Contributed By WH Partners
The primary legislation regulating gambling activities in Malta is the Gaming Act 2018 (Chapter 583 of the Laws of Malta) (the “Gaming Act”). This primary piece of legislation has been further augmented by a series of ancillary legislative instruments, encompassing both regulations and directives.
The Gaming Act was amended during 2023, where wording was introduced in order to emphasise that as a principle of public policy no action shall lie against a licensed operator and/or current and/or former officers and/or key person of such licensed entity for matters relating to the provision of a gaming service or against a player for the receipt of such gaming service if such action conflicts with or undermines the legality of the provision of the gaming service in or from Malta by virtue of a licence issued by the Malta Gaming Authority (MGA, or the "Authority") and relates to authorised activity which is lawful in terms of the Gaming Act and other applicable regulatory instruments. As a result of this, a court of law in Malta shall refuse recognition and/or enforcement in Malta of a foreign judgment or decision given regarding an action as mentioned above.
All types of gaming are permitted to be offered online under the Maltese regime, as long as the necessary authorisation is obtained from the MGA. The Maltese regime considers four types of games.
All types of gaming are permitted to be offered through gaming premises under the Maltese regime, as long as the necessary authorisations are obtained from the MGA. Land-based casinos require a concession from the government of Malta apart from the authorisation from the MGA, and certain lotto products are subject to a national lottery licence, which is granted after an international public tender and the issuing of a concession from the government of Malta.
The Gaming Act is the primary piece of legislation, supplemented by various regulations, directives and policies. There is a “three tier” framework, as set out below.
Tier One: Main Act
Tier Two: Secondary Legislation and Regulations
Tier Three: Directives and Other Legally Binding and Non-binding Instruments Issued by the MGA
Directives – 2018
Directives – 2019
Directives – 2020
Directives – 2021
Directives – 2022
The Gambling Act does not provide a simplified definition of "gambling", instead it provides definitions which form the basis of the gambling framework. Article 2 of the Gambling Act provides the following definitions.
The Gaming Act does not define land-based gambling per se, however, it considers gaming premises as one of the channels of delivery a licensed entity may be licensed to provide gaming services from. The Gaming Definitions Regulations define "gaming premises" as any premises accessible to the public, which is used or intended to be used for players to participate in a gaming service, and “controlled gaming premises” as any premises intended to make available for use, to host or operate one or more gaming devices, but shall not include premises in which gaming is carried out in virtue of a concession by government, or premises in which the only gaming which is carried out consists in tombola games.
The Gaming Act does not define online gambling, however, it considers online as one of the channels of delivery of gaming services. In addition, the Gaming Act considers remote but not online as a third channel of delivery, thus covering those situations where remote gaming takes place, but not through the online channel, such as via post or via telephone.
The Third Schedule to the Gaming Act provides a list of offences against the Act. These include:
The Third Schedule of the Gaming Act states that providing a service and/or supply which requires authorisation without the necessary authorisation and aiding or abetting such activity is considered a criminal offence.
In the case of any breach mentioned in the Third Schedule, there is discretion to impose a penalty of up to EUR500,000 for each infringement as an alternative to criminal court proceedings which may result in imprisonment.
Unlicensed offshore operators targeting Malta are not placed on a domain blacklist, however there is a list of unauthorised domains which falsely pertain to be regulated in Malta. There are no comprehensive payment service provider blocking mechanisms deployed.
The latest changes have focused on complementing the online gaming framework by permitting innovative licensees to utilise decentralised ledger technology and accept crypto-assets. The MGA has also launched a voluntary ESG Code of Conduct for its licensees.
Furthermore, the MGA has recently launched a number of consultations with the industry, wherein the following matters were looked into:
As a result, new directives following these consultations might be issued in the near future.
The MGA stands as the sole authority vested with the oversight, regulation and governance of gambling companies within Malta, encompassing both land-based and remote gaming operations. The MGA is empowered with supervisory and enforcement capabilities, including the authority to issue licences.
