Malta

Malta is one of the main licensing hubs for EU-facing online gaming, and many B2C operators and B2B suppliers are based there. The Gaming Act (Cap. 583) sets up the Malta Gaming Authority (MGA) and the licensing framework. The Act has been in force since 1 August 2018. Its subsidiary regulations set the detailed rules on authorisations, player protection, commercial communications and tax.

Most of the framework's text dates from 2018, but it has been amended since. The most recent change for licensees is a new gaming tax structure that took effect on 1 October 2026.

Note on sourcing: the MGA's website (mga.org.mt) blocked automated access during this review. This page relies only on the legislation itself, as published by Legislation Malta, and does not cover MGA directives, guidance or news releases.

Regulator and licensing

The Malta Gaming Authority is the single regulator for gaming in and from Malta. Under regulation 3 of the Gaming Authorisations Regulations (S.L. 583.05), no person may provide a gaming service or a critical gaming supply "from Malta or to any person in Malta, or through a Maltese legal entity" without a valid licence, unless an exemption applies. The Regulations set up two licence categories:

• Gaming Service licence: a business-to-consumer (B2C) licence to offer or carry out a gaming service.
• Critical Gaming Supply licence: a business-to-business (B2B) licence for a "critical gaming supply". The Act defines this as a supply that is indispensable to deciding the outcome of a game, or to processing and managing essential regulatory data.

Both licence categories are split into four game types:

• Type 1: games of chance against the house where a random generator decides the outcome. This includes casino games, lotteries and virtual sports.
• Type 2: games of chance against the house where the outcome depends on an external event and the operator manages its own risk through odds. In practice this is fixed-odds betting.
• Type 3: games not played against the house, where the operator takes a commission. This includes poker, bingo and betting exchanges.
• Type 4: controlled skill games.

The default licence term is ten years. A body corporate can apply for itself only or for its whole corporate group, in which case every member of the group is jointly and severally treated as the licensee.

Article 56A of the Gaming Act was added by Act XXI of 2023. As a principle of public policy, it bars actions against MGA licensees, and refuses recognition of foreign judgments, where the claim conflicts with the legality of gaming services provided under an MGA licence.

Key rules for affiliates

The Gaming Commercial Communications Regulations (S.L. 583.09) apply to authorised persons. Under regulation 3(b) they also apply to "any person providing any service to, or on behalf of, or in any way in collaboration with" an authorised person. That wording brings affiliates and marketing partners into scope. The main rules are:

• Unauthorised products. No person may advertise a licensable game unless both the game and the operator are authorised.
• Social responsibility. Commercial communications must be socially responsible and protect minors and vulnerable persons. They must not suggest that gaming solves financial problems or can replace employment.
• Unsolicited communications. Authorised persons may not send unsolicited commercial communications, either directly or through third parties. Requests to stop solicited communications must be met within three days.
• Self-excluded players. Players known to be self-excluded must not be targeted. Operators have up to 24 hours from the self-exclusion before this rule applies.
• Disclosures. Commercial communications must show the authorised person's name and identify the licensing authority, with any authorisation reference numbers.
• Social media. Content on social media accounts held by authorised persons, or by third parties acting for them or with them, is subject to the regulations in full.
• Liability for third parties. Under regulation 33, an authorised person is responsible for breaches "even if the action is not performed directly by it, but by any third party". The Authority may decide not to sanction the authorised person if the third party acted without its knowledge or approval, it took sufficient precautions, and it acted at once to fix the breach.

Responsible gaming duties, the protection of player funds, unfair terms and player disputes are covered separately by the Gaming Player Protection Regulations (S.L. 583.08).

Recent changes

• 1 October 2026: new gaming tax structure. Legal Notice 84 of 2026, the Gaming Tax (Amendment) Regulations, 2026, came into force on 1 October 2026 and replaced regulation 3 of the Gaming Tax Regulations. Gaming tax is now charged on gaming revenue from players in Malta at these rates:

  Activity	Rate
  Type 1 gaming services	15%
  Type 2, Type 3 and Type 4 gaming services	10%
  Activity in controlled gaming premises, or lawfully classified junkets	5%

  For services provided only at a distance, what counts is whether the player is established in Malta, has a permanent address there or usually lives there, not where the player is physically located. When a licence is held by a corporate group, the whole group is treated as one "person" for tax purposes.

• 1 October 2026: studio broadcasting levy. The same legal notice added a fixed €3,000 annual levy, paid in advance, for B2B critical gaming supply licensees that use premises as a studio to film or broadcast a gaming service. It also deleted the previous levy-rate regulation.

• Consolidated texts. On Legislation Malta, the consolidated Gaming Act is the version published on 16 June 2023. The Authorisations and Commercial Communications Regulations show no amending legal notices from 2024 to 2026.