“We’re not after numbers, we’re after quality, we’re after legitimate business.” That is how Kenneth Farrugia, the Chief Executive Officer of the Malta Financial Services Authority (MFSA), sums up the jurisdiction’s approach to licensing, in an interview with Finance Magnates.
He also stressed that regulatory officers “don’t have a social relationship,” despite Malta being a small island where the people they regulate might be next-door neighbours, while adding that perpetual futures “fall within the scope of intervention measures on CFDs,” and that the regulator’s focus includes understanding “whether, and how, prediction markets can fit within the MiFID framework.”
Farrugia has led the MFSA since April 2023, arriving from the Financial Intelligence Analysis Unit (FIAU), Malta’s anti-money laundering supervisor, where he served as director for six years. He took over an authority that had only recently worked its way off the Financial Action Task Force’s grey list of jurisdictions under increased monitoring, a listing Malta exited in June 2022 after a period the CEO now describes as “a rough patch."
"It’s Much Easier for a Player to Be Immediately Left Out”
Malta’s reputation as a crypto hub predates MiCA by several years. Farrugia traced it back to 2017, when the government legislated for crypto assets from both an anti-money laundering angle and a licensing and conduct one — a decision he called a “huge” one for a small jurisdiction to take unilaterally, since there was no international obligation to do so at the time.
The impact was immediate and severe by design. “In 2017, we had over 200 companies operating from Malta. When we introduced the regime, only 24 applied for a VASP licence, and we only licensed half of them,” Farrugia said. The rest, he added, moved on to jurisdictions with lighter requirements.
That period, which Farrugia measures at roughly seven years of hands-on supervisory experience before MiCA came into force in 2025, shaped how Malta approached the EU-wide regime once it arrived.
Most of Malta’s MiCA licensees, he said, were companies already supervised under the earlier Virtual Financial Assets Act, among them crypto.com, OKX, and Falcon X. New applicants have come in as well, but the numbers stay modest: Farrugia put the total at 22 licences issued to date, placing Malta fourth among EU jurisdictions by his own count.
That ranking tracks with public data. ESMA’s interim MiCA register has shown Germany well ahead of the rest of the bloc on authorisations, with the Netherlands and France some way behind in a similar range to each other, and Malta and Cyprus further down the list.
Farrugia declined to speculate on why other jurisdictions have issued more licences, saying only that Malta’s job is to assess its own applications properly rather than compete on volume.
A European Banking Authority (EBA) review of Malta’s licensing process came back largely positive, and the MFSA has since implemented roughly 80% of the recommendations that followed, with the outstanding item — a new supervisor case management system — expected to launch “hopefully early next year.”
Perps “Should Meet the CFD Definition”
The same gatekeeping logic extends to how Malta treats perpetual futures, a product increasingly offered by crypto exchanges. Farrugia said Malta’s position is that “derivatives marketed as perpetual futures should fall within the scope of the existing conduct and intervention measures on CFDs.”
Asked directly whether that means firms such as OKX or crypto.com would need to treat perpetual futures as CFDs, and take on the accompanying MiFID and product-intervention obligations, he confirmed: “Yes. But they should meet the CFD definition.”
His view aligned with the stance of ESMA. The pan-European regulator recently issued a notice stating that crypto perps may be classified as CFDs rather than general derivatives under MiFID II. A CFD classification means that the leverage offered for perps will be heavily limited, with strict rules governing their marketing to retail clients.
“All licence holders are obliged to assess their products, determine whether they fall within the relevant definitions, and ensure they meet all applicable requirements,” the MFSA CEO added. “If a product does not fall within that definition, it is outside the scope of those measures."
"Preventing Bad Actors from Entering the Jurisdiction”
The MFSA is one of the many national competent authorities (NCAs) in Europe. Although its collaboration with other regulators in the bloc is clear, oversight is also shifting towards offshore jurisdictions.
The Maltese regulator has been active on this front recently: it signed a memorandum of understanding with the Seychelles Financial Services Authority in April to formalise cooperation on broader financial oversight. It is one of several such agreements, Farrugia said, that Malta maintains both within and outside the EU.
He pointed to a growing web of bilateral arrangements with regulators beyond Malta’s borders, describing information sharing as often voluntary rather than triggered only by formal requests.
“This helps prevent bad actors from entering the jurisdiction,” Farrugia said. “If we take action against a bad actor operating in Malta and find that the same operator or individual is active in another jurisdiction, whether within the EU or elsewhere, we immediately alert the relevant regulator so they can take any necessary action."
"We Don’t Have a Social Relationship”
Behind that approach sits a regulator that has scaled up considerably.
The MFSA employs more than 600 people, part of a wider Maltese financial supervisory ecosystem that includes the FIAU, the Malta Business Registry, and the Central Bank of Malta.
Around 25 staff work specifically across crypto-related functions, and enforcement, Farrugia said, is built around remediation rather than fines alone: firms found in breach are required to demonstrate that corrective action has actually taken hold before the matter is considered closed.
Asked how a regulator polices an industry on an island of roughly 600,000 people, where a compliance officer might have a licensee company’s head as a next-door neighbour, Farrugia pushed back on the framing. “We don’t have a social relationship, let’s put it that way,” he said, describing the dynamic instead as a professional one built on regular engagement, consultation forums, and clear expectations. “Either you’re serious, you’re up to scratch, or otherwise you just close shop and move to wherever you want."
"It’s Not a Wait-and-See Situation”
While Malta has already established itself in the crypto space, it is now attracting a different set of companies: prediction markets.
Malta’s government has floated the sector as a potential growth area, but Farrugia was careful to separate enthusiasm from regulatory clarity. Event contracts, he said, could fall under financial services rules, gambling rules, or both, depending on how a given product is classified, and the MFSA is working alongside the Malta Gaming Authority to determine where the lines sit.
His approach to this specific market is also aligned with ESMA’s view, which recently said that event contracts might be classified as banned binary options, gambling products, or even fall under MiCA, depending on their nature.
Asked whether Malta was now in a wait-and-see posture — unlike its early, unilateral move on crypto in 2017 — Farrugia rejected the comparison: unlike virtual financial assets at the time, prediction markets already have functioning frameworks elsewhere to study, including in the United States. The practical friction, he noted, sits less with MiFID, where passporting already smooths cross-border access across the EU, and more with establishing definitional clarity before Malta moves to formalise a framework of its own.
