iGaming payments in Malta

Read the two curves together and the hub's shape in 2026 is clear. Malta is turning from a place where operators hold their primary license into a place where platforms, studios and payment intermediaries hold theirs, and where an operator licensed elsewhere in the EU keeps a Maltese footprint through a Recognition Notice at EUR 5,000 a year, of which the MGA issued 32 in 2025. The MGA writes this down itself: a growing number of jurisdictions require local licenses, operators are adopting multi-jurisdictional strategies, and the sector is moving from a license-driven to a service-driven model. For a payments reader the consequence is that the counterparty on a Maltese license is more often a B2B supplier than a book, and the book behind it may be licensed in three other countries whose rules on the cashier override Malta's.

A B2C license costs EUR 5,000 to apply for and EUR 25,000 a year to hold, and the real price is the compliance contribution charged monthly on gaming revenue wherever it was earned: for casino, 1.25% of the first EUR 3 million sliding to 0.40% above EUR 30 million, capped at EUR 375,000 per license period; for fixed-odds betting, 4% of the first EUR 3 million sliding to 0.40%, capped at EUR 600,000. The bands have not moved since the fee regulations took effect in January 2018. What has moved is the balance-sheet test. The EUR 100,000 share-capital floor for Type 1 and Type 2 is older; what the capital policy of 2 July 2025 added is positive equity: a negative balance at year end has six months to be repaired, with up to five years for holes that already existed at the end of 2024. A B2B supplier pays EUR 25,000 to EUR 35,000 a year by revenue band and no contribution at all, which is one more reason the base is tilting toward B2B.

Malta's largest bank keeps online gaming and betting on its restricted-categories list, not the prohibited one: Bank of Valletta accepts a gaming company after enhanced due diligence, case by case, with no published criteria, and refuses professional gamblers as customers outright. The last time it moved at scale was October 2019, when it began a de-risking exercise its chief executive described as a new risk profile agreed with the European Central Bank, gave licensees such as YoBetIt two months to move their funds and fifteen days before their cards stopped, then conceded that some of the letters had gone to clients who should never have received them. The second bank left earlier and more quietly. HSBC Malta's refusal of credit-card transactions for online gaming became public in May 2014, and on 23 December 2025 HSBC Continental Europe signed the sale of its 70% stake in HSBC Malta to Greece's CrediaBank for EUR 200 million, a deal HSBC Malta's chief executive said in August 2026 he expects to close in the second quarter of 2027. APS, Lombard, MeDirect, FIMBank and Sparkasse take no public position on gaming; Sparkasse's 2025 annual report does not contain the word.

The Player Protection Directive explains why an e-money institution, not a bank, is the normal home for an MGA licensee's money. Player funds must sit at a licensed credit, financial or payment institution in Malta, the EEA or another jurisdiction the Authority approves, the arrangement needs the Authority's approval, the balance may never fall below 90% of what players are owed with the rest allowed in transit, and the MGA keeps viewing rights on the account. A licensee that a Maltese bank turns away can satisfy every word of that with a Maltese or Lithuanian EMI. The Authority's own balance sheet carries EUR 8.7 million of player funds passed to it from accounts dormant for more than 30 months and from surrendered licenses. The institutions that pass our register test are profiled in the banking section, Bank of Valletta and FinXP among them, and Trust Payments in the catalog; what MGA licensed actually means on a payment company's website is in MGA-licensed payment providers.

The MGA approves no payment method and licenses no payment company; what it approves is where player funds sit. Article 45 of the Gaming Authorisations and Compliance Directive lets a licensee take and make payments through any provider it has notified to the Authority and that the Authority has not told it to stop using. Adding or dropping a method or a provider is notified within 30 days of the change under Article 37; the risk rating the licensee assigns to a method feeds the risk rating of the player using it. Around that sit the rules that do bind the cashier: no credit from the operator, ever; withdrawals within five working days where practicable and back to the originating account where possible; customer due diligence at EUR 2,000 of cumulative deposits, lifetime or in any 180 days, under the FIAU's remote-gaming procedures; and a Player Funds Report to the Authority every month, 1,757 of them in 2025.

• Visa/Mastercarddominant

  local cards

  Cards led deposits across MGA licensees in 2025 at 44.3%, and at Maltese-facing cashiers they come first: IZIBET takes credit and debit cards from EUR 20, Betsson from EUR 10. No credit-card ban exists; the Gaming Act only forbids the operator itself extending credit. Acquiring under an MGA license sits with Malta-based acquirers such as Trust Payments (Malta) and Truevo, and with BOV Accept only where the bank explicitly authorizes the merchant.

• Revolutdominant

  e-wallet

  Revolut puts 68% of Maltese adults, about 300,000 people, on its books (July 2024), which makes it the closest thing Malta has to a domestic instant rail. IZIBET takes Revolut deposits and pays out to Revolut instantly, against one to four days for cards and three to five for a bank transfer.

