In 2018 Malta passed the Virtual Financial Assets Act and became one of the first EU member states to write a purpose-built rulebook for crypto and distributed-ledger businesses. The marketing followed quickly. For a few years the island was branding itself Blockchain Island, and a run of exchanges and payment firms set up licensed entities there.
Eight years on, almost every structural advantage Malta held in 2018 has either been eroded by EU-wide harmonisation or absorbed into the ordinary cost of doing business. The jurisdiction is still there. The argument for choosing it has changed completely.
The first-mover bet
The logic in 2018 was straightforward. Crypto firms wanted a regulator that would licence them, and most European supervisors were not ready to. Malta built a framework, the MFSA staffed up to administer it, and firms that wanted an EU footprint with a licence they could actually obtain went where the licence was.
That produced a genuine cluster. Payment institutions, e-money issuers and VFA service providers concentrated in a country of roughly half a million people, alongside an iGaming industry that had been building there since the early 2000s and had already trained a local workforce in exactly the compliance disciplines payments firms need.
The greylisting years
The reputational bill arrived in June 2021, when the Financial Action Task Force added Malta to its increased-monitoring list. Being greylisted does not stop a jurisdiction operating, but it changes the arithmetic for everyone banking into it. Correspondent relationships get re-papered. Onboarding takes longer. Compliance teams at counterparties start asking why a transaction routes through Valletta.
Malta was removed in June 2022, faster than most greylisted countries manage, after tightening beneficial-ownership enforcement and tax investigations. The removal mattered. It did not fully undo the twelve months during which “Malta-licensed” was a phrase that triggered extra diligence.
What MiCA changed
The larger shift was legislative and came from Brussels rather than Valletta. The Markets in Crypto-Assets Regulation phased in through 2024 and 2025, replacing national crypto regimes with one EU framework and one passportable authorisation.
For Malta this cut both ways. Firms already holding VFA authorisations were among the better prepared in Europe, and the MFSA had years of supervisory practice behind it. But the thing Malta was selling, a licence you could get in the EU when nobody else would give you one, stopped being scarce. A firm authorised in Ireland, Germany or Lithuania now passports the same rights.
First-mover advantage in regulation has a short half-life. It lasts exactly as long as it takes the larger bloc to write its own rules.
Where the advantage actually sits now
Strip out the regulatory arbitrage and what remains is a more ordinary set of operational factors. Some of them are still genuinely strong.
| Factor | Still a Malta advantage? | Detail |
|---|---|---|
| Crypto licensing | No | MiCA harmonised it. Any EU authorisation passports. |
| Supervisory experience | Partly | MFSA has real institutional history with these firms, which shortens authorisation timelines. |
| Talent pool | Yes | Two decades of iGaming built a compliance and payment-operations workforce that is disproportionate to the population. |
| Working language | Yes | English is an official language, which removes a friction most EU jurisdictions carry. |
| Relocation of staff and founders | Yes | English-speaking, EU-passported, and with an established Malta’s residency-by-investment route that relocating executives already use. |
| Cost base | Weakening | Office and salary costs have converged upward toward mainland norms. |
The talent point is the one industry people raise most often and outsiders discount. A payments firm opening in Frankfurt competes for compliance staff with every bank in Germany. A payments firm opening in Malta hires from a pool that has been doing gaming-sector AML for twenty years and understands the work.
The relocation question sits alongside it rather than underneath it. Moving a compliance lead or a founding team is a practical exercise in residency paperwork, and the residency and citizenship instruments are separate mechanisms with quite different thresholds and timelines, as any comparison of how these programmes are actually structured makes clear. Firms tend to discover this at the point they are already committed to a jurisdiction.
What to watch
Three things will decide whether the Maltese cluster holds through the rest of the decade.
The first is whether MFSA authorisation timelines stay genuinely faster than the larger supervisors. Speed is now the product. If Dublin and Vilnius close that gap, the supervisory-experience argument thins out.
The second is consolidation. A cluster built partly on regulatory arbitrage tends to shed the firms that were only ever there for the arbitrage, and the remaining question is whether the operators left behind are the ones with real volume.
The third is the euro-area payments agenda more broadly. Instant payments obligations and the digital euro work will reshape cost structures for every payment institution in the bloc, and small jurisdictions with concentrated sectors feel that faster than large ones.
Malta spent 2018 to 2022 being the interesting answer to a question about regulation. The question has moved on to operations, and that is a harder contest to win on a press release.
