The review highlights stronger leadership engagement, empowered key function holders and better audit trails across licensed operators
The Malta Gaming Authority has published findings from its Thematic Review on Governance Assurance – Key Functions, giving licensed operators a clearer view of the standards expected across core governance roles.
The review formed part of the MGA’s 2025 supervisory priorities and reflects the regulator’s risk-based, evidence-led and outcomes-focused approach to oversight.
The Authority assessed governance arrangements across a sample of B2B and B2C Authorised Persons. Its focus was the practical effectiveness of the Chief Executive Officer, Compliance, Internal Audit and Prevention of AML/CFT functions.
That focus matters for Malta’s online gaming sector. Governance failures rarely sit in one department. They often emerge where strategy, compliance, risk, audit and AML oversight do not connect properly in daily decision-making.
The MGA found that many Authorised Persons have mature governance frameworks. These were supported by active senior leadership, engaged Key Function Holders and increasingly risk-based approaches to governance, compliance, internal audit and AML/CFT oversight.
The review also identified areas where operators can strengthen their arrangements.
Common themes included over-reliance on a small number of senior decision-makers, limited evidence of challenge and impact assessment in strategic decisions, and weaknesses in audit trails.
Those points are important because governance is not only about assigning responsibility on paper. Operators must be able to show how decisions were challenged, why certain risks were accepted and what impact assessments were carried out before significant business changes.
The strongest governance arrangements were marked by active leadership engagement, empowered Key Function Holders, effective collaboration across assurance functions and governance processes embedded into day-to-day operations.
The MGA also highlighted examples of good practice. These included structured escalation procedures, risk-based monitoring programmes, independent assurance functions, governance committees and proactive consideration of regulatory implications when entering new markets or implementing major business changes.
For operators, the message is clear. Key functions need authority, evidence and independence, not only job titles.
A Compliance function must be able to challenge the business when regulatory risk is rising. Internal Audit must provide independent assurance rather than duplicate management oversight. AML/CFT functions must be connected to real risk exposure, not only policy documentation.
The CEO function is equally important. Senior leadership must show active ownership of regulatory outcomes, rather than treating compliance as a purely technical or back-office responsibility.
The review fits into a wider shift in regulatory supervision. The MGA is moving beyond document checks and looking more closely at whether governance structures work in practice.
That means operators should expect more questions about evidence. Regulators want to see meeting records, escalation logs, risk assessments, audit findings, board-level challenge and follow-up actions.
Weak audit trails can create problems even where the underlying decision may have been reasonable. If an operator cannot show how a decision was made, who challenged it and how risks were assessed, its governance framework becomes harder to defend.
The review is also relevant for companies expanding into new markets. The MGA pointed to proactive regulatory assessment before market entry or significant business change as a positive practice.
That is a practical warning for international operators. Growth should be supported by governance capacity, AML/CFT analysis, compliance resources and clear accountability.
The publication is intended to help Authorised Persons assess the effectiveness of their own governance arrangements and identify opportunities for improvement.
It also gives boards and senior management a checklist of practical questions. Are Key Function Holders empowered? Are assurance functions working together? Are decisions properly documented? Are risks challenged before execution? Are governance processes used daily, or only prepared for regulatory review?
The MGA said it remains committed to promoting transparency, consistency and high governance standards across the online gaming sector.
Through ongoing supervisory engagement and outreach, the Authority aims to share regulatory insights, encourage best practice and support Authorised Persons in meeting evolving expectations.
For Malta-licensed operators, the review should be read as more than guidance. It is a signal of where future supervisory attention is likely to remain focused.
Strong governance will increasingly be measured by evidence, independence and impact. Operators that can show active leadership, empowered key functions and clear decision records will be better placed to meet the MGA’s expectations.
