Malta, a scenic Mediterranean island with a population of just over half a million, is quickly becoming the preferred European base for high-profile crypto companies like OKX and Crypto.com to come and set up shop.

Weeks after Europe’s Markets in Crypto Assets (MiCA) regime came into force last December, Malta awarded licenses to some of the largest crypto exchanges: OKX and Crypto.com. Securing a MiCA crypto asset service provider (CASP) license in one country enables firms to operate across the entire European Economic Area, which consists of 30 nations. Most recently, crypto exchange Gemini said it was looking to secure a MiCA license in Malta.

Malta’s rapid embrace of MiCA is drawing both interest and concern. While the CASP rules were created to set high and unified standards across Europe, member states have a degree of leeway when it comes to processing applications. Malta’s approach has led some crypto industry stakeholders to question whether the island’s light-touch attitude to its MiCA due diligence is too relaxed, and if it is processing applications quicker than it should.

MiCA’s Malta shortcut

Malta introduced a local regulatory framework for crypto in 2018 — the Virtual Financial Assets (VFA) Framework — which can be leveraged to allow certain firms to make the transition to MiCA with relative ease. The island’s legacy regime “has been recognised as being quasi-equivalent to MiCAR,” according to the Malta Financial Services Authority (MFSA).

The framework is an important stepping stone for companies seeking to gain MiCA designation, because if a crypto firm held a local VFA license before Dec. 30, 2024, Malta can offer a fast-track to MiCA and so-called “pre-authorization” status.

“While approval timelines can vary based on the completeness and quality of submissions, existing Virtual Financial Asset (VFA) Service Providers may experience expedited processing due to Malta’s established VFA regime,” an MFSA official said via email.

Oversight concerns

While Malta has shown it can adapt quickly to regulatory developments, and it is likely a welcoming development for firms that seek faster regulatory clarity, industry observers have raised questions regarding the substance and scale of its regulatory supervision.

“Smaller jurisdictions can adapt faster to regulatory developments, and they do,” Liat Shetret, vice president of global policy and regulation at blockchain analytics company Elliptic said in an interview with CoinDesk.

Shetret’s main concern is whether these fast-tracked approvals are backed by enforcement muscle behind them. “We have seen a lot of developments around ‘bring the business here.’ Licensing and registration is fast-tracked. And then the rest of it is almost disaggregated in terms of: How do we continue to supervise? What’s the oversight that these entities have? Are our agencies fit for that purpose in terms of size and scale?”

“I think we just need to move the conversation beyond licensing and registration in jurisdictions like Malta. Show me the enforcement team, show me a skilled crypto enforcement or up-skilled crypto law enforcement team that knows how to investigate,” Shetret said.

But crypto industry players on the island say that Malta’s familiarity with digital assets regulation is what sets it apart from other places.

“These operators are actively seeking regulation by authorities who understand the crypto industry,” Ian Guaci, the managing partner at Malta-based law firm GTG, said in an interview. “The concern is this: In countries that have never previously regulated crypto-assets, even if they now implement MiCA, who will ensure that the regulation is applied effectively, with the necessary expertise and consistency?”

In simple terms, it’s like ordering a quick takeout versus going to a Michelin-star restaurant after waiting for three months to get a reservation. This is the point Przemysław Kral, the CEO of Zondacrypto, the largest crypto exchange in Poland, is making, regarding the decision to switch his firm’s MiCA focus from Malta to Estonia, despite the latter being more complicated and time-consuming.

“Estonia is much more exclusive than the Maltese regulatory process,” said Kral, whose firm is a competitor to crypto exchanges on the continent, in an interview, adding that “receiving a MiCA license should not be like ordering food in McDonald’s.”

“The process should be complicated and should be very strict. If I were a customer, I would choose a company that is applying for a MiCA license that’s a bit more of a complicated procedure, and not with such a fast outcome — because OKX received it in a few days, frankly speaking.” (OKX received a pre-authorization on Jan. 23, 2025 and a full license on Jan. 27, 2025 — just four days later.)

Crypto giants’ bet on Malta

Among some of the crypto firms that have received the expedited license in Malta is OKX, a top-five exchange known for sponsoring the likes of Manchester City soccer club and the McLaren Formula 1 Team.

