MGA Key Functions

Check the individual's eligibility for the actual role

Use the current role-specific criteria when assessing experience and qualifications. For example, the MGA's live instructions distinguish managerial, compliance, legal, privacy, AML and technology experience rather than accepting one generic “gaming professional” profile.

The MGA also assesses role knowledge, fitness and propriety. Check the full current criteria for the proposed person, particularly for MLRO, legal, privacy and internal-audit appointments.

Ask candidates to link their evidence to the intended function. A technology lead should explain the relevant system and responsibilities; a compliance candidate should demonstrate knowledge of the business's regulatory procedures. Record which requirement each qualification or previous role supports and where additional evidence is needed.

The MGA also publishes a policy on eligibility and ongoing competency. Check its date and schedules against current instructions.

AML appointments need their own assessment

Where the relevant AML/CFT function applies, review the candidate, applicable FIAU registration and the business's procedures together. The current MGA instructions include MLRO eligibility material, registration evidence and an assessment of knowledge of the authorised person's AML/CFT procedures.

A supplier should not copy an operator's staffing plan, and “we are B2B” does not answer the questions about the entity's activities, privacy duties or wider obligations. Establish the scope before deciding which appointments are needed.

Can one person hold several key functions?

Some combinations are incompatible. Check the MGA policy's conflict provisions and Fourth Schedule before proposing a combined role.

The policy identifies conflicts between executive and specified control functions. It also treats internal audit as incompatible with the other key functions and identifies restrictions involving AML/CFT, data protection, ultimate beneficial owners and non-executive directors. Review the precise proposed pair and the person's other involvements, not just the job title on an organisational chart.

As a preparation check, record the proposed combination, applicable policy provision, existing appointments, workload and decision. If compatibility remains unresolved, do not present the combined staffing cost as a confirmed saving.

Prepare and submit the individual application

The MGA's portal process connects a personal declaration with company involvement. The individual creates the declaration through the personal-portfolio process and selects the proposed function. The company then handles the resulting involvement request through the relevant access permissions.

Article 5 of the Directive identifies the chief executive, compliance and applicable AML/CFT functions at application stage, with the remaining applicable functions notified within six months of licence issuance. It also sets three working days for notification of resignation or dismissal and fifteen working days for notification of the replacement appointment. A person can be notified before approval but must still obtain the certificate of approval.

Prepare the document pack before starting the filing:

• certified identity evidence;

• residential-address evidence;

• police-conduct material covering the applicable residence history;

• a birth certificate where required for a first application;

• signed application material and role-specific supporting evidence.

Check the current requirements for certification, additional Malta-residence documents and notification instructions at submission. The published fee is €50 per key function role, not per entity; use the portal's payment instructions and reference.

Track the individual application and company involvement separately. An application number shows that a filing exists, not that the MGA has approved it.

Outsourcing must provide a working function

An external provider should identify the individual, tasks, reporting line, access, time commitment and continuity arrangements. A contract that offers a name without access to the operation is a poor basis for an accountable appointment.

Before agreeing terms, establish:

• Which natural person will perform the function and what approval is required.

• Which records, systems and meetings that person can access.

• Who can act on findings and how unresolved issues reach management.

• What happens during absence, resignation or replacement.

• How fees change if the scope or workload changes.

Budget the professional service separately from the small regulatory application fee. The Malta gaming fees and operating-cost model separates those layers.

Keep approvals current after appointment

Maintain a log of the approved roles, entities, conditions, evidence and renewal dates. For an additional function or involvement, check compatibility before filing the change. For a departing person, follow the MGA termination-notification process and arrange continuity rather than leaving the function without an owner.

Continuous professional development is part of maintaining competency. The MGA publishes annual role-specific requirements; the CEO/equivalent requirement is a minimum of five hours and the listed principal control and operational functions generally require ten. Check the exact role and applicable period before completing a declaration.

Keep proof of attendance or completion and a short explanation of relevance. A course title alone may not demonstrate why the activity supports the approved function. Where a person holds several functions, assess the evidence against each role rather than assuming every hour counts everywhere.

Prepare the appointment plan with MGL

Send the proposed licence route, organisational chart, functions to be covered, candidate profiles and existing involvements. Identify any intended combinations or outsourced appointments at the outset.

Discuss the MGA key function plan with MGL so that candidate selection, application preparation and operational access are scoped together. If the business is considering recognition of an existing foreign authorisation, assess the Recognition Notice requirements before assuming the full-licence appointment model transfers unchanged.