MFSA Under Scrutiniy: MiCA in Malta – Genuine Gateway or Regulator-Sponsored Backdoor?

tamir
Sun, 15 Jun 2025 07:57:39 +0000
Crypto Compliance, Malta Financial Services Authority, ticker, Trending, Crypto.com, Gal Barak, Gemini, Gery Shalon, Gijs Op de Weegh, ING, OKX, PayVision, StablR, Uwe Lenhoff

1. Context – MiCA’s promise meets Malta’s “crypto-friendly” reality

The EU’s Markets in Crypto-Assets Regulation (MiCA) was sold to legislators as the end of Europe’s regulatory patch-work. In theory, every crypto-asset service provider (CASP) will live under the same anti-money-laundering (AML), governance and disclosure standards from 30 December 2024. In practice, the first six months of “early bird” licensing suggest that member states are already competing to become the Cayman Islands of MiCA.

Malta is the out-of-the-gate frontrunner. Within weeks of MiCA’s entry into force, it rubber-stamped licences for OKX and Crypto.com and is now preparing one for Gemini, prompting ESMA and peer regulators to worry aloud about a “race to the bottom.”

How has the island been able to move so fast? The answer lies in a two-step transposition strategy:

Legal Notice 296 of 2024 rewrote Malta’s 2018 Virtual Financial Assets (VFA) rules to make them “MiCA-equivalent” a full year before they become mandatory (Source: legislation.mt).

MFSA’s fintech team publicly boasts that this alignment was “completed earlier in 2024,” allowing a simplified application procedure for existing VFA licence holders (Source: mfsa.mt)

Fast-tracking may look efficient, but it also hands Malta a first-mover marketing slogan: “Get your passport here—today!” That slogan should make every serious compliance officer nervous. Remember, this is the same jurisdiction that spent a year (June 2021 – June 2022) on the FATF grey list for strategic AML deficiencies— hardly ancient history.

2. Case study – StablR, Payvision fingerprints and the MFSA’s blind eye

Nothing illustrates Malta’s tolerance better than StablR Ltd, the euro-stablecoin issuer proudly waving an MFSA e-money licence since July 2024. FinTelegram has already documented why the project raises every conceivable red flag:

Leadership baggage. Founder/CEO Gijs op de Weegh and several senior executives cut their teeth at Payvision, the Amsterdam high-risk PSP ING was forced to shut in 2021 after a string of money-laundering scandals. Dutch prosecutors have since fined former Payvision directors for AML breaches.

Direct links to organised cyber-crime. As Payvision COO, op de Weegh personally boarded the boiler-room networks of Uwe Lenhoff, Gal Barak and Gery Shalon—names synonymous with European cyber-fraud.

Omission of material facts. None of this chequered past appears in the StablR white paper or marketing deck—although MiCA’s disclosure rules (Articles 5–15) require full information on senior management integrity.

The question: How did MFSA’s “enhanced MiCA due-diligence” not spot—or not mind—what a few Google queries reveal in minutes?

Read our reports on Payvision here.

3. Systemic implications – MiCA’s weakest link problem

MiCA is built on mutual recognition: a CASP licensed in one member state can passport its services to all 27. That architecture only works if the toughest supervisor sets the bar. Today, it is the softest that dictates the standard. The Payvision precedent tells us what happens when gate-keeping collapses:

1. Illicit flow risk – Stablecoins are borderless cash. History shows that Payvision-trained managers treat AML controls as optional.

2. Market integrity risk – By offering a quick-and-easy licence, Malta undermines slower but stricter peers (e.g., France, Germany), incentivising regulatory arbitrage.

3. Reputational risk for the EU – The bloc fought hard to sell MiCA as a gold standard after the FTX debacle. A Malta-based scandal will hand ammunition to every crypto-skeptic policymaker.

4. What Malta says – and what it doesn’t

MFSA insists that “expedited processing” is possible because it has “in-depth understanding acquired over these years.” But those very years include:

The Pilatus Bank fiasco, where senior officials ignored blatant laundering signals.

The FATF grey-listing, triggered by lax enforcement of beneficial-ownership rules.

If institutional memory is Malta’s secret sauce, investors deserve to taste the recipe. So far, transparency is scarce; MFSA’s licence decisions come with no published reasoning, unlike ESMA’s fit-and-proper assessments in securities markets.

Read our reports on Pilatus Bank here.

5. Recommendations – closing the Maltese loophole

1. Immediate ESMA peer review. Article 122 MiCA gives ESMA authority to investigate national competent authorities. Malta should be top of the list.

2. Public fit-and-proper dossiers. Require host regulators to publish (redacted) integrity assessments for passported firms, allowing civil-society watchdogs to validate findings.

3. Transition cap. Until the peer review is complete, limit the number or size of MiCA licences a single MS can issue.

4. StablR re-assessment. Given Payvision’s proven AML failures, MFSA should reopen its gatekeeper report—or ESMA should do it for them.

Read our reports on StablR here.

6. Final thought

MiCA was never meant to be a marketing incentive; it was meant to be a safety net. By racing ahead with a minimalist interpretation, Malta risks turning that net into a sieve. The StablR case shows exactly how bad actors exploit regulatory enthusiasm for “innovation.” The choice for EU supervisors is stark: enforce one standard everywhere, or watch the single market become a haven for the next Payvision—in stablecoin clothing.

FinTelegram will keep digging. Whistle-blowers with additional information about StablR, MFSA’s licensing process, or any other MiCA-passporting shortcuts are invited to contact us via Whistle42.

Share Information via Whistle42