Malta
Malta hosts a large share of Europe's iGaming operators and B2B gaming suppliers, together with payment, e-money and investment firms. In both sectors, B2B partners, payment providers and licensing processes increasingly ask for documented security governance. Kellwick provides ISO 27001 implementation and independent internal audits, supplier assurance, DORA readiness for financial entities and fractional security leadership.
Buyers
Local context
Context for scoping, not legal advice. Whether a law applies to you depends on your entity type, sector and size; where a formal legal position is needed we work alongside your counsel.
Gambling is not a sector listed in the NIS2 annexes. What drives security work for gaming companies is licence conditions, payment-provider reviews and B2B due diligence. We do not describe ISO 27001 as a licensing requirement; buyers and licensing processes increasingly ask for the kind of evidence an ISMS produces.
Payment and e-money institutions, investment firms and other entities listed in DORA Article 2 have been subject to DORA since 17 January 2025. Suppliers to them meet DORA mainly through contract terms.
Malta transposed NIS2 by legal notice in 2025, with all provisions in force from January 2026. Applicability depends on sector and size.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.
Services
Delivery
Sectors
Questions
Gambling is not one of the sectors listed in the NIS2 annexes, so being an iGaming operator does not bring a company into scope. A gaming group may still have entities that fall in scope for other reasons - for example as a cloud or managed service provider above the size thresholds.
Yes. Supplier and second-party audits assess a supplier against the security requirements you set them, with a report you can rely on in your own audit or licensing processes.
No. Kellwick delivers remotely and arranges onsite days per engagement. Engagements are contracted with Sodasoft LLC.
The standards, the sites and the deadline are enough to start. A specialist replies within one business day and confirms whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.