recognition notice is separate from a licence. It treats an authorisation from another EU or EEA Member State, or from a State whose safeguards the Authority deems largely equivalent to Maltese law, as having the same effect as an MGA authorisation. Anyone offering licensable games in or from Malta under such an authorisation must apply for one.

Owners and key people

Applicants must pass the fit and proper test at application and on an ongoing basis, judged mainly on integrity, honesty and reputation, and on competence and capability. The test reaches the applicant and every relevant person, including anyone with a qualifying interest, set at ten percent or lower if the Authority decides. If the Authority is not satisfied, it must refuse the licence. Only a person established in the European Economic Area can hold one, and the applicant must meet the share capital and annual financial statement requirements.

People who carry out a key function for a licensee need a certificate of approval. Key functions include compliance (responsible gaming, player support and the rules on marketing, advertising and promotions) and the prevention of money laundering and the financing of terrorism. Performing a key function without a certificate is an offence.

Player money

A licensee holds player funds solely for and on behalf of that player. The funds form a distinct patrimony, separate from the operator's own assets, and the operator's creditors have no claim on them. Insolvency and bankruptcy law applying to the operator does not touch them.

Funds must be kept apart from anyone else's money at all times. A common player funds account is allowed if each player's money stays separately identifiable. An operator that outsources player funds stays fully responsible and liable to players for losses caused by the third party. On insolvency, or on demand of a player or the Authority, control and title pass to whoever the Authority instructs. Failing to pay players when lawfully due, or to protect essential regulatory data, is a criminal offence under the Third Schedule to the Gaming Act.

Games and testing

A licensable game may be offered only once the Authority has approved or recognised it. A game built on a random number generator or game engine the Authority has not already approved needs prior written approval. A licence is refused if the games do not meet the minimum fairness requirements for their type.

Testing labs must be independent and accredited in an EU or EEA Member State, or in another jurisdiction the MGA approves or recognises. Online games with random outcomes must pay out on average at least 85% of the money wagered, or more if the licence requires, measured over one calendar year unless the MGA directs otherwise. Critical gaming supplies must come from a provider with a B2B licence or a recognition notice.

Servers and data

The key technical setup must sit in Malta or another EU or EEA state. A live or real-time mirror server of essential regulatory data must be readily accessible to the Authority at all times, and changes to essential components need its prior written approval. Security breaches that harm the confidentiality of player information, or stop players reaching their accounts for more than 12 hours, must be reported.

Advertising

Gambling adverts must not condone or encourage criminally or socially irresponsible behaviour, portray gaming as a means of resolving problems, or suggest it is an alternative to employment. They cannot refer to easily available credit or tarnish the image of another licensee. Under the Gaming Commercial Communications Regulations (S.L. 583.09), an advert must show the licensee's name, licence number, minimum age and responsible gaming information.

Homepage and terms

Online B2C licensees must show key information prominently on the homepage, reachable from every page of the site. That means a sign that underage gaming is not permissible, a message that gaming can be harmful if not controlled, and the fact that they are licensed by the Authority, in a manner readily visible to players. Any identifier the MGA requires, which may include a dynamic seal or kite mark, must sit on the homepage of every website. A site that offers both regulated and unregulated games needs a clear homepage notice saying which are which. Before the first deposit, players must be told about responsible gaming tools and linked to organisations that help people with gambling problems.

Terms, including promotion terms, must not be unfair under the Consumer Affairs Act. For remote gaming they must sit no more than one click from the homepage or the game they cover. A licensee may hold only one version of its general terms (one per brand for multi-brand licensees). If language versions conflict, the version most beneficial to the player prevails, and a doubtful term is read in the way most favourable to the player.

Players must be notified of material changes and expressly accept them before they take effect. A player who declines cannot keep playing but can withdraw the balance under the terms originally agreed. Any commission or fee charged to the player must be readily available.

Registration and accounts

Nobody may gamble with a B2C licensee without being registered as a player with an account. The operator collects at least name and surname, date of birth and permanent residential address, and verifies them with due diligence under anti-money-laundering rules. Where it becomes aware or reasonably suspects that details are materially false, it must cancel the registration.

