MGA-Licensed Payment Providers: The License That Does Not Exist

A payments vendor published a ranking of Europe's top casino PSPs this March with itself in first place and this credential attached: "Fully licensed under the Malta Gaming Authority." A payment-broker site runs an entire page category called "MGA Licensed Gaming Payments." A merchant-account seller tells operators the MGA "mandates pre-approved payment provider lists." All three statements describe a license class that does not exist. The Malta Gaming Authority does not license payment providers, has no register category for them, and its own directives spell out a different relationship entirely.

This matters beyond pedantry because "MGA licensed" is doing sales work. Malta is the EU's largest online gambling hub, an MGA reference signals regulated-market credibility, and an operator's procurement checklist that accepts the phrase at face value has verified nothing. In our own catalog, 22 of 74 providers reference the MGA in their supported-licenses field; on our cards that field reads "Supported Gambling Licenses" and means the provider serves MGA-licensed operators, because after auditing Malta's registers in July 2026 we concluded no payment provider can mean anything else by it.

Two license classes, and payments is not one of them

The Gaming Act 2018 (Cap. 583) and its Gaming Authorisations Regulations create two license types, and only two. The B2C Gaming Service Licence covers offering games to players. The B2B Critical Gaming Supply Licence covers suppliers, and the regulations spell out the covered supply:

...supply and management of material elements of a game; and/or supply and management of software, whether as a stand-alone or as part of a system, to generate, capture, control or otherwise process any essential regulatory record; and/or the supply and management of the control system itself on which such software resides.

That is game content, RNGs, and the platform software holding regulatory records. Payment processing appears nowhere in the definition, and the MGA's own B2B application page, titled "Game Providers and Back Office," does not mention payment services once. Below the license tier sit a voluntary certificate for material (non-critical) supplies and recognition notices for suppliers licensed elsewhere in the EEA, both still gaming supply, still not payments.

The register mirrors the law. We checked the MGA Licensee Register on July 23, 2026: its service filter offers two options, "B2C - Gaming Service Licence" and "B2B - Critical Supply Licence," and no payments category exists in the taxonomy. Pull up a large operator's record and the pattern is visible in the data: William Hill's authorisation lists B2B suppliers Evolution, Play'n GO, Yggdrasil, Relax Gaming and Playtech, game and software companies all, with not one payment processor among them. The B2B class is growing fast, 171 critical-supply licenses in the 2025 annual report against 131 B2C, but every one of them is a gaming supplier.

The exception that proves it: when a cashier really does need MGA licensing

There is one route by which a payments-adjacent company can be dragged into MGA licensing, and its shape confirms the rule. Article 28(2) of the Gaming Authorisations and Compliance Directive presumes that an outsourced provider which contracts with players directly, or handles player registration together with deposits and withdrawals, requires a gaming service license of its own, unless it processes those registrations and payments solely to facilitate the licensee's service. A white-label cashier that starts owning the player relationship stops being a vendor and becomes, in the MGA's eyes, an operator.

Note what the trigger is: operating the player relationship, not moving money. A platform whose cashier module generates or processes essential regulatory records can need a B2B license for that software. The funds flow itself is regulated by a different authority under a different law, which is the entire point of the distinction.

Notify and veto: the actual MGA rules about payment providers

The MGA governs payments through obligations on its operator licensees, and the mechanism is written in Directive 3. Article 45(1) permits licensees to accept and make player payments only through payment providers notified to the Authority, and only so long as the Authority has not instructed the licensee to refrain from using one. That is a notification-plus-veto regime: no pre-approval list, no PSP certification, but a standing power to ban a specific provider from a specific licensee's cashier. Article 37(1) backs it with change control, requiring notice to the MGA within 30 days when a payment method or PSP is added or dropped.

Player money gets the strictest treatment, in the Player Protection Directive. Player funds must sit in a licensed credit, financial or payment institution, and the account setup is subject to the Authority's approval (Article 31), the closest thing to "MGA approval" a payment or e-money institution ever touches, and it approves the operator's arrangement, not the institution. Funds must be segregated as the players' own patrimony, the balance must cover player liabilities at all times with at least 90% in the accounts, and withdrawals must be remitted within five working days. Crypto follows the same logic at one remove: the 2018 sandbox was closed in January 2023 and replaced by the MGA's policy on distributed ledger technology, under which a licensee needs case-by-case approval to accept digital assets, while the crypto service providers themselves are licensed by the financial regulator under MiCA.

Put together, the MGA-PSP relationship has three verbs: the operator notifies, the Authority can veto, and the player-funds account gets approved. None of them licenses the PSP.

A Maltese PSP license exists. The MFSA issues it.

The credential a payment provider can hold in Malta is an authorisation from the Malta Financial Services Authority under the Financial Institutions Act (Cap. 376): a payment institution license with initial capital between EUR 20,000 and EUR 125,000 depending on services, or an e-money institution license at EUR 350,000, both passportable across the EU and EEA. These appear in a public register and can be verified to the entity and license class, which is what we did this month through the EBA's pan-EU register, the same method behind our FCA register audit.

The audit shows what real Malta claims look like. Trust Payments holds a live MFSA payment institution authorisation on Trust Payments (Malta) Limited, C56013, granted in 2012 with EU-passported acquiring. MiFinity Malta Limited, C64824, is a full MFSA e-money institution authorised in 2020. Xace runs a narrower Malta payment institution, C 102626, licensed for remittance and payment execution in January 2024. BVNK's Malta entity, System Pay Services (Malta) Limited, C66961, holds both an e-money license from 2016 and a MiCA CASP authorisation from February 2026. Each of those is specific, register-checkable, and none of it involves the Gaming Authority.

The counterexample from the same audit is instructive too. Paramount Commerce's Malta reference was "Malta FIAU," pointing at Citadel Commerce (Malta) Ltd. The FIAU is Malta's AML intelligence unit; registration with it as a subject person is not a license, it has no public register to check, and the entity holds no MFSA payment or e-money authorisation. A Malta claim that cannot be resolved to a C-number and a license class in a public register is not a credential, it is a sentence.

Reading Malta claims in the wild

Return to the three statements this article opened with, now with the register in hand. Fluid's "fully licensed under the Malta Gaming Authority" finds no support in the MGA Licensee Register: a search for "fluid" on July 23, 2026 returned no items. The register indexes legal entity names, so a differently named parent could in principle hold something, but the claim as worded is unsupported by the public record, and a cashier-orchestration vendor fits no MGA license class in any case. WiseAlt's "MGA Licensed Gaming Payments" page names a category the taxonomy does not contain, from a company whose own disclaimer states it is not a PSP or EMI. And the "pre-approved payment provider lists" claim inverts Article 45: Malta runs notification with veto power, not pre-approval, and AML supervision of Maltese operators belongs to the FIAU besides.

The procurement translation is short. When a PSP says Malta, ask for the legal entity and the C-number, and check it in the MFSA or EBA register for a payment institution or e-money class; that is the license. Ask which MGA-licensed operators it serves and whether it has ever been the subject of an Article 45 instruction; that is the gambling relationship. Any pitch that fuses the two into "MGA-licensed PSP" has told you something useful, just not about its licenses.