Malta vs Estonia for a MiCA CASP Licence: Which EU Hub Fits Your Crypto Business?

If you want to serve crypto clients in the EU, the question is no longer whether you need a MiCA licence but where you get it. Malta and Estonia come up in almost every founder conversation we have: Malta for its early crypto framework, Estonia because it once handed out more crypto licences than almost anyone else.

Under MiCA (Regulation (EU) 2023/1114), the rulebook, capital tiers and passport are now the same. What still differs is how each regulator works, how much local substance you must build, what banks and partners think, and how your profits are taxed.

Here is a practical comparison to help you pick a home state for your crypto-asset service provider (CASP).

First, what MiCA makes identical

Minimum capital. Article 67 and Annex IV of MiCA set the same permanent minimum capital everywhere in the EU, based on the services you provide:

• Class 1 – EUR 50,000: e.g. reception and transmission of orders, execution of orders, placing, transfer services, advice, portfolio management.
• Class 2 – EUR 125,000: Class 1 services plus custody and administration of crypto-assets and/or exchanging crypto-assets for funds or other crypto-assets.
• Class 3 – EUR 150,000: Class 2 services plus operating a crypto-asset trading platform.

Your prudential requirement is the higher of that amount or one quarter of your previous year's fixed overheads, and it can be met with own funds, an insurance policy, or a combination.

Core authorisation rules. Under Article 59, an authorised CASP needs a registered office in the Member State where it carries out at least part of its services, its place of effective management in the EU, and at least one director resident in the EU.

The statutory review clock. The regulator has 25 working days to check your application is complete, then 40 working days to assess it, and it can pause the clock for up to 20 working days to ask questions. That clock is the same in Valletta and Tallinn.

Passporting. Once authorised, you notify your home regulator of the Member States you want to serve. You can start there once the host authority receives the notification, or at the latest 15 calendar days after you submit it.

So if someone tells you one country has "lower capital" for a MiCA CASP, be careful.

The transition period is over: legacy licences no longer protect you

• Estonia: the Market in Crypto-Assets Act (KrüTS) moved crypto licensing from the Financial Intelligence Unit (FIU) to Finantsinspektsioon (the Estonian Financial Supervision Authority) and applies to CASPs from 30 December 2024. Legacy virtual currency service providers had to comply by 1 July 2026. On that date the FIU cancelled the register entries for the old licences. Firms with an application still pending may not take on new clients until a decision is made.
• Malta: the MFSA confirmed that the transitional measures for Virtual Financial Assets (VFA) licence holders expired on 30 June 2026. From 1 July 2026, operational firms without a CASP licence were expected to wind down in an orderly way.

ESMA confirms the transitional period ended EU-wide on 1 July 2026. An old Estonian VASP or Maltese VFA licence no longer lets you provide crypto-asset services, so incumbents without a CASP authorisation need a full MiCA application, like any new entrant.

Malta vs Estonia at a glance

*Based on ESMA's interim MiCA register as downloaded on 12 October 2026. The register is updated regularly.

Regulator approach: experienced hub vs a clean slate

Malta (MFSA). Malta has regulated crypto since its VFA framework, works in English and has a MiCA Rulebook that adds local detail. OKX, Crypto.com's Foris DAX MT, Gemini, Blockchain.com and FalconX all appear on the ESMA register under the MFSA.

One nuance: in July 2025, ESMA's fast-track peer review of one MFSA CASP authorisation found the MFSA only partially met expectations on the authorisation process (while fully meeting them on supervisory resources). Expect sharp questions on governance, conflicts of interest, ICT, custody and AML/CFT, especially if you are part of a larger group.

Estonia (Finantsinspektsioon). Estonia's story is about a cleanup. The FIU says there were 641 valid virtual currency licences in mid-2021 and 36 at the start of 2026. The new supervisor has been clear that AML paperwork alone is not enough: it wants to see how client assets are protected and how cyber resilience is managed. By the end of the transition, Finantsinspektsioon had authorised only one standalone CASP (Lightspark Payments Europe AS). LHV Pank and Lightyear Europe AS provide crypto services under their existing financial licences.

For a strong team, that can work in your favour. But there is very little track record to show what a "typical" Estonian MiCA application looks like.

Timeline: same legal clock, different reality

On paper, the two are identical. Once your file is complete, MiCA allows roughly three to four and a half months of formal review, including the maximum clock stop. What changes the real timeline is:

• Preparation. Programme of operations, governance, AML/CFT, DORA-compliant ICT documentation, custody and segregation policies, and fit-and-proper files. This is usually where months go.
• Pre-application steps. The MFSA uses a statement of intent and a thematic questionnaire before the formal application.
• Language and hiring. Estonia expects an Estonian-language application unless you state you will file documents in English. In both countries, hiring credible local key-function holders often takes longer than drafting.

Be wary of anyone promising a fixed number of months.

Substance and local staff

Neither jurisdiction accepts a letterbox company anymore.

