An overview of the regulation of virtual assets in Malta

1. Virtual asset laws and regulations in Malta

In late 2017, Malta initiated discussions on regulating virtual assets through consultation papers issued by the Malta Financial Services Authority (MFSA). This effort eventually led to the enactment of the Virtual Financial Assets Act (VFAA) in November 2018. The Act focuses on initial virtual financial asset offerings and virtual financial assets, and subsequent efforts include rulebooks for crypto-asset services providers (CASPs) and issuers. The Minor alignment of the Virtual Financial Assets Rules (VFA Rules) with Markets in Crypto-assets Regulation (MiCAR) by 2023 shows Malta’s commitment to enhancing security and compliance for regulated CASPs.

What is considered a virtual asset in Malta?

In Malta, virtual assets are defined as ‘virtual financial assets’ (VFAs) which are of any digital medium that is used as an exchange unit or an account or store of value, but which is not considered electronic money, a financial instrument or a virtual token. This definition includes cryptocurrencies that can be considered as virtual financial assets. Cryptocurrencies like Bitcoin and Ethereum are digital assets that can be used as a medium of exchange or store of value, and as such, can fall under the definition of VFAs in Malta.

What are the relevant laws and regulations?

The Virtual Financial Assets Act, 2018: This is the primary legislation governing VFAs in Malta. The act defines the term VFA and sets out the regulatory framework for VFAs, including issuers, VFA agents, and VFA service providers. It also establishes the Malta Digital Innovation Authority (MDIA) as the regulatory body responsible for overseeing the VFA sector. The Act provides for the registration and licensing of VFA agents and service providers and prescribes the requirements for Initial VFA Offerings (IVFAOs).
The Virtual Financial Assets Regulations, 2018 (Legal Notice 360 of 2018) (VFAR): These regulations provide more detailed rules and requirements for VFAs, including exemptions, fees, control of assets, and administrative procedures. They also set out the process for registering whitepapers for IVFAOs and the rules for asset segregation and custody.
The VFA Rulebook: This is a set of detailed rules and guidance issued by the MFSA under the Virtual Financial Assets Act and Regulations. The Rulebook provides further regulation applicable to VFAs and operators in the financial services sector, including VFA agents, IVFAOs, and VFA service providers. It provides guidance on compliance, governance, risk management, and other aspects of operating in the VFA sector.
The Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR), 2018 (Legal Notice 306 of 2018): These regulations apply to all operators in the financial services sector in Malta, including those dealing with VFAs. They set out the requirements for identifying and verifying customers, risk assessment, record-keeping, and reporting obligations for suspicious transactions. The PMLFTR also sets out the obligations of designated non-financial businesses and professions, which includes VFA service providers.
Guidance Notes: The MFSA has issued various guidance notes to provide further guidance on the interpretation and application of the Virtual Financial Assets Act, Regulations, and Rulebook. Some of these guidance notes cover topics like the registration of VFA agents, the process for whitepaper registration, and the determination of whether a VFA qualifies as electronic money.

Who do such laws and regulations apply to?

In Malta, virtual assets laws and regulations apply to issuers of virtual financial assets, VFA agents, licensees, and administrators.

According to the Virtual Financial Assets Regulations (Legal Notice 357 of 2018) of Malta, virtual assets laws and regulations apply to all natural and legal persons engaging in the provision of virtual financial asset services. More specifically, the definition of a “subject person” in the regulations includes anyone who provides or offers to provide a virtual financial asset service as well as anyone who holds himself out to be providing a service whether supervised or not. This includes custodians, brokerages, portfolio managers, exchange operators, wallet providers and financial advisors.

Who are the relevant regulatory authorities in relation to virtual assets in Malta?

Malta Financial Services Authority (MFSA) – The MFSA is the primary regulatory authority in Malta and is responsible for overseeing the implementation of the Virtual Financial Asset Act and Virtual Financial Asset Regulations. It also has the power to issue licenses to conduct virtual financial asset activities and to supervise license holders.
Financial Intelligence Analysis Unit (FIAU) – The FIAU is responsible for the prevention of money laundering and terrorism financing activities. It also plays a supervisory role in relation to the enforcement of the due diligence obligations of license holders under the laws of Malta.
Malta Digital Innovation Authority (MDIA) – The MDIA was established to promote the development and innovation of digital technologies in Malta. It is responsible for the certification of Technology Service Providers that undergo a process of quality assurance and compliance assessment in accordance with Maltese law.

What are the penalties for breaches of virtual asset laws and regulations in Malta?

