Home › Crypto Regulation › Malta

Quick answer — Malta, 2026

• Yes, owning, buying, selling, and trading crypto is legal in Malta; the euro stays the only legal tender.
• There is no standalone crypto tax; it falls under existing income-tax, stamp-duty, and VAT rules, depending on use and your residence.
• Residents buy through MFSA-regulated exchanges authorised under the EU's MiCA framework, after completing KYC and funding in euro.

Malta was one of the first countries in the world to build a dedicated legal framework for crypto-assets, earning the nickname "Blockchain Island" after it passed its Virtual Financial Assets (VFA) regime in 2018. That early head start has now merged into the European Union's single rulebook, the Markets in Crypto-Assets Regulation (MiCA), which applies directly in Malta as an EU member state. In 2026 the practical picture is one of a regulated, EU-aligned market in which crypto-asset service providers are licensed and supervised by the Malta Financial Services Authority (MFSA).

This page explains, in plain language, whether crypto is legal in Malta, who regulates it, the main laws and frameworks, how exchanges are licensed, how crypto is generally taxed, the anti-money-laundering rules, and how to buy and use crypto in practice. This is general information as of 2026 and is NOT legal, tax, or financial advice. Crypto rules change frequently and depend on your circumstances, so always verify the current position with the named official regulator, the MFSA, or a qualified Maltese professional before acting. See also our wider guides to crypto regulation and country regulation.

Next: How crypto is taxed · Sending crypto safely
Nearby: Greece · Italy · Monaco · Portugal
All countries: browse the 205 country guides

On this page: Legal status · Who regulates it · Taxes · How to buy · Mining

Yes. Owning, buying, selling, and trading Bitcoin and other crypto-assets is legal in Malta. There is no ban on individuals holding crypto or on businesses dealing in it, provided they comply with applicable licensing, anti-money-laundering (AML), and consumer-protection rules. Malta is a regulated, crypto-friendly jurisdiction rather than an unregulated one.

Legal is not the same as legal tender. Like the rest of the euro area, Malta's only legal tender is the euro. Bitcoin is treated as a private crypto-asset, not as official money, so no merchant is obliged to accept it and any acceptance is a matter of private agreement. The regulated activity is providing services around crypto-assets to others; using crypto for your own account is generally not itself a licensed activity.

Three bodies matter most for crypto in Malta.

• Malta Financial Services Authority (MFSA) is the single national financial regulator and the competent authority for crypto-assets under MiCA and Malta's Markets in Crypto-Assets Act. It licenses and supervises crypto-asset service providers (CASPs) and issuers, and enforces rules on governance, client-asset protection, and market integrity. Its dedicated crypto page is the primary reference for status and procedures.
• Financial Intelligence Analysis Unit (FIAU) is Malta's national AML and counter-terrorist-financing (CFT) agency. It supervises crypto businesses for AML/CFT compliance, receives suspicious-transaction reports, and can impose administrative penalties.
• European Securities and Markets Authority (ESMA) is the EU-level body that coordinates how MiCA is applied across member states. In July 2025 ESMA published a peer review of how the MFSA authorised a CASP under MiCA (see Recent developments below).

You can read the regulator's own material on the MFSA Crypto-Assets page and the AML supervisor's material on the FIAU website.

Malta's crypto regulation now operates on two layers that fit together.

• EU layer (MiCA): The Markets in Crypto-Assets Regulation applies directly in Malta. It sets harmonised rules for crypto-asset service providers, such as exchanges, custodians, and brokers, and for issuers of asset-referenced tokens and e-money tokens. A firm authorised as a CASP in one EU country can passport its services across the bloc.
• National layer: Malta enacted a Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta), which designates the MFSA as competent authority and lets the responsible minister and the MFSA issue subsidiary legislation and rules supplementing MiCA. Malta's earlier 2018 framework, the Virtual Financial Assets Act, the Innovative Technology Arrangements and Services Act, and the Malta Digital Innovation Authority Act remain part of the broader blockchain-governance framework, with the VFA Act being phased out (see below).

Because Malta's original VFA framework was already close to MiCA, the transition required modest changes for many firms, and a VFA service provider submitting a CASP application between 30 December 2024 and 1 July 2026 received a 50% reduction in application fees under the Markets in Crypto-Assets Act (Fees) Regulations. AML and CFT obligations apply on top of all of this and are supervised by the FIAU.

