During the first edition of the Delta Summit, the Malta Gaming Authority (MGA) announced and published guidelines on its Sandbox Framework for the acceptance of Virtual Financial Assets (VFAs) and the use of Distributed Ledger Technologies (DLTs) within the Gaming Industry. The first phase of the sandbox will commence on 1 January 2019 for the purpose of the acceptance of VFAs and virtual tokens, and last for a period of ten (10) months, followed by the second phase which will in turn extend to applications for the use of Innovative Technology Arrangements (ITAs). (The terms VFA, Virtual Token, DLT exchange and DLT Asset shall have the same meaning assigned to them in the VFA Act.)

Any operator wishing to participate in the sandbox framework must already hold a license issued by the MGA and comply with any other regulatory requirements stemming from other applicable legislation, including but not limited to the VFA Act and regulations issued thereunder. Subsequently, the operator must then apply to the MGA for approval; however, the applicant must first conduct a Financial Instrument Test as issued by the MFSA in order to ensure that the DLT asset in question qualifies as a VFA or as a Virtual Token.

Operators may also accept VFAs which satisfy the following criteria:

  • Financial Value
  • Technological Value
  • Scalability
  • Market Conditions
  • DLT Asset Economics

DLT assets that fall to be regulated as financial instruments as defined in the Investment Services Act (Cap. 370 of the Laws of Malta), or as electronic money as defined in the Financial Institutions Act (Cap. 376 of the Laws of Malta) may only be accepted as a means of payment if specifically approved on a case-by-case basis by the MGA.

On the other hand, with regards to DLT assets that fall to be regulated as Virtual Tokens, the MGA shall assess whether to accept or reject the use of such tokens on a case-by-case basis and be guided by the characteristics of the applicant as follows:

  • Technology
  • Company Structure
  • Market Applications
  • Security
  • Human Resources

Virtual Tokens may be acquired directly from the relevant operator on its platform and may be sold to registered players for fiat money, in order to make use of such tokens on the same platform. Any withdrawals from a player’s account are to be made in fiat money and any remaining tokens may be exchanged using the same exchange rate at which they were originally acquired.


A wallet in terms of these guidelines shall be taken to mean the same as any other VFA wallet due to the limited set of basic operations as listed below:

  • Address
  • Specific VFAs can be deposited
  • Funds can be withdrawn if there is sufficient balance

A wallet address shall be a part of the on-boarding process of any registrant and shall form part of the player’s registered identity with the operator. Thus the latter has to ensure that the wallet actually belongs to the registrant. If the player wishes to deposit from a different address, he shall add that wallet to his account and follow the same procedures undergone upon registration of the first wallet. Only wallets whose address or addresses are linked to the individual player shall be admissible for use in the gaming ecosystem. Registered players will then have to verify their account within 30 days of the first deposit. No withdrawals are permissible unless the verification process is completed.

In the case of operators accepting payments in fiat currency as well as VFAs, the fiat currencies and each individual VFA shall be treated separately and exchanging between one and another shall not take place within the operator’s ecosystem.

For clarity’s sake, any deposits made in fiat money shall not serve to be withdrawn as a VFA and vice-versa. VFAs and fiat are to be treated individually and may not be exchanged on the operator’s platform.


Currently, operators are required to maintain player-specified limits for fiat currencies; rather than include VFAs within the same limit, operators should add a distinct player-specified ceiling for VFAs that is distinct from the fiat currency limit. However, no operator may accept deposits in VFAs by a player exceeding the equivalent of one thousand euro (€1,000) per month. For the sake of clarity, the maximum deposit amount is considered on a player-to-operator level, and may not be applied on a per brand level instead. Due to the aforementioned high volatility, it is likely that during the lifetime of this sandbox, players may deposit a sum which is less than the maximum deposit amount. However, after a period of time – perhaps without even playing a game – they might end up with a total that is significantly higher or lower than the maximum deposit amount.

Moreover, the FIAU Implementing Procedures – Part II – for the remote gaming sector shall also apply to any operators wishing to participate in the sandbox.

Innovative Technology Arrangements

In order for an operator to leverage an ITA, including DLT platforms and smart contracts, within its key technical equipment, it requires the specific approval of the MGA and inclusion within the sandbox framework. Innovative technology arrangements shall be audited by system auditors registered with the MDIA in terms of the ITAS Act. Moreover, administrators as defined in the ITAS Act shall be assessed on their competence in the context of their assessment as persons performing key functions, and shall be required to show specific competence in relation to administering an innovative technology arrangement, where pertinent to the function they perform.

For the duration of this sandbox, the MGA will accept games and game components that are hosted fully or partially on a DLT environment, subject always to the system audit as mentioned.

Lastly, the hosting architecture must be located in Malta and, or any EU/EEA Member State, or in any other third country jurisdiction wherein the Authority is satisfied that the same principles can be obtained.

For more information on the Regulation of Gaming Companies, and the Regulation of Cryptocurrencies please contact Dr Ian Gauci on igauci@gtgadvocates.com and Dr Gabriel Fenech on gfenech@gtgadvocates.com

Disclaimer: This article is not intended to impart legal advice and readers are asked to seek verification of statements made before acting on them.

Disclaimer This article is not intended to impart legal advice and readers are asked to seek verification of statements made before acting on them.
Skip to content