For several years now, Malta has established itself as a destination of choice for companies in the crypto industry looking to obtain regulatory approvals quickly. Last December, the archipelago issued around thirty VASP ("Virtual Assets Services Provider") licences in just one month, a process so rapid that it has ironically been dubbed the "Malta Miracle" in the industry. But this ease of installation is attracting a great deal of criticism, particularly from other European regulators, who are concerned about the inadequate on-site controls.
Several big names in the industry, such as Cryptocom and OKX, have recently opted for Malta, whereas they had previously announced that they would be setting up their European headquarters in Paris. Why this change of direction?
The main factor seems to be the speed with which files are processed.
While the French regulator sometimes takes several months to process a pre-file, Malta has set up a much smoother system. According to one person familiar with the system, "Malta has 60 people who have been working on these issues for a long time, which means they can move very quickly."
He adds, "Companies know that now is the time when everything is at stake and that they have to be on the market, and many don't want to spend months waiting on a regulator's desk. "But is this speed at the expense of seriousness?
Many observers are criticising the lack of rigour in the examinations carried out by the MFSA, the Maltese regulator. According to one expert, "cybersecurity checks are non-existent, equity has been hastily validated and the understanding of the companies' business model is highly questionable."
Moreover, it would appear that many companies obtain their licences without having any "substance" on the ground, i.e. no local employees or real infrastructure.
>> Tribune - Arnaud Touati: "Faced with French complexity, Malta is establishing itself as a leader in Europe"
European passporting, a roundabout advantage? One of Malta's main advantages is the European passporting system. Once authorised in Malta, a company can freely offer its financial services throughout the European Union without other national regulators being able to object. This system, designed to facilitate the single European market, is becoming a tool of regulatory competition, with some countries applying much lighter standards than others.
Faced with this situation, several European regulators, including the Autorité des marchés financiers (AMF) in France, the FMA in Austria and the BaFin in Germany, are concerned about these practices and their consequences for investor protection.
ESMA, which is the European supervisory authority, can possibly conduct investigations and publish critical reports, but it cannot directly impose sanctions on the national regulators that issue authorisations.
But while Malta's appeal is undeniable for companies seeking rapid authorisation, this choice also entails risks. From a reputational point of view, operating in a jurisdiction that is perceived as not being very rigorous can be a handicap in attracting institutional clients. As one industry observer explains, "if you're targeting an institutional clientele, going to Malta is not the right plan".
Coinbase, Circle and Kraken, which also target institutions, have meanwhile chosen Ireland, reputed for its seriousness and used to housing the European branches of American giants.
This thinking is also at the heart of the reflections of more traditional financial players. According to our information, the online bank Revolut is being pushed by its shareholders to obtain a banking licence in Western Europe. The licence currently issued by Lithuania's central bank would limit the company's valuation with a view to an IPO...
>> Read also:Coinbase wins historic victory against SEC : a turning point for the crypto industry
ESMA's powerlessness in the face of regulatory competition Despite growing criticism from several national regulators, ESMA finds itself in a tricky position. In theory, it is supposed to ensure the harmonisation of regulatory practices within the European Union, but in practice its powers are limited.
ESMA can neither force a national regulator to change its licensing policy, nor prevent a company licensed in one Member State from moving its services elsewhere.
This lack of any real coercive authority allows countries like Malta to maintain more flexible practices without risking immediate sanctions. "
When overly lax regulation is identified, ESMA's only weapon remains "product intervention", a measure that consists of issuing recommendations or publishing a report denouncing practices deemed inappropriate. However, these interventions take time and have no immediate binding effect.
As a result, recalcitrant national regulators can easily ignore these warnings as long as no legislative changes are imposed by the European Commission...
A lawyer working in a large Parisian law firm draws a parallel between this situation and what happened after Brexit, when banks had to re-establish themselves in continental Europe. At the time, ESMA published a supervisory briefing to combat so-called letterbox entities, i.e. firms obtaining a licence without any real local presence.
These recommendations required, among other things, that at least one director reside in the country of authorisation and that the majority of the market be located in that country.
A similar briefing dedicated to crypto firms was indeed sent by ESMA to the various national regulators on 31 January 2025 (you can view it here) . "But these are just recommendations, European law gives us almost no power of constraint," laments a European official.
Where to go for reform of the European system? This situation reveals a structural flaw in the European system of financial regulation. The problem of passporting is not unique to cryptos: sectors such as derivatives or online trading have already been confronted with similar abuses, with countries such as Cyprus or Luxembourg playing a role comparable to that of Malta today.
Discussions are taking place within ESMA and the European Commission to better supervise these practices. One avenue being considered would be to increase regulatory convergence between countries and give ESMA more powers to verify and harmonise authorisation procedures.
But while awaiting structural reform, Malta continues to attract crypto companies in search of regulatory facilities, much to the chagrin of the continent's most demanding regulators.
