Setting up a Crypto Exchange in Malta


The pop­u­lar­i­ty of Cryp­to-Exchanges is on the rise. With more entre­pre­neurs will­ing to set up these plat­forms, it makes sense to analyse the impor­tant role Mal­ta [now ubiq­ui­tous­ly known as ‘Blockchain Island’] is play­ing in this new realm of inno­v­a­tive cryp­tocur­ren­cy-based ser­vices.

Quite frankly, giv­en the per­ceived ‘high risk’ when deal­ing with Exchanges, Mal­ta has tak­en the ground-break­ing step to guar­an­tee ‘legal cer­tain­ty’. This is being done by com­pre­hen­sive­ly pro­mul­gat­ing a set of laws which pri­mar­i­ly seek to offer investor pro­tec­tion based on Malta’s already-sound and robust finan­cial ser­vices leg­is­la­tion.

Through­out this arti­cle, Dr. Wern­er & Part­ner will attempt to elu­ci­date why ‘set­ting up shop’ in Mal­ta is the best option for any prospec­tive VFA Exchange Oper­a­tor and how DWP VFA Agent Ltd. will be your best bet when attempt­ing to ensure that the process is manged and com­plet­ed as smooth­ly as pos­si­ble.

Class 4 License.

VFA [Vir­tu­al Finan­cial Asset] Oper­a­tors seek­ing to acquire accred­i­ta­tion to man­age and oper­ate a Cryp­to-Exchange will need to acquire a license in terms of Arti­cle 8(1) of Sub­sidiary Leg­is­la­tion 590.01 of the Vir­tu­al Finan­cial Assets Act. In fact, the MFSA ‘shall set out in the license, the nature of the activ­i­ties which par­tic­u­lar license hold­ers may car­ry out’. In this con­nec­tion, to oper­ate an Exchange, cus­tomers will require a Class 4 License which also implies that ‘hold­ers may hold or con­trol clients’ assets or mon­ey in con­junc­tion with the pro­vi­sion of a VFA Ser­vice’. This is an impor­tant point, espe­cial­ly when the MFSA con­sid­ers the clients’ ‘seg­re­ga­tion of assets’ to be of para­mount impor­tance.

The essence of operating from Malta.

The Leg­is­la­tor places a strong empha­sis on ensur­ing that a prospec­tive license hold­er has some form of ‘pres­ence’ on the island. Whilst the issue of ‘sub­stance’ will be dealt with lat­er, the law states that a ‘per­son wish­ing to be licensed to pro­vide a VFA ser­vice shall be a legal per­son estab­lished in Mal­ta’. This clause auto­mat­i­cal­ly implies that the Ser­vice Hold­er shall be a Lim­it­ed Lia­bil­i­ty Com­pa­ny. In fact, the objects of the com­pa­ny will be expect­ed to reflect that the body cor­po­rate will be oper­at­ing a VFA Exchange in terms of the Vir­tu­al Finan­cial Assets Act, Cap. 590 of the Laws of Mal­ta. As VFA Agents, our team of experts will also be able to guide you vis-à-vis the set­ting up and estab­lish­ment of a Com­pa­ny, and this in terms of the Com­pa­nies Act, Cap. 386 of the Laws of Mal­ta.

The VFA Agent Requirement.

A per­son seek­ing to obtain a License to oper­ate a VFA Exchange ‘shall appoint a VFA Agent reg­is­tered with the MFSA in terms of Chap­ter 1 of the MFSA’s Fin­tech Rule­book. Notice how the leg­is­la­tor has placed an empha­sis on the manda­to­ry oblig­a­tion to use an agent with the word ‘shall’. There­fore, the onus is on the License Hold­er to seek & engage an Agent accord­ing­ly[1]. In this con­nec­tion, as stat­ed in Rule­book 3, ‘the appli­cant shall ensure that all com­mu­ni­ca­tions, meet­ings, noti­fi­ca­tions and sub­mis­sions to the MFSA are made through its VFA Agent’.

In pre­vi­ous DWP arti­cles, men­tion was made that a VFA Agent appoint­ed in terms of Arti­cle 7 of the VFA Act [deal­ing with Ini­tial VFA Offer­ings], has an on-going obligation/relationship with the Issuer. How­ev­er, in terms of Arti­cle 14 [which is what oper­a­tors of a VFA Exchange will notice], the VFA Agent’s rela­tion­ship with the License Hold­er tech­ni­cal­ly ends upon the grant­i­ng and approval of a license. This is the fun­da­men­tal dif­fer­ence between an ICO/IVFAO and a VFA Exchange. How­ev­er, as stat­ed in R3‑ ‘the Appli­cant may appoint its VFA Agent to under­take the Com­pli­ance func­tion’ accord­ing­ly.

