The MGA Licence: How the Malta Gaming Authority Works in Practice

What MGA is – from the 1962 state lottery to the 2018 Gaming Act

The first thing to grasp: MGA is not an EU body. It is an independent Maltese regulator whose decisions are only binding within Malta's jurisdiction. But because Malta is an EU member and corporate law is aligned with the Treaty, an MGA licence can be marketed across the Union – with national exceptions such as Sweden, Germany, and Spain.

Maltese gambling oversight evolved in three stages. The first state lottery launched in 1962. The Lotteries and Gaming Authority (LGA) was created in 2001 and rebranded as the Malta Gaming Authority in 2015 after restructuring. The current legislation – Gaming Act (Cap. 583) – came into force on 1 August 2018, replacing half a dozen earlier acts. Before that, Malta had five separate licence types based on the technical form of the game. The 2018 reform consolidated these into two fundamental categories (B2C and B2B) across four licence classes, making the framework more predictable for operators and clearer for players.

Scale matters here because it shapes both MGA's resources and its incentives. According to the MGA Annual Report 2023 the regulator oversees over 300 active licensees that together contribute a significant share of Maltese GDP. That is both MGA's strength and its weakness: large budgets for supervision, but also material dependence on licence fees as a revenue stream. Bear that in mind when reading sanctions decisions – MGA is simultaneously regulator and industrial policy actor.

The four licence classes – Class 1, 2, 3, and 4

The Gaming Act 2018 sorts every MGA licence into four classes. As a player you mainly interact with Class 1 (casino), Class 2 (sports betting), and Class 3 (peer-to-peer), while Class 4 is invisible to you but critical – it is where the game suppliers sit. Here is how the classes relate to one another, the minimum issued share capital, and the games that fall under each:

An operator running both slots and a sportsbook therefore needs both Class 1 and Class 2 – and the combined capital requirement becomes €200,000 of issued share capital, plus the equivalent funded coverage for player balances. Class 4 is invisible to you as a player, but it is these B2B suppliers (Evolution, Pragmatic Play, NetEnt and others) that produce the games you actually play. Their being under MGA oversight as well is a central reason an MGA licence covers the full stack.

Capital requirements and technical audits – how the operator is vetted

Capital is only one of three vetting layers an operator must clear to obtain and keep an MGA licence. The other two are the technical System Audit and ongoing compliance review. You should know all three because together they decide whether the operator can in practice pay out your winnings.

The first layer is capital. As the table above shows, the minimum issued share capital is €40,000 or €100,000 depending on the class. On top of that the operator must segregate player funds from working capital on a dedicated client account. This is one of the most important differences from an unregulated operator: if the operator becomes insolvent, player funds should in theory be protected from creditors. In practice that protection depends on whether the operator has actually followed the rules continuously – if funds have been commingled, the protection can be worthless.

For a sizeable operator that is a fraction of the reserve requirement UKGC applies, which uses a proportional calculation based on player balances.

The second layer is the System Audit. Before an operator receives a final licence, it must undergo an independent technical audit of its gaming platform, RNG implementation, and reporting systems. The audit report is filed with MGA. Operators on a provisional licence have 90 days to complete a full audit – failure to do so leads to revocation. The third layer, compliance review, is ongoing. The Compliance & Enforcement directorate reviews licensees on a risk basis and publishes an annual overview of cases, sanctions, and surrendered licences. According to MGA's public sanctions register, hundreds of enforcement actions are taken against licensed operators each year – from warnings to outright revocations.

The Player Protection Framework in practice

The Player Protection Framework is the collective name for the safeguards MGA requires the operator to offer you. It is not an optional policy – it is statutory under the Gaming Act and the Player Protection Directive, and non-compliance leads to sanctions. You have at least six concrete rights as a player on an MGA-licensed site.

The first is the ability to set your own limits. The operator must offer deposit limits, loss limits, session limits, and wager limits – and they must be accessible from first registration, not buried three clicks deep. The second is reality checks, telling you how long you have played and your net outcome. The third is a cooling-off period: a short, automatic break you can trigger yourself. The fourth is self-exclusion – from a minimum of seven days up to permanent. The fifth is age verification and KYC before the first withdrawal. The sixth is prominent information about responsible gambling, usually via links to external support organisations such as GamCare or GambleAware.

There is one important gap we think you should know about: MGA has no equivalent of GAMSTOP, Spelpaus or OASIS. Self-exclusion is operator-specific. If you exclude yourself at one MGA casino you can still register at another MGA casino without any flag, as long as you do not use the same email or phone. In practice a player can keep playing at 20–50 other MGA-licensed sites despite exclusion at one. This is one of the main reasons our guide to self-exclusion effectiveness recommends national systems wherever they exist.

Dispute resolution and the ADR process, step by step

Dispute resolution is one of MGA's strongest protections – and the one where most players miss their own process. The rules are clear: you must escalate internally with the operator first, then to an independent ADR body, and only last to the MGA Player Support Unit. The step between them is where most disputes stall.

The short version: after you submit a formal written complaint to the operator, they have 21 days to issue a final response. If you do not receive one within 21 days – or the response is unacceptable – you may escalate the case to the ADR body the operator lists in its terms. The ADR decision is binding on the operator if you accept it. You also retain the right to pursue the matter in civil court if you prefer.

We regularly see two mistakes in this process. The first: the player chats with operator support, gets nowhere, and gives up – without ever filing a formal complaint. The 21-day clock does not start ticking until you submit a formal written complaint via the operator's published complaints procedure. The second: the player goes straight to MGA instead of to the operator's designated ADR body. MGA is the last stop, not the first. Our experience is that ADR bodies resolve most disputes within 60 days, while cases that land at MGA directly without an ADR step are often rejected and have to be restarted.

