How to Start a Sportsbook in Malta: 2026 Guide

Malta is the gold-standard jurisdiction for founders building a regulated online sportsbook inside Europe. This Mediterranean island punches far above its size: as an EU member state with a specialist gambling industry regulator, a mature iGaming talent ecosystem, and a licensing framework built around real product verticals, it functions as the primary European market gateway for sports betting companies entering the regulated iGaming space. 

This guide covers the full launch path – jurisdiction choice, MGA licensing, incorporation, compliance, sports integrity, banking, and platform setup.

Key Takeaways

• • MGA B2C Gaming Service Licence with Type 2 approval is the correct licence for fixed-odds sports betting
  • Company formation through system audit and go-live runs five to eight months for clean structures
  • Licensing, banking, and system audit must run as parallel workstreams – not sequentially
  • A mandatory sports integrity framework with suspicious betting reporting is unique to Type 2
  • Banking is the most common failure point – start payment workstreams in week one
  • Gaming tax, compliance contributions, and corporate tax are three separate cost layers

Why Malta is the Strategic Choice for Online Sportsbooks

Malta combines MGA regulatory prestige, EU legal domicile that strengthens market entry conversations across Europe, a deep iGaming talent pool, and genuine tax efficiency – a package that has made this Mediterranean island the dominant jurisdiction for online sportsbook licensing for over two decades. The Malta Gaming Authority has operated a dedicated online gaming framework since 2004, giving it institutional depth no newer regime matches.

On tax: Malta's headline corporate rate is 35%, but the 6/7 shareholder refund on trading profits brings the effective rate to approximately 5% for most structures – making it a genuinely tax-efficient jurisdiction. 

The optional 15% FITWI regime introduced in 2025 offers a simpler alternative. Choosing the right jurisdiction before incorporating is worth dedicated analysis: Malta's double taxation agreement network covering over 70 countries enables international expansion without punitive withholding costs, while the separate 5% gaming tax on betting revenue from players physically present in Malta adds a third distinct cost layer to model.

Choosing the Right MGA Licence

The MGA separates gaming authorisation into B2C (Gaming Service Licence) and B2B (Critical Gaming Supply Licence) categories, then divides B2C into four vertical types. 

For a sports betting company setting odds and carrying financial risk on event outcomes, the answer is unambiguous: the B2C Gaming Service licence with Type 2 approval is the correct licence. The B2B Critical Gaming Supply Licence applies to software and platform suppliers – operators need to understand this distinction because every third-party supplier in your stack must hold one. Choosing the wrong class at the application stage means an amendment cycle, not a quick fix.

Comparing Types 1, 2, 3, and 4

Type 2 covers sports betting, esports betting, spread betting, and virtual sports – both pre-match and in-play. The distinction from Type 1 is financial: a Type 2 operator is in the business of odds setting, managing fixed-odds wagering risk, and carrying exposure on outcomes through published betting lines. 

Founders who describe a sportsbook as a generic gaming portal trigger MGA amendment cycles because the regulator reviews the odds-setting and financial-risk model directly – not just the product label.

What Markets the Malta Licence Actually Unlocks

An MGA licence opens the EU betting market as a credibility foundation – it is not a passport into every regulated market. Operators targeting international markets beyond Malta need local authorisation: Great Britain via the UKGC, Germany through the GGL, Spain via the DGOJ, and Italy through the ADM. Budget for each as a separate project – they are not extensions of the Malta process.

Step-by-Step Setup Process for an Online Sportsbook

A Malta sportsbook launch has four linked phases: company formation, sports betting company registration, licensing, and system audit and certification through to go-live. Banking runs as a parallel workstream from week one, not after regulatory approval. Payment providers run independent due diligence that can match the MGA timeline in length; starting late consistently makes banking the bottleneck at the worst possible moment.

Step 1: Incorporate With the Malta Business Registry

Most founders choose a private limited company (Ltd) over a PLC. The Malta Business Registry requires:

Pre-filing:

• Certified ID and proof of address for all directors, shareholders, and UBOs
• Source of wealth declarations and professional references for key persons
• Director and company secretary appointment letters

At filing:

• Memorandum and articles of association
• Share capital structure (MGA Type 2 minimum: €100,000 paid-up)
• Registered legal address in Malta

Governance substance matters: a resident director and accessible key persons materially improve MGA fit-and-proper outcomes and payment partner onboarding.

