Obtaining a Gambling Licence from the Malta Gaming Authority (MGA)

Any operator wishing to provide gaming services in or from Malta requires a valid gambling licence issued by the Malta Gaming Authority (MGA). The legislation currently provides for four distinct licence classes, which differ based on the primary activity and the applicable tax structure.

At DW&P, we have guided numerous companies through the application process for a Malta gambling licence over the years. Because the application procedure is relatively complex, rigorous, and involves strict compliance requirements, we have outlined the key steps and obligations below.

Legal Basis and Purpose

The Maltese government established the legal framework for gambling licences with the passing of the Lotteries and Other Games Act in 2001. This led to the creation of the Lotteries and Gaming Authority, which was rebranded as the Malta Gaming Authority (MGA) in 2015.

Malta pursues a proactive approach to position itself as a leading hub for the iBetting and iGaming sectors within Europe and globally. However, this is balanced by a commitment to maximum legal certainty and strict adherence to all international and EU laws, regulations, and best practices.

Consequently, the MGA mandates a rigorous due diligence process, including a thorough system audit, for every applicant. This involves detailed documentation of the company's commercial, legal, and technical affairs, as well as background checks on the integrity and reputation of the founders and individuals holding key functions.

Corporate Documentation

The MGA requires the submission of the company's certificate of incorporation (issued by the Malta Business Register – MBR) and full disclosure of the corporate structure. This includes confirmation of any mergers or acquisitions, as well as share registers identifying the shareholders of both the applicant company and any parent companies.

Due Diligence on Beneficial Owners

The application process requires a comprehensive due diligence check on all Ultimate Beneficial Owners (UBOs) who hold 10% or more of the company's shares. Each UBO must complete a detailed personal declaration form provided by the MGA.

Furthermore, the following documents must be submitted as originals or certified copies (in English):

• Copy of passport or ID card;
• Birth certificate;
• A current police conduct certificate (criminal record check) from every country where the individual has resided for at least 6 months during the past 2 years;
• Details of any other gambling licences held by the individual;
• Proof of residence (e.g., a bank statement or utility bill).

Due Diligence on Key Function Holders

The due diligence process described above applies equally to all individuals appointed to 'Key Functions' within the company. The same documentation must be provided in English.

In principle, one person may hold multiple Key Functions. However, there must be a strict separation between individuals responsible for commercial operations and those responsible for legal/compliance matters to ensure the independence of the latter.

While the list below is currently considered valid, the MGA reserves the right to determine which positions and responsibilities constitute a Key Function:

• Chief Executive Officer (or equivalent);
• Management of day-to-day gaming operations, including payment processing to and from players;
• Compliance with obligations arising from the licence(s) issued by the Authority;
• Administrative and financial strategies, including the payment of taxes and fees due to the Authority;
• Marketing and advertising, including bonuses and promotions;
• Legal affairs, including contractual arrangements and dispute resolution;
• Player support;
• Responsible gaming;
• Prevention of fraud to the detriment of the licensee;
• Risk management strategies;
• Prevention of money laundering and financing of terrorism (AML/CFT);
• Compliance with applicable data protection and privacy laws (GDPR);
• Technological affairs, including the management of the backend and control systems where essential regulatory data is stored;
• Network and information security.

Operational Requirements

• Minimum Share Capital: The company must have a minimum issued share capital of EUR 40,000 (depending on the licence type).
• Segregated Accounts: You must maintain separate bank accounts for operational funds and player funds. At least one specific account must be designated for each purpose. This must be evidenced by a written declaration from the bank confirming the segregation of player funds.
• Business Plan: A three-year business plan must be submitted to the MGA. This should include revenue and profit forecasts as well as details on primary target markets. At DW&P, we can assist in preparing these financial projections based on your data to meet the business plan requirements.
• Policies and Procedures: The MGA has clear guidelines regarding operational procedures, particularly for legal compliance. If you already have procedure manuals, we can review them for MGA compliance and make necessary adjustments. Alternatively, we can draft new policy documents for any areas where you currently lack documentation.
• Terms and Conditions: The MGA requires a copy of the Terms and Conditions (T&Cs) that will apply between the company and its players. We can draft these in accordance with MGA requirements, tailored to your specific products and player eligibility criteria.

Technical Infrastructure and System Architecture

A critical part of the MGA system audit involves documenting your technical infrastructure and IT workflows. Once all documentation is submitted and any necessary changes are implemented, this will be reviewed by an external auditor. You can view the specific requirements in the MGA's system checklist.

• Server Register: A register of all servers and virtual machines used by the company, including specifications (brand, model, functions, internal IP address, OS software).
• Network Diagram: A schematic representation of your entire network layout.
• Software List: A list of all major software applications used (e.g., MySQL, Java, PHP) and their current version numbers.
• Location & Replication: Under MGA rules, production servers must generally be located within the EU/EEA. Furthermore, the player database, financial transactions, and gaming transactions must be replicated in real-time to a server or virtual machine physically located in Malta. This means you will require a data centre presence in Malta. We can introduce you to reliable local data centre providers if needed.

Gaming System Specifications

The MGA reviews comprehensive information regarding the specific games your company intends to offer. The focus is on verifying that the calculation of odds/winnings is legally compliant and that measures are in place to prevent fraud.

The following details must be documented:

• Details of the games, including a list, screenshots, and descriptions of all available buttons/functions;
• Procedures for flagging high stakes or significant winnings;
• Measures to monitor and prevent collusion;
• Measures to detect money laundering transactions;
• Mechanisms to detect if players are using bots or automated devices;
• Details on liquidity distribution.

Submission of Agreements

To verify your company's processes and responsibilities, the MGA requires copies of various internal and external contracts. This starts with clarifying which Key Functions are handled by internal staff and which are outsourced to external service providers (including other companies within your group).

You must also identify the data centres you intend to use. For all Payment Service Providers (PSPs), you should provide a list and draft agreements. Additionally, you must select an Alternative Dispute Resolution (ADR) entity from the MGA's approved list to handle player disputes.

The Process Moving Forward

Once all necessary documents and policies have been drafted and collated, we will work with you to submit the application for a gambling licence to the MGA.

The MGA will review these documents in detail. Following this review, you will receive a report outlining any required changes that must be implemented before the system audit. Together with our technical experts, we can initiate a mock audit of your systems to ensure you are fully prepared for the official inspection.

If the external system audit confirms compliance with all requirements, the MGA will issue the gambling licence, allowing your company to commence operations immediately.

Summary

Applying for a gambling licence from the Malta Gaming Authority involves extensive requirements, ranging from complex legal, commercial, and technical documentation to strict due diligence on beneficial owners and key staff.

At DW&P, we have supported numerous companies through this process over the last decade. We guide you from the initial gathering of documents to the drafting of required policies, ensuring compliance with all technical, economic, and legal standards.

Are you planning to apply for a gambling licence in Malta? Contact us today to schedule a consultation with one of our experienced advisors.