Under the Virtual Financial Assets Act in Malta, administrative penalties may be imposed for non-compliance with the provisions of the Act and regulations. Such penalties may include fines, the suspension or revocation of licenses, and the publication of details of the infringement. The amount of the fine imposed may not be less than €1,000 and may exceed €150,000 or 10% of the total annual turnover of the individual or legal person in the preceding year where the infringement is committed by a legal person.

Criminal sanctions may also apply in certain circumstances. Companies may be held vicariously liable for the non-compliant actions of their officers or employees. Additionally, repeat offenders will face higher sanctions which will be proportionate to the seriousness of the infringement.

2. Regulation of virtual assets and offerings of virtual assets in Malta

Are virtual assets classified as ‘securities’ or other regulated financial instruments in Malta?

According to the VFAA, a VFA is defined as “a form of digital medium recordation that is used as a digital medium of exchange, unit of account, or store of value and that is not electronic money, a financial instrument or a virtual token. the Virtual Financial Assets Act does not explicitly classify all virtual assets as securities or other regulated financial instruments. Instead, it sets out requirements that virtual financial assets must meet if they are to be offered to the public or traded on a Distributed Ledger Technology (DLT) exchange.

The VFAA establishes the rules around IVFAOs and how virtual financial assets are regulated in Malta. It provides that if a virtual financial asset meets the criteria of a financial instrument or electronic money, the issuer shall comply with the respective applicable laws and regulations in Malta.

Regarding financial instruments, Malta has implemented the European Union’s Markets in Financial Instruments Directive framework (MiFID II), which describes specific requirements for investment firms that provide investment services and activities. Malta has also enacted additional legislation such as the Investments Services Act (ISA) to regulate the offering of financial instruments.

Regarding electronic money, Malta has implemented the Electronic Money Directive (EMD) and has relevant provisions in the MFSA.

Therefore, issuers must comply with any applicable laws and regulations, including MiFID II, ISA, EMD, and the MFSA regulations, when issuing virtual financial assets, classified as financial instruments or electronic money.

In this way, virtual assets that meet the characteristics of securities or other regulated financial instruments in Malta may be subject to regulation as such. Still, virtual assets that do not meet these criteria may not be classified as securities or regulated financial instruments. Therefore, it is up to the issuer and its VFA agent to determine whether a particular asset will be classified as a financial instrument or electronic money, and if so, to ensure compliance with the applicable laws and regulations in Malta.

Are stablecoins and NFTs regulated in Malta?

Stablecoins: stablecoins are regulated in Malta under the VFAA, which provides for the regulation of any virtual financial asset, including stablecoins. Stablecoins are regarded as Electronic Money under the Act subject to certain criteria being met. However, not all stablecoins are necessarily considered VFAs. They may be classified as financial instruments, which would not make them eligible for electronic money status.

If a stablecoin does qualify as a VFA, then it must meet the criteria set out in the Virtual Financial Assets Act in order to be considered as electronic money. Specifically, it must have a one-to-one ratio with a fiat currency and be redeemable at any time at par value. Additionally, the issuer must have the required amount of fiat currency in reserve to cover the outstanding stablecoins.

The VFAA provides clear guidelines on what information a white paper for a stablecoin should include, how collected funds may be used, and how due diligence on the individuals behind the project or entity seeking fund is to be carried out. It also clearly clarifies that businesses will be liable to pay damages to anyone that loses money due to false statements contained in the whitepaper.

Furthermore, the EU MiCAR governs the issuance and operation of stablecoins in the EU. If a stablecoin exceeds a certain size or market cap, it will be subject to MiCAR. Therefore, stablecoin issuers operating in Malta will have to comply with both VFA Act and MiCAR requirements and guidelines to ensure proper regulatory compliance.

NFTs: The MFSA has established guidelines under the VFA Framework regarding the regulatory treatment of Non-Fungible Tokens (NFTs). These guidelines, effective from July 1, 2023, clarify that NFTs are excluded from the VFA definition and framework due to their unique and non-fungible nature, lacking attributes for use as a means of exchange, store of value, or unit of account.

While excluded from the VFA framework, NFTs may fall under other categories of Distributed Ledger Technology Assets (DLT assets), including financial instruments. Stakeholders can use these guidelines to determine the regulatory framework applicable to their NFT activities.

The guidelines specifically apply to issuers offering NFTs to the public in or from within Malta, as well as individuals providing services related to NFTs. These guidelines should be consulted before applying the Financial Instrument Test for determining the regulatory classification of DLT Assets.

