Malta’s MFSA Tightens Crypto Rules Operators Must Know

TL;DR: Malta’s MFSA is explicitly prioritising licence quality over volume, has aligned with ESMA in treating crypto perpetual futures as CFDs, and has extended AI governance expectations to cover third-party LLMs used by licence holders. Operators running EU-facing crypto, forex, or iGaming products need to map their exposure before regulators do it for them.

The MFSA’s Core Philosophy: Gate First, Scale Never

Kenneth Farrugia, CEO of the Malta Financial Services Authority since April 2023, runs the numbers on Malta’s licensing history like an operator runs funnel data: conversion rate matters, but only if the quality at the bottom justifies the cost at the top. In 2017, Malta had over 200 crypto companies operating within its borders. When the Virtual Financial Assets (VFA) regime launched, only 24 applied for a VASP licence. Malta licensed 12. The rest relocated to lighter jurisdictions.

Farrugia does not frame that attrition as a failure. He frames it as the product working as designed. “It’s much easier to leave a bad player out than to licence and punish,” he has said publicly, and that sentence functions as the MFSA’s operating doctrine. By the time MiCA came into force in 2025, Malta had seven years of hands-on supervisory experience with crypto firms. Most of its 22 current MiCA licences went to companies already supervised under the VFA Act, including crypto.com, OKX, and Falcon X.

Germany leads the EU on MiCA authorisations. The Netherlands and France sit in a similar band behind it. Malta and Cyprus are further down the list. Farrugia declined to speculate on why other jurisdictions have issued more licences, stating that Malta’s job is to assess its own applicants properly, not compete on volume. A European Banking Authority review of Malta’s process came back largely positive. The MFSA has implemented roughly 80% of the recommendations, with a new supervisory case management system expected to launch in early 2026.

Crypto Perps Now Face CFD Classification and Leverage Caps

The most operationally significant development in the interview for any exchange or broker running perpetual futures is Malta’s alignment with ESMA’s position on CFD classification. Farrugia confirmed that perpetual futures derivatives should fall within the existing conduct and product-intervention measures for CFDs under MiFID II. Asked directly whether firms like OKX and crypto.com would need to treat perps as CFDs, his answer was unambiguous: “Yes. But they should meet the CFD definition.”

What does that mean in practice? CFD classification triggers strict leverage limits for retail clients and tightly governed marketing rules. Perps have become one of the highest-volume instruments in crypto trading globally, with the asset class hitting $61.7 trillion in notional volume recently. If ESMA and the MFSA formalise CFD treatment at the EU level, every operator running perps for retail EU clients will need to rebuild their product presentation, risk disclosures, and leverage tiers to comply with the same regime applied to traditional forex CFDs.

This is not a future threat. It is a current supervisory expectation in Malta. Operators using paid acquisition channels to drive retail sign-ups for perp products in EU markets should be reviewing their ad copy, landing page claims, and leverage messaging against CFD marketing standards immediately.

Bilateral Enforcement Networks Reach Offshore Jurisdictions

The MFSA’s regulatory reach extends well beyond EU borders. In April, Malta signed a memorandum of understanding with the Seychelles Financial Services Authority, formalising cooperation on financial oversight. Farrugia described a growing web of bilateral agreements with regulators both within and outside the EU, with information sharing described as often voluntary rather than triggered only by formal requests.

The enforcement logic is explicit: if the MFSA takes action against a bad actor in Malta and identifies the same operator or individual active in another jurisdiction, it immediately alerts the relevant regulator. This is not a passive system. It is a proactive information-sharing network designed to prevent bad actors from simply hopping between jurisdictions when scrutiny intensifies.

For operators who have structured their businesses around regulatory arbitrage, moving product lines to lighter jurisdictions while maintaining EU client-facing operations, this bilateral network significantly raises the cost of that strategy. The era of clean jurisdictional separation between where you hold a licence and where you source clients is contracting.

