MGA License

1) Overview and positioning

MGA (Malta Gaming Authority) is one of the world's most recognized iGaming regulators. The license is valued by banks/PSPs and content providers due to its high due diligence standard, responsible attitude towards RG/AML and mature technical requirements for infrastructure and SDLC. Suitable for European strategy and international brand/provider portfolios.

• B2C operators building long-term reputation and access to payment rails (cards, A2A/open banking, local methods through PSP partners).
• B2B platforms/studios/aggregators integrating with multiple operators and markets.

2) Types of licenses and perimeter

2. 1 B2C (Control Rooms)

Perimeter: front/back office, cash and payments, onboarding/CCM, RG tools, content contracts/PSP/KYC, advertising/affiliates, full regulatory and fiscal reporting. Different verticals are possible (casino, betting, live, poker, bingo, etc.).

2. 2 B2B (suppliers)

Perimeter: platform, content aggregation, studios, live studios, API/SDK, hosting/integration, SDLC/releases, SLA and export of logs/metrics for operators.

3) Requirements for the applicant: due diligence core

Beneficiaries and Key Persons: transparent ownership structure, Source of Funds/Wealth, non-conviction/reputation, relevant qualification (especially for MLRO/AMLO, DPO, RG-Lead, Head of Compliance/Platform/SRE).
Policies and procedures: AML/CTF (risk-based), Responsible Gaming, advertising/affiliates, data protection (GDPR + DPIA), incidents and breach responses, DR/BCP, vendor management.
Contractual framework: content (studios/aggregators), PSP and banks, CCM/sanctions providers, hosting/auditors/laboratories, SLA/OLA.
Financial stability: provisions/guarantees for payments, tax and regulatory reporting plan.
IT architecture: residency/data flows, network segmentation, secure SDLC/releases, observability, logging, DR/BCP plans.

4) Technical standards and IT controls (essentials)

SDLC and delivery: staging pipelines, change control, SBOM, artifact signature, rollback policy, "no humans in prod," provable release log.
Observability (Observability): logs/metrics/end-to-end traces (OTel), SLO/SLI (latency p95/p99, error-rate), synthetic checks "deposit/CCP/output," retention of logs for audit.
Security: encryption in transit/at-rest, KMS and secret management, SSO/MFA/PAM, segmentation, WAF/bot management, vulnerability management (SAST/SCA/DAST), regular penetration test.
Data and GDPR: DPIA for high-risk operations, PII/PAN minimization, access control and logging, DSR (access/erasure/portability) procedures and response times, retention/deletion policy.
DR/BCP: backups, periodic restore tests, stated RTO/RPO goals and exercise acts.

5) AML/KYC и Responsible Gaming

Risk-Based AML/CTF: customer/geo/method profiles, PEP/sanction screening, EDD triggers, transaction monitoring (velocity/anomalies), SAR/STR procedures.
KYC: age/identity/address, re-KYC by triggers and periodic, document/selfie/livestatus assessment (according to the provider model).
Responsible Gaming: deposit/loss/time limits, timeouts and self-exclusion (including national registries), reality checks, behavioral triggers, and interventions with provable telemetry.

6) Advertising and affiliates

Age barriers (18 +/21 + in the market), transparent T&C promos, restrictions on creativity and frequency of shows, prohibition of misleading statements.
Affiliate control: contractual responsibilities for RG/AML/data, channel whitelists, creative audits, stop lists and traffic traceability.

7) Taxes and reporting (in general terms)

The taxation base is usually built around GGR with the necessary detail by verticals and taking into account adjustments (bonuses/jackpots).
Regulatory reporting: periodic reports on finances, RG metrics, complaints/incidents, changes in organizational structure/Key Persons.
Fiscal reporting: synchronization with PSP/bank data and game/payout logs.

(Specific rates/fees depend on the current norms and business structure - they should be clarified at the time of preparation of the package.)