Criteria for classifying NFTs are set out, emphasising uniqueness and non-fungibility. Exclusions are also provided, highlighting that large series or collections of NFTs may impact fungibility, potentially leading to the asset not being classified as a non-fungible token.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in Malta?

DeFi activities, including virtual asset lending, are regulated in Malta under the VFA framework. The regulations mandate licensing or exemption for individuals engaged in VFA services, emphasising the safekeeping of clients’ assets and prevention of unauthorised use.

Chapter 1 of the Virtual Financial Assets Rulebook consists of rules for VFA Agents, covering the general scope, high-level principles, and registration requirements. Ongoing obligations for VFA Agents, including those involved in DeFi lending, are explained in Title 2, covering compliance with anti-money laundering laws and various requirements.

Chapter 2 of the Rulebook and the Rules for Issuers of Virtual Financial Assets address DeFi activities, specifying requirements for issuers and VFA agents involved in lending virtual assets. This includes obligations related to Initial VFA Offerings, trading on DLT exchanges, and adherence to the Virtual Financial Assets Act.

Chapter 3 of the Rulebook focuses on licensing requirements for Virtual Financial Asset Service Providers, including those engaged in DeFi activities. It stipulates the need for a valid license issued by the MFSA for providing VFA services in Malta. The chapter sets out the authorisation process, high-level principles, and capital requirements for VFA Service Providers, including those operating virtual asset lending services.

The VFAA classifies VFAs as digital mediums of exchange, units of account, or stores of value, subjecting DeFi activities to regulation. Entities involved in DeFi, such as issuers, agents, and service providers, must be authorised by the MFSA and comply with AML/CFT regulations. The Financial Instrument Test determines the regulatory classification of DeFi activities, while appointing a Money Laundering Reporting Officer is required for compliance with AML/CFT provisions.

Are there any restrictions on issuing or publicly offering virtual assets in Malta?

The issuance or public offering of virtual assets in Malta is subject to strict regulations described in the VFAA and the associated Virtual Financial Assets Rulebook Chapter 2.

Under the VFAA, Article 3(1) imposes restrictions, stating that no issuer can issue or propose to issue virtual financial assets to the public in or from within Malta without registering a whitepaper for that specific virtual financial asset with the MFSA. The whitepaper, which is subject to registration, must include key information such as details about the issuer, its management structure, the virtual financial asset, and provisions for enforcement, as specified in the VFAA.

Article 3(2) of the VFAA explains the mandatory content for the whitepaper, ensuring comprehensive information about the issuer and the virtual financial asset.

Furthermore, the VFAA requires that the offering of virtual financial assets to the public must be conducted in a fair, transparent, and non-misleading manner. The MFSA is empowered to issue guidelines, rules, and orders to specify requirements for such offerings, ensuring compliance with the high-level regulatory principles established under the framework.

Additionally, issuers undertaking a public offering or seeking admission to trading on a DLT exchange must adhere to certain MiFID II framework requirements, such as preparing a prospectus or offering document.

Title 2 of chapter 2 specifies the requirements issuers must follow, including the production and registration of a whitepaper with the MFSA. Title 3 of Chapter 2 details supplementary conditions for VFAs admitted to trading on a DLT exchange, listing conditions for admissibility to trading. As per chapter 2 following are the restrictions and requirements for issuing or publicly offering virtual assets in Malta:

Producing and registering a whitepaper with the MFSA before making a VFA offering;
conforming to any guidelines or guidance notes issued by the Financial Intelligence and Analysis Unit of Malta;
undertaking the Financial Instrument Test before offering a DLT asset to the public or applying for its admission on a DLT exchange;
issuing a compliance certificate before commencing the offering or procedure for the admission of a VFA;
appointing a VFA agent who is registered with the MFSA;
compliance with any applicable financial regulations or requirements;
accessibility of all VFA-related information to the public;
issuing a written confirmation of the proper extraction of accounting information from accounting records;
appointing an independent third party as a custodian for VFAs and virtual tokens;
maintaining proper accounting books and records;
disclosure of all relevant information to the MFSA;
providing access to documents upon request;
co-operating with the MFSA in an open and honest manner and providing the authority with any information required;
complying with the Maltese laws, regulations, and rules related to VFA and the guidance notes issued by the MFSA;
issuers shall not apply under this Act unless they have an appropriate legal structure to carry out their obligations; and
obligation to appoint key functionaries and to comply with the criteria applicable to them.

