Buy-side CASP acquisition · Malta
Buy a CASP in Malta: MFSA-authorised crypto licence
Malta wrote the EU’s first comprehensive crypto regime in 2018, and that head start now reads as MFSA-supervised CASPs converted from the old VFA register and a small set of fresh MiCA grants like System Pay Services (Malta) Limited (BVNK) in February 2026. The English-language regulator, the seven-year track record of crypto supervision, and the Article 83 qualifying-holding mechanic make Malta a credible buy-side route for an acquirer who wants an EEA-passporting CASP without re-applying de novo.
Why Malta
Seven years of crypto supervision, now under MiCA Title V
The Malta Financial Services Authority (MFSA) is the competent authority for crypto-asset service providers under Article 62 of Regulation (EU) 2023/1114. Malta’s pre-MiCA regime, the Virtual Financial Assets Act of 2018, was the first comprehensive crypto-licensing framework in any EU member state and ran for six years before MiCA’s full application on 30 December 2024. Existing VFA Act licensees convert into the MiCA-CASP perimeter under Article 143 transitional arrangements, and the MFSA’s December 2024 Circular to the Industry on the Authorisation Process for MiCA Applicants set out the file expectations for both the converting cohort and the de novo applicants.
The credibility test moved beyond the local conversation in mid-2025. The MFSA was the subject of the first ESMA fast-track peer review of a CASP authorisation under MiCA, published 10 July 2025. The Peer Review Committee assessed the MFSA as fully meeting expectations on supervisory resources and institutional settings, and as largely meeting expectations on the exercise of supervisory powers post-authorisation. The committee also flagged that the overall authorisation process should have been more thorough on the file it sampled, and that material issues remained pending remediation at the point of authorisation. ESMA’s recommendations to all NCAs (business growth, conflicts of interest, governance, intragroup arrangements) now define the standard a sophisticated acquirer’s diligence applies to any MFSA-authorised CASP file.
BVNK’s MFSA licence on System Pay Services (Malta) Limited in February 2026 was the headline tier-1 fintech grant for the year. The licence covers exchange of crypto-assets for funds and for other crypto-assets, custody and administration of crypto-assets on behalf of clients, and transfer services. Combined with BVNK’s existing Maltese e-money authorisation, it produced an unusual single-platform stack of MiCA-CASP plus EMI plus direct SEPA access. The takeaway for acquirers is what the grant confirms: Maltese authorisation works at scale for tier-1 cross-border crypto operators, and the MFSA is granting on substantive files rather than retrenching after the ESMA review.
What an MFSA MiCA-CASP authorisation permits
Title V scope, Article 67 capital, and the obligations the buyer inherits
A Maltese CASP authorisation is granted under MiCA Title V and unlocks the Annex I service menu: custody and administration of crypto-assets on behalf of clients, exchange of crypto-assets for funds, exchange of crypto-assets for other crypto-assets, execution of orders, placing of crypto-assets, reception and transmission of orders on behalf of clients, advice on crypto-assets, portfolio management of crypto-assets, transfer services for crypto-assets, and operation of a trading platform. Each service in scope is named explicitly on the MFSA authorisation. Adding a service after the grant requires an Article 64 modification, not a fresh authorisation.
Permanent minimum own funds sit at three classes under Article 67. Class 1 services (advice, reception and transmission of orders, transfer services, portfolio management, placing) are floored at EUR 50,000. Class 2 (execution of orders, exchange of crypto-assets for funds or for other crypto-assets, custody and administration) raises the floor to EUR 125,000. Class 3 (operation of a trading platform) takes it to EUR 150,000. The figures above are statutory floors only. The binding number for an established target is the higher of the floor and one quarter of the previous year’s fixed overheads, which is where mature Maltese targets — VFA-converted operators in particular — typically settle well above the headline minimum.
Article 75 governs segregation of clients’ crypto-assets from the CASP’s own holdings, with reconciliation discipline and clear contractual disclosures. Article 68 sets the prudential governance frame: at least two fit-and-proper executive directors, organisational structure proportionate to the service mix, internal control and compliance functions resourced to do their job, locally executed decision-making, and a documented business continuity plan. DORA (Regulation (EU) 2022/2554) layers ICT risk management on top from January 2025, and the Travel Rule under Regulation (EU) 2023/1113 governs originator and beneficiary information on crypto-asset transfers. Malta’s local Implementing Procedures Part II — Virtual Financial Assets Sector remain the operational AML reference point alongside the MFSA’s MiCA-specific guidance. The acquirer inherits all of this at completion, including any open MFSA correspondence and any in-flight conversion file from the VFA register.