Operators must also detect identical or similar player details, and the use of one IP address, device identifier or SIM card identifier by different players. Where a player holds several accounts, responsible gaming limits apply across all of them, unless the request relates only to specific games or gaming verticals. An operator sets when an account counts as inactive, but never earlier than three calendar months. Players get at least 30 days' warning, and no inactivity fees may be charged during a self-exclusion.

How the MGA enforces

If the Authority suspects a breach, or that a licensee is no longer suitable, it must open a formal investigation, and hindering one is an offence. The measures available are orders to correct conduct, warnings, an administrative penalty under article 25(3) of the Act where a breach is not an offence, a report to the Executive Police where it is, and suspension or cancellation of the licence. One enforcement entry records administrative penalties of €147,080 for numerous shortcomings. The Authority may also keep and publish a list of operators that do not comply.

Grounds for suspension include a licensee, owner or key function holder no longer being fit and proper, a breach of anti-money-laundering law, failing or being about to fail to meet commitments to players on time, and failing to pay the Authority on time. Suspension normally follows at least twenty days' written notice to show cause, but can be immediate where a licensee presents an imminent threat of serious prejudice to players. Operating while suspended is a ground for cancellation. Neither step removes liability for earlier acts or sums already due. Most sanctions stay unpublished unless the public interest or another law requires otherwise, but suspensions and cancellations must be made public.

Voluntary ESG Code

Taking part in the ESG Code is voluntary, and licensees who choose not to take part face no consequences. The Code covers only operations under the MGA licence, not an operator's global activity.

Player money, game approval and homepage duties are covered above. This section covers the tools a player can use and where a dispute goes.

Responsible gaming tools

• Self-exclusion must be available at all times, for a definite or indefinite period, no more than one click from the responsible gaming page. It covers all of the licensee's games and all its channels, and takes effect at once.
• It ends only on the player's request or when the set period expires. Shortening or ending a set period takes effect at least 24 hours after the licensee agrees, and an indefinite one at least seven days after.
• With no unified self-exclusion database for remote gaming, a multi-brand licensee whose brands need separate registration may limit a self-exclusion to the brand where it was requested. An exclusion based on signs of a gambling problem covers every brand.
• Remaining funds can be withdrawn during a self-exclusion, and the process must be set out in the terms. For an exclusion longer than six months, the operator may close the account and refund the balance.
• Licensees must offer deposit limits and, or wagering limits, and online they must ask before the first deposit whether a player wants to set them. A tighter limit applies at once. A looser limit, or its removal, applies after 24 hours.
• A licensee can exclude a player itself when there are sufficient reasons to think the player has a gambling problem. The signals it must at least weigh are the amount and frequency of deposits and wagers, use of multiple payment methods, reversed withdrawals, more complaints and bonus requests, and use of responsible gaming tools.
• For online house games with random outcomes, a player can set a pop-up alert at set intervals. It suspends play, reminds the player to stay in control and shows time and money spent in the session.
• The account balance and currency must be visible at all times, and the last six months of gambling history must be accessible.
• The MGA links to the Responsible Gaming Foundation, SEDQA, CARITAS, Oasi and BetBlocker for people who struggle to control their gambling.

Complaints and disputes

The route runs in three steps.

1. The casino comes first, and the MGA strongly recommends trying to settle the dispute with its support and management before complaining to the regulator. The casino must publish how to complain to it and how to refer disputes to an ADR entity, and the procedure must sit in its terms. It must give the result of its inquiry within ten days of receiving the complaint. It may take a further ten days if it tells the player within the first ten days and gives the reasons. The reply must explain how to go to an ADR entity and to the Player Support Unit.
2. A player who is not satisfied must be offered the chance to refer the dispute to an ADR entity, free of charge. The entity must be established in the EU or EEA, listed under Article 20(2) of the ADR Directive and competent for gaming or gambling disputes. Its services must at least include arbitration or adjudication with a binding outcome for both sides. A licensee with no ADR arrangement must refer the player to a listed entity within twenty days of the player saying the dispute is unresolved. Players must be told how the decision affects their right to further legal action. For disputes outside the jurisdiction of the Small Claims Tribunal, the licensee may instead offer non-binding ADR such as mediation. The online dispute resolution article was repealed with effect from 20 July 2025 because the European platform was discontinued.
3. The Player Support Unit takes complaints from anyone who reports that a licensee's service is unlawful or not safe, fair or transparent. The online form is the formal channel for complaints against MGA-licensed operators, and cases are reviewed in English or Maltese. The reasons offered include payment and withdrawal problems, bonuses, responsible gaming concerns, identity verification, technical errors, fraud, terms and conditions, and account closure or restriction. The form asks for the website URL, the operator, the username, the game, the disputed amount, and the date and time of the incident. The Unit examines a complaint independently of any ADR dispute. It can demand information from the operator and escalates possible breaches to the Authority's compliance directorate.