In summary, the issuance or public offering of virtual assets in Malta is possible but strictly regulated, requiring adherence to the VFAA framework, Virtual Financial Assets Rulebook Chapter 2, and associated regulations.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in Malta?

Yes, according to the VFA Rulebook, there are some exemptions to the restrictions on issuing or publicly offering virtual assets in Malta:

Small Offerings Exemption: VFAs issued with an aggregate value of fewer than 5 million euros don’t require the whitepaper’s registration or the issue of the VFA Offering Circular.
Professional Investors exemption: VFA offerings structured in such a way to target exclusively professional investors that explicitly state that it is not suitable for retail investors will be exempt from the public offering requirements.
Non-Trading Assets exemption: VFAs that possess certain non-trading elements that go beyond its functions as a simple financial asset will be exempt from requiring a VFA agent, a whitepaper, and an authority-approved systems auditor.
Closed-Loop payment instrument exemption: VFAs intended to be used exclusively as payment instruments for the purchase of goods or services exclusively from the issuer’s network of service providers may qualify for an exemption.

Other exemptions are given in the VFA Act and regulations, and some of them are as follows:

Public Sector Issuers: Public Sector Issuers and virtual financial assets issued by them are exempt from the requirement to appoint a VFA agent and making public disclosures.
Cryptocurrency and Initial Coin Offering (ICO) companies: Such companies that conduct certain activities in Malta might be considered as offering Innovative Technology Arrangements or Services under the Innovative Technology Arrangements and Services Act, which means that they are required to apply for a license with the MDIA. However, the MDIA offers exemptions from licensing under certain conditions as listed below:
- Exemption for small-scale ICOs: An exemption is available for small-scale ICOs in terms of the VFA Act. Under this exemption, an issuer of VFAs whose fundraising through an ICO does not exceed €8 million over a period of 12 months can apply to be exempted from the requirement of having to prepare and register a white paper
- Accredited investors exemption: ICO issuers may be exempted from obtaining an MDIA license if the sale of the token to the public is restricted exclusively to accredited investors.
- Exemption on the grounds of national interests: The authority may grant an exemption from the need to obtain a licence on the grounds that it is in the national interest for the Innovative Technology Arrangement or Service to be carried out in Malta and provided that no Maltese entity is capable of providing the same services or performing the same functions.
Transferable securities or other financial instruments: Virtual financial assets that constitute transferable securities or other financial instruments fall under a different regulatory regime, and are exempt from VFA regulations.
Virtual financial assets traded among qualifying investors: Virtual Financial assets traded among qualifying investors who are not retail investors are exempt from any obligation under this Act.

3. Regulation of VASPs in Malta

Are VASPs operating in Malta subject to regulation?

Yes, Virtual Asset Service Providers (VASPs) operating in Malta are subject to regulation under the VFAA and related regulations. The VFAA and its associated rules set out a regulatory regime for VASPs, which are entities that offer services related to VFAs and include virtual currency exchange platforms, wallet providers, and brokers.

VASPs operating in Malta are required to obtain authorisation or registration from the MFSA before they can operate. The scope and type of authorisation that the VASPs require depend on the type of services provided and the associated risks.

The VFAA has established four classes of VASPs, and each class has its own authorisation requirements, such as capital requirements, risk management frameworks, and compliance obligations. The four classes of VASPs are as follows:

Class 1 VASPs: These are VASPs that provide custody services of virtual financial assets and do not hold control over the assets they hold for their clients. Class 1 VASPs are required to register with the MFSA.
Class 2 VASPs: These are VASPs that provide exchange services between virtual financial assets and fiat currencies or other virtual financial assets. Class 2 VASPs are required to obtain a license from the MFSA.
Class 3 VASPs: These are VASPs that provide services related to the operation of a VFA market, including the operation of a multilateral or organised trading facility. Class 3 VASPs are required to obtain a license from the MFSA.
Class 4 VASPs: These are VASPs that provide services not covered by any of the above classes. Class 4 VASPs are required to apply for registration or authorisation with the MFSA.

All VASPs are also required to comply with the VFAA’s anti-money laundering (AML) and counter-terrorist financing (CTF) requirements, which include customer due diligence, ongoing monitoring, and reporting of suspicious activities to the Financial Intelligence Analysis Unit (FIAU). Additionally, VASPs must comply with the MFSA’s ongoing supervision and reporting requirements.

Are VASPs providing virtual asset services from offshore to persons in Malta subject to regulation in Malta?

Yes, VASPs providing virtual asset services from offshore to persons in Malta are subject to regulation in Malta under the VFAA and associated regulations.