Step 2: Build Your Business Plan and Documentation Pack

The MGA reviews viability and operational credibility – not form completeness. A strong pack covers:

Personal documents:

• UBO and shareholder structure with source of funds evidence
• Director and key person CVs and probity declarations

Company documents:

• Business plan: sportsbook model, target markets, odds management approach, revenue projections, risk management strategy, and financial sustainability evidence
• Memorandum, articles of association, AML/KYC policies, IT and platform documentation

Generic plans that avoid specifics on odds sourcing, market selection, or viability evidence are the leading cause of MGA amendment delays.

Step 3: Submit the MGA Application and Pass Fit and Proper Review

The MGA runs a staged review. Stage 1 covers fit and proper checks on all shareholders, directors, and UBOs – probity checks with local and foreign authorities, source of wealth, and source of funds verification. A resident director with demonstrable oversight strengthens this stage materially. Stages 2 and 3 cover operational and financial review: business structure, financial sustainability, and B2C Gaming Service Licence conditions. All key functions must be nominated concurrently. Layered or nominee-heavy ownership does not disqualify – but it slows every stage.

Step 4: System Audit, Certification, and Go-Live

After technical documentation is accepted, the MGA provides 60 days to implement in a staged environment and commission an external System Audit from an approved provider. The audit validates platform testing across bet processing accuracy, settlement logic validation, automated suspicious betting alert mechanisms, and compliance with published technical standards. 

Certification is the mandatory gate before go-live. The architecture you document at submission is the one you prove at audit – build audit readiness into the system design from day one.

Setup Costs and Realistic Timeline

Plan for five to eight months for a clean, well-documented application with straightforward ownership. Complex ownership structures or exposure to high-risk markets push this to nine to twelve months. The process is sequential – fit-and-proper review, staged operational review, 60-day staging window, external audit – and does not compress by applying pressure.

Founders consistently underestimate the contingency buffer needed for banking and audit delays. The statutory fee stack is only the floor: once audit fees, platform licensing, PSP onboarding, legal drafting, and staffing are added, total launch spend is reliably six figures. Use the sportsbook budget calculator to model your specific structure against these statutory floors.

Compliance, Sports Integrity, and Key Functions

Compliance is the operating spine the MGA assesses before issuance and monitors continuously afterward. Three interlocking pillars structure the work: AML/KYC infrastructure, Type 2 sports integrity obligations, and key-function governance. The pillars are assessed together – a gap in any one weakens the entire application and creates post-licence regulatory exposure. Review the full compliance framework before building your documentation pack.

Building Your AML and KYC Framework

The MGA's AML/CFT framework requires specific platform-level controls: 

• flag single transactions of €2,000 or more; 
• maintain full customer risk-assessment history; 
• disable accounts when customer due diligence or enhanced due diligence requirements are unmet; 
• record deposit and withdrawal account details; and 
• run ongoing transaction monitoring, fraud prevention, and source of funds verification. 

Risk assessment systems must be operational at go-live – not documented and deferred. GDPR compliance is a separate governance area under the key-function framework. Founders who build these controls into the platform architecture from day one clear audit fastest – when AML is written into policy documents after the fact, the audit exposes it immediately.

Sports Integrity Obligations Unique to Type 2

The MGA Sports Betting Integrity department requires operators to run automated wagering pattern alerts, detect suspicious betting in real time, and report through the Suspicious Betting Reporting Mechanism (SBRM) immediately – and no later than three days after first becoming aware. The obligation covers match-fixing prevention across traditional sports and esports. 

The MGA cooperates with the International Betting Integrity Association, IBIA (formerly ESSA), and may restrict markets where integrity is compromised. Mandatory staff training on suspicious betting recognition and internal reporting procedures is required before go-live and reviewed continuously. There are no easy steps to grow sportsbook revenue if this layer is structurally weak – integrity failures become regulatory failures fast.

Key Functions and the Mandatory MLRO

The MGA requires eight key functions: chief executive, day-to-day gaming operations, compliance, legal affairs, data protection, AML/CFT, technology, and internal audit. All require MGA approval; certificates are valid for three years.

