Banking · Payments · Licensing · 2025–2026
A Malta company plus a Curaçao licence is one of the most common structures in iGaming.
It is also one of the most misunderstood by the operators holding it.
Banks do not see a Malta company. They see a Curaçao-licensed gambling merchant with a European wrapper.
The most expensive mistake in iGaming is treating incorporation and licensing as interchangeable.
Banks assess the licence jurisdiction, not the corporate entity. A Malta company holding a Curaçao licence is evaluated as an offshore gambling operation. The Malta registration improves governance signals. It does not change the risk tier.
Unless you understand exactly what banks are seeing, you cannot fix it.
Five things banks know about your structure
- MGA-licensed operators access Tier-1 payment processors at an estimated 85% acceptance rate. Legacy Curaçao sub-licence structures achieve 30 to 50%, according to industry practitioners.
- The LOK reform, enacted 24 December 2024, creates the legal architecture for improved trust. Bank and card-scheme risk models will take years to catch up.
- Visa and Mastercard continue to categorise Curaçao gaming merchants as high-risk in 2025–2026, regardless of the Malta corporate entity.
- The MGA issued 23 cease-and-desist letters, 15 warnings, and over €139,000 in administrative penalties in H1 2025 alone, according to MGA enforcement data. Enforcement visibility is what banks actually measure.
- A Malta + Curaçao structure is bankable. But only with demonstrable substance, a documented AML programme, player fund segregation, and accurate target-market mapping.
Quick answer: what does a bank actually see in this structure?
A bank conducting KYC on a Malta company with a Curaçao licence sees a hybrid risk structure: a European corporate entity anchored to an offshore gaming licence with limited historical enforcement. The Malta entity signals UBO traceability and corporate governance. The Curaçao licence signals elevated AML risk, limited Tier-1 acceptance, and potential grey-market exposure in EU player jurisdictions. The net result is a high-risk merchant assessment, typically steered toward EMIs and specialist acquirers rather than mainstream EU banking.
Why do banks single out this structure?
Online gambling is a high-risk vertical across every major financial institution's risk classification.
High transaction volumes, cross-border flows, elevated chargebacks, and AML exposure mean that even fully licensed, technically compliant casinos are regularly declined by mainstream EU banks, according to sector-specific analysis from payments advisers.
The structure in question adds a layer of complexity.
A Malta-registered company holding a Curaçao licence creates a mismatch: the contracting entity is EU-domiciled, but the regulatory authority is offshore.
Banks conduct KYC on the entire structure, not just the top-of-group entity.
When the licence jurisdiction is Curaçao, the operator is assessed as a Curaçao-licensed gambling merchant regardless of where the holding company is incorporated.
"Banks look at the entire structure , contracting entity, licence jurisdiction, target markets, and payment flows, rather than just the country of incorporation. Banks will not treat a Malta company with a Curaçao licence as equivalent to an MGA-licensed entity."
CGA compliance guidance and banking intelligence synthesis, 2025.
What does a bank's due diligence framework actually examine?
A KYC/KYB team reviewing a Malta + Curaçao application works through five core dimensions in a structured sequence.
Understanding each one is the first step to presenting your structure credibly.
Figure 1 · Due diligence table
How MGA, Curaçao LOK, and Curaçao legacy structures compare across the banking compliance framework
| Dimension | Malta MGA | Curaçao LOK (2025+) | Curaçao Legacy | Banking impact |
|---|---|---|---|---|
| Licence type and regulator | Direct B2C/B2B from the MGA, an active EU regulator | Direct B2C/B2B from the CGA, a newly empowered regulator | Sub-licence from a private master licence holder | Banks favour direct government oversight. Legacy sub-licences were flagged as nominally supervised. |
| Capital and substance | Min. €100K capital, EU office, resident directors, staff. Mandatory. | Local entity, physical office, and key person by April 2027. Maturing requirement. | No minimum capital or local presence historically required. | Substance signals a genuine, stable operation. Malta provides this immediately. |
| Compliance reporting | Monthly financials, quarterly compliance reports, annual audits. Mandatory. | CGA now mandates incident, complaint, and compliance reporting. Track record building. | Minimal to no ongoing reporting under the legacy framework. | Banks prefer jurisdictions with proven supervisory activity. MGA's history is established; CGA's is new. |
| Player fund segregation | Strict legal mandate. Separate accounts, cannot be used for operations. | Expected under responsible operation but not historically codified. | Not mandated. Mixed player and operational funds documented in enforcement cases. | Critical solvency signal. Malta's strict requirement gives banks auditable protection for player liabilities. |
| Public register and UBO | Active public register, rigorous UBO investigations by the MGA. | CGA now maintains a public register and conducts UBO checks. Major positive development. | Opaque structure. Limited UBO visibility or accountability under the legacy model. | Instant licence verification and UBO access is essential for a bank's initial screen. |
The tier-1 payment processor acceptance gap
The gap between MGA and Curaçao acceptance at Tier-1 payment processors is the commercial consequence of everything in the due diligence table above.