The VFAA applies to any VASP providing virtual asset services within or from Malta, regardless of whether the organisation is licensed in Malta or operates from another jurisdiction. Therefore, VASPs providing virtual asset services from offshore to persons in Malta must comply with Maltese regulations for providing such services.

Specifically, any person carrying out VFA services to Malta, including VASPs providing virtual asset services from offshore, must comply with the requirements of the VFAA and the rules and regulations made thereunder. This includes obtaining any necessary authorisation or registration with the MFSA and complying with the requirements related to AML and CTF, customer due diligence, ongoing monitoring, and reporting of suspicious activities to the FIAU.

The VFAA applies to persons engaged in the issue, offering, or trading of VFAs, including VASPs that operate from offshore but provide virtual asset services to persons in Malta. Therefore, VASPs must ensure that they comply with the VFAA and its rules and regulations when providing virtual asset services to persons in Malta, regardless of their location.

It is worth noting that VASPs providing virtual asset services from offshore may also be subject to similar regulations and requirements in their home jurisdiction. Therefore, they may need to comply with both their home jurisdiction and Malta’s regulatory requirements when providing virtual asset services to persons in Malta.

What are the main requirements for obtaining licensing / registration as a VASP in Malta?

Malta has established a regulatory framework for VASPs operating in or from within its jurisdiction. The VFAA provides the legal requirements for licensing of VASPs in Malta. The following are the main requirements for obtaining licensing as a VASP in Malta:

Application Requirements: Any person seeking a licence or authorisation as a VASP in Malta must submit an application for a VFA Services Licence to the MFSA. The application must be submitted by a duly authorised representative of the applicant. This representative must undergo a thorough fitness and properness assessment by the MFSA.
Different Categories of License: Depending on the nature of the business, a person may apply for one or more of the following classes of VFA service:
Class 1A – Reception and transmission of orders
Class 1B – Execution of orders on behalf of clients
Class 2 – Dealing on own account
Class 3 – Custodian or Nominee Services
Class 4 – Investment Advice
Class 5 – Portfolio Management.
Licensing Fees: The licensing fees vary depending on the type of VFA service and size of the business, as follows:
Class 1A – €10,000
Class 1B – €25,000
Class 2 – €50,000
Class 3 – €25,000
Class 4 – €25,000
Class 5 – €50,000
Ownership, Management and Governance Criteria: All individuals with significant control over the VASP must undergo a thorough fit-and-proper test by the MFSA. VASPs must also observe strict governance principles, such as having clear lines of responsibility, management structures, and effective internal controls. They must also have adequate operational and security arrangements to ensure the safety and security of customer information.
Adequate Resources: VASPs must demonstrate they have adequate resources to carry out their VFA services. This includes having sufficient capital and liquidity to absorb potential losses and operational issues and to ensure compliance with the VFAA requirements and regulations.
AML/CFT and Customer Due Diligence (CDD): Policies VASPs must have adequate policies, procedures, and systems in place to monitor, detect, and prevent money laundering, financing of terrorism, and other illicit activities. This includes implementing a risk-based approach for customer identification, conducting enhanced due diligence (EDD) on higher-risk customers, and conducting ongoing CDD measures to ensure the integrity of customer information. It is important to note that the VFAA regulation provides detailed requirements for VASPs seeking authorisation/licensing to operate in Malta.

In addition, issuers seeking licensing or registration as VASPs in Malta must comply with Chapter 2 of the Virtual Financial Assets Rulebook. Requirements include:

be a legal person formed under Maltese law;
submit an annual compliance certificate;
appoint an independent third-party custodian;
obtain a license or registration from the MFSA; and
submit a compliant whitepaper to the MFSA along with relevant documentation and fees.

Issuers must also adhere to Virtual Financial Assets Rulebooks covering enforcement and sanctions, initial and ongoing requirements for issuing and trading virtual financial assets, and compliance and enforcement. The MFSA holds sanctioning powers, including administrative penalties up to EUR 150,000, considering factors like cooperation, past infringements, and systemic consequences.

What are the main ongoing requirements for VASPs regulated in Malta?