The Auditing obligation.

For the pur­pos­es of this write-up, the ‘Audit­ing’ func­tion will be divid­ed into 1) Internal/External Audi­tors and 2) Sys­tems Audi­tors.

Arti­cle 50(1) of the VFA Act states that the ‘Licence Hold­er shall appoint an audi­tor who shall the duty to report imme­di­ate­ly to the com­pe­tent author­i­ty any fact or deci­sion which e.g. is like­ly to lead to a seri­ous qual­i­fi­ca­tion or refusal of the auditor’s report on the accounts of a license’.

More­over, the Audi­tor has an oblig­a­tion to ‘report annu­al­ly to the com­pe­tent author­i­ty on the licence holder’s sys­tems and secu­ri­ty access pro­to­cols in the man­ner and for­mat required by the com­pe­tent author­i­ty’. The MFSA’s con­sent is required pri­or to the appoint­ment or replace­ment of an audi­tor.

In terms of Arti­cle 39(d) of the act, the MFSA may also require ‘an audit of a per­son reg­u­lat­ed under this Act’ accord­ing­ly. Also, in terms of Rule­book 3 [specif­i­cal­ly R3‑], the Licence Hold­er ‘shall estab­lish and main­tain an inter­nal audit func­tion which is sep­a­rate and inde­pen­dent from the oth­er func­tions and activ­i­ties of the Licence Hold­er’. Essen­tial­ly, the Inter­nal Audit will seek to ensure that the Ser­vice Provider has a prop­er audit plan in place to ensure the Licence Holder’s effec­tive man­age­ment of inter­nal con­trol mech­a­nisms, issue rec­om­men­da­tions, ver­i­fy com­pli­ance with rec­om­men­da­tions and to report in rela­tion to inter­nal audit mat­ters.

Sys­tem-con­trols and hav­ing a robust cyber-secu­ri­ty frame­work are imper­a­tive con­sid­er­a­tions for the MFSA. It goes with­out say­ing that the tech­nolo­gies deployed will cer­tain­ly be sub­ject to an exter­nal tech­ni­cal audit which [gen­er­al­ly speak­ing] is best pro­vid­ed through the engage­ment of a Sys­tems Audi­tor.

The laws also spec­i­fy that ‘when­ev­er’ an Inno­v­a­tive Tech­nol­o­gy Arrange­ment[2] is in place, the Author­i­ty ‘may’ require the Licence Hold­er to appoint a Sys­tems Audi­tor. (The MFSA’s approval will be required pri­or to the appoint­ment and/or replace­ment of a Sys­tems Audi­tor). More­over, the Licence Hold­er shall ensure that its ‘Sys­tems Audi­tor pre­pares a sys­tems audit report on its own ITAS and that a copy is also for­ward­ed to the MFSA’.

Licensing Considerations.

The MFSA will con­sid­er cer­tain key fac­tors when deter­min­ing whether or not a license will be grant­ed. These con­sid­er­a­tions will include (i) the pro­tec­tion of investors and the gen­er­al pub­lic (ii) the pro­tec­tion of Malta’s rep­u­ta­tion (iii) the pro­mo­tion of inno­va­tion & com­pe­ti­tion (iv) suit­abil­i­ty of the appli­ca­tion etc. These points also tie in with the next salient pro­vi­sion which entails that the Author­i­ty will also con­sid­er a license based on a Fit­ness and Proper­ness exam­i­na­tion and the ‘onus’ of pro­vid­ing suf­fi­cient to the MFSA that the pro­posed appli­cant is Fit and Prop­er will pri­mar­i­ly rest with the Appli­cant and its VFA Agent.

The Fitness and Properness Test

In this con­nec­tion, in terms of Rule­book 3, all prospec­tive Licence Hold­ers will be required to prove to the sat­is­fac­tion of the MFSA, that they have passed a Fit­ness and Proper­ness test (F&P). The test itself will be based on the fol­low­ing three key facets: (i) Integri­ty (ii) Sol­ven­cy and (iii) Com­pe­tence.

The F&P is also linked with the over­all man­age­ment of the company/service provider. So much so, that the test is applic­a­ble to every per­son that has a qual­i­fy­ing hold­ing share, ben­e­fi­cial own­er, mem­ber of the board of Admin­is­tra­tion, Senior Man­ag­er, MLRO, Com­pli­ance Offi­cer, Risk Man­ag­er and any oth­er per­son who will be direct­ing the busi­ness of the Appli­cant.