OKX claimed to be the first global player granted pre-authorization by the crypto-friendly island in January, having been in possession of a class 4 crypto service provider license in Malta.

In a turn of events, about a month after OKX trumpeted its MiCA pre-authorization status, the firm paid half a billion dollars to settle charges with the U.S. Department of Justice (DoJ), a penalty related to the firm’s alleged history of not holding the appropriate licenses to offer crypto services.

It’s not clear if Malta had knowledge of the pending settlement with the DoJ, given the sensitivity of the matter. However, in April, MFSA fined OKX $1.2 million for breaching the country’s money laundering rules.

When asked why the MFSA would grant MiCA pre-authorization to a firm that had a pending judgment and settlement with the DoJ, the Maltese watchdog said it takes a risk-based approach.

“Authorisations are granted once all information deemed necessary is collected, and on the basis of its careful analysis and cross checks conducted at that juncture. It is important to recognise the need for a balance between comprehensive assessments and processing expediency, essentially focusing on what really matters,” MFSA said via email.

“Maintaining this balance is key to ensuring that any market entry framework functions effectively. Our approach to assessing risks has been thoughtfully developed over years of supervision and expertise in the various sectors, allowing us to implement measures that are both proportionate and effective,” MFSA added.

OKX did not provide a comment by publication time.

However, OKX Europe’s CEO, Erald Ghoos, recently took to X to air his views on Malta. “We chose Malta because they had made more advances in their licensed product offering as a whole,” Ghoos said, noting that the firm explored France and Netherlands, before finally deciding on Malta.

“Did OKX receive any favorable terms from MFSA? The answer is no, and in fact, again the opposite,” he added.

Similar to OKX, another heavyweight, Crypto.com also announced in January that it had in-principle approval from Malta before being granted a CASP license under MiCA.

Crypto.com, which also courts high profile sponsorships with FIFA World Cup, F1 and PGA golf tours and others, has secured licenses in competitive markets like Dubai, South Korea, Singapore, Australia and even the U.K.

But Crypto.com also has a history of operating without the proper licenses in place. De Nederlandsche Bank, which seeks to sustain financial stability in the Netherlands, fined Crypto.com 2.85 million euros ($3.25 million) in 2023 for operating in the country without a license for almost two years. It registered with De Nederlandsche Bank as a provider of crypto services in 2023.

A spokesperson for Crypto.com said the firm has a longstanding presence in and commitment to Malta. “We have maintained a workforce in Malta since the early stages of our existence as a company, and Malta has been the base of our global operations business unit for more than five years,” the spokesperson said via email.

France fires back

Sticking with the restaurant analogy, there are Michelin-star chefs and then there are French cuisine-trained Michelin-star chefs, coveted as one of the most technically challenging feats within the restaurant business.

Similar dynamics seem to be playing out with the regulatory framework in the continent as well.

In a speech earlier this year, Marie-Anne Barbat-Layani, the president of the financial markets authority in France (AMF), warned of products coming to market via a MiCA passport that were “approved by some of our peers with, let’s say, a rather quick pen.”

The AMF president called for stronger coordination with the European Securities and Markets Authority (ESMA) to maintain a level playing field.

“We want to avoid what’s known as ‘regulatory shopping,’ that is, actors seeking approval in jurisdictions where it’s easiest to obtain,” Barbat-Layani said.

MiCA authorization is hammered out through a series of private conversations between commercial firms and their respective regulators, making it difficult to compare and contrast the approaches of various jurisdictions.

ESMA and the European Banking Authority (EBA) are supposed to drive convergence by setting up structures for peer review and exchange of information. In theory, all member states ought to be aware of how each other is doing this job, and do things in a broadly similar way.

Daniel Arroche, a partner at French crypto and blockchain-focused law firm d&a partners, said that while MiCA seeks harmonization, in practice, standards vary widely. “Regulatory arbitrage” is happening within the EU, Arroche said, which could mislead firms into thinking all licenses are equally solid.

France has taken the lead by anticipating MiCA with its PACTE law and by applying strict vetting, Arroche added.

“France’s regulator, the AMF, has deep experience and is now processing MiCA applications in close alignment with ESMA’s evolving standards,” Arroche said in an email. “In contrast, countries like Malta or Cyprus have issued licenses before all regulatory technical standards were published — in some cases even granting ‘pre-approvals’ not foreseen by MiCA, raising serious concerns about regulatory shortcuts.”