Exchanges, brokers, custodians, and similar providers serving EU customers must be authorised as crypto-asset service providers (CASPs) under MiCA, with the MFSA acting as the competent authority in Malta. A person wishing to provide one or more crypto-asset services applies to the MFSA, and beneficial owners, qualifying holders, and senior managers must pass fitness-and-properness checks before authorisation.

The transition is now complete. Providers that already held a Maltese VFA licence before 30 December 2024 (sometimes called Category A entities) could continue operating under transitional, or grandfathering, arrangements until 1 July 2026, or until they were granted or refused a CASP authorisation, whichever came first. That window has closed. The Virtual Financial Assets Act, Chapter 590 of the Laws of Malta, was repealed on 3 July 2026 by Act XXXVI of 2024, and the national legislation register now records Chapter 590 as not in force. Under the Markets in Crypto-Assets Act (Fees) Regulations, a VFA service provider submitting a CASP application between 30 December 2024 and 1 July 2026 received a 50% reduction in application fees. Firms that did not hold a VFA licence by that date must apply afresh under MiCA. Because exact deadlines and procedures are set by MiCA and Maltese rules and can change, providers should confirm their own status directly with the MFSA. You can also check whether a platform is authorised on the MFSA's public registers and the relevant EU and ESMA listings.

Independent trackers of ESMA's interim CASP register, synced on 31 July 2026, recorded 22 crypto-asset service providers authorised in Malta out of 321 across the EEA, which places Malta fifth by number of authorisations behind Germany, France, the Netherlands and Cyprus. Those listed against Malta include OKX Europe Limited, Foris DAX MT Limited (Crypto.com), Gemini Intergalactic EU Ltd, Gate Technology Limited, Blue Cube Malta Limited (Blockchain.com), System Pay Services Malta Limited (BVNK), BP23 CA Limited (Bitpanda), Bequant Pro Limited, Damex Digital Ltd, Payhound Limited and Calamatta Cuschieri Investment Services Limited, along with a small number of e-money-token issuers. Trackers count slightly differently and one other put Malta at 25 on the same date. Because a CASP authorised in Malta can passport its services across the EU, some large platforms chose Malta as their EU base. The exact list changes as applications are decided, so always confirm a provider's current status on the MFSA and ESMA registers rather than relying on any fixed list.

Malta has no single, standalone "crypto tax." Crypto-assets are taxed under existing income-tax, stamp-duty, and VAT rules, and the treatment depends heavily on the facts. In 2018 the tax authority (then the Commissioner for Revenue, now the Malta Tax and Customs Administration) issued guidelines on the treatment of distributed-ledger-technology (DLT) assets for income tax, stamp duty, and VAT. The guidance follows a few core principles:

• Use, not label, drives treatment. DLT assets are grouped into coins and tokens (with tokens split into financial and utility tokens), but the guidelines stress that tax treatment depends on the purpose for which an asset is used, not just its category.
• Activity matters. Profits from frequent, business-like trading can be treated as income, while one-off disposals may be treated differently. Coins used purely as a means of payment are broadly treated like other currency.
• Residence and domicile matter. Malta operates a remittance basis for individuals who are resident but not domiciled, which can change how foreign-source income and gains are taxed. This is a complex area with conditions and minimum-tax rules.
• VAT. Following the EU Court's Hedqvist decision, exchanging crypto for traditional currency is generally treated like other currency transactions for VAT purposes.

The rates that apply are Malta's ordinary income tax rates. For basis year 2026 the single computation charges 0% on the first 12,000 euro, 15% from 12,001 to 16,000 euro, 25% from 16,001 to 60,000 euro and 35% above 60,000 euro. Coins held as capital assets fall outside the capital gains charge altogether. Resident non-domiciled individuals pay on the remittance basis, with a minimum tax of 5,000 euro a year where foreign income of at least 35,000 euro was not received in Malta in full. For your actual liability, check current guidance from the Malta Tax and Customs Administration and our general crypto taxes guide, and speak to a Malta-qualified tax adviser. This section is informational only and is not tax advice.