The Money Laundering Reporting Officer (MLRO) must be structurally independent from the Compliance Manager – their reporting obligations run to the Financial Intelligence Analysis Unit (FIAU) under a separate chain of authority outside the day-to-day compliance reporting line. Both roles carry distinct fit and proper requirements and are assessed individually during the MGA application. Treating them as a combined or junior appointment is a regulatory risk the MGA will identify.

Banking, Payments, and Choosing Your Sportsbook Platform

High-Risk Banking and PSPs

Banking is where many otherwise well-prepared sportsbook applications stall. Traditional banks classify gambling as high-risk and apply extended due diligence – compliance committee escalation, multiple rounds of UBO documentation, and onboarding timelines of three to nine months, even for MGA-licensed operators. 

EMIs are faster – four to eight weeks for a complete application – but they use correspondent IBAN structures that institutional counterparties, suppliers, and auditors treat as a secondary account, not a primary banking relationship. Neither replaces the other: you need a traditional bank for credibility with suppliers and platform partners, and an EMI for multi-currency settlement speed and flexibility.

 

Payment service providers sit inside every operational flow: deposits, withdrawals, card acquiring, fraud detection, and chargeback management. Chargeback rates are a material KPI – card schemes impose escalating consequences, and PSPs monitor independently of your own internal control policies. 

Crypto payments are permitted within MGA-approved frameworks, but the Authority's 2026 supervisory agenda tightens internal controls around crypto asset use specifically – address this at the technical documentation stage.

Choosing Your Sportsbook Software Platform

The build-vs-buy decision covers two routes: proprietary development or licensed third-party sportsbook software. Any third-party supplier providing material software or control systems must hold an MGA B2B Critical Gaming Supply Licence – verify against the MGA authorisation register before signing. An unlicensed supplier stack is a licensing condition failure.

SOFTSWISS offers its Sportsbook under an MGA B2B Critical Gaming Supply Licence covering Type 2 Fixed Odd Betting, including Live Betting – with a fully integrated odds engine, bet settlement logic, security infrastructure, and regulatory reporting stack. The platform is GLI-33 certified and ISO 27001 compliant. 

Operators entering fast use the Turnkey Sportsbook Solution; those with an existing casino platform base use Sportsbook Integration via API or iFrame. Both delivery models are built to meet MGA system audit requirements at the certification stage – meaning the compliance architecture is already in place, not something the operator has to build from scratch.

Common Mistakes and Remote Operation Realities

Running a sportsbook as a bookie business without understanding the full risk management policies – bankroll management, risk assessment, internal control policies, and the compliance risks tied to high-risk industry classification – is the fastest route to regulatory failure. Operational risks compound when suspicious betting controls are treated as policy rather than product architecture.

Foreign founders can own 100% of a Malta sportsbook – the MGA allows EU/EEA-incorporated entities to apply directly. What determines outcome is whether UBOs, directors, and key persons pass fit-and-proper scrutiny with documented source of wealth and funds. Invisible governance – nominee-heavy ownership, absent key persons – will slow or stop an application. Treating betting as a business means building visible operational substance, not just a registered address.

How long does it take to obtain an MGA licence for a sportsbook in Malta?

Five to eight months for a clean structure covering fit-and-proper review, staged operational assessment, and system audit. Complex ownership or weak source-of-funds documentation pushes this to nine to twelve months. This is a planning estimate, not an MGA service-level commitment.

Can a foreign founder own 100% of a Malta sportsbook?

Yes. Malta company law places no nationality restrictions on shareholders, and the MGA allows EU/EEA-incorporated entities to apply directly. Fit-and-proper scrutiny and source of funds documentation determine outcome – not nationality or residency

What is the gaming tax rate for sports betting companies in Malta?

Three layers apply: a monthly compliance contribution (4% of first €3M GGR, min €25,000), a 5% gaming tax on revenue from players physically present in Malta, and corporate tax – effectively ~5% via the imputation refund or 15% under the FITWI election. Model all three before fixing the structure.

Are crypto payments allowed in Malta-licensed sportsbooks?

Yes, within an MGA-approved framework – but the 2026 supervisory agenda tightens internal control requirements around crypto asset use. Address this at the technical documentation stage, not post-launch.

Do I need a separate licence for each country I accept bets from?

Yes, for every serious regulated market. An MGA licence does not replace local authorisation in Great Britain, Germany, Spain, or Italy. Treat market-by-market licensing as a parallel project track with its own budget and timeline – not an extension of the Malta process.