The Financial Intelligence Analysis Unit (FIAU) routinely oversees gambling entities in relation to their adherence to AML measures and efforts to counteract the financing of terrorism.
The Office of the Information and Data Protection Commissioner (IDPC) monitors compliance pertaining to obligations under data protection laws.
The Maltese regulatory regime is technology neutral with the aim of being future proof. The regulatory regime defines the basic concepts related to gaming and, through regulations and directives, provides further detail in respect of the implementation of the concepts.
There are no relevant changes expected.
Any person providing or carrying out a gaming service or providing a critical gaming supply from Malta or to any person in Malta, or through a Maltese legal entity, must possess a valid licence or be explicitly exempt from the requirement of a licence under the Gaming Act or any other regulatory instrument. Depending on whether a prospective gambling operator seeks to provide business-to-business (B2B) online gambling services or business-to-consumer (B2C) online gambling services the requirements and fees differ greatly.
See 2.1 Online for the four types of games considered under the Maltese regime.
The gambling industry in Malta is open for business with only national lottery games having limitations under a single concession. All other licence types are under a local licensing regime with licence applications being accepted and no limitation on the number of licensees.
Land-based casinos, in addition to a licence being awarded by the MGA, also require a government concession through a competitive tender process. Obtaining the concession is seen as a difficult task with a limited number of concessions awarded over the past ten years.
Licences are issued for a period of ten years and can be renewed on condition that a set of requirements are adhered to, and that renewal is made within a pre-established timeframe before the expiry of the licence.
Applications are submitted through a secure designated portal where information and documentation are uploaded and submitted with set forms required to be submitted depending on the licence type being applied for. An individual seeking a B2B or B2C licence from the MGA must submit a series of documents.
The first phase primarily consists of submitting the following documents.
The MGA also requires that individuals who hold a key function will be vetted and awarded a key function certificate. The roles required are CEO, key individual overseeing operations, the key individual responsible for compliance, the key individual responsible for legal, the key individual responsible for data protection, the money laundering reporting officer (MLRO), the individual responsible for main technology and the internal audit.
During the licensing procedure, nominations and approvals are mandatory for the roles of the CEO, the key compliance officer and the MLRO for B2C operators. Subsequent to the issuance of the licence, the remaining roles must be duly appointed within six months. B2B operators are not required to have the MLRO. There are also additional roles which are required for the land-based casino operators.
The next stage involves submitting technical documentation for the operations in line with a variety of requirements for infrastructure hosting and live data replication. The specifications of the gaming system are intended to show the user journey and list the games being offered to the players. Once the technical documentation is vetted and considered to be satisfactory, the applicant company is required to perform an audit via an external approved auditor of its systems to ensure that the technical infrastructure is in line with the MGA’s requirements.
Only subsequent to the satisfactory completion of the due diligence examinations on individuals, coupled with a thorough audit, shall a licence be issued. Upon the issuance of a licence, the licensee becomes subject to an array of reporting requirements. Moreover, within the first year of operations, an exhaustive system assessment must be undertaken to ascertain that the licensee’s operations align coherently with both the stipulations and the documentation proffered during the application phase.
Each application is unique and therefore it is difficult to provide an accurate estimate of the timeframe required to obtain a licence, however recent experience shows a B2C licence can take from 9-12 months to obtain approval whilst a B2B licence can take from six to nine months.
Application fees are set at EUR5,000 and payable upon application submission. A fee of EUR50 is also charged for each key function application submitted.
As part of the licensing process, the applicant is required to perform a technical audit. The cost of the audit depends on the auditor engaged since the audit which is performed by an approved independent technical auditor.
The annual licence fee for a business-to-consumer (B2C) licensee stands at EUR25,000. However, for operators providing solely Type 4 gaming services this fee is reduced to EUR10,000.