What we broker here
The Maltese CASP files we work with
The Maltese CASP book divides into a few distinct populations. Converted VFA Act licensees — the firms that held a 2018-regime authorisation and have either completed or are completing the MiCA file under Article 143 — sit at one pole, with seven years of MFSA correspondence behind them and (typically) the strongest revenue base. De novo MiCA-CASP grants since 30 December 2024 sit at the other, often with cleaner files but shallower MFSA history. In between are Maltese subsidiaries of cross-border crypto-and-payments groups whose parent is restructuring the licence stack, and the rarer category of payments groups that paired an existing Maltese EMI authorisation with a fresh CASP grant for the SEPA-plus-crypto stack BVNK demonstrated in February 2026.
Our diligence gates on every Maltese file are the standard four. Banking continuity (which Maltese credit institution holds the segregated client crypto-asset proceeds, what the relationship looks like post-completion, and the realistic re-papering window if it has to move). The AML programme under Malta’s Implementing Procedures Part II and MiCA Title V (transaction monitoring, sanctions screening, the MLRO’s seniority and replaceability, the FIAU correspondence trail). The substance pillar (Maltese-resident management, locally executed decision-making, the support functions the MFSA expects under its real-presence test, and the FTE retention plan post-completion). And the technology stack (custody architecture, key-management arrangements, third-party providers inside the audit perimeter, and the DORA ICT risk register).
One Malta-specific gate sits on top of those four after the ESMA peer review. We read the target’s authorisation file against the four areas the Peer Review Committee flagged — business growth assumptions, conflicts of interest, governance and intragroup arrangements — and surface any post-authorisation remediation items the MFSA has opened or is likely to open as a result. That is information acquirers historically had to discover after closing. We do not list the same target with multiple acquirers, and we will not present an entity we have not personally diligenced against the MFSA’s published expectations.
Acquisition path
Article 83 change-of-control, in practice
The acquisition mechanic for a Maltese CASP runs through Article 83 of MiCA. Any proposed acquirer of a qualifying holding (10%, 20%, 30%, or 50% thresholds, or any holding that confers control) must notify the MFSA in writing before the transaction completes. The supervisor acknowledges the notification, opens the assessment window of up to 60 working days, and may extend it once by a further 30 working days where it requests additional information. Assessment criteria run to reputation of the proposed acquirer, suitability of incoming directors and key function holders, financial soundness, ability of the target to comply with MiCA on an ongoing basis post-completion, and AML/CFT risk.
What shortens the MFSA window is a complete dossier delivered with the initial notification, not after the supervisor’s first request for further information. We build that dossier with our acquirers before signing: UBO disclosure, sources-of-funds, group ownership chart, three-year prudential plan, governance arrangements at the target post-completion, and (where the target is a VFA converter) the status of the in-flight Article 143 file. See the acquisition process for the standing checklist.
Why Cadena
Buy-side only, transactional, fast
We act for the acquirer only. The Maltese target’s adviser sits across the table from us on every CASP transaction, never on the same side, and the same engagement letter that opens a Malta mandate authorises us to extend the search to EU comparables if the Malta diligence does not converge. That removes the conflict-of-interest cloud that mixed-mandate brokers carry into a supervisor’s review and gives the acquirer a single advisory thread from sourcing through Article 83 sign-off.
The engagement is concrete. We open with sourced approaches under NDA on the Maltese targets that match the acquirer’s thesis (size, service mix, customer geography, banking arrangements, VFA-converter vs de-novo status). We run the regulatory diligence on each candidate in parallel with the qualifying-holding filing at the MFSA, which compresses the calendar versus a sequential approach. We structure the SPA around the change-of-control conditions a CASP transaction actually carries: regulatory non-objection, banking continuity confirmations, key-person retention, the warranties an acquirer needs on the AML programme, and explicit reps on any open ESMA-peer-review remediation items in the target’s MFSA correspondence.
FAQ
Frequently asked: Maltese CASP and MiCA acquisitions
Can I buy a CASP licence in Malta rather than apply de novo?
