The MiCA Fast Track: Why Crypto Giants like OKX and BVNK are Anchoring in Malta
Why is Malta’s CASP license frequently regarded as the starting point for EU compliance? How can it be obtained? Which business activities does CASP cover, and what are its limitations? Furthermore, which types of enterprises are best suited for this path?
In our previous blog posts, we have discussed various popular cryptocurrency licenses including MiCA CASP, the Swiss SRO, Abu Dhabi’s ADGM, and the evolving Polish VASP framework.
Among these, MiCA CASP is one of the most frequently queried. While many perceive the barriers to entry as high and the timelines as lengthy, certain member states under the MiCA framework are more suitable as a primary entry point for a crypto business portfolio. Malta, often referred to as the Blockchain Island, is a prime example.
This article explores why Malta is the popular choice for many firms seeking EU compliance while also addressing the market controversies that cannot be ignored.
Ⅰ. Choosing a MiCA Home: Why Malta is Frequently Selected
Since MiCA is now fully in force, any firm wishing to operate in the crypto space within the EU must obtain a CASP authorization. The critical decision for an enterprise is where to place their first license among the 27 member states and 3 EEA countries. Although MiCA provides a unified framework, the enforcement standards vary significantly.
- France (AMF): Known for exceptionally rigorous scrutiny. OKX famously withdrew its French application due to the intensity of these standards.
- Germany (BaFin): They emphasize that their licenses are active immediately rather than being a principle approval. However, the overlap with the Banking Act (KWG) and Securities Trading Act (WpHG) means that firms dealing with RWA tokenized securities often require an additional investment company license.
- Netherlands (AFM & DNB): A dual regulator system requires complex coordination. Friction in this jurisdiction previously led to Crypto.com being placed on a warning list for operating without a license.
The Passporting mechanism is a shared feature across the EU, allowing a firm authorized in one member state to expand across the entire EEA. However, the choice of the first jurisdiction determines the speed and efficiency of the entire EU launch. Malta remains a top choice for three reasons:
- 1. Market Cognitive Habit: Investors and partners recognize Malta as a crypto hub, which effectively lowers communication costs.
- 2, Regulatory Maturity: The transition from the legacy VFA framework to MiCA was seamless. Local regulators and service providers are crypto native in their thinking.
- 3. Strategic Entry Point: It is easier in Malta to bundle exchange, custody, and execution services into a single narrative for the regulator.
Malta has successfully attracted several industry leaders whose strategies illustrate the value of combined licensing.
- OKX: The firm designated Malta as its European hub and secured a Payment Institution (PI) license there. This combination of CASP and PI allows their stablecoin payment services to proceed under both MiCA and PSD2 frameworks.
- Crypto.com: They obtained a VFA Class 3 license and an EMI permit, proving Malta’s ability to handle the intersection of exchanges and banking services.
- BVNK: The stablecoin payment infrastructure provider also secured its CASP license from the Malta Financial Services Authority (MFSA).
Despite these successes, controversy remains.
The core concern centers on whether the scrutiny is sufficiently rigorous. Some critics at the EU level fear regulatory arbitrage, where firms choose faster jurisdictions to gain access to the entire union via passporting. A peer review by the European Securities and Markets Authority (ESMA) previously questioned whether certain approvals in Malta were granted before all material issues were fully resolved. This has led to the occasional description of the process as licensing on demand, which critics believe could weaken the rigor of the unified MiCA framework.
Malta has fully aligned its domestic system with the MiCA framework. The current legal axis has shifted from the VFA era to the Markets in Crypto Assets Act 2024 (Cap. 647, Act XXXVI of 2024). The MFSA serves as the competent authority for authorization and ongoing supervision.
Malta’s role in the MiCA system is primarily that of a gateway. Its value is derived from its passporting capabilities rather than the local market size. This positioning is evident in three ways:
- Service Integration: A single CASP license can include multiple service types such as trading, custody, and order execution. While some countries may require separate tracks taking up to 18 months, Malta’s integrated path typically concludes in 6 to 12 months.
- Parallel Authorizations: Services not covered by CASP, such as stablecoin issuance or payments, can be pursued via parallel applications for ART or PI permits within the same jurisdiction.