Industry practitioners consistently estimate this gap at around 35 to 55 percentage points in favour of MGA.
These are advisory estimates, not published primary data, and should be treated as indicative ranges based on practitioner experience.
Figure 2 · Acceptance comparison
Estimated Tier-1 PSP acceptance rates by licence structure
The practical consequences of a lower acceptance rate include a smaller pool of willing providers, higher per-transaction fees, mandatory rolling reserves, and vulnerability to sudden account closures when risk models are reviewed.
Operators relying on EMIs and specialist high-risk acquirers face higher ongoing costs and fragile banking relationships compared with operators who hold MGA licences and access mainstream EU banking infrastructure.
How does Curaçao compare to Malta on regulatory trust?
Banks do not evaluate licences in isolation.
They evaluate the regulator behind the licence: its enforcement history, the visibility of sanctions, and whether it has demonstrated a willingness to act against non-compliant operators.
This translates into what practitioners describe as a jurisdictional trust ladder.
Figure 3 · Trust ladder
How banks position regulators on the trust ladder
Malta Gaming Authority
In H1 2025 the MGA issued 23 cease-and-desist letters, 15 warnings, and over €139,000 in administrative penalties, according to MGA enforcement records. The Winzon Group licence cancellation for AML and compliance failures is a documented precedent. Banks and card schemes treat MGA licensing as a signal of active, enforceable oversight with EU anchoring, monthly reporting obligations, and mandatory player fund segregation.
Curaçao Gaming Authority (LOK, 2024+)
The LOK creates the legal framework for enforcement: a public register, direct CGA licensing, UBO disclosure, AML obligations, and mandatory local substance. The CGA is building its enforcement track record. Banks and Visa and Mastercard continue to treat Curaçao merchants as high-risk in 2025–2026 while monitoring whether enforcement practice matches the legislative intent.
Curaçao legacy sub-licence (pre-LOK)
Under the 1993 NOOGH framework, four private master licence holders issued sub-licences with minimal oversight, no minimum capital, and limited AML obligations. Banks consistently categorised this structure as high-risk with opaque UBO chains. Operators still relying on expired or quasi-informal legacy arrangements face immediate compliance risk with both regulators and financial institutions.
Why enforcement history matters more than legislation
A new law does not immediately change a bank's risk model.
Banks and card schemes update their internal ratings based on observed enforcement outcomes, regulatory dialogue, and peer institution experience, not on the date a new ordinance passes.
The LOK framework is the right move for Curaçao. Its banking impact will be measured over a 2 to 5 year horizon, not in months.
Does the Malta company actually change the risk calculation?
Yes, but not in the way many operators expect.
A Malta-incorporated entity does provide genuine value to a banking application. It is not cosmetic.
UBO traceability
A Malta company provides access to EU corporate law, clearer UBO registration obligations, and courts familiar to European counterparties. Banks can verify the entity and its controllers more reliably.
Governance signals
EU jurisdiction of incorporation, audited accounts from recognised firms, and access to EU legal remedies improve a bank's perception of corporate substance and accountability.
Regulatory equivalence
A Malta company is not a Malta-regulated gaming company. Without an MGA licence, there is no MGA supervision, no mandatory responsible gambling controls, and no enforced player fund segregation. Banks know the difference.
Licence jurisdiction
The licence is what matters for payment scheme classification. Visa and Mastercard's merchant category codes and risk assessments track the licence, not the holding company address.
A Malta entity that merely acts as a holding or contracting vehicle for a Curaçao-licensed operation offers some comfort in EU jurisdiction, clearer corporate law, and access to EU courts, but does not provide the same regulatory comfort as an MGA licence.
If the Malta company's name, licence, and actual operating footprint do not align, compliance teams may conclude the structure is designed primarily for regulatory or reputational arbitrage.
