iGaming — MGA data exchange

iGaming (online gaming: sports betting, casino, poker, lotteries) is Malta's signature sector. With roughly 10% of GDP and nearly 300 operators licensed by the MGA (Malta Gaming Authority), the island is the world capital of regulated online gaming. Its peculiarity for our subject: here the structured data flow is not driven by a tax e-invoice (Malta has no mandate) but by regulatory reporting and B2B exchanges between operators, aggregators and studios.

History — from Remote Gaming 2004 to the Gaming Act 2018

Malta seized the online gaming opportunity very early. The Remote Gaming Regulations of 2004 (L.N. 176 of 2004) made it the first EU jurisdiction to license remote gaming in a structured way, attracting a massive operator inflow. The Lotteries and Gaming Authority became the MGA in 2015, then the Gaming Act (Cap. 583) of 2018 overhauled everything around a modern regime: single B2C licence, B2B licence, and a Player Protection Directive.

2000       | Malta Lotteries and Gaming Authority created — the island's
           | first gaming regulatory framework.
           |
2004       | Remote Gaming Regulations (L.N. 176 of 2004): Malta becomes
           | the first EU jurisdiction to license online gaming in a
           | structured way. Massive operator inflow.
           |
2015       | The LGA becomes the Malta Gaming Authority (MGA). Reporting
           | and player protection ramp up.
           |
2018       | Gaming Act (Cap. 583): full overhaul. Single B2C licence +
           | B2B licence, regime built on "gaming services" and "critical
           | gaming supplies". Player Protection Directive.
           |
2018-2023  | Rollout of electronic regulatory reporting: player,
           | transaction and AML/CFT data, Player Reporting System. B2B
           | aggregator <-> operator integrations via API/EDI.
           |
2024-2026  | Malta remains the world capital of iGaming (~10% of GDP).
           | Strengthened AML (FIAU), continuous MGA reporting, B2B
           | exchanges standardised via REST APIs + structured flows.

Governance — MGA + Gaming Act

The MGA regulates the whole sector under the Gaming Act (Cap. 583) and its subsidiary legislation (S.L. 583.x). It distinguishes two main categories: gaming services (B2C licence, player-facing) and critical gaming supplies (B2B licence: game supply, platforms, RNG, aggregation). Each operator is identified by a licence number (e.g. MGA/B2C/123/2018) that serves as the key in all reporting flows. The FIAU (Financial Intelligence Analysis Unit) oversees the anti-money-laundering side (AML/CFT).

Schema — B2C and B2B flows

Two families of flow coexist. On the B2C side, the operator reports player and transaction data to the MGA (KYC, balances, bets, wins, self-exclusion, deposit limits) via the Player Reporting System, and reports suspicious operations to the FIAU. On the B2B side, the operator integrates games from aggregators and studios and pays them a revenue share / royalties based on Gross Gaming Revenue.

Maltese iGaming data architecture
=================================

  [ B2C player ]
       |  deposit / bet / win / withdrawal
       v
  [ MGA-licensed operator (B2C) ]
       |  \
       |   \---> MGA reporting (Player Reporting System): KYC, balances,
       |   |     transactions, self-exclusion, deposit limits.
       |   \---> FIAU (AML/CFT): suspicious transaction reports, thresholds.
       |
       |  integrates games supplied by:
       v
  [ B2B supplier / aggregator (critical gaming supply) ]
       |  game catalogue, certified RNG, session flows,
       |  revenue-share / royalties billing via EDI/API.
       v
  [ Game studio ]

The most representative B2B flow is the monthly revenue statement between operator and game supplier. It aggregates, per title, the number of rounds, bets, wins, GGR and supplier share — a business EDI often carried over REST APIs rather than EDIFACT:

// B2B operator <-> game aggregator exchange (revenue-share)
// Monthly reconciliation message (structured API-style JSON)
{
  "messageType": "GAMING_REVENUE_STATEMENT",
  "period": "2026-05",
  "operatorLicence": "MGA/B2C/123/2018",
  "supplierLicence": "MGA/B2B/456/2018",
  "currency": "EUR",
  "lines": [
    {
      "gameId": "studio-x:book-of-malta",
      "rounds": 184320,
      "totalBets": 921600.00,
      "totalWins": 875520.00,
      "grossGamingRevenue": 46080.00,
      "revenueSharePct": 15.0,
      "supplierAmount": 6912.00,
      "vatCategory": "E"
    }
  ],
  "totalSupplierAmount": 6912.00
}

Comparison — data exchange vs classic e-invoice

Adoption — ~300 licensed operators

• ~300 MGA-licensed operators operate from Malta, from listed giants to niche studios, employing thousands (developers, compliance, payments, support).
• Dense B2B ecosystem: game aggregators, platform providers, payment providers, KYC vendors — each plugged via API/EDI into multiple operators.
• Continuous reporting: the MGA Player Reporting System and FIAU obligations impose regular structured submissions, far more demanding than invoicing.
• Agglomeration effect: the operator concentration creates de facto B2B exchange standards (statement formats, catalogue APIs) specific to the industry.

Common pitfalls

• Applying standard VAT. Many gaming services are exempt (category E). Coding 18% on a GGR statement generates phantom VAT and breaks compliance.
• Confusing GGR with turnover. The B2B billing base is Gross Gaming Revenue (bets − wins), not total bets. An error here multiplies the invoice by an order of magnitude.
• Neglecting AML/CFT. Player transaction flows are subject to the FIAU. A data pipeline that ignores reporting thresholds risks heavy sanctions.
• Badly formatted licence number. The actor key is the MGA number (MGA/B2C/123/2018), not the VAT. Mixing them breaks B2B reconciliation.

Cross-links

• Malta hub — full view
• VAT regimes — iGaming exemption
• Financial services — ISO 20022
• Identifiers — VAT + MBR
• Malta Gaming Authority (MGA)
• Laws of Malta — Gaming Act Cap. 583
• FIAU — Financial Intelligence Analysis Unit