VASPs operating in Malta are subject to ongoing requirements stated in the VFAA, VFAR, and the Virtual Financial Assets Rulebook. The following are some of the main ongoing requirements that VASPs in Malta are expected to comply with:

Compliance with VFAA, VFAR, and the Rulebook: VASPs are expected to continue adhering to the provisions and requirements set out in the VFAA, VFAR, and the Rulebook. This includes submitting regular reports, complying with ongoing due diligence requirements, and ensuring that all operations remain in line with regulatory standards at all times.
AML/CFT Program: VASPs must maintain adequate AML and CFT policies and procedures. This includes performing customer due diligence, monitoring financial transactions for suspicious activity, and submitting regular reports to the relevant regulatory authority.
Ongoing Financial Reporting: VASPs must prepare and file periodic financial statements and reports, including auditor attestation reports and compliance certificates. Additionally, VASPs must notify the MFSA of any material changes to their operations, employees, or ownership structure.
IT and Security Requirements: VASPs must have robust IT and security protocols in place to protect the integrity of their systems and customer data. This includes undergoing regular IT system audits and implementing measures to detect and prevent fraud and cyber threats.
Adequate Resolution Framework: VASPs must maintain a suitable resolution framework to ensure that customer funds and assets are protected in the event of insolvency or other financial difficulties.
Regulatory Supervision and Oversight: VASPs must cooperate fully with the regulatory authority and provide any requested information in a timely and accurate manner. Additionally, VASPs must ensure that their employees and agents are properly trained on all regulatory requirements and standards.

What are the main restrictions on VASPs in Malta?

In Malta, the regulation of VASPs is governed by the VFAA which imposes stringent requirements on various service providers, including those launching cryptocurrencies, brokerages, portfolio managers, custodian and nominee service providers, eWallet providers, investment advisors, and notably, cryptocurrency exchanges.

Key restrictions and requirements for VASPs in Malta include:

Appointment of VFA Agent: Issuers of Virtual Financial Assets must appoint a VFA agent, approved by the MFSA, responsible for specific reporting and monitoring obligations.
Licensing Requirements: License requirements apply to the provision of any VFA service in or from Malta, covering a range of services, such as reception and transmission of orders, execution of orders on behalf of others, portfolio management, and more.
Whitepaper Guidelines: The VFAA provides clear guidelines on the content of a whitepaper, including information disclosure, utilisation of collected funds, and due diligence on the individuals associated with the fund-seeking entity.
Liability for False Statements: Businesses are liable to pay damages to individuals who incur losses due to false statements contained in the whitepaper.
Initial VFA Offerings and Trading: The VFAA regulates the types of VFAs issued through an IVFAO and admission to trading on a DLT exchange, requiring the submission of a registered whitepaper to the MFSA.
Authorisation and Ongoing Compliance: Service providers intending to offer VFA-related services must obtain authorisation from the MFSA and adhere to ongoing compliance with applicable rules, regulations, and guidelines issued by the MFSA and/or MDIA.
Licensing Requirements for VASPs: Chapter 3 of the VFAA consist of general requirements for licensing VASPs, emphasising restrictions on activities. Only licensed entities can provide VFA services in or from Malta.
Competent Authority Discretion: The competent authority may prohibit individuals or entities from providing VFA services if they pose risks to investors, the public, Malta’s reputation, or the promotion of innovation, competition, and choice.
Exemplary Conduct and Resources: Licenses are granted to individuals or entities with exemplary conduct in all respects and possessing the necessary financial, organisational, and technical resources.
Activity Limitations and Conditions: VASPs must operate strictly within the activities permitted by their granted license, subject to conditions set by the competent authority.
Restrictions on IVFAOs: VASPs must adhere to specific restrictions and disclosure requirements related to IVFAOs, as described in Chapter 2 of the VFAA.
Advertisement Approval: Only license holders may issue or cause to be issued advertisements related to VFA services, with contents vetted and approved by the license holder’s board of administration.
Compliance with Laws: VASPs must operate in compliance with all applicable laws, regulations, and rules, subject to the satisfaction of the competent authority.

What are the main information that VASPs have to make available to its customers?

VASPs must make available to its customers the following information:

full details of the Issuer, legal advisors, auditors, and technical experts;
services offered;
terms and conditions of the services provided;
information on the risks of owning, acquiring, or holding virtual financial assets;
information regarding fees and charges, including fees, commissions, or any other remuneration;
complaints procedures;
whether it holds clients’ funds/securities or registers them under its ownership in a nominee account;
any conflict of interest that may arise;
a whitepaper with all the information stipulated in the First Schedule to the Act, including a detailed description of past and future milestones, how these milestones will be financed, progress reports, and the effect of the public offering on investors;
changes to conditions stipulated in the whitepaper, including any smart contract thereof, must be notified beforehand to the Authority and shall not be applied before the Authority grants its approval;
procedures providing a reasonable basis for the board of administration to make proper decisions regarding AML/CFT/KYC matters;
the identity of the Functionaries it appoints within the whitepaper. Functionaries refer to persons responsible for the Issuer’s safekeeping of customers’ assets, custody (where applicable), and money laundering compliance who must satisfy all the conditions for fit and proper tests specified by the Authority;
the name of the VFA agent and its responsibilities, providing the Authority with up-to-date information on the Issuer, inter alia, with regards to fitness and properness assessment; and the contact details of a designated Money Laundering Reporting Officer (MLRO) responsible for ensuring that the VASP’s AML/CFT controls and processes are effective.