That conclusion ends the onboarding conversation.
What does the compliance stack look like?
The compliance stack is the set of documented policies, controls, and records that a bank requires before and during the relationship.
For a Malta + Curaçao operator, this stack has two layers: the standard gambling merchant layer and an additional layer specific to the hybrid structure.
Figure 4 · Compliance stack
What banks require from a Malta + Curaçao operator
| Document or control | Standard gambling merchant | Additional for Malta + Curaçao |
|---|---|---|
| Corporate structure | Incorporation docs, share register, group chart | Mapping of which entity contracts with players, processes payments, and holds the licence |
| Gaming licence | Valid licence and any ancillary approvals | Proof of direct LOK/CGA licence; evidence that any legacy sub-licence arrangements are resolved |
| UBO identification | UBO KYC and screening records | Explanation of any offshore ownership layers; confirmation Malta entity has real substance, not nominee directors |
| AML programme | Documented AML policy, CDD, PEP/sanctions screening, SAR process | Alignment with CGA's enhanced AML/CTF obligations introduced under LOK in 2024 |
| Player fund controls | Evidence of player fund handling policy | Segregation documentation and reconciliation process, even where not legally mandated by the licence |
| Target markets | General business description | Explicit mapping of player jurisdictions, applicable licences or exemptions, and geo-blocking controls for prohibited markets |
| Financials | Audited or management accounts | Accounts from a recognised audit firm clearly linking gaming revenues to licensed entities |
| Crypto payments | Not always required | If applicable: integration of crypto flows into AML/CTF controls, wallet monitoring, and transaction traceability |
What gets operators rejected?
Banks reject Malta + Curaçao applications for patterns that are specific and consistent.
Knowing them before you approach a provider is the difference between a structured, successful application and a declined relationship that stays on your compliance record.
Figure 5 · Red flags
Rejection patterns for Malta + Curaçao structures
| Red flag | What the bank sees | The risk |
|---|---|---|
| Legacy sub-licence still active | Continued reliance on expired or quasi-informal arrangements | Immediate compliance risk; unacceptable in any onboarding conversation post-2025. |
| Malta entity is a brass plate | No staff, no premises, nominee directors only | Banks interpret this as regulatory and reputational arbitrage. The relationship is declined. |
| No documented AML programme | Generic or absent AML policy, no CDD procedures | Automatic decline. AML documentation is a baseline requirement, not a differentiator. |
| Unclear market targeting | No mapping of player jurisdictions, no geo-blocking evidence | Banks must not facilitate illegal gambling. Ambiguous market targeting creates liability the bank will not accept. |
| Complex offshore ownership layers | Multi-hop structures with UBOs in opaque jurisdictions | Raises ML/TF risk score. Each additional layer without clear documentation reduces approval probability. |
| High chargeback history | Fraud incidents or unresolved complaint volumes | Triggers card-scheme scrutiny and can lead to termination of existing acquiring relationships. |
| No player fund segregation | Commingled operational and player funds | Signals financial instability and poor governance. Particularly damaging in the absence of an MGA mandate. |
The de-risking roadmap
De-risking is not a single action. It is a sequenced programme that builds the compliance record that banks require.
The roadmap below splits into two parallel paths depending on whether the operator is building toward an MGA upgrade or optimising the current Curaçao structure.
Figure 6 · Roadmap
Two de-risking paths for Malta + Curaçao operators
Upgrade to MGA licensing
Optimise Curaçao under LOK
The seven detailed steps
Whether on Path A or Path B, every operator needs the same foundational compliance programme in place before approaching any payment provider.
These are the seven steps, drawn from the banking due diligence framework and the CGA licence conditions.
Migrate to a direct CGA LOK licence
Cease all operations under expired legacy sub-licences. Obtain a direct B2C licence from the Curaçao Gaming Authority under the LOK framework. The Orange Seal expired 15 October 2025. Any operator still relying on a legacy arrangement is in immediate breach.
Establish genuine Malta substance
Staff a Malta office. Appoint resident directors with active decision-making functions. Banks distinguish genuine substance from mail-drop arrangements with a forensic attention that surprises most operators.
Build a comprehensive AML/KYC programme
Document AML policies, customer due diligence procedures, PEP and sanctions screening, and suspicious activity reporting aligned with FATF guidance and EU AML directives. This must exist before any banking application, not as a response to a compliance question.