It’s perhaps not surprising to find some crypto regulation professionals in France calling out Malta’s fast-track approach. France has become known for the glacial speed of its MiCA license authorization; so far, the nation has awarded three Crypto Asset Service Provider (CASP) licenses. OKX, for one, was pursuing licenses in both Malta and France but gave up on France in July last year.

In any case, close scrutiny of Malta is reportedly happening behind the scenes. Bloomberg reported in March that several EU regulators had urged ESMA to take action concerning OKX in the wake of the hack of crypto exchange Bybit, as well as to press Malta regarding the firm’s license.

Additionally, Agence France-Presse (AFP), a French international news agency, recently reported that ESMA had launched a “peer review” of an unnamed regulator that is potentially too lax.

An executive at a European CASP, who asked to remain anonymous, told CoinDesk that several sources had indicated to him an ESMA audit on Malta’s financial regulator is taking place.

Both ESMA and the AMF declined to comment.

Crypto’s growing pains in the EU

While France may not be in favor of how other countries are fast-tracking their regulatory framework, it does raise the question of the risk of centralization and how that spills beyond just crypto-related politics.

Implementing MiCA at a national level throws a spotlight on how the EU functions as a centralized yet diverse band of trading countries, and raises fundamental questions about the importance of uniformity among Europe’s member states, said Mark Foster, EU Policy Lead, Crypto Council for Innovation.

“Do you want a federal Europe, essentially, where everything is decided at European level, where there is a certain centralization and a value to that in terms of economies of scale to compete with China or the U.S.?” Foster said in an interview.

“On the other hand, a more decentralized approach respects the diversity of each country, some of whom may have specialization in areas like asset management, for instance. That’s obviously very important for those domestic countries and those jurisdictions, who would have a lot to lose if you then just centralize everything and put it all in Paris,” Foster said.

This is likely creating growing pains within the crypto firms that are craving a clear regulatory framework in the region.

Firms don’t want to talk openly about ways in which MiCA compliance might vary from one place to the next. But it’s possible to read between the lines in some cases.

Crypto exchange Bitpanda, which holds MiCA licenses in Austria, Malta and Germany, and also competes against OKX and Crypto.com, hinted at how it views MiCA license equivalence when the firm was granted a license by the German regulator, BaFIN.

“This licence has immediate validity — unlike in-principle licenses announced by other crypto platforms which are neither valid nor exist at all,” Bitpanda said of its German license when it was approved in January of this year.

Bitpanda declined to comment.

Cash for citizenship

Aside from growing debate over centralization and decentralization, a high profile legal spat with the European Commission (EC) over the island’s right to offer Maltese citizenship to people who invest in the country, recently came to a head.

Just over a month ago, Malta’s so-called “Golden Visa” or Malta Permanent Residence Programme (MPRP) scheme was deemed illegal by Europe’s highest court. The program allowed wealthy individuals to gain EU citizenship for a price tag of around $1 million. The EC has said these visas opened Europe’s door to money laundering, tax evasion and corruption.

“The same places that tend to implement golden passport programs also offer really accommodating offshore legislation for companies,” according to a former investigator from Tracfin, an anti-money laundering intelligence unit attached to the French Ministry of Finance.

“This is no coincidence,” said the person, who asked to remain nameless. “Most of these countries are tax havens and they do these kinds of activities because they don’t have a lot of resources and are struggling to develop their economy.”

While Malta didn’t appeal the ruling, the country said it is reviewing what the court ruling means legally.

Although the golden visa loophole bears no direct relation to crypto regulation, there could be a parallel in the way that Malta appears to be passporting both wealthy individuals and cash-laden crypto companies into the EU.

OKX’s Chinese CEO and founder, Star Xu, availed himself of a Maltese passport in March of 2024, according to documents seen by CoinDesk.

“The risk for European regulators is that supervisory arbitrage appears to be possible in the region. It’s possible to go to the jurisdiction that offers the biggest promise and the least hassle,” said one anonymous compliance professional who has worked with CASPs attached to multiple member states.

“If firms go to Malta to get a license because other jurisdictions are taking too long, I think we have failed to build a system for serious trading firms.”

UPDATE (June. 30, 08:35 UTC): Adds that France has issued three MiCA licenses to date.