Giv­en these require­ments, it is unde­ni­ably obvi­ous that the MFSA will require sev­er­al key per­sons who will form part of the Busi­ness and Man­age­ment admin­is­tra­tion of the Com­pa­ny to be prop­er­ly vet­ted. More­over, as already seen dur­ing the set­ting up of the VFA Agent struc­ture, the Author­i­ty will most cer­tain­ly empha­size that at a min­i­mum, an appli­cant will be able to demon­strate that the busi­ness will be man­aged by a group of indi­vid­u­als in strict adher­ence with the ‘Dual Con­trol’ prin­ci­ple.

This robust frame­work is aimed at noth­ing else but ensur­ing that the man­age­ment of the Ser­vice Provider is ‘tai­lor-made’ to ensure that investor pro­tec­tion is at the fore­front of the day-to-day oper­a­tions.

Policies and Procedures

Whilst an in-depth analy­sis of the required poli­cies and pro­ce­dures will be tack­led in anoth­er arti­cle, appli­cants should be made aware of the fact that the Author­i­ty has placed a strong empha­sis on the Licence Hold­er ensur­ing that robust ‘Poli­cies and Pro­ce­dures’ are in place. To this end, in terms of R3‑ the Licence Hold­er ‘shall estab­lish imple­ment and main­tain’ inter alia doc­u­ments such as a: Cyber­se­cu­ri­ty Pol­i­cy, Account­ing Pol­i­cy, Busi­ness Con­ti­nu­ity Pro­ce­dure, Key Man­age­ment Pol­i­cy etc. The Licence Hold­er shall also ‘take into account the nature, scale and com­plex­i­ty of its busi­ness’ accord­ing­ly.

Initial Capital Requirements & Annual Fees.

VFA Exchange oper­a­tors will need to note that the com­pa­ny will need to ‘main­tain an amount equal to the ini­tial cap­i­tal required for the autho­ri­sa­tion’ and vis-à-vis Exchanges, this amount should be not less than 730,000 EUR [ful­ly paid-up][3].

Rule­book 3 spec­i­fies that ‘the Licence Hold­er shall prompt­ly pay all amounts due to the MFSA’ includ­ing an Annu­al Super­vi­so­ry Fee which shall be payable by the Ser­vice Provider on the day that the audit­ed finan­cial state­ments are sub­mit­ted to the Author­i­ty. Upon autho­ri­sa­tion, the com­pa­ny will be required to pay the min­i­mum annu­al super­vi­so­ry fee for the first year of oper­a­tion ‘upon receipt of the License’.

This fee is payable pro­por­tion­ate to the peri­od remain­ing between the date of licens­ing grant and the sub­mis­sion of the annu­al accounts. For per­sons oper­at­ing a Class 4 License, the Application/Notification fee is that of EUR 24,000 and the Annu­al Super­vi­so­ry fee will depend on rev­enue accord­ing­ly. For rev­enue up to EUR 1 mil­lion, the fee will be 50,000 EUR and for ‘fur­ther tranch­es of EUR 1 mil­lion up to a max­i­mum of EUR 100 mil­lion, the fees will be 5,000 EUR per tranche or part there­of’.

The Business Plan

The MFSA has made its inten­tions clear regard­ing hav­ing in place prop­er man­age­ment struc­tures and this via the exi­gency of ensur­ing that the Ser­vice Provider has a prop­er­ly struc­tured Busi­ness Plan. It would be rec­om­mend­ed that the Board of Admin­is­tra­tion would be heav­i­ly involved in the plan’s set up but not with­out also involv­ing the VFA Agent’s exper­tise.

Here at DWP VFA Agent Ltd, our team of experts can rec­om­mend an approved struc­ture which will form an essen­tial barom­e­ter when dis­sem­i­nat­ing infor­ma­tion to the rel­e­vant author­i­ty. More­over, the Agent can help the appli­cant ‘tai­lor-make’ the Busi­ness Plan by also sug­gest­ing and vet­ting pro­posed per­sons who will be involved in the day-to-day man­age­ment of the Com­pa­ny [and this of course on a case-by-case basis].

The essence of ‘substance’.