What This Means for Forex and Crypto Marketing Operators

The regulatory signals coming out of Malta in 2026 have direct implications for how operators across forex, crypto, and iGaming structure their acquisition and retention marketing in EU-accessible markets.

First, if your product includes perpetual futures marketed to retail clients in Malta or any EU jurisdiction where ESMA’s guidance carries weight, your current ad creative, leverage claims, and landing page copy almost certainly need a compliance review. The CFD framework imposes restrictions on marketing that are materially stricter than the rules many crypto exchanges have been applying to perp products. Running a full marketing audit against CFD advertising standards is the first step, not an optional one.

Second, the MFSA’s enforcement architecture rewards operators who build genuine compliance infrastructure rather than performing it. Remediation is required to demonstrably stick before a matter is considered closed. That means forex lead generation campaigns that push aggressive leverage messaging to EU audiences carry growing regulatory tail risk, even when the broker holds a valid licence. Licence quality is being scrutinised, not just licence existence.

Third, for crypto operator acquisition funnels, the tightening of MiCA supervision in Malta signals that the window for undifferentiated volume plays is closing. Operators who compete on quality of client, product legitimacy, and clean marketing practices are better positioned under the regulatory regime Farrugia is building than operators who optimise purely for registration volume.

For iGaming operators watching prediction markets, the situation is more complex. Farrugia acknowledged that prediction market products could simultaneously fall under MiFID, MiCA, and gambling law depending on product classification. There is no EU passporting mechanism for gambling licences, meaning a single prediction market product could require separate regulatory approvals in multiple frameworks with no consolidated route to market. Malta’s Gaming Authority is working alongside the MFSA to define where the lines sit, but no timeline exists for resolution.

AI Governance: Third-Party LLMs Now Inside the Compliance Perimeter

Farrugia’s comments on AI are operationally relevant for any licensed firm using external AI tooling in client-facing or trading infrastructure. The MFSA issued a “Dear CEO” letter setting expectations for AI use among licence holders, positioning Malta as one of the first jurisdictions to do so formally. The critical detail: those expectations cover third-party providers, including general-purpose LLMs, that feed into a licensed firm’s operations.

That is a meaningful expansion of the compliance perimeter. A broker or exchange using an LLM-powered customer service tool, a trading signal assistant, or an AI-driven lead qualification agent cannot treat the AI layer as outside the scope of its regulatory obligations. The MFSA’s position is that governance requirements extend to the full operational stack, regardless of whether the AI component is built in-house or sourced from a third party.

Farrugia described agentic trading as “still at an infancy stage,” with detailed rules expected to develop incrementally rather than arrive as a finished framework. But the “Dear CEO” letter means the expectation of governance, controls, and oversight is already live, not pending. Operators integrating AI into audience targeting and personalisation workflows should document those integrations and their governance structure now, before a supervisory review requests it.

Quality Gating as a Competitive Signal for Legitimate Operators

Farrugia’s repeated emphasis on quality over volume carries a practical implication that many operators miss: a jurisdiction that actively culls bad actors from its licence roster makes being a licence holder more valuable, not less. When the MFSA reduced 200 operating companies to 12 licensed ones in 2017, it created a credibility signal for the firms that passed. That signal is part of why crypto.com and OKX sought Maltese supervision in the first place.

For operators committed to building durable, compliant EU-market businesses, Malta’s gatekeeping approach is a feature rather than a friction point. The operators who treat compliance as a competitive moat, rather than a cost centre, are the ones who benefit when a regulator like Farrugia makes the bar demonstrably high and enforces it consistently.

The MFSA employs more than 600 staff, with 25 dedicated to crypto functions. It has bilateral agreements spanning EU and non-EU regulators. It holds licence holders accountable for remediation, not just acknowledgment. For operators building in this environment, the question is not whether the regulatory bar will stay high. It will. The question is whether your compliance and marketing infrastructure is built to clear it.

Originally reported by Finance Magnates, August 2026.