Malta: the MFSA Rulebook expects enough people in key functions, at least one executive director based in Malta, at least two people effectively directing the business (dual control), an independent compliance officer approved by the MFSA, and an MLRO appointed at all times. Directors, senior managers, the MLRO and the compliance officer all go through fit-and-proper assessment.

Estonia: the CASP must be an OÜ (private limited company) or AS (public limited company) with its registered office in Estonia and a management board of at least two members. An OÜ offering custody or operating a trading platform also needs a supervisory board of at least three members. Annual accounts must be audited, and management changes must be notified to the regulator at least 30 days in advance.

On top of this, MiCA's own rules apply in both countries: effective management in the EU and at least one EU-resident director.

Brand perception and banking access

Banks and partners look at the licence and at the regulator's reputation.

• Malta benefits from a visible roster of global exchanges and a deep ecosystem of lawyers, auditors and compliance professionals. After ESMA's peer review, a strong compliance story matters.
• Estonia carries baggage from the pre-2021 licensing boom, which its own regulators say "hurt the reputation of the country." A Finantsinspektsioon CASP licence is a very different credential from an old FIU licence, but you may need to explain that to counterparties.

In both cases, banking still takes work. A MiCA licence makes conversations easier, but banks run their own due diligence on your model, ownership and flows. Start banking and safeguarding-account talks in parallel with your application.

Tax: refund system vs distribution tax

Malta charges a 35% headline corporate rate, but its full imputation system lets shareholders claim refunds on distributed profits. For trading income, the usual 6/7 refund gives an effective rate of about 5%. Since 2025, eligible companies can instead choose a final 15% tax with no refund (FITWI). That election binds you for five years. The refund route means paying tax first and recovering it later, so plan your cash flow.

Estonia taxes profits only when they are distributed. Retained and reinvested profits are taxed at 0%. Distributions are taxed at 22% (22/78 of the net amount). The planned 2% corporate profit tax and the increase to 24% were both cancelled before taking effect.

Rule of thumb: Estonia suits founders who reinvest for growth; Malta can deliver a lower rate on distributed profits, with more structuring and admin. Tax residence follows real management, and large groups face global minimum tax rules, so get structure-specific advice.

Cost

Government fees are the visible part. Malta charges EUR 10,000 to 25,000 to apply, depending on class, plus an annual supervisory fee built from a fixed base, EUR 2,000 per authorised service and a volume-based component. Estonia charges a EUR 3,000 processing fee, and its supervision fee is formula-based.

For most founders, though, the real budget is regulatory capital (identical in both), salaries for local directors, compliance and MLRO, office, audit, legal work and DORA-grade ICT. Malta is generally seen as the pricier place to run a team; Estonia can be leaner, but budget for language requirements and governance bodies.

Which one fits you?

Choose Malta if you:

• run an exchange, custody or trading-platform business (Class 2 or 3) that needs an established, English-speaking regulator and ecosystem;
• want a regulator other large exchanges have already chosen, which helps when talking to partners;
• plan to distribute profits to shareholders and are comfortable with refund-based tax planning;
• can recruit or relocate a Malta-based executive director and a strong compliance team.

Choose Estonia if you:

• are a lean, tech-led team planning to reinvest profits for growth;
• already have a Baltic or Nordic presence or Estonian-speaking staff;
• offer a narrower service set and want lower regulatory fees;
• are prepared for a regulator with a short MiCA track record and a very strict view of client-asset protection and cyber resilience.

Consider neither (yet) if: you have no realistic plan for EU-based management. Under MiCA, that is non-negotiable wherever you apply.

FAQ

Is the minimum capital for a CASP lower in Estonia than in Malta? No. MiCA sets EUR 50,000, 125,000 or 150,000 depending on your service class, in every Member State. You also need to hold at least one quarter of your previous year's fixed overheads if that is higher.

Can I still operate under my old Estonian VASP or Maltese VFA licence? No. The transitional period ended on 1 July 2026 (Malta's measures expired on 30 June 2026). Legacy licences do not convert automatically, so you need a full MiCA CASP authorisation.

Will a Maltese or Estonian CASP licence let me serve clients across the EU? Yes. Both give you the same MiCA passport. You notify your home regulator, and you can start in the countries you listed once the host authority receives the notification, or at the latest 15 calendar days after you submit it.

Which is faster? The legal review clock is identical. In practice, speed depends on how complete your application is, how quickly you hire local key staff and how fast you answer regulator questions.

Talk it through before you commit

Your CASP home state shapes your hiring, tax and banking for years. If you are weighing Malta against Estonia, or another EU jurisdiction, book a free 15-minute consultation with OnScale. We help crypto founders form the right entity, prepare the MiCA application and set up the IT and compliance foundations around it.

Write to us at contact@onscale.org.

This article is for general information only and does not constitute legal or tax advice. Regulatory fees, registers and tax rules change; verify current figures with the relevant authority or your advisers before deciding.