KYC and AML – the money laundering controls under MGA

KYC (Know Your Customer) and AML (Anti-Money Laundering) are not bureaucratic friction – they are protections aimed at preventing money laundering, terrorism financing, and unauthorised access to your account. MGA applies the EU 5th Anti-Money Laundering Directive and the Maltese FIAU rules, which makes the regime at least as strict as UKGC's equivalent.

Before your first withdrawal, MGA-licensed operators require standard KYC: identity confirmation (passport or ID), proof of address (a recent bank statement or utility bill), and proof of payment method ownership (card or bank transfer registered in your name). This usually happens at withdrawal, not at deposit, which is a known criticism of the framework – money in is frictionless, money out demands documentation. For larger amounts, enhanced due diligence (EDD) kicks in: source of funds questions, possibly proof of employment, and bank statements showing where the gambling funds come from.

The thresholds are worth knowing. A single transaction above €2,000, or cumulative transactions above €15,000 within a rolling 24-hour period, triggers additional KYC review. At €35,000 in total turnover, EDD activates under FIAU guidelines. The operator also has an obligation to file Suspicious Transaction Reports (STRs) with the FIAU. A player who suddenly deposits large amounts via multiple payment methods without a credible explanation will almost always be asked to justify the source of funds.

MGA compared with UKGC, SGA, Spillemyndigheden, and GGL

To see what MGA is – and what it is not – we have to compare it to the other large European licences. Sweden (SGA), the UK (UKGC), Denmark (Spillemyndigheden) and Germany (GGL) represent four different supervisory philosophies. Here is a summary of the differences most relevant to you as a player:

Note row four. Only the UKGC (GAMSTOP), SGA (Spelpaus), Spillemyndigheden (ROFUS), and the GGL (OASIS) offer a statutory national self-exclusion that covers every licensee in the market simultaneously. MGA does not. For a player who is uncertain about their gambling, that is a concrete difference worth weighing – and it is why we always recommend locally licensed operators first when you live in a market that has its own regulator.

Verifying a casino on authorisations.mga.org.mt

Verifying that a casino actually holds the MGA licence it advertises takes under two minutes. We use the same checklist internally every time we review an MGA casino, and we recommend you do the same before depositing a single euro. This is the official method via the MGA public register.

1. Scroll to the casino's footer and find the MGA licence number (typical formats: MGA/B2C/123/2007 or MGA/CRP/123/2018).
2. Open authorisations.mga.org.mt in your browser – this is the MGA's official public register.
3. Search by licence number or company name. The company name should match the entity listed in the casino's Terms & Conditions, not necessarily the brand.
4. Confirm the status reads "Authorised" or "Active". If it says "Suspended", "Expired", or "Cancelled", do not deposit regardless of what the casino website states.
5. Confirm the casino's domain (or a related domain) appears under "Authorised URLs" in the registry. This is the most-missed check – many fraudulent sites use a legitimate licence number but sit on a domain that has never been authorised.
6. Check that the licence class matches what the casino offers. A casino offering both slots and sports betting must hold both Class 1 and Class 2, not just one of them.
7. Note "Licence Issued" and "Licence Expiry" dates. MGA licences typically run for 5 or 10 years. A licence nearing expiry should normally have a renewal in progress – if no renewal is visible in the registry, it is worth asking support.

If any step does not check out – the domain is missing from the registry, the status is not "Authorised", or the licence class does not cover what is offered – stop depositing and contact MGA at support.mga@mga.org.mt. We continuously report such anomalies to the MGA Player Support Unit and have seen them taken seriously – several operators have lost their licences following such reports over the years.

If the operator refuses to pay – your step-by-step plan

The worst-case scenario for a player is a frozen withdrawal, an unresponsive operator, and several thousand euros locked in. It happens on every licence type – including MGA – but on an MGA-licensed operator you have a structured step plan to follow. Here it is, with deadlines so you know what you are entitled to demand and when:

1. Document everything immediately: screenshots of the balance before and after, transaction IDs, the date and time of the withdrawal request, your full correspondence with support. Also save the operator's terms as they were worded at the time – terms can change retroactively.
2. Submit a formal written complaint to the operator's official complaints address (often complaints@operatorname.com). Use the subject line "Formal Complaint under MGA Player Protection Directive" and reference your account number.
3. Wait 21 days for the operator's final response. If you receive no response within 21 calendar days, that counts as refusal and you may escalate to the next step.
4. Escalate to the ADR body listed in the operator's terms. eCOGRA and IBAS are the most common. Include all previous correspondence, your documentation, and the operator's terms. The ADR decision is binding on the operator if you accept it.
5. If the ADR decision is not enforced within 30 days, or the matter is outside the ADR mandate, submit a formal report to the MGA Player Support Unit via support.mga@mga.org.mt. Include the ADR decision and all prior documents.
6. MGA investigates the case and may take action against the operator – from an order and a fine to revocation of the licence. For you as a player, an MGA decision means either payment per the order or a written reasoning for why the case is dismissed.
7. The final stop is civil court in Malta. It is rare but possible if the amount is large enough. We find most disputes resolve at the ADR stage – which is why we always recommend choosing operators that clearly list a known ADR body in their terms from the start.

One thing to bear in mind: the timeframes above are minimums, not maximums. ADR bodies such as eCOGRA handle thousands of cases per year, and investigations typically take 30–60 days. The MGA Player Support Unit averages 60–90 days for complex cases. Plan for 3–6 months from first complaint to final outcome in the worst case. It is not fast – but it is fundamentally far better protection than an unregulated operator without an ADR link gives you.

Common questions about the MGA licence