- Mature Ecosystem: Local legal and compliance experts have been familiar with crypto regulation since the VFA days, providing significant practical convenience.
According to the Markets in Crypto Assets Act (Cap. 647) and the MiCA Rulebook and application notices issued by the MFSA in 2025, new applicants are required to submit their authorization requests to the MFSA under the MiCA framework. For entities that already held a local VFA license before December 30, 2024, transitional arrangements and simplified procedures are available.
This is an area where many founders experience confusion, and we believe it is essential to clarify these boundaries before discussing the application process.
The CASP authorization specifically targets crypto asset services. A single CASP application can specify multiple service types, allowing one license to cover a variety of activities once approved. MiCA explicitly lists nine services:
- Operating a trading platform
- Custody and administration of crypto assets
- Exchange of crypto assets for fiat or other crypto assets
- Execution of orders for crypto assets
- Reception and transmission of orders
- Portfolio management
- Providing advice on crypto assets
- Placing of crypto assets
- Providing transfer services for crypto assets
When combined, these services can support several typical business models:
- Crypto Exchanges: By combining trading platform operation, custody, exchange, and order execution, a single CASP license is sufficient.
- Wallets and Custody Services: This model is supported by custody and transfer services, allowing for both the safekeeping of assets and on chain transfers.
- Stablecoin Transfer and Exchange: As long as the firm does not issue the stablecoins, a CASP license is enough to provide custody, transfer, and exchange services for them.
- Trading and Custody of RWA Tokens: If RWA tokens are classified as crypto assets under the MiCA framework rather than MiFID II securities, CASP can cover their trading and custody.
However, certain activities fall outside the scope of a CASP license:
- Stablecoin Issuance: Issuing Asset Referenced Tokens (ART) requires a separate ART issuer authorization. Issuing Electronic Money Tokens (EMT) pegged to a single fiat currency can only be performed by licensed EMIs or credit institutions.
- Payment Services: Any business involving fiat and stablecoin payments requires a Payment Institution (PI) or Electronic Money Institution (EMI) license under the PSD2 framework.
- RWA Tokens as Financial Instruments: If a token is classified as a financial instrument under MiFID II, it remains entirely outside the scope of MiCA and requires an investment company license.
In short, if your goal is a full stack business involving an exchange, stablecoin issuance, and payments, a single CASP license will not suffice. This is why firms like OKX pursue both CASP and PI licenses. However, for pure CASP services such as trading, custody, and exchange, one license can indeed cover everything if specified at the time of application.
The application process is divided into three distinct stages: Preparation, Formal Submission, and Review and Approval.
The focus of this stage is defining the strategic direction and ensuring all hard requirements are met before filing.
- 1. Defining Business Scope: Determine whether the business requires pure CASP services or a combination such as CASP plus ART issuer authorization or CASP plus PI or EMI licenses. These combinations dictate the application path and capital requirements.
- 2. Confirming Capital Requirements: Minimum capital is divided into three tiers based on the type of CASP service:
- €50,000: For reception and transmission of orders or providing advice.
- €125,000: For execution of orders, placing of crypto assets, or portfolio management.
- €150,000: For operating a trading platform or providing custody services. If ART issuer or EMI licenses are also required, capital requirements will be significantly higher. For example, the minimum capital base for an EMI is approximately €350,000. Firms must prove they have sufficient funds to manage risks and operational costs, and the MFSA will scrutinize the source, structure, and sustainability of these funds.
- 3. Establishing Local Substance and Governance: This involves registering a company in Malta, opening a bank account, and appointing directors and a company secretary. CASP applicants must have a real office in Malta that is capable of hosting on site regulatory inspections. While shared offices may be considered, they must be supported by lease agreements, dedicated workstations, and office equipment. A mere registered address without substance is insufficient.
- Executive Requirements: At least two executives with relevant experience are required, and at least one must be a resident of Malta.
- Key Functions: Firms typically must appoint a Compliance Officer, an MLRO (Money Laundering Reporting Officer), a Risk Manager, and an Internal Auditor.
- Staffing Levels: Within six months of obtaining the license, the company should have at least ten employees working within Malta through direct employment or local outsourcing.
- 4. Preparing Documentation: The MFSA focuses its review on the business plan, financial forecasts, key personnel arrangements, governance structures, AML and CFT policies, technical arrangements, and outsourcing control mechanisms.