A separate development from how crypto is taxed is how it is reported to tax authorities. Malta has transposed the EU's DAC8 directive, which extends automatic exchange of information to crypto-assets and builds on the OECD's Crypto-Asset Reporting Framework (CARF). Malta gave DAC8 effect through Legal Notice 162 of 2026, amending its regulations on cooperation with other jurisdictions on tax matters.

• Who reports. Reporting crypto-asset service providers must collect and report information about their reportable users and transactions to the Maltese tax authority (the Malta Tax and Customs Administration), which then exchanges it with other jurisdictions.
• When it starts. The first reporting period is the calendar year beginning 1 January 2026, with the first reports due to the Commissioner for Tax and Customs within nine months of the year end, that is by 30 September 2027.
• Due diligence. Providers must run CARF-style due diligence on new customers from 1 January 2026, and complete checks on pre-existing customers by the end of 2026.

For ordinary users, the practical effect is that details of your crypto holdings and transactions held by a regulated provider can be shared with tax authorities, so accurate personal record-keeping matters more than before. Legal Notice 162 of 2026 was published in the Government Gazette on 22 May 2026 and is deemed to have come into force on 1 January 2026. MiCA-authorised CASPs do not register separately because the MFSA communicates a list of authorised CASPs to the tax authority; other crypto-asset operators must register with the Commissioner for Tax and Customs. Penalties include 500 euro for a registration failure, 2,500 euro for a record-retention failure, up to 50,000 euro for significant reporting non-compliance, and 10,000 to 30,000 euro personally for senior officials who submit false or misleading information.

Anti-money-laundering and counter-terrorist-financing rules are central to crypto activity in Malta. Licensed providers are subject to obligations supervised by the FIAU, working alongside the MFSA. In practice this means:

• Identity verification (KYC). Expect full identity checks when you open an account with a regulated provider, and source-of-funds checks for larger transactions.
• Customer due diligence and monitoring. Providers must risk-assess customers, monitor transactions on an ongoing basis, and report suspicious activity to the FIAU.
• The travel rule. Under EU transfer-of-funds rules, providers must collect and pass on originator and beneficiary information when crypto moves between providers.
• Enforcement is real. The FIAU has imposed penalties on crypto firms for failures in risk assessment, due diligence, and monitoring, so compliance is not just paperwork.

For ordinary users, the main effect is that you will need to verify your identity and may be asked for documents; this is a legal requirement, not an optional step.

Buying crypto in Malta is straightforward and is done mainly through online exchanges and brokers. The key regulatory point is that the platform should be authorised to serve EU customers as a CASP under MiCA, or be operating under the relevant transitional arrangements. A typical, compliant path looks like this:

• Choose a regulated platform that is authorised to serve Malta and supports euro funding, and verify its status on the MFSA registers and EU/ESMA listings.
• Verify your identity by completing KYC with ID and any requested documents.
• Fund your account in euro, typically by SEPA transfer or card, noting fees and limits.
• Place your order after reviewing the price, spread, and fees.
• Secure your holdings with two-factor authentication, and for larger or longer-term amounts consider a wallet you control, including a hardware wallet, with your recovery phrase backed up offline.
• Keep records of dates, amounts, and cost basis for tax reporting.

There are no old-fashioned exchange-control restrictions on ordinary crypto purchases; the constraints that matter are AML/KYC compliance and using a regulated venue. Bitcoin ATMs exist in some EU markets but have historically been very scarce in Malta, and any cash-for-crypto operator would still be subject to AML rules; for most people a regulated online exchange is cheaper and simpler.

There is no specific law banning Bitcoin mining in Malta, and individuals are generally free to run mining hardware. In practice, Malta is not a meaningful mining hub. Relatively high electricity costs, a warm climate that raises cooling demand, and limited industrial space make proof-of-work mining economically unattractive compared with regions that have cheap or surplus energy.

Anyone considering mining should weigh electricity costs, hardware and cooling, noise and heat, and the tax treatment of mined coins, which may be treated as income when received. MiCA also introduced sustainability-related disclosure expectations for service providers and issuers regarding the environmental impact of crypto-assets. Malta's policy emphasis has been on regulated financial services and blockchain businesses rather than on attracting large-scale mining.

