MGA Governance Review Identifies Enhancement Opportunities Across Key Functions in iGaming
TL;DR — The MGA’s 2025 Thematic Review found many authorised persons operate with mature governance but noted over-reliance on few decision-makers, weak audit trails, and limited evidence of strategic challenge. It also disclaimed links to seven sites falsely claiming MGA licensing. The findings offer a practical self-assessment tool for B2B and B2C operators.
SCCG Take — This is a structural signal for client-partners to reduce key-person risk and tighten documentation. Proactive alignment with the MGA’s expectations will limit exposure at a time of heightened supervisory focus.
The Malta Gaming Authority (MGA) has published the findings of its Thematic Review on Governance Assurance – Key Functions. This review was a key supervisory priority for 2025, aligned with the regulator’s risk-based, evidence-led approach to oversight. It examined governance in a sample of B2B and B2C authorised persons, concentrating on the practical effectiveness of the CEO, compliance, internal audit, and AML/CFT prevention functions.
Many authorised persons maintain mature governance frameworks supported by active senior leadership, engaged key function holders, and risk-based methods. The MGA nevertheless identified opportunities for further enhancement, including over-reliance on a limited number of senior decision-makers, insufficient evidence of challenge and impact assessment in strategic decision-making, and weaknesses in audit trails.
Characteristics of Effective Governance Arrangements
The strongest arrangements feature active leadership engagement, empowered key function holders, effective collaboration across assurance functions, and governance processes embedded in day-to-day decision-making. Highlighted good practices include structured escalation procedures, risk-based monitoring programmes, independent assurance functions, governance committees, and proactive consideration of regulatory implications when entering new markets or implementing significant business changes. The MGA anticipates that the review will help authorised persons assess their arrangements, identify improvements, and strengthen oversight and accountability.
The Regulatory Signal for Maltese Licensees
The MGA also denied any connection to several gambling sites it says may be making false claims of holding an MGA licence, listing spinlander.nu, coldfootball.com, wtboxers.com, smartsportsdaily.com, blackjack.com, duelgp.com, and 56pkcasino.com. As reported by Focus Gaming News, this dual communication underscores the regulator’s emphasis on both internal governance and external integrity.
This review marks an inflection point for authorised persons. Client-partners should address the highlighted dependencies and documentation gaps now. In my three decades as a gaming and securities attorney, timely response to such supervisory signals consistently lowers enforcement risk and supports long-term operational stability.
Reporting: Focus Gaming News
Mature frameworks exist, but over-reliance on few leaders and thin audit trails create compliance exposure for MGA licensees.
We work with B2B and B2C operators holding MGA licenses across our 545-partner network. When the regulator publishes a thematic review like this, it's a roadmap—and a warning. Addressing key-person risk and tightening documentation now prevents costly remediation or scrutiny later, especially as supervisory intensity ramps up.
- MGA found over-reliance on limited senior decision-makers and insufficient strategic challenge
- Good practices include structured escalation, risk-based monitoring, and independent assurance functions
- MGA publicly disclaimed seven sites falsely claiming MGA licensing
SCCG angle: We help client-partners use this review as a self-assessment tool: identifying key-person dependencies, strengthening audit trails, and embedding governance in daily operations. Our network includes compliance advisory, governance consultants, and MGA-focused legal counsel who can move fast to close gaps before the regulator does.