Key Points
- NEXT.io managed to get hold of some info that the MGA has ditched its standard legal opinion template, which is a major win for B2B suppliers. Their new obligations have been scaled back considerably too.
- It seems that industry reps weren’t convinced that the regulator had the right to ask for certain bits of info. We might see some changes to the existing rules as a result.
- Unfortunately for B2C firms, the MGA still plans to start asking them for data later this year, but that’s for the 2025 reporting period.
Companies in Malta that operate with foreign licences were facing a tougher time from the Malta Gaming Authority (MGA). Many of the proposed checks have now been watered down or scrapped, following some pushback from the industry.
NEXT.io got hold of a copy of the MGA’s Feedback Statement, which was dated October 26th, but the regulator hasn’t bothered publishing it, so we can only go on what’s been leaked so far. According to that document, the MGA was forced to rethink its original plan within a pretty tight six-month window.
What the MGA Decided to Ditch, According to NEXT.io
Recognition Notices allow Malta-based companies to operate under a licence from another EU or EEA state, and the MGA is cool with using licences from other places that have similar safeguards to Malta’s.
The MGA used to require companies using Recognition Notices to renew them every year and pay a nice €5,000 upfront fee. They also had to cough up a separate €5,000 application fee. And then there was the small matter of an annual review and a €5,000 fee to boot.
As the MGA had a bit of a think about its next move, it decided to launch a targeted consultation on April 29th last year, all based on the outcome of its own internal review. Malta’s latest National Risk Assessment and AML/CFT Strategy for the next couple of years even helped shape the changes it wanted to bring in. Then industry reps piped up and complained about the whole thing, and the MGA ended up accepting most of their grievances.
According to the Feedback Statement that NEXT.io got its hands on, one of the big changes is that companies will no longer need to provide a full family tree of their corporate structure. All they need to do is give the MGA the lowdown on who their ultimate decision-makers are.
The standard legal opinion isn’t required anymore, because let’s face it, not every country has the same laws. And the MGA has toned down the requirement for five years of regulatory history too. Companies will only need to report on stuff that’s actually relevant to their business, and not just everything from way back when.
For B2B suppliers, it’s a major win. The MGA axed most of the new requirements that were supposed to apply to them. Industry reps said that checks meant for operators dealing with consumers shouldn’t put the same pressure on suppliers.
It’s worth noting that the RN system has become a bit of a grey area for B2B suppliers, but that’s a whole other story.
Industry Feedback According to the MGA
Feedback from industry participants was “constructive and valuable” and the regulator said that they supported its general approach. Their main issue was “unnecessary duplication with requirements imposed by foreign licensing authorities.”
While responding to NEXT.io, the MGA stated that its approach was guided by “proportionality, flexibility and risk-based regulation.”
According to the MGA, “the finalised framework shall take into account a more differentiated approach between B2B and B2C RN holders.” That is, the regulations will vary based on whether a company provides its services to gambling businesses or operates directly with clients.
Next.io claims that the MGA still plans to introduce collection of data from B2C holders already this year. That will involve the 2025 reporting period. With just a few weeks before the start of 2027, the timeline does not leave much space for further delays amid finalising the new rules.
Also, NEXT.io reports that the MGA said that it will not contact all RN holders simultaneously.
Why the RN Approach Was Worrisome for Risk Assessors
The 2023 National Risk Assessment conducted in Malta assigned a medium-high residual risk rating to the remote notification mechanism. Remote gambling as well as land-based gambling were rated medium in the same assessment.
As of the end of 2021, 111 gaming companies incorporated in Malta had RNs. 46 of those were B2C operators, the assessment says. Unfortunately, our material does not provide a more recent number of RN holders.
Two main shortcomings of the approach were identified. Firstly, some companies were operating under foreign licenses without an RN. Secondly, supervision in some foreign jurisdictions was not as effective as in Malta. In addition, the system depends on the company providing information to the MGA. That creates difficulties in detecting unreported cases.
Malta has had problems with financial controls in recent years. It was put on the grey list by the Financial Action Task Force (FATF) in 2021. Malta was delisted on 17 June 2022.
Can the MGA Legally Demand Such Data?
