Malta Gaming Authority (MGA) key functions identify approved people responsible for important work inside a licensee; reporting duties attach to the authorised business and its activities. A compliance manager can coordinate a return, but that does not make every report “the compliance function's report.” Build a matrix that separates the legal duty, data owner, preparer, reviewer, approver and filing evidence for each submission.
This guide is for MGA B2C and B2B licensees, their boards and control teams. It is an editorial operating template, not an official MGA allocation of tasks or legal advice. Apply the current licence conditions, portal instructions and individual facts of the business.
What is a Key Function under the MGA framework?
The MGA Key Functions page describes them as important roles or tasks carried out in connection with a gaming service or gaming supply. The Authority requires prior approval and a Key Function certificate. The person must have enough knowledge, understanding and access to the licensee's operations, and the MGA assesses integrity, reputation, competence and capability.
This is an individual-authorisation layer, not a substitute for the company's gaming licence. The MGA B2C page and B2B Critical Gaming Supply page describe different licensed activities. The BETTIMES MGA B2B guide explains which game and back-office supplies enter the critical category.
| Key Function on the MGA's published page | Operational domain to map | Boundary to preserve |
|---|---|---|
| CEO / equivalent | Business model, governance and overall operations | Board and company obligations do not disappear because a key person is approved |
| Management of Operations | Payment, risk and fraud procedures, operational delivery | Payment execution and financial-report sign-off may involve separate owners |
| Compliance | Gaming Act and binding-instrument obligations, responsible gaming and advertising | Not automatically the preparer of every financial or technical report |
| Legal Affairs | Contracts, disputes and legal matters | Does not replace product, account or ledger evidence owners |
| Data Protection Officer | Data-protection policies and procedures | Privacy compliance is not identical to gambling-regulator reporting |
| Money Laundering Reporting Officer | AML/CFT controls and escalation | Should not be reduced to an ordinary customer-support role |
| Technological Affairs | Systems, infrastructure and technical setup | A supplier can operate a system, but the licensee needs an accountable internal view |
| Internal Audit | Independent review of applicable requirements | Independence and role conflicts must be assessed before combining appointments |
These are editorial descriptions drawn from the MGA's eligibility requirements, not a statutory RACI issued by the Authority. The same page links to a Key Functions Conflict Matrix; consult it before adding an involvement. BETTIMES' earlier MGA governance review gives background on governance changes, while this article focuses on operational reporting.
The reporting matrix: duty first, people second
The MGA Reporting Requirements page is the starting point for the obligation register. For every line below, the company should record whether it applies, the portal submission path, internal cutoff, evidence owner and named backup. The “likely working team” column is an editorial allocation example, not an MGA mandate.
| Submission or event | MGA-published applicability or timing | Likely working team to verify internally |
|---|---|---|
| B2B Compliance Report | Monthly for B2B licensees; due by the 20th day of the following month; identifies B2B/B2C clients and relationship type | Commercial operations + compliance + client-contract owner |
| Gaming Tax Report | Monthly; reporting page says by the 20th day of the following month | Finance + tax + gaming-ledger owner |
| Player Funds Report | All B2Cs and B2Bs managing pooled jackpots, including pre-live; by the 20th day of the following month | Finance + payments + wallet/reconciliation owner |
| ADR Report | Monthly reporting page, with provider, dispute detail and ruling | Customer operations + legal/compliance |
| Industry Performance Return | All licensees, twice yearly; 7 September for January–June, 28 February for July–December | Finance + data + operations |
| Interim and annual financial reports | Within two months of the relevant half-year or full financial year | Finance + board reviewer |
| Audited financial statements | Within six months of financial year end | Finance + external auditor + directors |
| Auditor player-funds and gaming-revenue declarations | Annual, within nine months of financial year end; applicability differs by B2C remote/land-based scope | Finance + auditor + payments/revenue ledger owner |
| Information-security incident | Certain player-data breaches or account unavailability exceeding 12 hours: within 72 hours via portal | Technology + security + compliance/legal |
| Material outsourcing arrangement | Reported case by case through the portal | Procurement + legal + compliance + technical owner |
The table is a dated reading of the current MGA page, not a universal calendar for every licensee. For example, the MGA says the Player Funds Report applies to all B2Cs and to B2Bs managing pooled jackpots, and the auditor declarations have distinct remote and land-based B2C applicability. Before operational use, compare the portal form, the licence's activities and the latest MGA notice.