• SEPA bank transfermajor

  bank transfer

  34.5% of deposits and 68.5% of withdrawals across MGA licensees in 2025, the default payout rail. Sending SEPA Instant became mandatory for euro-area banks on 9 October 2025; Bank of Valletta switched outward instant payments on from 6 October 2025 at no extra charge, with Verification of Payee.

• Skrill / Neteller / Payzmajor

  e-wallet

  14.6% of deposits and 16.8% of withdrawals MGA-wide in 2025. IZIBET and Betsson both carry the Paysafe pair, with Payz beside them.

• paysafecardminor

  vouchers & cash

  Cash still pays for 67% of point-of-sale transactions in Malta by count (ECB SPACE 2024), the highest band in the euro area, but the voucher rail barely reaches the cashier: Betsson lists paysafecard; IZIBET does not.

1. 1

   The MGA approves the setup

   Since 30 January 2023 a licensee needs the Authority's prior approval for any deposit setup with crypto on either side: crypto received as crypto, crypto received as fiat, fiat received as crypto. Coins with built-in anonymization are prohibited outright, and the platform may not function as an exchange.

2. 2

   The provider must be authorized

   The policy allows only service providers authorized under Maltese law, which since 1 July 2026 means a MiCA crypto-asset service provider. Payhound, BVNK's Maltese entity and OpenPayd's OP Digital Services are on that register; the operator's cashier is not.

3. 3

   Limits count in euros

   The player's limits under the Player Protection Directive, set in fiat, apply to crypto deposits at their fiat value, cumulatively with fiat deposits; a deposit that would breach one is rejected, or the excess returned to the player.

Malta's financial regulator put 22 entries on the MiCA register by August 2026, 20 authorizations and two Article 60 notifications, nine of them between 29 May and 30 June, the month before the transitional period closed: OpenPayd's OP Digital Services, Strike, FalconX, Xcoins, Bequant among them, after BVNK's System Pay Services (Malta) in February. Two things frame that list. In July 2025 ESMA published a fast-track peer review of the MFSA, prompted by events it did not describe, which questioned the timing of one authorization granted while material issues were unresolved, and credited the authority with adequate expertise and resources. And in March 2026 the MGA put crypto assets in online gaming on its supervisory agenda for the year, alongside cash, as a thematic review of internal controls. The routes that pass both regulators are on the crypto gateways page; the register logic is in MiCA and the CASP cliff.

Any MGA licensee may take Maltese residents by default; the price is the gaming tax on that revenue. Malta pays cash for 67% of purchases at the till by count, the highest band in the euro area in the ECB's 2024 survey, and carries Revolut on 68% of its adults by Revolut's own 2024 count, so the domestic cashier is cards first, Revolut second, and a wallet pair from Paysafe behind them. IZIBET, run by IZI Interactive under an ordinary B2C license from 2016 rather than the lottery concession, takes Visa, Mastercard, Maestro, Skrill, Neteller, Revolut and Payz from EUR 20 with no fee, and pays Revolut and wallets instantly against one to four days for a card and three to five for a bank transfer; the National Lottery's online casino, same company, same license, shows the same logos plus bank transfer. Betsson's cashier adds paysafecard on the way in and Trustly on the way out, from EUR 10. Nothing in Maltese law bans credit cards at a cashier; the Gaming Act only bans the operator extending credit. There is no affordability rule, no statutory deposit cap, and no unified self-exclusion register online, only the land-based one: the Player Protection Directive requires an operator to offer limits and ask about them before the first deposit, and the MGA's mystery-shopping review of 2025, published in February 2026, found four of twenty licensees failing to prompt for limits at registration or first deposit and three letting a self-excluded player open an account at a sister brand.

For a book with a real Maltese customer base the arithmetic is unpleasant but small, because the base is small: the MGA collected EUR 21.5 million in contributions, fees and tax from the National Lottery in 2025 and EUR 21.6 million from the four casinos, and those are the only operators whose Maltese revenue the Authority publishes. For an online book the change lands in the data more than the ledger. Taxability for distance gaming turns on where the player is established or resides, which the regulations already said, so the address and residence fields in the KYC and payment stack decide what is taxable, and a book that treats a Maltese IBAN or a Maltese card BIN as a residence signal without a rule for it will over- or under-declare from the first return. Corporate-group licensees are taxed as one person. The VAT side is the larger structural shift: Legal Notice 86 narrows the exemption to what the minister approves, and the tax authority's April guidelines approve low-risk games, occasional junkets and on-site betting at sporting events, so a remote casino's supplies fall under ordinary place-of-supply rules and its input VAT becomes recoverable.

1. Oct 1, 2026

   gaming tax triples for Type 1, device levy goes

2. Every dated obligation we track sits on the compliance calendar.