What market misconduct legislation/regulations apply to virtual assets?

The VFAA sets out specific provisions addressing market abuse for virtual assets in Malta. These provisions are consistent with EU-wide standards and with existing standards established by the MFSA for traditional financial services.

Firstly, the VFAA prohibits insider dealing and unlawful disclosure of inside information. This includes buying, selling, or otherwise trading a VFA while in possession of insider information or disclosing insider information to third parties. Any person involved in such activities could face administrative fines, imprisonment, or both.

Secondly, the VFAA also prohibits market manipulation, which involves using deceptive or manipulative practices on a market, such as false or misleading statements or the spread of false rumors to manipulate prices. Any person found to have manipulated the VFA market could face administrative fines and imprisonment.

Thirdly, the VFAA prohibits fraudulent practices, such as spreading false or misleading information for the purpose of inducing others to trade. This includes intentionally spreading rumors or false information about VFAs. Persons found guilty of such acts could face administrative fines, imprisonment, or both.

The VFAA also requires all VFA service providers, including VFA exchanges and VFA wallet providers, to establish and maintain effective controls and systems to prevent, detect, and report any potential market abuse activities. Furthermore, the MFSA has broad investigative and enforcement powers under the VFAA to investigate, request information and documents, and impose administrative sanctions for any breaches identified. It’s worth noting that these provisions apply to all VFA activities that take place in or from within Malta.

Furthermore, the VFAA empowers the MFSA to take various actions to prevent market abuse, including:

requiring the inclusion in the whitepaper, advertisement or the issuer’s website, as applicable, of supplementary information necessary for investor protection as the competent authority may specify;
requiring the amendment in the whitepaper, advertisement or on the issuer’s website, as applicable, of statements which are misleading, inaccurate or inconsistent;
requesting any person to take steps to reduce the size of the position or exposure;
discontinuing or suspending the trading of virtual financial assets on a VFA exchange;
suspending temporarily the trading of a virtual financial asset on any VFA exchange; and
suspending or removing from trading a virtual financial asset which no longer complies with the definition of a virtual financial asset or the bye-laws of the VFA exchange.

These powers of the MFSA do not permit it to demand information about the source codes of any proprietary technology or of information of highly sensitive, intellectual property which is protected by law and which relates to innovative DLT or smart contracts. The VFAA also allows the MFSA to share relevant information with other European and national authorities.

4. Regulation of other crypto-related activities in Malta

Are managers of crypto funds regulated in Malta?

Yes, the managers of crypto funds in Malta are regulated by the MFSA under the ISA and the VFAA.

The ISA regulates all investment services in Malta, including the management of collective investment schemes (CISs), which include crypto funds. Managers of crypto funds in Malta are therefore required to obtain an Operator of CIS license from the MFSA. CIS managers in Malta are also subject to ongoing regulatory requirements, including reporting standards, financial viability assessments, risk management standards, and disclosure requirements.

In addition to the ISA, the VFAA places additional requirements on managers of crypto funds. Under the VFAA, managers of crypto funds are considered to be VFA service providers and must obtain a VFA services license from the MFSA. Managers of crypto funds must also appoint a compliance officer and a MLRO, and ensure that they have adequate risk management and compliance procedures in place.

Are distributors of virtual asset funds regulated in Malta?

Yes, distributors of virtual asset funds are regulated in Malta under VFAA. According to the VFAA, distributors are considered to be VFA service providers and must therefore obtain a VFA services licence from the MFSA. Distributors of virtual asset funds must meet certain requirements to obtain a license, such as having adequate financial resources, a sound governance structure, and fit and proper individuals in key positions. Distributors must also have appropriate risk management and compliance procedures in place, including AML/CFT procedures.

The VFAA also requires distributors of virtual asset funds to provide investors with appropriate information about the products they are distributing. This includes information about the risks associated with investing in virtual assets, the fees charged, and any other material information that is necessary to enable investors to make an informed decision.

