The Malta Gaming Authority (MGA) has released findings from its thematic review examining governance assurance practices and the role of key function holders across licensed operators. The review, which scrutinised how licensees structure internal governance and assign critical responsibilities, arrives at a moment when regulatory expectations around corporate accountability in iGaming are tightening across Europe. Its conclusions carry direct implications for how operators staff, oversee, and document their compliance frameworks.
What the MGA’s Governance Review Signals for Operators
Before diving into the specifics, it helps to frame why this review matters beyond Malta’s borders. The MGA remains one of the most widely referenced licensing authorities in online gambling, and its regulatory posture often sets a benchmark that other jurisdictions watch closely. The findings here aren’t just compliance housekeeping; they reflect a broader shift toward holding individuals, not just corporate entities, accountable for regulatory adherence.
- The review assessed whether licensees have adequate governance structures in place to ensure that key function holders are properly appointed, qualified, and empowered to fulfil their roles
- Operators that treat key function appointments as box-ticking exercises rather than substantive governance mechanisms face heightened regulatory scrutiny
- The MGA identified gaps in how some licensees document the responsibilities and decision-making authority of individuals in critical compliance and risk management positions
- Succession planning and contingency arrangements for key function holders emerged as a weak spot across multiple licensees
- The findings reinforce the MGA’s trajectory toward more granular, individual-level accountability in its supervisory approach
Governance Gaps the Review Exposed
At the heart of the thematic review sits a straightforward question: are the people responsible for compliance, anti-money laundering, and risk management actually equipped to do their jobs? The MGA found that while most operators had formal appointments on paper, the substance behind those appointments varied considerably. Some key function holders lacked clear mandates. Others held multiple roles simultaneously, raising questions about bandwidth and potential conflicts of interest (a distinction regulators have been slow to enforce uniformly across the sector).
Documentation proved another friction point. The authority noted instances where the delineation of responsibilities between key function holders and senior management was ambiguous, making it difficult to establish who bore accountability when things went wrong. In practice, this ambiguity can shield poor decision-making from regulatory consequence.
And while the MGA stopped short of naming specific licensees, the tone of the findings suggests these aren’t edge cases.
Why Individual Accountability Is Gaining Regulatory Traction
The shift toward personal accountability in gambling regulation mirrors developments in financial services, where regimes like the UK’s Senior Managers and Certification Regime have made individual responsibility a cornerstone of supervisory enforcement. The MGA’s review fits this pattern. Rather than relying solely on entity-level sanctions, regulators increasingly want to know which person failed, not just which company.
This matters for operators structuring their teams across multiple jurisdictions. A key function holder licensed under the Malta Gaming Authority’s framework may also carry responsibilities under other regulatory regimes, and the governance expectations don’t always align neatly. Operators that haven’t mapped these overlaps are arguably building compliance risk into their own org charts.
Practical Implications for Licensees
| Area of Concern | MGA Expectation | Common Shortfall |
|---|---|---|
| Key Function Appointments | Formal, documented, with clear authority | Appointments treated as formalities without substantive mandates |
| Segregation of Duties | No conflicting dual roles without mitigation | Individuals holding compliance and commercial roles simultaneously |
| Succession Planning | Contingency arrangements documented and tested | No succession plan in place for critical governance positions |
| Reporting Lines | Direct access to board or senior management | Key function holders reporting through intermediaries, diluting oversight |
Reframing Compliance as Organisational Design
One dimension that often gets overlooked in discussions about regulatory governance is how deeply these requirements intersect with organisational psychology. Compliance isn’t purely a legal architecture problem. It’s a behavioural one. When key function holders lack genuine authority or operate under ambiguous mandates, the result isn’t just a regulatory gap on paper. It shapes how teams make decisions under pressure, how information flows upward, and whether bad news reaches the people who need to hear it.
Operators that approach governance through a purely procedural lens tend to build structures that look robust from the outside but fracture under stress. The MGA’s findings implicitly point to this. Effective governance requires more than appointing someone to a role; it requires creating conditions where that person can challenge senior leadership, escalate concerns without career risk, and access the information they need without gatekeeping. These are cultural variables, not just regulatory ones.
Still, culture is notoriously difficult to regulate. What the MGA can do, and appears to be doing, is raise the bar on the structural prerequisites. Clear mandates, documented authority, segregated duties, and succession plans don’t guarantee good governance. But their absence almost guarantees the opposite. The operators that internalise this distinction, treating governance design as a strategic investment rather than a compliance cost, will find themselves better positioned not just with the MGA but across an increasingly demanding regulatory landscape.
Frequently Asked Questions
What is a key function holder under MGA regulations?
A key function holder is an individual designated by a licensed operator to bear responsibility for a critical area of the business, such as compliance, anti-money laundering, or risk management. The MGA requires these individuals to be formally appointed, properly qualified, and granted sufficient authority to carry out their duties independently.
Does this review result in enforcement action?
Thematic reviews are supervisory tools rather than enforcement proceedings. They identify systemic trends and set expectations. That said, operators that fail to address the gaps highlighted may face closer scrutiny during subsequent inspections, and persistent non-compliance could escalate.
How does this affect operators licensed outside Malta?
Directly, it doesn’t. But the MGA’s approach often influences regulatory thinking elsewhere. Operators holding multiple licences should assess whether their governance structures meet the highest common standard across all jurisdictions where they operate, not just the minimum in each one.