8) Licensing Process: Phases and Timelines

1. Pre-fit & Gap analysis (1-8 weeks): target markets/verticals, provider map (content/PSP/KYC), IT readiness audit, remediation plan.
2. Document package (4-12 weeks): corporate/finance/Keu Persons, policies, contracts, IT architecture, DR/BCP, vulnerability reports/penetration tests.
3. Technical checks/certifications (4-16 weeks): laboratories for software/integrations (if required), SDLC/observability/safety/DR-acts.
4. Review and Q&A: Beneficiary/Policy/IT/Data Questions, Key Persons Interviews, Log/Dashboard/Procedure Demos.
5. Release and commissioning (2-6 weeks): reporting, PSP/content onboarding, dry-run RG/AML/payment scenarios.
6. Post-licensing obligations: periodic reports and audits, renewal and license variations.

9) MGA pros and cons

Pluses

Strong reputation with banks/PSPs and content vendors.
Predictable processes and mature standards (fewer audit surprises).
Convenient for multi-brand strategies and B2B portfolios.
Increases capitalization and partner/investor confidence.

Cons

Higher TCO and preparation time compared to "light" modes.
Strict requirements for the provability of processes: "paper" policies do not pass.
Strict discipline of advertising/affiliates and reporting.

10) When to choose MGA

• We need stable access to the payment ecosystem and top content.
• The goal is long-term European growth and multi-licensing.
• Ready for mature SDLC/observability/safety and evidence-first culture.

• The task is ultra-fast MVP with a minimal budget.
• Geofocus is far from recognized markets/providers where MGA provides the most value.

11) Readiness checklists

11. 1 Definition of Ready

• Selected perimeter (verticals/geo), confirmed payment reality (PSP/methods).
• Key Persons assigned (MLRO/AMLO, DPO, RG-Lead, Head of Compliance/Platform/SRE), collected SoF/SoW.
• AML/RG/Advertising/Data/Incidents/DR policies approved; there is a journal of audits and trainings.
• SDLC: artifact and SBOM signatures, release history, rollback policy, "no humans in prod."
• Observability: SLO/SLI dashboards, synthetic deposit/CCL/output checks, log retention.
• Pentest/scans are closed (critical/high without expired exceptions).
• Provider contracts (content/PSP/KYC/labs/hosting) agreed.

11. 2 Definition of Done

• Included regulatory and fiscal reporting; KPI owners are assigned.
• PSP/content onboarding completed; webhooks subscribed (HMAC), idempotency and DLQ work.
• RG tools are active; intervention telemetry and a decision log are maintained.
• DR/BCP: restore tests performed and documented (RTO/RPO).
• Affiliate/advertising contour: whitelisting, creative auditing, stop procedures.

12) 90-180 Day Roadmap (example)

Month 1-2: gap analysis, Key Persons assignment, launch of SDLC/Observability/Safety remediations, lab reservations.
Month 2-3: collection of corporate package and policies, penetration tests/scans, DR acts, contracts with providers.
Month 3-4: submission, preparation for Q & A/interviews, dry-run demonstrations (dashboards, magazines, RG/AML scenarios).
Month 4-6: Q & A/Variations, Finalization, PSP/Content Onboarding, Reporting Enabled.

13) RACI (example for licensing program)

14) Typical risks and how to reduce them

15) FAQ (short)

Can B2B and B2C be combined? Yes, when separating licenses, processes, and logs.
Do I need local hosting? Different models are allowed, but residency and controlled data flows, DR and log auditing are important.
What is more important - politics or evidence? Always evidence of policy enforcement.
When to prepare for the extension? Maintain Evidence Map constantly; 60-90 days before the deadline - formal preparation.

Summary

The MGA license is an entrance ticket to the "big" payment and partner ecosystem of iGaming, but the price is mature processes and provable IT controls. Build an evidence-first culture (SDLC/observability/safety, RG/AML, DR, advertising/affiliates), maintain reporting discipline and book laboratories/auditors in advance - then the Maltese license will become a stable foundation for scaling and capitalization growth.