Moreover, a gaming tax is due to the MGA. This tax is calculated at a rate of 5% on the gaming revenue derived from the gaming services rendered by a B2C licensee to players physically situated in Malta. It is imperative to note that the Gaming Tax operates as a consumption tax and is applicable across all verticals and game types exclusively for players residing in Malta. In contrast, for players outside of Malta, no such gaming tax is levied.
Additionally, there is a compliance contribution, which is to be remitted on a monthly basis. The magnitude of this contribution is predicated upon the monthly gross gaming revenue (GGR), with various tiers dictating distinct percentage rates.
Gaming supply (B2B) annual fees are fixed at EUR25,000 for game providers and EUR10,000 for back-office platform providers.
A gaming levy is imposed on gaming devices. The levy is dependent on the types of games offered and calculated as follows:
If a place wants to have electronic gaming machines (EGMs), they need a Controlled Gaming Premises authorisation. This type of establishment must be run by someone with a B2C licence, and this licensee has to get approval for each location they want to set up the machines. The Gaming Premises Regulations provide rules for these machines in specific locations, including how players access them and self-exclusion options, as well as where the machines can be placed.
A licence for a land-based casino in Malta is conditional on a concession which can only be granted by the government of Malta through a competitive tender process. Currently, there are four land-based casinos in Malta with no tenders expected to take place in the near future.
There are no recent or anticipated changes in this sector.
The Malta Regulatory Framework allows online gaming operators with an MGA B2C licence to offer online gambling services beyond Malta’s borders. However, the Gaming Act and its related rules do not list specific countries where these services can be offered. Instead, the responsibility falls on the gaming operators themselves. They must carefully choose where they operate and advertise, ensuring they are not violating any local laws of those countries. In essence, while Malta does not restrict where these services can be offered, it expects operators to ensure they are acting legally in the places they choose to operate.
Online operators that do not contract directly with players, but only provide supplies to gambling operators are required to obtain a B2B licence if its supply is considered to be a critical supply. A critical supply can be either one of the below.
The B2B licence holder is to provide a critical gaming supply only to licensed operators, which are either licensed by the MGA, or licensed by another competent regulator in the EU or the EEA or in another jurisdiction where the MGA has an agreement with the relevant regulator. The B2B licence holder may also offer the critical gaming supply to licensed operators which are licensed by competent regulators in another reputable jurisdiction where the MGA, in its sole discretion, is satisfied that equivalent regulatory safeguards are in place and the B2B’s integrity is not compromised.
There are no specific measures applicable to affiliates, however affiliates are bound to follow the advertising requirements which licensed entities are required to follow. Affiliates are considered as marketing partners and no approval is required in order to engage affiliates.
There are no specific measures applicable to white labels. Regardless of any white label arrangement, the licensed entity remains responsible for compliance with the regulatory requirements at all times.
There is no applicable information in this jurisdiction.
It is required that a licensed operator holding a licence issued by the MGA either hosts its infrastructure in Malta or has at least a mirror server in Malta on which the regulatory data, ie, player data, financial data and gaming data, is replicated on a real time basis.
The purposes of the Gaming Act are:
Operators need to maintain up-to-date policies that support responsible gambling, considering the type of games they offer and associated risks. These policies should have methods to spot signs of problem gambling or any behaviour suggesting a player might be at risk.
The Player Protection Directive, denoted as Directive 2 of 2018, explains a multitude of obligations to which strict compliance is imperative. Pursuant to the provisions of the Directive, operators licensed by the Authority are mandated to conspicuously exhibit the following on all their affiliated websites.
Furthermore, operators are required to offer self-exclusions and limits (either a deposit limit or a wagering limit) to players in order to manage their gambling. Loss limits and time/session limits are optional. For repetitive games, operators are required to also offer reality checks which suspended play at specific intervals.
The same Directive states that players should never be encouraged to:
There are no recent or anticipated changes in this area.
Self-Exclusion
Operators must always have an effective and readily available mechanism whereby players can exclude themselves from playing for a definite or indefinite timeframe.
