Markets

Malta (MGA): iGaming Payments, KYC, RG and Marketing Rules

A one-page summary of the Player Protection Directive and FIAU rules that govern MGA licensees: withdrawals, player funds, due diligence, limits, self-exclusion and terms.

4 min readPart of markets

On this page
  1. Who regulates MGA licensees?
  2. Which payment rules apply?
  3. What are the KYC and AML rules?
  4. What responsible gambling rules apply?
  5. What are the marketing and terms rules?
  6. What should an operator check first under an MGA licence?
  7. How does an MGA licence relate to other markets?
  8. What does a compliant MGA player journey look like?
  9. What mistakes do operators commonly make?
  10. Checklist
  11. Frequently asked questions
  12. Sources
  13. More guides

The Malta Gaming Authority licenses many operators that serve players across Europe and beyond. Its Player Protection Directive sets rules on withdrawals (remit within five working days where practicable), player funds, limits, self-exclusion and fair terms, while the FIAU supervises AML, including customer due diligence once deposits reach €2,000 and an annual Risk Evaluation Questionnaire.

Key takeaways

  • Withdrawals within five working days where practicable; back to source; no restriction on deposited funds unless AML requires [1].
  • Player funds are the players’ assets and protected from the licensee’s creditors [1].
  • CDD at €2,000 in deposits [2].
  • Limits: tighten immediately, loosen after 24 hours [1].
  • Annual FIAU REQ; the 2026 deadline was 9 April [3].
5 working dayswithdrawal expectation
€2,000CDD threshold
€250minimum monthly withdrawal limit
24 hoursdelay to loosen limits

Who regulates MGA licensees?

The MGA licenses and supervises gaming; the FIAU supervises AML and is Malta’s financial intelligence unit. Many MGA licensees serve players in other countries and also follow local rules there.

Which payment rules apply?

Rules at a glance
Area Rule in brief Deep guide
Withdrawals Five working days where practicable; back to source; €250 minimum monthly limit [1] Casino withdrawals from MGA licensees
Player funds Held at approved institutions; protected from creditors [1]
Cancellation Do not encourage; reversals are a risk indicator [1]

What are the KYC and AML rules?

Age controls and affirmation apply before use. CDD is required at €2,000 in deposits, with enhanced measures for higher risk; licensees maintain a business risk assessment and file the REQ through CASPAR [2] [3]. FIAU penalties have cited missing source of funds information [4]. See KYC requirements for MGA licensees.

What responsible gambling rules apply?

Deposit and wagering limits are required; self-exclusion is available at all times and takes effect immediately; licensee-initiated exclusion is allowed where a problem is suspected; reduction or revocation of an exclusion takes effect after 24 hours (definite) or seven days (indefinite) [1].

What are the marketing and terms rules?

Terms, including promotional terms, must be fair, clear and accessible before registration; only one current version of general terms per brand; material changes need express acceptance; licensees must not try to keep self-excluded players using their services [1].

What should an operator check first under an MGA licence?

  1. Licence typeB2C gaming service licence from the MGA.
  2. AML programmeFIAU-compliant risk assessment, CDD, monitoring and reporting [2].
  3. Player protectionLimits, reality checks and self-exclusion under the Player Protection Directive [1].
  4. Complaints and ADRA complaints procedure and named ADR provider.
  5. Target market rulesAn MGA licence does not override local rules in markets that license operators themselves.

How does an MGA licence relate to other markets?

Many operators hold an MGA licence and also local licences in markets such as Sweden, Germany or the Netherlands. Each local licence brings its own rules on KYC, limits, bonuses and payments, which apply to players in that market. The MGA licence remains relevant for markets without local licensing and for the operator’s corporate obligations.

What does a compliant MGA player journey look like?

  1. Age affirmed; limits offered before first deposit.
  2. CDD completed.
  3. Remitted within five working days, back to source.
  4. Operator procedure, then registered ADR.

What mistakes do operators commonly make?

Restricting deposits for bonus terms

Not allowed unless AML requires [1].

Missing the REQ

Breach of FIAU duties [3].

Encouraging cancellation

Prohibited [1].

Checklist

  • Five working day withdrawals tracked.
  • CDD at €2,000.
  • Limits with correct change rules.
  • Fair, single-version terms.
  • REQ filed.
  • Local licence rules mapped per target market.
  • FIAU risk evaluation questionnaire submitted.

Frequently asked questions

Who regulates Maltese online casinos?

The MGA, with the FIAU for AML.

How fast must MGA casinos pay?

Within five working days where practicable.

When must MGA casinos verify me?

CDD by €2,000 in deposits.

Are my funds protected?

Player funds are the players’ assets and protected from the licensee’s creditors.

Can I self-exclude?

Yes, at any time, effective immediately.

What is the REQ?

The FIAU’s annual Risk Evaluation Questionnaire.

Can an MGA casino cap my withdrawals?

Only reasonably; a monthly limit can never be below €250.

Where do I complain?

To the operator, then a registered ADR entity.

Does an MGA licence allow operating in any EU country?

No. Many EU countries require their own licence.

What is the FIAU?

Malta’s AML supervisor and financial intelligence unit.

Sources

  1. MGA: Player Protection Directive
  2. FIAU: Implementing Procedures
  3. AML Watcher: FIAU REQ 2026
  4. NEXT.io: FIAU penalty on Kanon Gaming

Casino withdrawals from MGA licensees

The Player Protection Directive: five working days, source account payouts and limits.

KYC requirements for MGA licensees

Age checks, the €2,000 due diligence threshold and FIAU expectations.

Deposit limits by market

Mandatory and default deposit limits in the UK, Netherlands, Germany, Sweden, Malta, Ontario and US states.

Self-exclusion schemes

GAMSTOP, Spelpaus, OASIS, Cruks, BetGuard, Brazil’s platform and US state lists compared.

Source of funds and source of wealth

When SoF and SoW checks are triggered, what evidence counts, and what regulators penalised.

Further reading elsewhere