Segregate and document player funds
Establish a player fund segregation structure with documented reconciliation, even where not legally mandated. Banks use this as a key solvency and governance signal to assess whether an operator can cover player liabilities.
Prepare a structured compliance documentation pack
Compile incorporation documents, share register, group chart, audited accounts, gaming licence, AML policy, responsible gambling procedures, and a clear, written explanation of target markets and payment flows before approaching any provider.
Map your player markets and legal permissions
Identify where players are located, what licences or exemptions apply, and how prohibited markets are blocked. Banks and PSPs must not facilitate illegal gambling in markets that require local licences, and they will ask for this mapping explicitly.
Approach specialist EMIs and PSPs with your compliance pack
Begin with specialist high-risk EMIs rather than Tier-1 banks. Build a transaction and compliance track record over 12 to 24 months. Compliance is a state, not a document submission.
How Folkfox helps operators build the story banks actually read
The compliance work is one half.
The other half is making your structure legible: to banks, to payment partners, to affiliates, and to the players who decide whether to trust your brand.
That is the half Folkfox owns.
We are a boutique growth marketing consultancy built for iGaming operators navigating regulated and complex environments.
We help you turn your compliance position into content, trust signals, and a brand that banks, partners, and players can read clearly.
If you are working through ADR compliance alongside your banking structure, these two Folkfox guides cover the Curaçao ADR landscape in detail.
Is your Curaçao casino ADR-compliant?
How to choose a Curaçao ADR provider: the definitive guide
Talk to Folkfox
If your Malta + Curaçao structure needs work on the marketing and positioning side, drop your email.
We will come back to you directly. No pitch decks. No waiting.
Folkfox is a growth marketing consultancy and not a legal adviser, compliance firm, or banking specialist.
This article is informational and does not constitute legal or financial advice.
Operators should obtain qualified legal counsel and engage a specialist compliance firm for their specific structure and jurisdictional requirements.
Frequently asked questions
No. Banks assess the licence jurisdiction, not just the corporate entity. A Malta company holding a Curaçao licence is assessed as a Curaçao-licensed gambling merchant. The Malta entity improves UBO traceability and governance signals, but does not substitute for MGA regulatory oversight.
Industry practitioners estimate Tier-1 PSP acceptance for MGA operators at approximately 85%, compared with 30 to 50% for legacy Curaçao structures. These are advisory estimates, not published primary data. Curaçao LOK operators are expected to improve on the legacy range as the CGA builds its enforcement record.
The LOK is the National Ordinance on Games of Chance, enacted in Curaçao on 24 December 2024. It replaces master-licences with direct CGA-issued licences and introduces UBO disclosure, local substance, and AML obligations. Bank perception will improve gradually as enforcement history accumulates.
Typically: incorporation documents, share register, UBO identification and KYC, gaming licence and approvals, AML policy, responsible gambling procedures, audited accounts, and a detailed explanation of business model, target markets, and payment flows. Banks often request additional evidence of Malta substance and CGA licence status.
MGA licensing requires minimum paid-up share capital of €100,000 plus a compliance deposit. Total initial outlay including setup is typically €170,000 to €205,000, with a 6 to 9 month timeline. Curaçao under LOK has no equivalent statutory minimum capital, with initial outlay estimated at €30,000 to €50,000.
Card scheme risk classifications respond slowly to regulatory change. Visa and Mastercard continue to associate Curaçao with the legacy master-licence framework and limited historical enforcement. The LOK creates the legal architecture for improved standing, but the CGA must demonstrate active, consistent enforcement before schemes revise their risk categories.
Migrate to a direct LOK licence, establish genuine Malta substance, implement a documented AML programme, segregate player funds, and prepare a structured compliance pack. Present this proactively to specialist EMIs rather than mainstream banks. Build a clean transaction record over 12 to 24 months before approaching Tier-1 acquirers.
When targeting regulated European markets, seeking stable Tier-1 banking, or preparing for investment or acquisition. MGA licensing costs €170,000 to €205,000 upfront with a 6 to 9 month timeline, but delivers significantly better banking access, lower processing fees, and stronger credibility with affiliates and payment partners.
Fresh tracks
Latest from the iGaming - Casino Compliance trail
Is your banking structure ready for bank scrutiny?
International banks look for compliance narratives that make sense. folkfox helps operators present a credible, transparent story to banks and payment processors.