New VASP licensing rules affecting recovery in Malta – financial forensics

Malta's virtual-asset licensing system is tightening. For practitioners trying to trace or freeze digital assets held by or flowing through Maltese-licensed entities, that shift has direct and immediate consequences.

As of early 2026, updated VASP licensing requirements in Malta have changed what operators must record, disclose, and report – and those changes reshape the practical tools available under a disclosure order against a VASP or a tracing exercise anchored in follow-the-money analysis. Acting before a new operator migrates or restructures under the revised rules can make the difference between reaching records and losing them.

This alert covers what changed, who is affected, and the steps that matter now.

What changed in Malta's VASP licensing rules?

Malta has aligned its virtual-asset service provider licensing system more closely with the requirements flowing from the Markets in Crypto-Assets regime and the updated anti-money-laundering transfer-of-funds rules. The practical effect is a higher compliance burden on licensed VASPs operating from Malta. They must now maintain more granular transaction records, apply enhanced customer due-diligence standards to a broader category of wallet interactions, and report suspicious activity through defined channels.

For asset tracing, the significance is this: compliant operators now hold richer data sets than they did under earlier rules. A disclosure order against a VASP directed to a Malta-licensed entity has more to reach. Counterintuitively, the same rules can also accelerate restructuring by operators who want to reduce their exposure to disclosure – which is precisely why timing matters.

Who is affected?

Three groups face the most immediate impact.

• Fraud victims and insolvency practitioners whose asset tracing exercise involves a counterparty that holds, processes, or custodies digital assets through a Malta-licensed VASP. The improved record-keeping standards may assist a Bankers Trust order or a Norwich Pharmal order directed at transaction data.
• Referring lawyers and funders assessing a matter where value passed through Malta on its way to another jurisdiction. The follow-the-money chain through a regulated Maltese entity is now more legible – but the window to act before records are archived or the entity restructures is finite.
• Practitioners already engaged in asset recovery Malta proceedings who need to reassess whether an existing disclosure application captures the fuller record set the new rules require operators to keep.

In our experience, the lag between a regulatory change and practitioner awareness of its evidentiary consequences is where opportunities – and losses – are made. A licensed VASP that was barely useful as a disclosure target six months ago may now hold exactly the data needed to reconstruct a layered payment trail.

What to do now

Do not wait for litigation to clarify the position. Three steps are worth taking immediately.

First, review whether any counterparty in your tracing chain holds a Malta VASP licence under the revised rules. If so, the records it is now required to maintain may support a disclosure order or a freezing application. We regularly advise on whether those records can be reached and how quickly.

Second, consider whether a without-notice application for a disclosure order against a VASP is viable before the operator has an opportunity to restructure or archive. Applications made without notice are measured in hours to days; delay can mean the data is no longer held in a retrievable form.

Third, preserve whatever partial records you already hold. The myth that missing records kill the trail is exactly that – a myth. We reconstruct payment trails from partial records and identify where value settled, using the regulated data environment that Malta's revised licensing rules now provide as an anchor. On-chain tracing tools reinforce what documentary records cannot supply on their own.

We coordinate closely with admitted local counsel in Malta; local procedure governs the filing of any formal application, and the steps above describe the general approach rather than jurisdiction-specific legal advice.

For a confidential read on whether a Malta-linked digital asset trail is still reachable, contact us at info@axiomtracel.com.

Further context on financial forensics methodology is available in our Financial Forensics insight section. For jurisdiction-specific detail, see our Malta jurisdiction guide. For a worked example of tracing through nested accounts, read Following a wire through nested accounts.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We have reconstructed payment trails where records appeared incomplete and identified where value had settled across multiple jurisdictions. Our team has traced assets through VASP choke points and supported disclosure applications across regulated financial centres. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction; we coordinate closely with admitted local counsel in Malta, where local procedure governs the filing of any formal application. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.