The self-exclusion system should always be easy to access and simple to use. Operators should not try to convince the player to keep playing. During self-exclusion, players cannot play games, but they should be allowed to withdraw their money. If a player wants to end their self-exclusion, they need to:
When an account is reopened, operators should suggest that players use tools to help them gamble safely. Players can get back into their account after awaiting 24 hours for a set period of exclusion, and seven days for an open-ended exclusion.
Limits
Operators are mandated to offer tools that promote responsible gambling, ensuring players navigate their gambling activities in a secure and sustainable fashion. It is imperative that operators implement either deposit or wagering limits. However, it is also encouraged by the MGA for operators to consider additional limit options.
During registration or before making their first deposit, operators need to give players the option to set either deposit or betting limits. This option to set limits should always be easy to find and use. When setting limits, it is important to make sure they fit with the player’s financial situation.
Once a limit is set, it can only be changed if the player asks for it or when the time period for the limit ends. If a player wants stricter limits, the change should happen right away. If they want to raise their limits, there is a 24-hour waiting period.
Operators also need to provide reminders that pop up at set times during play. These reminders pause the game to show the player how long they have been playing, how much they have bet, and their wins or losses. Players need to acknowledge they have seen this message and should be given the choice to stop playing.
AML and terrorist financing are regulated by the following laws and regulations:
There is no applicable information in this jurisdiction.
The Financial Intelligence Analysis Unit (FIAU) serves as Malta’s primary agency for managing information related to countering money laundering and terrorism financing (ML/FT). The binding Implementing Procedures of the FIAU guide all "subject persons" in meeting their responsibilities under the PMLFTR.
The Fourth AML Directive identifies gambling operators as "subject persons", placing them under rigorous compliance, reporting and procedural mandates. Under the PMLFTR, gaming licensees are deemed as "subject persons" conducting a relevant activity. Thus, they must adhere to the obligations of the PMLFTR, particularly in instituting AML/CFT safeguards. However, the FIAU’s Implementing Procedures specify exceptions. Licensees that solely offer critical gaming supplies (B2B services), those granted a recognition notice as per Maltese regulations, and those exclusively providing skill games or controlled skill games are not considered as "subject persons". Thus, only B2C gaming service providers are classified as "subject persons" for PMLFTR purposes.
A company holding an MGA B2C gaming licence is to adhere to the below obligations pursuant to the PMLFTR:
For the purpose of ensuring that the Gaming Commercial Communications Regulations were being adhered to, the Commercial Communications Committee was set up within the MGA, with the aim of reviewing commercial communications brought to its attention and assessing any possible breaches.
The Gaming Definitions Regulations define commercial communications, advertisement and promotion as text, images, sound or any other medium transmitting information, designed to promote, directly or indirectly, the goods, services, image or brand of a person pursuing a licensable gaming activity, and for the avoidance of doubt, this also includes product placement and any emerging advertising techniques.
The Gaming Commercial Communications Regulations (S.L. 583.09) of Malta govern advertising practices within the gaming sector. These regulations apply to all licensed gaming entities as well as any associated service providers. They detail specific restrictions on the content of advertisements, ensuring that the content is appropriate and does not target vulnerable or underage individuals. In addition, these regulations mandate the inclusion of specific information within the advertisements. Notably, there is a broad prohibition on placing such advertisements in public places, with only a few exceptions permitted. The Regulations also provide guidelines on how sponsorships in the gaming sector can be undertaken.
MGA online operators are required to comply with relevant regulations whether the advertisement is offered within or outside of Malta’s borders.
The MGA has also published a set of guidelines related to the Regulations. While these guidelines offer insight into the interpretation of the Regulations, they should not replace or be seen as an alternative to the actual laws and regulations.
Gambling operators are permitted to use affiliates which is a leading form of advertisement and acquisition. The player protection mechanisms and advertisement laws apply equally to affiliates and operators. Typically, operators are responsible for advertising whether published directly or via a third party, with the operator facing sanctions for any breaches.