Industry representatives raised a question about whether the MGA would have a right to demand all data included in the regulator’s original proposals. It was agreed that there might need to be certain changes in the current regulation in order to implement some RN requirements.
Regulation 22 of the Gaming Authorisations Regulations gives the right to issue Recognition Notices. It was suggested by some sources to NEXT.io that there might be a connection between the latest gaming legislation adopted last week and the proposed amendments. There is no confirmation of such a hypothesis in the public information we reviewed.
There is another separate legal challenge facing the licensing regulations of Malta. Article 56A of the Gaming Act was added in Bill 55 in 2023. This Article is being reviewed in Case C-683/24, to be delivered on 19 November.
The issue was referred to the Court of Justice of the European Union (CJEU) by an Austrian court after a dispute related to a legal opinion. Article 56A gives Maltese courts the possibility to reject certain foreign judgments against licensed gambling providers.
In April, Advocate General Nicholas Emiliou gave an opinion proposing two ways for the Court to decide the case.
According to the Advocate General’s main position, the referral should be considered inadmissible because it is related to a dispute regarding a lawyer’s diligence. If the Advocate General’s alternative position is considered, Article 56A would be found “manifestly incompatible” with the EU regulation on recognition of judgments.
Advocate General’s opinion does not make the Court bound to any position. So, there is a possibility that the Court will take a different decision.
The British Example of the Consequences of Weaker Supplier Controls
The UK gives a recent example of what weak supplier controls can result in.
On 23 July 2026, the Gambling Commission announced a £4.75m settlement reached with Evolution Malta Holding Limited. Games provided by the company had been available via six websites that were not licensed and were operated by two gambling companies. These sites were accessible to British players.
The visits from Great Britain to those websites were high from December 2023 till November 2024. In addition, the Gambling Commission discovered that the money laundering risk assessment made by Evolution did not reveal that two of its partners had been providing their services to the British players without necessary licenses.
What’s Changed for Operators and Suppliers?
Companies that thought they’d get slugged with tougher disclosure requirements are instead facing a much lighter set of obligations in the short term. B2B suppliers are coming out on top because the MGAs have taken a step back on several checks that were originally designed for companies that deal with consumers, according to a statement NEXT.io got their hands on.
Of course, B2C companies are still going to get hit with data requests, although they’ll be allowed to submit some numbers in ranges rather than exact amounts, which is a bit of a relief.
The MGA is also sticking with that risk-based approach when dealing with RN holders, so operators should still expect to get asked for information whenever the regulator thinks it’s necessary.
Companies who are weighing up the pros and cons of different European licensing jurisdictions will be keeping a close eye on Malta’s moves here, and whether it can actually enforce the rules it’s sticking to.
Expert Analysis: Did the MGA Ask for Too Little, or Were They Wise to Back Down?
We think the MGA’s decision to dial back the proposed checks makes sense on a legal level, but it also raises a few practical concerns for us.
If a regulator is questioning its own power to request certain info, it’s not too hard to see how it could end up getting stuck when trying to enforce those rules. So, in a way, removing or changing the disputed requests might help avoid those kinds of problems. However, we’re worried that the info that won’t be getting collected is going to be crucial. Reporting numbers in broad ranges and grouping payment methods together can actually make it harder to spot anything out of the ordinary.
We also have to wonder why data collection is starting with B2C companies in the first place, suppliers who serve lots of operators might actually be at a higher risk of causing problems. Operators can point to the fact that they’re already being supervised by their home country’s regulators, which is a fair point. But the MGA’s own assessment from last year highlighted some weaker supervision in certain foreign jurisdictions, so we’re a bit puzzled by this change of tack.
To be honest, our main question is: if the MGA thought the original plan was proportionate enough to go ahead with, why didn’t they just stand their ground and defend it?
Of course, a lighter set of rules doesn’t automatically mean the system is going to fall apart, the MGA still has to show that the new checks can actually identify the risks that were flagged in their own assessment.
The MGA says they’ll get their website sorted out in due course. As soon as the revised rules are published, the industry will have a much clearer picture of whether Malta’s just paused its crackdown or if they’ve actually given up on bits of it.
Share
7 views