When a licence is suspended or cancelled

A suspended operator can no longer run gaming but must keep players' accounts accessible for visibility. After revocation, the holder cannot run gaming in or from Malta, with immediate effect. A cancelled operator is directed to notify all players by email and on its website for 30 days, refund all player money in line with the Gaming Act, and remove any reference to the Authority and the licence at once.

In one liquidation, outstanding player balances were transferred to the Authority through proceedings before the First Hall Civil Court (Commercial Section). Players owed funds could submit a formal claim with evidence, and balances go back to the originating account where possible.

UK players

The complaint form's country of residence list includes the United Kingdom, and the regulator's guidance note on the UK's exit from the European Union is marked repealed. The MGA's pages do not say that a licence lets a casino accept UK players. A casino licensed abroad is never a way around a self-exclusion.

Each casino below has a licence entry that matches its operator.

• PlayOJO: Skill On Net Limited
• Betway: Betway Limited, 150 free spins + £10 Uber Eats voucher for a £20 stake
• Spin Genie: Skill On Net Limited, 120 free spins on Book of Dead for a deposit of £10 or more
• Videoslots: Videoslots Limited, 100% first deposit bonus
• LeoVegas: LeoVegas Gaming plc, 50 free spins on Big Bass Splash for a deposit of £10 or more

The public licensee register is on the MGA website. It can be searched by licensee name, authorisation status, URL or gaming service, and each heading holds a list of all operators. The dynamic seal on a licensee's site opens further information. A separate recognition notice register is searched by company name or recognition number, and pressing Search with no field selected lists every notice. The enforcement register lists all enforcement actions under the Act and its directives, filtered by year from 2013 to 2026. For the method used across every regime, see How to check a casino licence.

A matching entry ties three things together: the company named in the casino's terms, the licence number shown on the site and in its adverts, and the URL in the register. The enforcement register gives examples of how an entry reads. One records Winzon Group Limited, licence MGA/B2C/717/2019, cancelled effective 11 March 2026. Another records Condor Malta Limited, licence MGA/B2C/340/2016, suspended under regulation 8(1)(f) of the Compliance and Enforcement Regulations effective 16 September 2026.

What a mismatch looks like

• A company name, licence number or URL that does not match any register entry.
• A site on the unauthorised URLs list, where the MGA declares it has no connection and calls any reference to the MGA or an MGA licence false and misleading. Each entry shows a URL and a notice date. The list includes domains with UK in the name or a .uk ending, with notice dates such as 30 October 2025, 10 March 2026 and 14 August 2026. A notice published on 25 September 2026 covers further URLs identified during September 2026.

The regulator warns that unlicensed entities are unregulated and lack the framework's safeguards, which makes dealing with them risky for consumers. Fake claims are covered on Fake and cloned casino licences.

This page describes one regime and sets no verdict against the others. Separate pages put the Malta licence next to the UK and Curacao regimes, and list the casinos that hold it.

• UKGC vs MGA licence
• MGA vs Curacao licence
• Casino licences compared

A regulator can change a rule, and a line on this page can be wrong. When either happens, the team reads the regulator's own page or register again and corrects this page. Corrections go to info@biglicence.co.uk.

• Big Licence team checks of the licences we cover
• mga.org.mt Used for the Malta Gaming Authority's own pages and licensee register.
• legislation.mt Used for the Maltese gaming regulations.