Furthermore, the VFAA requires that distributors of virtual asset funds comply with any other regulatory requirements that may be applicable to the products they are distributing. For example, if the virtual asset fund is a CIS, the distributor would also need to comply with the ISA and obtain the necessary authorisation to distribute that CIS in Malta.

Are there requirements for intermediaries seeking to provide trading in virtual assets for clients or advise clients on virtual assets in Malta?

Yes, the MFSA has established requirements for intermediaries seeking to provide trading services in virtual assets for clients or advise clients on virtual assets in Malta. These requirements are specified under the VFAA and the ISA.

Under the VFAA, intermediaries that wish to provide virtual asset services in Malta are considered to be VFA service providers and are required to obtain a VFA services license from the MFSA. Intermediaries are subject to ongoing regulatory requirements, including ongoing due diligence of clients, compliance with AML/CFT requirements, and ongoing monitoring of client transactions. Intermediaries are also required to maintain adequate financial resources and a sound governance structure.

Under the ISA, intermediaries that provide investment services in or from Malta, including those related to virtual assets, are required to be authorised and licensed by the MFSA. Investment service providers are subject to compliance with a range of regulatory requirements, including conducting appropriate due diligence of clients, maintaining appropriate records, complying with AML/CFT requirements, and ongoing reporting requirements. Investment service providers are also required to maintain adequate financial resources and a sound governance structure.

Furthermore, intermediaries that provide trading services in virtual assets or advise clients on virtual assets are also subject to specific requirements related to the provision of information and advice to clients. They have an obligation to provide clients with appropriate information about the products being traded or advised on, including the risks and costs involved. They must also ensure that clients are aware of all the options available to them and that they are making informed decisions based on their personal circumstances and risk tolerance.

5. Other relevant regulatory information

Are there any upcoming regulatory developments in respect of crypto-related activity in Malta?

Malta is gearing up for significant changes in its virtual currency sector due to the upcoming MiCA regulation in the EU, scheduled for implementation in 2024. MiCA aims to standardise the oversight of crypto assets across EU member states, including Malta. The MFSA is actively aligning its regulations with MiCA, working towards a unified licensing system for crypto service providers. MiCA introduces concepts such as reverse solicitation, allowing non-EU firms to offer crypto services without MiCA authorization at the customer’s request. Existing licensed firms can provide crypto services without additional authorization.

Has there been any notable events in Malta that has prompted regulatory change recently?

Malta’s recent regulatory changes are influenced by the upcoming MiCA regulation, effective December 2024. The MFSA is aligning the country’s crypto regulations with MiCA through public consultations. Changes include revising the VFA framework, removing audit and insurance requirements to simplify compliance for crypto businesses. Aim is to prepare local businesses for the EU-wide regulatory environment.

6. Pending litigation and judgments related to virtual assets in Malta (if any)

There are currently no pending litigations or judgments in Malta.

7. Government outlook on virtual assets and crypto-related activities in Malta

Malta has a positive outlook on virtual assets and crypto-related activities, being an early adopter of a specific regulatory framework with the enactment of the VFAA in November 2018. The MDIA was established to promote the development of digital technologies. Aligning with the EU’s MiCA, Malta aims to standardise crypto asset oversight across EU member states. The MFSA began discussions on virtual asset regulation in late 2017, leading to the VFAA’s enactment. The VFA Rulebook provides additional regulation for Crypto-Asset Service Providers and financial services sector operators. The MFSA has issued guidance notes covering aspects like VFA agent registration and whitepaper registration processes, reflecting a proactive approach by the Maltese government in regulating virtual assets and crypto-related activities.

8. Advantages of setting up a VASP in Malta

Malta has a regulatory framework designed to protect customers, investors, market integrity, and the country’s reputation. To obtain a full license for a Maltese cryptocurrency company, specific requirements must be met, offering advantages such as a tax system with low corporate income tax, international double taxation agreements, and relatively low VAT.

Various legal entities, including Ltd and Plc, can be established for trading or holding purposes. VFA service providers can benefit from the Highly Qualified Professionals Policy, enjoying a 15% flat tax rate up to EUR 5 million. Crypto-specific tax guidelines issued by the CFR office provide clarity on income tax, stamp duty, and VAT rates for DLT assets. Malta’s Virtual Financial Assets Act sets regulations for launching cryptocurrencies and services such as brokerages, portfolio managers, custodians, eWallet providers, investment advisors, and cryptocurrency exchanges. With an established VFA framework aligned with international standards, Malta fosters a business-friendly culture, evident in the MFSA’s open-door policy, making it a preferred choice for crypto industry players.