- Statement of Intent: Before the formal application, a Statement of Intent is submitted to the MFSA to outline the proposed business type and service scope. This allows the regulator to provide initial feedback.
- Formal Application Package: Applicants must complete the specified CASP application forms and submit them along with all supporting documentation and the required application fees.
- Completeness Check: The MFSA performs a check to ensure all materials are present. Any missing information will require a supplement, and each round of supplements will extend the overall timeline. The quality of the initial application package directly determines the subsequent pace.
- Substantive Review: Once the package is deemed complete, the MFSA conducts a detailed review against MiCA rules. This includes the capital plan, governance, technical systems, security controls, and compliance policies.
- Fit and Proper Assessments: The MFSA conducts background checks and interviews with directors, shareholders, compliance officers, and MLROs to verify their qualifications, integrity, and reputation.
- Inquiries and Rectification: During the review, the MFSA may issue inquiries or request additional materials. The speed and quality of these responses significantly impact the approval progress.
- In-Principle Approval (IPA): If the review is successful, the MFSA issues an IPA letter. This indicates approval of the business plan but may include pre-licensing conditions that must be satisfied.
- Final License: Once all pre-licensing conditions are met, the MFSA issues the official license, which may still carry certain post-licensing conditions.
Obtaining a MiCA authorization from the MFSA allows a firm to quickly enter other EEA markets through the passporting mechanism.
In practice, this involves notifying the regulators in the target member states and detailing the scope of services to be provided. Once confirmed, operations can begin. This path is far more efficient than applying for individual licenses in every country and allows a single compliance framework to cover multiple markets.
However, all necessary steps must be followed. Before entering each EEA market, the notification and local landing actions must be completed. Some countries may add specific localization requirements, and firms must comply with the consumer protection and disclosure rules of the target country.
Furthermore, passporting status is not permanent. It can be lost if capital adequacy falls below requirements, if major AML or KYC issues arise, if client asset protection fails, or if false information is provided to regulators. If the MFSA revokes the authorization or if there are serious violations in a target market, the right to operate across the entire EEA may be compromised.
Obtaining a license is only the beginning. The real challenge is maintaining it through several pillars of supervision:
- Governance and Control: Major changes to shareholding or management require prior approval from the MFSA.
- AML and KYC Systems: These are continuous obligations that must be updated as regulations and business models evolve.
- Technology and Security: Key management and custody systems must run stably, as regulators demand constant IT robustness.
- Disclosure and Audit: Marketing content and audit reports are subject to ongoing MFSA assessment.
At CryptoLicense, we wish to reiterate our long standing view that a license is ultimately about finding the right fit for your specific business. While the Malta route appears efficient, it is not universally suitable for every enterprise.
Based on our application experience, the return on investment for the Malta path is highest for the following four categories of firms:
- Firms with Mature Compliance Teams: Malta requires a comprehensive and functional compliance system. If your team has not been established yet, it is essential to complete the fundamental groundwork before applying.
- Firms Targeting the Entire EU Market: The primary value of the Malta path lies in its passporting capabilities. If a firm only intends to operate in a single country, this strategic advantage remains underutilized.
- Firms with Clear Business Models: This path is best for enterprises that can accommodate a lead time of four to nine months along with significant upfront costs.
- Firms Requiring Multiple Compliance Puzzles: Malta is ideal for businesses needing a combination of payments, custody, trading, and stablecoin authorizations. OKX serves as an excellent case study here, where Malta successfully accommodated their integrated need for both crypto and PI licenses.
In the MiCA era, Malta’s positioning is clear as a suitable entry point for a crypto business portfolio and a foundation for expansion across the European Union.
On the side of certainty, CASP supports the integration of multiple services, allowing additional authorizations to proceed in parallel within the same jurisdiction. The fact that firms such as OKX, Crypto.com, and BVNK have successfully navigated this path proves that it is more than just a theoretical concept.
On the other side of uncertainty, the ESMA has previously audited Malta’s approval process, and market rumors regarding licensing on demand are not entirely without merit.
Now that you have a comprehensive understanding of Malta’s application framework, if you are interested in exploring further, please feel free to contact CryptoLicense. On the path to compliance, we can always begin our conversation with a focus on suitability.