Yes, when the underlying entity holds a current MFSA authorisation under Article 63 of MiCA, or a complete in-flight conversion file from the VFA Act register that the MFSA has accepted under Article 143. The transaction is a change-of-control under Article 83: you notify the MFSA of the proposed qualifying holding, the supervisor runs a fit-and-proper assessment of the acquirer and incoming key function holders, and the deal completes on the supervisor’s non-objection. We broker only entities whose authorisation is live or whose VFA conversion file is genuinely complete (a distinction the headline registration status does not capture).
What is the difference between a VFA licence and a MiCA-CASP authorisation in Malta?
The VFA Act of 2018 was Malta’s pre-MiCA national crypto regime, supervised by the MFSA with a VFA Agent acting as the regulator-facing intermediary on applications. MiCA replaces the VFA framework on substance: Title V of Regulation (EU) 2023/1114 now defines the service categories, the prudential rules, and the supervisory regime EU-wide. Article 143 of MiCA gives existing VFA Act licensees a transitional path to convert their authorisation into a MiCA-CASP. The licence text on a converted entity references Title V of MiCA and identifies the MFSA as the issuing authority. For an acquirer the practical difference is the EEA passporting right under Article 65 — VFA was Malta-only; a MiCA-CASP grants the entire single market.
How is the VFA-to-MiCA transition tracking under Article 143?
Each EU member state set its own transition window within the maximum 18 months MiCA Article 143 allowed, and Malta opted for a structured run-off rather than an instantaneous cut-over. Existing VFA Act licensees that filed (or will file) a complete MiCA-CASP application before the local cut-off continue to provide their pre-MiCA services under the transitional regime until the MFSA decides their file. The MFSA’s December 2024 Circular to the Industry on the Authorisation Process for MiCA Applicants is the procedural anchor. For acquirers diligencing a converter the binding question is what is in the application file at the MFSA today, not what the headline VFA licence says.
Can a Maltese CASP licence passport across the EU?
Yes. Article 65 of MiCA gives any authorised CASP an EEA-wide passport to provide its scoped services in any other EU or EEA member state through a notification rather than a fresh authorisation. The acquirer inherits the Maltese passporting rights at completion. The passport covers exactly the Title V services named in the original MFSA authorisation; expanding into adjacent services after closing requires an Article 64 modification with the MFSA first.
How does Article 83 change-of-control approval work at the MFSA?
You file a written qualifying-holding notification with the MFSA before the transaction closes. The supervisor has 60 working days from acknowledged-complete notification to assess, extendable by 30 working days where it requests further information. Assessment criteria are reputation, suitability of incoming directors and key function holders, financial soundness, MiCA-compliance capability, and AML/CFT risk. The dossier mirrors what the MFSA expects on a qualifying-holding for an investment firm or e-money institution under its other supervisory regimes, because the criteria are calibrated on the same fit-and-proper logic across vertical.
What did the ESMA peer review say about Malta and how should it shape diligence?
The ESMA Peer Review Committee published its fast-track review of a CASP authorisation and supervision in Malta on 10 July 2025. The MFSA was assessed as fully meeting expectations on supervisory resources and largely meeting expectations on supervisory powers post-authorisation. The committee also flagged that the authorisation process on the file it sampled should have been more thorough and that material issues remained pending remediation at the time of authorisation. The MFSA welcomed the review and said it would action the recommendations. For acquirers the practical implication is concrete: diligence on any MFSA file should specifically test the four areas ESMA highlighted — business growth assumptions, conflicts of interest, governance, and intragroup arrangements — and the SPA should carry explicit reps on open or anticipated remediation items.
Is buying a Maltese CASP different from buying one in another EU country?
The MiCA framework is identical across member states; the supervisor and the candidate pool differ. Malta is unusual because the VFA Act gave the MFSA a six-year head start on crypto supervision, which produces a deeper bench of converters and a higher proportion of mature operators than Cyprus, Lithuania, or Ireland. The English-language regulator and the established VFA-Agent ecosystem are practical advantages. The ESMA peer review sharpened the diligence template every Malta acquirer now applies. Compare the EU CASP hub for side-by-side reads on Malta against Cyprus, Germany, Lithuania, and Ireland.
Next step
Open a buy-side mandate on Maltese CASPs
If your acquisition thesis points at MiCA-CASP coverage with MFSA supervision and EEA passporting, send us your acquisition criteria. We come back with the Maltese targets that match: pre-vetted on MFSA standing, banking continuity, AML programme, VFA-conversion-file status where relevant, substance under Article 68, and Article 83 readiness. Where Malta is not the right fit on diligence, the same engagement covers EU CASP comparables in adjacent member states.
