Compliance Setup for Malta (MFSA) Jurisdiction
Malta was first in the EU to develop comprehensive crypto regulatory framework (VFA Act 2018), earning it the reputation "Blockchain Island". MFSA (Malta Financial Services Authority) regulates VFA (Virtual Financial Assets). The licensing process is one of the most detailed in EU, but the result provides strong regulatory brand.
VFA License Classes
Class 1: VFA Services where the firm does not hold clients' assets — reception and transmission of orders, investment advice. Capital: €50,000.
Class 2: Portfolio Management. Capital: €125,000.
Class 3: Dealing on own account. Capital: €730,000.
Class 4: Custody. Capital: €730,000.
VFA Exchange: separate category for trading platforms. Capital: €730,000+.
VFA Agent — Mandatory Element
Unique to Malta: before submitting application, you must engage VFA Agent — MFSA-accredited intermediary (lawyer or auditor). VFA Agent submits application on behalf of company and bears responsibility for document correctness.
VFA Agents: Nexia BT, PKF Malta, WH Partners — list on MFSA website.
Documentation Requirements
MFSA is the most documentation-heavy regulator in EU:
System Audit: independent IT audit of technology infrastructure (mandatory, from MFSA-accredited auditor). Includes: security architecture review, penetration testing, DRP assessment.
AML/CFT Programme: detailed program including Business Risk Assessment matrix, Customer Risk Scoring methodology, Transaction Monitoring rules library.
Compliance and Internal Audit Function: separate Compliance Officer and Internal Audit function. For small companies — external outsourcing permitted.
Financial Projections: 3-5 year projections with sensitivity analysis.
Technology Description: detailed description of all systems, including wallet infrastructure, trading engine, KYC platform. MFSA asks technical questions.
AML under Maltese Legislation
// Malta PMLA (Prevention of Money Laundering Act) + VFA Act
const MaltaAMLRequirements = {
// Mandatory CDD for all clients
cddThreshold: 0, // for VFA — CDD from first transaction
// EDD for high-risk
eddTriggers: ["PEP", "high_risk_country", "unusual_transaction_pattern", "threshold_exceeded"],
// Transaction thresholds
thresholds: {
occasionalTransaction: 1000, // EUR — requires CDD
enhancedMonitoring: 10000, // EUR — SAR consideration
},
// Reporting
reporting: {
sarPlatform: "FIAU Malta (Financial Intelligence Analysis Unit)",
sarDeadline: 5, // working days
annualReport: "MFSA Annual Compliance Report",
},
};
Timing and Cost
MFSA is a slow regulator: 6-12 months for review is not uncommon. But the license has EU passporting.
| Stage | Timeline |
|---|---|
| VFA Agent engagement | 1-2 weeks |
| Documentation preparation | 3-5 months |
| MFSA in-principle approval | 2-4 months |
| Conditions fulfilment | 1-2 months |
| Full licence | total 8-13 months |
Expenses: €25,000-€50,000 VFA Agent fees + MFSA application fee €10,000-€25,000 + legal/audit costs.
Malta compliance setup with preparation of complete documentation package and VFA Agent support — 3-5 months preparatory work.