Three reporting boundaries that are easy to miss
Client relationships are not just a list of company names
For the monthly B2B Compliance Report, the MGA specifies five relationship types, including directly supplied games, aggregated third-party games and back-office/control-system supply to B2C or B2B clients. A single client name does not explain which regulated service is supplied. Keep the contract, game or platform scope, effective dates and report classification together. This makes a change in product or client relationship visible before filing.
Player-funds reporting needs ledger and external evidence
The MGA says the monthly Player Funds Report includes month-end player funds, open bets, pending withdrawals, jackpot funds and designated bank or PSP account balances. It also asks for supporting evidence, such as back-end screenshots and bank or PSP statements, to assess surplus or shortfall. A dashboard total without the reconciliation trail is therefore insufficient. The BETTIMES PAM explainer shows why account and wallet records need to be connected.
Incident time starts before the next reporting cycle
The MGA reporting page describes a 72-hour portal report for specified information-security incidents. It includes a breach adversely affecting confidentiality of player information and an incident preventing player account access for more than 12 hours. These are event-driven, not monthly returns. The internal process needs detection, classification, decision and evidence retention before the filing window closes.
Build a usable RACI and filing evidence pack
The following fields turn the table into a working register:
- Obligation: exact MGA source page, licence condition or portal instruction, with verification date.
- Scope: B2C/B2B, game type, remote/land-based and whether the business is live.
- Accountable entity and approver: legal licensee and named internal decision-maker.
- Data owners: wallet, game, finance, payment, supplier, complaints or security systems that create the evidence.
- Preparer and reviewer: people who compile and challenge the numbers or narrative.
- Submission route: portal application name, delegated access, confirmation receipt and escalation backup.
- Cadence: regulatory deadline, earlier internal deadline and trigger for a change or incident.
- Audit trail: source extract, reconciliation, exceptions, approval, submitted version and MGA acknowledgement.
Test the matrix with an absence scenario. If the primary Key Function holder is unavailable on the 19th day of a monthly cycle, can the authorised backup access the evidence, review it and file on time? If not, the matrix is a chart rather than an operating control.
Appointments and changes need their own control
The MGA application page describes a Personal Declaration Form and a company approval step for a new involvement. It also says an individual ceasing an approved role must be notified and links to the conflict matrix for additional roles. Do not treat a spreadsheet change as sufficient evidence that an appointment or termination has been approved and recorded by the Authority.
The MGA's Prior Approval Requirements page separately identifies changes to games, verticals, essential components and channels. That is another reason to keep a change register next to the reporting calendar: not every regulatory event arrives on a month-end schedule.
Frequently asked questions
Are MGA Key Functions the same as the company's reporting obligations?
No. A Key Function is an approved person carrying out an important role; a reporting obligation is imposed on a licensee according to its authorised activities and the applicable rules. A key person may coordinate a submission, but the company still needs data owners, review, approvals and proof of filing.
Does every MGA B2B licensee file a Player Funds Report?
The MGA's current reporting page says the monthly Player Funds Report is submitted by all B2Cs and by B2Bs managing pooled jackpots. That wording should not be flattened into “all B2Bs”. Verify the licence's actual scope, any pooled-jackpot operation and the current portal instructions before marking the obligation applicable or inapplicable.
When is the B2B Compliance Report due?
The MGA's published reporting page states that a B2B licensee submits the report monthly, no later than the 20th day of the following month. The report identifies client companies and the relationship type for the licensable supply. Set an earlier internal cutoff so contracts and technical scope can be checked before submission.
Can one person hold several MGA Key Functions?
Possibly, but do not assume every combination is allowed or practical. The MGA directs applicants to its Key Functions Conflict Matrix before adding another involvement. It also highlights time-commitment documentation for some multiple AML/CFT roles. Check conflicts, capacity, fit-and-proper requirements and the actual approval status before assigning a second role.
Is a 72-hour security notice the same as the next monthly report?
No. The MGA lists an event-driven 72-hour portal report for specified security incidents, including adverse confidentiality impact to player information or account inaccessibility beyond 12 hours. Monthly tax, B2B and player-funds reports run on their own cycles. An incident workflow needs a separate trigger, owner and escalation route.
Source and review note
Primary MGA sources reviewed on 23 September 2026: Key Functions page and linked eligibility/conflict materials; B2C and B2B licensing descriptions; Reporting Requirements; Prior Approval Requirements. The working-team and RACI columns are BETTIMES editorial examples. Confirm current MGA portal forms, licence scope and any newer binding instrument before implementation.
Editorial conclusion: one matrix should show the legal duty; a second view should show who produces, reviews and submits the evidence. Keeping those views separate makes gaps, role conflicts and missed deadlines easier to detect.