In addition, the under the Broadcasting Act a subsidiary legislation has been passed providing for the requirements for gambling advertisements. This subsidiary legislation provides directions in respect of the time in which an advert can be aired on television or radio.
Adverts must be compliant with the requirements envisaged in the Gaming Commercial Communications Regulations (S.L. 583.09), including but not limited to, displaying the licensee’s name, licence number, the minimum age to participate and responsible gaming-related information.
In Malta, there is a broad prohibition on gambling advertising in public places. This means that advertising for gambling activities is generally not permitted in areas that are accessible or visible to the general public such as public transport or billboards, although some exemptions apply, such as locations frequented mainly by tourists, including airports, hotels and holiday complexes, conference or events specifically organised in relation to gaming sector, and newspapers/magazines.
In the event that the MGA determines that a commercial communication does not comply with the regulations, the MGA may order its modification, retraction or termination. Furthermore, the MGA may take any administrative action required, including issuing of administrative sanctions.
There is no relevant information in this jurisdiction.
There are various reporting requirements under the MGA licence, and aside from periodic reporting requirements, there are various events which are required to be reported within specific timeframes.
Any investment in the licensee other than by subscription of shares and any loan taken by the licensee which is not issued by an EU/EEA credit institution requires reporting within 30 days of the event taking place.
A change in direct or indirect qualifying shareholding within the licensee would trigger a reporting requirement within three days from the change, provided that all required documentation is to be submitted within 30 days. The MGA holds the power to revert a transaction where it is satisfied that the change of control prejudices the fitness and propriety of the licensee or otherwise hinders its suitability for a licence. For this reason, most operators opt to request a prior approval, notwithstanding that this can be reported post completion.
There are some matters, such as change to the directors of the licensee, which require prior approval by the MGA.
A change of corporate control occurs when a person or legal entity crosses the threshold of owning directly or indirectly 10% of the shares or the voting rights in the company holding the licence.
There is no applicable information in this jurisdiction.
Under Part III, Section 12(2) of the Gaming Act, the MGA has the authority to enforce compliance by imposing a range of sanctions on licence holders who fail to adhere to the stipulated rules and regulations.
Providing or assisting in offering a service that needs authorisation without the proper permit is a criminal offence in Malta. The MGA can impose penalties for such violations.
The following actions can be taken by the MGA against non-compliant licence holders:
The Third Schedule of the Gaming Act 2018, titled "Criminal Offences", provides a comprehensive breakdown of specific offences related to gaming and the corresponding sanctions that can be imposed.
Any person guilty of a breach stipulated under the Third Schedule of the Gaming Act shall on conviction be liable to a fine of not less than EUR10,000 and not more than EUR500,000, or to imprisonment for a term of not more than five years, or to both. Provided that in case of a recidivist the fine shall be of not less than EUR20,000 and not more than EUR1 million, or to imprisonment for a term of not less than six months and of not more than six years, or to both.
In the case of a breach of any regulatory instrument which is not mentioned in the Third Schedule, the MGA may impose an administrative penalty not exceeding EUR25,000 for every breach or non-compliance and/or an administrative penalty not exceeding EUR500 for each day the breach persists.
Individuals may also be personally liable under the Gaming Act and, if found guilty, fined accordingly.
A gaming tax is due to the MGA. This tax is calculated at a rate of 5% on the gaming revenue derived from the gaming services rendered by a B2C licensee to players physically situated in Malta.
It is imperative to note that the Gaming Tax operates as a consumption tax and is applicable across all verticals and game types exclusively for players residing in Malta. In contrast, for players outside of Malta, no such gaming tax is levied.
There is no applicable information in this jurisdiction.
Quantum House,
75 Abate Rigord Street,
Ta' Xbiex XBX1120
Malta
+356 20925100
contact@whpartners.eu www.whpartners.eu