MGA-Licensed Payment Providers: Malta's License That Does Not Exist

No payment provider holds a Malta Gaming Authority license. The MGA licenses two things, gaming services and critical gaming supplies, and payment processing is neither, so a PSP described as MGA licensed is a PSP that serves MGA-licensed operators. Its own credential in Malta, where it has one, is a payment or e-money license from the Malta Financial Services Authority, and the MGA reaches the PSP only through the rules it sets for operators.

At the end of 2025, 302 gaming companies held MGA licenses, which is why an MGA reference carries weight in a PSP pitch. A procurement checklist that accepts "MGA licensed" as the provider's own license has checked nothing. Of the 78 providers rated here, 24 serve MGA-licensed operators, and none of them holds an MGA license.

MGA license types: B2C gaming service and B2B critical supply

The Gaming Act 2018 (Cap. 583) and the Gaming Authorisations Regulations (S.L. 583.05) create two license types. The B2C Gaming Service License covers offering games to players. The B2B Critical Gaming Supply License covers suppliers, and the regulations define the supply it covers:

...supply and management of material elements of a game; and/or supply and management of software, whether as a stand-alone or as part of a system, to generate, capture, control or otherwise process any essential regulatory record; and/or the supply and management of the control system itself on which such software resides.

The definition covers game content, RNGs and the platform software that holds regulatory records, and payment processing falls outside it. The MGA's B2B licensing serves game providers and back-office platforms, and none of its routes covers a payment service. Below the license sit a voluntary certificate for material, non-critical supplies and a recognition notice for suppliers licensed elsewhere in the EEA, and both cover gaming supply only.

On July 23, 2026, the B2B suppliers registered under William Hill's MGA license were Evolution, Play'n GO, Yggdrasil, Relax Gaming and Playtech, all game and software companies and none of them a payment processor. Critical supply is also the license class that keeps growing while the operator class shrinks. MGA licensees held 171 critical-supply licenses at the end of 2025, up from 164 a year earlier and from 68 in 2018, against 131 B2C licenses, down from 147.

When a payment cashier needs an MGA license

A payments company needs a gaming service license of its own in one case. Article 28(2) of the Gaming Authorisations and Compliance Directive presumes that an outsourced provider which contracts with players directly, or handles player registration together with deposits and withdrawals, needs that B2C license, unless it processes those registrations and payments only to facilitate the licensee's service. A white-label cashier that takes over the player relationship is an operator in the MGA's eyes.

The trigger is the player relationship, and software is a separate question. A platform whose cashier module generates or processes essential regulatory records can need a B2B license for that software, while the funds flow falls to the MFSA under the Financial Institutions Act. Cashier orchestration on its own fits neither MGA class, which is why Fluid, a Cyprus-registered orchestrator that runs casino cashiers, holds no MGA license.

MGA rules for an operator's payment providers and player funds

The MGA governs payments through obligations on its operator licensees, set out in Directive 3. Under Article 45(1) a licensee may accept and make player payments only through payment providers it has notified to the Authority, and only while the Authority has not instructed it to stop using one. Malta keeps no pre-approved PSP list and certifies no PSP, though the Authority can bar a specific provider from a specific licensee's cashier at any time. Under Article 37(1), the licensee notifies the MGA within 30 days when it adds or drops a payment method or a PSP.

Player money gets stricter rules under the Player Protection Directive. Player funds must sit in a licensed credit, financial or payment institution, and the Authority approves the account setup under Article 31. The approval goes to the operator's arrangement, and it is the closest a payment or e-money institution ever comes to MGA approval. The funds are segregated as the players' own patrimony, the balance must cover player liabilities at all times with at least 90% held in the accounts, and withdrawals go out within 5 working days where practicable.

Crypto follows the same split between gaming and financial regulation. Since January 30, 2023, when its policy on distributed ledger technology replaced the 2018 sandbox, the MGA has required its prior approval for any deposit setup with crypto on either side, and since July 1, 2026, the crypto service provider behind such a setup must be a MiCA-authorized CASP.

The MGA's hold on a PSP therefore comes down to three acts. The operator notifies the provider, the Authority can veto it, and the Authority approves the account that holds player funds and any crypto deposit setup. None of the three licenses the PSP.

MFSA payment and e-money licenses in Malta

A payment provider's license in Malta comes from the Malta Financial Services Authority under the Financial Institutions Act (Cap. 376). A payment institution needs initial capital of EUR 20,000 to EUR 125,000 depending on its services, an e-money institution needs EUR 350,000, and both licenses passport across the EU and EEA. Each license sits on a named legal entity with a Maltese company number, the C-number, and a license class.

Trust Payments (Malta) Ltd, C56013, has held an MFSA payment institution license since June 21, 2012, and acquires cards across the EU on its passport. MiFinity Malta Limited, C64824, has been an MFSA e-money institution since January 10, 2020. Xace Malta Ltd, C102626, has held a narrower payment institution license since January 18, 2024, covering money remittance and payment execution only, with no e-money and no acquiring. System Pay Services (Malta) Limited, C66961, BVNK's Malta entity, has held an e-money license since February 2, 2016, and a MiCA CASP authorization since February 13, 2026. Mastercard closed its acquisition of BVNK on August 3, 2026, and the entity kept both. All four groups also hold FCA authorizations for the UK.

Anti-money-laundering supervision sits with a third body, the Financial Intelligence Analysis Unit (FIAU), which oversees gaming operators and licensed payment institutions alike. On August 27, 2026, the FIAU closed a settlement with MiFinity Malta Limited over AML breaches found in a 2023 compliance examination, cutting a EUR 266,833 penalty to EUR 160,099.

Registering with the FIAU as a subject person is an AML obligation that licenses nothing, and the FIAU keeps no public register of subject persons. Citadel Commerce (Malta) Ltd, C39694, Paramount Commerce's Malta entity, holds an FIAU registration and no MFSA payment or e-money authorization. A C-number only proves that a Maltese company exists. The license is the MFSA class attached to it.

How to check a PSP's Malta license

A PSP's Malta credential and its MGA relationship are two separate questions. For the license, ask for the legal entity and its C-number, then look the entity up in the MFSA Financial Services Register or the EBA's register of payment and e-money institutions and confirm a payment institution or e-money class. For a crypto cashier, your due-diligence file also needs the provider's MiCA CASP authorization and your MGA approval under the distributed ledger policy.

For the gambling side, ask which MGA-licensed operators the PSP serves and whether the MGA has ever instructed a licensee to stop using it, and make sure the provider is in your Article 45 notification to the Authority. A provider that answers both questions with "MGA licensed" has answered neither.