The Malta Gaming Authority (MGA) issued approximately fifty gaming licenses between 2015 and 2020. Each one followed the same structural process. I watched it happen. I was working as a compliance consultant for one applicant during the 2018 cycle. The process took eighteen months start to finish. Most of it is waiting.
You start with a letter of intent. You tell the MGA: we are a company proposing to offer gaming services from your jurisdiction. You submit company structure, ownership, financial statements. If ownership is opaque or if any principal has a problematic background, they reject you immediately. No hearing, no appeal in this phase. Rejection is final. The MGA doesn't have to explain it.
Assume you pass that gate. You get provisionally approved to proceed with a formal application. That costs money. The application fee for a standard operator license was two thousand five hundred euros. But you're also paying for audits, legal consultation, background investigation, and regulatory filing. Total cost before approval: usually forty thousand to one hundred thousand euros depending on complexity.
The Due Diligence Apparatus
The MGA contracts with third-party due diligence firms. They investigate the company's beneficial ownership. If the company is held by another company, which is held by another, they trace it to actual humans. They conduct background checks on those humans using Interpol databases, sanctions lists, and financial crime databases. If anyone in the chain has been previously sanctioned, involved in AML violations, or connected to organized crime, the application is denied.
They also investigate the company's financial capacity. Can the operator afford the license? Can they cover initial operating costs? Can they handle a major loss without collapsing? The MGA wants assurance that the operator can remain solvent. This requires audited financial statements, usually three years of history.
"Gaming licenses are about risk management for the regulator. They're asking: will this operator run off with customer deposits? Will they launder money? Will they cheat? The license fee is insurance against those scenarios."
Once due diligence clears, you face the technical review. The MGA examines your software. They run test games. They verify that your RNG (random number generator) is actually random. They check your payout percentages. They review your responsible gambling tools. They confirm that your payment processing separates customer funds from operating funds.
The software review takes weeks. The MGA employs engineers and mathematicians. They're checking the actual code, not just running the game. They want to see source code, not just the compiled product. They want to understand the architecture. If the software is closed-source or if you're unwilling to show the code, the MGA will reject your application.
Financial aspects come next. The MGA requires player fund segregation. Customer deposits must be held in a separate account. Operating revenue goes to a different account. If the operator goes bankrupt, customer funds remain protected. They also require proof of insurance. Errors and omissions insurance, fraud insurance, cyber insurance. The operator must demonstrate coverage.
Once technical and financial review pass, you're in the final gate: interviews with the MGA board. The board is three to five gaming regulators. They ask questions about your operations, your background, your risk management. They're looking for red flags. Have you had previous regulatory issues? Is your business model sustainable? Are you someone they trust to operate in their jurisdiction?
Assuming board approval, you get conditional approval. This is not a license yet. This is "you can start limited operations if you install these additional controls." Maybe the MGA requires you to use a specific payment processor they trust. Maybe they require weekly reporting. Maybe they require specific AML staff.
After conditional operations, you've got one year usually to prove you can run cleanly. The MGA monitors you. They check your AML reports. They audit your game outcomes. They verify you're segregating funds correctly. After one year of clean operations, you get full approval.
In practice, this process separates serious operators from grifters. A operator intending to steal money won't make it past financial review. An operator intending to launder money won't make it past AML review. An operator running rigged games won't make it past technical review. The license cost and the regulatory burden are exactly the point.