The defining trend is consolidation under MiCA. In July 2025 ESMA published a peer review of how the MFSA had authorised a CASP under MiCA. The review recognised the MFSA's good level of resources and supervisory engagement and its expertise, but it also found that, in the case examined, the authorisation process should have been more thorough and that some material issues, such as aspects of ICT infrastructure, custody, and business-model assessment, were unresolved or pending at the time of authorisation. The MFSA publicly welcomed the review. ESMA also issued recommendations to all EU supervisors on forward-looking assessment, governance and third-party arrangements, ICT resilience under DORA, exposure to DeFi, and consistency of consumer-facing disclosures.

The other major development is the closing of the VFA-to-MiCA transition. Grandfathering for existing VFA licence holders ran until 1 July 2026 and the VFA Act was repealed on 3 July 2026. ESMA confirmed in a statement of 17 April 2026 that from 1 July 2026 any entity providing crypto-asset services to EU clients without MiCA authorisation would be in breach of EU law and must cease operations, with credible wind-down plans in place. A MiCA CASP authorisation is now the only basis on which a provider can serve EU clients from Malta. A further 2026 change is on tax reporting: Malta transposed the EU's DAC8 directive through Legal Notice 162 of 2026, bringing crypto-assets into automatic exchange of information between tax authorities, with the first reporting period starting on 1 January 2026 (see the tax-reporting section above). Four dated items sit in the pipeline. The MFSA closed a consultation on tokenisation of financial instruments and real-world assets (Ref. 02-2026) on 30 June 2026 and a discussion paper on decentralised finance (Ref. 03-2026) on 31 July 2026, and has not yet published draft rules from either. The European Commission's review of MiCA is open from 20 May 2026 to 30 September 2026 and feeds a report under MiCA Articles 140 and 142 that may carry a legislative proposal. Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation, applies from 10 July 2027 and will require regulated providers to close anonymous crypto-asset accounts and stop supporting anonymity-enhancing coins. The Commission's December 2025 proposal to move CASP supervision from national regulators to ESMA is still under negotiation, and Malta is among the member states resisting it. Because details are evolving, treat this page as a starting point and verify specifics with the official sources below.

EU rules such as MiCA aim to raise standards for crypto-asset service providers, including disclosure, governance, and custody requirements, and they give users of authorised firms clearer protections than dealing with unregulated platforms. But regulation cannot remove market risk or protect you from your own security mistakes.

The main risks for crypto users in Malta are the same as elsewhere: sharp price volatility, scams and phishing, loss of access if you lose your keys, and counterparty risk if a platform fails. Sensible precautions include using only regulated and reputable providers, verifying a platform's authorisation on the MFSA registers, being wary of guaranteed-return promises and unsolicited offers, never investing more than you can afford to lose, enabling two-factor authentication, and keeping your own records. This is general information, not investment advice; we make no price predictions and past performance does not indicate future results. If you are unsure, consult a licensed financial adviser in Malta.

Because crypto rules in Malta are EU-aligned and still evolving, always confirm the current position with the primary official sources rather than relying on summaries. The most authoritative starting points are:

• MFSA Crypto-Assets for licensing, CASP authorisation, registers, and the Markets in Crypto-Assets Act.
• FIAU (Financial Intelligence Analysis Unit) for AML and CFT obligations and supervision.
• Malta Tax and Customs Administration for tax treatment of DLT assets and filing obligations.
• ESMA for EU-level MiCA implementation, registers of authorised CASPs, and peer-review findings.

To verify that a platform is allowed to serve you, check that it is authorised on the MFSA registers and the relevant EU/ESMA listings before depositing funds. To reiterate: this page is general information as of 2026 and is NOT legal, tax, or financial advice, and you should confirm your specific situation with the MFSA or a qualified Maltese professional. For more context, see our crypto regulation guide.

Facts reviewed: 5 August 2026. Page updated: 5 August 2026.

More countries in the region

• Crypto regulation in Cyprus
• Crypto regulation in Gibraltar
• Crypto regulation in San Marino
• Crypto regulation in Spain
• Browse all 205 country guides

Practical guides

• How crypto is taxed
• Setting up a hardware wallet
• Why exchange custody is risky