Based on pri­or expe­ri­ence with exist­ing and reg­u­lat­ed enti­ties, ‘sub­stance’ will cer­tain­ly be a key ele­ment when deter­min­ing whether or not the MFSA will grant a license to any appli­cant to act as a VFA Ser­vice Provider. There will cer­tain­ly be the require­ment for ‘res­i­dence’ of the key person/official involved in the Com­pa­ny [in an anal­o­gous mod­el used by Gam­ing Com­pa­nies] which con­clu­sive­ly also sug­gests that an office will be required to for­mal­ly ‘set up shop’ in Mal­ta.

In this con­nec­tion, the over­all and antic­i­pat­ed approach of the MFSA will cer­tain­ly equate to ‘phys­i­cal pres­ence’ on Blockchain Island- as this would be the best option for the Author­i­ty to mon­i­tor and reg­u­late all appli­cants accord­ing­ly. Apart from the afore­men­tioned facts, is the gen­er­al reg­u­la­to­ry require­ments imposed by local banks and Tax Author­i­ties that sub­stance goes hand in hand with a phys­i­cal pres­ence – which, more often than not, implies hav­ing some senior man­age­ment present in Mal­ta, a Com­pa­ny Sec­re­tary who is also res­i­dent on the island and gen­uine fis­cal sub­stance.


DWP VFA Agent Ltd. is already in pos­ses­sion of the In-Prin­ci­ple Approval and has already com­menced advis­ing var­i­ous appli­cants accord­ing­ly [although ful­ly-fledged ser­vices will be offered once the Cer­tifi­cate of Reg­is­tra­tion is grant­ed by Fin­tech].

The impor­tance of the VFA Agent can nev­er be dis­count­ed espe­cial­ly in light of the seem­ing­ly cum­ber­some reg­u­la­tions that are already in place. Whilst some might be dis­suad­ed by the fact that the require­ments could be tedious and tax­ing, the ‘legal cer­tain­ty’ that Mal­ta has enshrined in its VFA Laws ensures that ‘investor pro­tec­tion’ and ‘good gov­er­nance’ are at the fore­front of any busi­ness endeav­our.

In this con­nec­tion, a rep­utable VFA Agent and a sound busi­ness plan should cer­tain­ly be the key ingre­di­ents in a promis­ing appli­ca­tion that will even­tu­al­ly be pre­sent­ed to the MFSA.


The above-men­tioned arti­cle is sim­ply based on inde­pen­dent research car­ried out by Dr. Wern­er and Part­ner and can­not con­sti­tute any form of legal advice. If you would like to meet with up with any of our rep­re­sen­ta­tives to seek fur­ther infor­ma­tion, please con­tact us for an appoint­ment.

[1] Although, strict­ly speak­ing, more than one Agent may be appoint­ed pro­vid­ed that pri­or noti­fi­ca­tion is grant­ed to the MFSA explain­ing the dif­fer­ent respon­si­bil­i­ties that will be under­tak­en by the respec­tive Agents.

[2] In terms of the First Sched­ule of the ITAS Act, this arrange­ment is defined as either being ‘soft­ware and archi­tec­tures which are used in design­ing and deliv­er­ing Dis­trib­uted Ledger Tech­nol­o­gy and smart con­tracts & relat­ed appli­ca­tions.

[3] As estab­lished in Sub­sidiary Leg­is­la­tion 590.01, the cap­i­tal require­ments are com­men­su­rate to the type of license obtained. In this con­nec­tion, a VFA Class 1 Licence [pri­mar­i­ly deal­ing with Invest­ment Advice and recep­tion and trans­mis­sion of orders is EUR 50,000 or 25,000 EUR + Insur­ance. A Class 2 Licence [pri­mar­i­ly deal­ing with the hold­ing and con­trol­ling of clients’ funds] is 125,000 EUR and a Class 3 Licence [for oper­a­tors will­ing to deal on own account] is priced at 730,000 EUR.

About Dr. Michael Calleja

Dr. Michael Calle­ja, born on the 07.01.1988, stud­ied law at the Uni­ver­si­ty of Mal­ta from 2006 till 2012. He grad­u­at­ed Bach­e­lor of Laws & Euro­pean Stud­ies in 2009 with a Sec­ond Class Upper Degree and grad­u­at­ed Notary Pub­lic in 2010. He suc­cess­ful­ly defend­ed his the­sis enti­tled: ‘Beyond the Bosman Rul­ing: Con­trac­tu­al Dis­putes in Foot­ball and the Spe­cif­ic Nature of Sport in the Euro­pean Union’ in 2012 and obtained his Doc­tor of Laws (LL.D) accord­ing­ly.

View All Posts

Leave a Reply

Your email address will not be published.