The Malta Gaming Authority's governance review found mature frameworks across many sampled B2B and B2C authorised businesses, but it also identified concentrated decision-making, limited evidence of challenge and impact assessment, and weaknesses in audit trails. The findings were published on 29 July 2026.
This update is for MGA licensees, key function holders, boards, operators and suppliers. It summarises the authority's thematic findings and turns them into testable governance questions. It does not score a named company, infer the confidential sample, or replace the full review and licence requirements.
What the MGA published
The MGA published its governance assurance findings on 29 July 2026. Governance Assurance: Key Functions had been identified as a 2025 supervisory priority within the authority's risk-based, evidence-led and outcomes-focused approach.
The review covered a sample of B2B and B2C authorised persons. It used information from supervisory reviews and meetings to assess whether governance roles operated effectively in practice.
The public summary presents positive and corrective observations together. It is not an announcement that every sampled business failed or that every MGA licensee shares the same weakness.
Which functions were examined
| Role | What it means | Where to verify |
|---|---|---|
| Chief Executive Officer | Does senior leadership own decisions and regulatory impact without concentrating all challenge in one person? | Decision papers, delegated authority, minutes, escalation and accountability. |
| Compliance | Can the function challenge commercial decisions and show how regulatory effects were assessed? | Advice, challenge logs, market-entry reviews, monitoring and closure evidence. |
| Internal audit | Is assurance sufficiently independent and connected to material risks? | Audit plan, scope, findings, management actions and validation. |
| AML/CFT prevention | Does financial-crime governance influence customers, products, payments and markets in practice? | Risk assessment, monitoring, escalations, reports and board oversight. |
The functions overlap, but they should not collapse into one committee or one senior decision-maker. Independence and information sharing have to coexist.
What the MGA viewed positively
The authority said many authorised businesses had mature governance frameworks supported by active senior leadership, engaged key function holders and increasingly risk-based approaches. That finding gives useful context to the weaknesses.
Positive features included structured escalation procedures, risk-based monitoring programmes, independent assurance functions and governance committees. The MGA also highlighted proactive regulatory consideration when entering new markets or making significant business changes.
These examples describe practices the authority observed or endorsed in the thematic review. They are not a certification of any named company and should not be repackaged as an award.
Concentrated decision-making risk
One recurring theme was over-reliance on a limited number of senior decision-makers. Concentration can make a business fast, but it can weaken challenge, continuity and separation of duties when material decisions depend on the same small group.
A governance review should identify which decisions require independent input, who can block or escalate them, and what happens when a key person is absent or conflicted. Delegated authority needs real capability, not only a policy label.
The BETTIMES Malta B2C vs B2B licence guide explains why group and licence roles need precise ownership. A B2B supplier and B2C operator can face different risks even when senior management overlaps.
Evidence of challenge and impact assessment
The MGA identified insufficient evidence of challenge and impact assessment in strategic decisions. A final approval line does not show what compliance asked, what risks were raised, which alternatives were considered or why the business accepted the residual risk.
Material decisions can include entering a new market, launching a product, changing a payment method, acquiring a customer portfolio or altering technical infrastructure. Governance evidence should connect the proposal to legal, AML, player-protection, security and operational impacts.
The BETTIMES licence verification guide can support market-entry evidence, while the regulated market monitor provides a dated source map. Neither replaces management's documented assessment.
Why audit trails matter
An audit trail lets an independent reviewer reconstruct what information existed, who considered it, what challenge occurred, which decision was made and whether follow-up actions closed. The MGA identified weaknesses in these trails across the review themes.
Minutes that record only approved or noted can be insufficient for a high-risk decision. Stronger evidence can include decision papers, source attachments, dissent or challenge, owners, deadlines and a later effectiveness check.
Audit trails also protect good decisions. If a regulator can see the evidence and reasoning, the organisation is less dependent on retrospective explanations from people who may have changed roles.
Independence and collaboration
The authority associated stronger governance with empowered key function holders, effective collaboration across assurance functions and independent assurance. Those goals can pull in different directions if independence is mistaken for isolation.
Compliance, AML, risk and internal audit need access to relevant operational data. At the same time, internal audit should retain enough independence to assess the controls designed and operated by management.
The BETTIMES AML explainer and transaction monitoring guide show how governance connects to operating evidence rather than ending at policy approval.
A practical self-assessment
- List the ten most material regulatory decisions made in the last 12 months.
- Identify who proposed, challenged, approved and independently reviewed each decision.
- Confirm that the record contains source evidence and a documented impact assessment.
- Test whether key function holders could escalate or stop the decision in practice.
- Check that internal audit coverage follows current risks rather than an unchanged annual cycle.
- Trace every action to an owner, due date, closure record and effectiveness review.
- Repeat the exercise for new-market entry and significant business changes.
This turns broad governance language into evidence a board and supervisor can inspect.
What the review does not establish
The public summary does not name the sampled authorised persons or state that the findings apply equally to every MGA licensee. It does not publish a league table or a numerical governance score.
The full MGA thematic review PDF should be used for detailed methodology and examples. BETTIMES does not infer confidential supervisory outcomes that are not in the document.
This article also does not turn good-practice examples into new binding rules. Current licence conditions, directives and supervisory communications remain the controlling sources.
Why the findings matter for suppliers
B2B authorised businesses were within the review scope, so governance is not only a consumer-operator topic. Platform, game, payment and infrastructure decisions can create destination-market, security and financial-crime risk.
The BETTIMES iGaming platform guide and casino game provider guide show how supplier functions interact with operators. Each legal entity still needs its own decision and assurance trail.
The Evolution Malta settlement covered elsewhere on BETTIMES illustrates a separate British enforcement case in which B2B risk assessment and live control effectiveness mattered. It should not be merged with the MGA thematic review or treated as part of its sample.
Frequently asked questions
Did the MGA say licensee governance is poor?
No. The authority said many sampled authorised businesses had mature governance frameworks, active senior leadership and engaged key function holders. It also identified recurring areas for improvement, including concentrated decision-making, insufficient evidence of challenge and impact assessment, and weaknesses in audit trails.
Which businesses were reviewed?
The public summary says the sample included B2B and B2C authorised persons but does not name them. BETTIMES does not infer the confidential sample. The findings are best used as sector-wide self-assessment prompts rather than as evidence that a particular unnamed licensee passed or failed.
Which key functions were in scope?
The review focused on the Chief Executive Officer, Compliance, Internal Audit and Prevention of AML/CFT functions. It examined effectiveness in practice, not only whether appointments existed. Evidence of authority, challenge, escalation, monitoring and independent assurance therefore matters alongside role descriptions.
What is an adequate audit trail?
An adequate trail should let a reviewer reconstruct the information considered, challenge raised, decision taken, accountable owner and follow-up result. The exact evidence depends on the decision, but a bare approval line often lacks regulatory impact, alternatives, residual risk and proof that actions were completed.
What should a board do next?
A board can sample recent material decisions, test whether key function holders were empowered to challenge them, and trace actions through closure and effectiveness review. New-market entry and significant business changes deserve particular attention because the MGA highlighted proactive regulatory consideration in stronger governance arrangements.
The current position
The MGA review gives a balanced message: many governance frameworks are mature, but formal roles are not enough. Licensees need evidence of challenge, impact assessment, independent assurance and follow-through. The most useful response is a reproducible decision-file review, not a new policy document with no operating proof.