Malta Gaming Authority warns against tick-box compliance
The Malta Gaming Authority (MGA) has warned licensed gambling operators that appointing key governance personnel is not enough, following a sector-wide review that found varying levels of governance maturity and weaknesses in how some firms embed compliance into business decision-making.
The regulator’s new Governance Assurance: Key Functions thematic review examined a risk-based sample of B2B and B2C licensees as part of its 2025 supervisory programme. Rather than investigating individual gambling operators or taking enforcement action, the report assesses how key governance functions operate in practice and highlights common strengths, weaknesses and examples of best practice across the sector.
The review concluded that the strongest governance frameworks were characterised by active senior leadership, empowered key function holders and robust oversight embedded in day-to-day decision-making. However, the MGA said governance maturity varied significantly between operators.
Among its findings, the Authority identified instances where strategic decisions, including market expansion and new product launches, were not consistently supported by documented impact assessments or meaningful challenge from compliance, legal and risk teams. In some cases, those control functions were consulted only after key decisions had already progressed, limiting their ability to influence outcomes.
The report also found that some compliance functions remained focused primarily on regulatory reporting and administrative obligations rather than acting as proactive second-line oversight functions capable of challenging management decisions. Other MGA-licensed gambling sites were found to have fragmented compliance responsibilities, reducing accountability and visibility over emerging compliance risks.
Internal audit arrangements also came under scrutiny, with the MGA identifying examples where the function appeared to operate largely as a compliance exercise rather than assessing the effectiveness of governance, risk management and internal controls. Some operators were unable to demonstrate how audit findings influenced management decisions or governance improvements.
Summarising its findings, the Authority said operators should ensure governance arrangements provide “meaningful oversight and assurance in practice rather than merely satisfying regulatory requirements”, urging licensees to review whether their key functions are genuinely effective rather than simply established on paper.
Our take on the MGA’s review
The MGA deserves credit for lifting the curtain on what its supervisors are seeing during engagements with licensees. The report contains some worthwhile observations, particularly around compliance teams being consulted too late in major business decisions, governance functions lacking independence, and internal audit failing to provide meaningful challenge.
Ironically, however, the publication risks becoming the very type of exercise it warns operators against.
The report repeatedly cautions licensees against treating governance as a “tick-box” exercise, yet it offers little hard data to help readers understand the scale of the issues it identifies. No operators are named, no statistics are provided on how common individual failings were, and there is no indication of whether any of the findings resulted in regulatory action.
For operators, the review serves as useful guidance on the MGA’s supervisory expectations. For industry observers, however, it leaves some obvious questions unanswered. Were these isolated shortcomings, or systemic issues across the Maltese online gaming sector? Which governance failures concern the regulator most? And, perhaps most importantly, have standards improved compared with previous years?
Those answers would have transformed an informative guidance document into a genuinely revealing snapshot of governance standards across one of the world’s largest online gambling licensing jurisdictions.
