Malta’s gaming regulator has moved away from broadly uniform online gambling licence fees and toward a tiered model that charges operators according to activity type and gross gaming revenue bands. The new structure is meant to make larger firms contribute more, while smaller B2C and B2B licensees face lower thresholds.
A recent industry report said the fee change is arriving alongside stricter reporting obligations. Operators are being asked for more granular data on player activity, deposits, self-exclusion events and suspicious transactions, reflecting a supervisory style that looks more closely at risk. The thematic review showed that the authority has been pressing licensees to prove controls work in practice.
That review focused on self-exclusion in the online B2C sector and was carried out in 2025 after reports that some players could still access multiple brands despite having self-excluded. It examined 20 licensees and 58 active URLs, using mystery shopping to test self-exclusion processes, cross-brand account controls and the presentation of responsible-gambling tools at key points of play.
The findings were broadly positive, with most licensees judged to be broadly in line with regulatory expectations. But the authority also found delays in activating self-exclusion, cases where exclusions were lifted without the required cooling-off period, problems detecting duplicate or closely matching identity details across brands, missing limit-setting prompts at registration and incomplete information inside Reality Check pop-ups.
The MGA told the relevant licensees to address the issues and submit rectification plans, and said follow-up supervisory engagement would continue where necessary. It also said the work formed part of its broader risk-based oversight approach aimed at promoting higher and more consistent standards of player protection.
The same theme runs through the regulator’s 2025 annual report. CEO Charles Mizzi said the challenge facing regulators was “not to regulate more, but to regulate better”, and said the MGA had refined its approach by strengthening risk-based oversight, improving engagement, streamlining processes and using more data and technology to focus on where it mattered most.
A practice guide said that in December 2024 the MGA updated financial reporting requirements by introducing annual financial reports and interim financial reports, both due within two months of the end of their reporting periods, while audited accounts still have to be filed within 180 days of year-end.
The same guide said that in July 2025 the authority issued a capital requirements policy for remote gaming operators. That policy introduced a positive-equity requirement and required firms to restore compliance promptly if negative equity arose, which the guide described as an early warning tool against financial instability.
The industry report placed Malta within a wider international shift toward more granular regulation. It said Britain has been tightening affordability checks, marketing rules and bonus transparency, Germany’s GGL applies layered oversight, and the Netherlands has continued to raise the bar on responsible-gambling monitoring since opening its licensed market.
The common thread, the report argued, is granularity. Regulators want to see behaviour at the player level rather than only aggregate financials, and they want the largest operators to carry the heaviest compliance load. Analysts including Regulus Partners have said compliance is among the fastest-growing line items on operator income statements and can outpace marketing spend in mature markets.
The same article said this shift is also changing how operators deal with complaints. Steve Donoughue argued that outcome-based regulation is forcing firms to treat customer complaints as compliance data rather than customer service noise. The report’s broader view was that higher fees and heavier reporting tend to leave fewer but better-resourced operators in regulated markets, while offshore sites continue to serve players who want looser bonus terms or fewer checks.
