Malta's gaming review found too much decision-making concentrated in too few hands

Malta's latest governance review does not say a gaming company becomes unsafe when a small executive team makes decisions. It says over-reliance on a limited number of senior people can weaken challenge, continuity and evidence. The risk appears when knowledge and authority have no credible substitute.

The MGA examined how chief executives, compliance, internal audit and AML/CFT functions worked in practice across a sample of B2B and B2C authorised persons. That cross-section matters because supplier and consumer-facing businesses distribute risk differently.

The authority reports mature frameworks at many businesses, supported by active leadership and engaged key-function holders. It also identifies three recurring concerns: decisions concentrated in too few hands, insufficient records showing challenge and impact assessment, and weak audit trails.

Those weaknesses can coexist with polished governance documents. A board pack may list a decision without recording who questioned it, what regulatory consequence was considered or why an alternative was rejected.

A compliance officer disagreeing in a meeting is useful only if the concern reaches the decision, is evaluated and can later be reconstructed. The MGA's emphasis on challenge and impact assessment turns governance from attendance into an observable process.

This does not mean every disagreement requires a long transcript. It means material decisions need enough record to show the information considered, the objections raised and the owner of follow-up actions.

A thin record makes supervision harder, but it also leaves a licensee unable to explain a reasonable decision after staff change or a market event. Strong trails preserve context, evidence and approvals without depending on one executive's memory.

The same applies to AML/CFT oversight. A risk-based decision may be defensible even when an outcome later looks bad, but only if the original risk, information and control response were documented.

Records also expose repeated exceptions. One urgent approval outside normal governance may be reasonable. Ten similar exceptions can show that the stated process is not the real process. Without dates, owners and reasons, internal audit cannot distinguish an unusual decision from a control that has quietly stopped operating.

The MGA points to structured escalation, risk-based monitoring, independent assurance functions, governance committees and early consideration of regulatory effects when entering markets or making significant changes. These are examples, not automatically a universal checklist.

Their common feature is distribution. Information moves to the right level, challenge can come from outside the decision owner and assurance is not performed solely by the team being reviewed.

That design also creates resilience. A deputy can find the record, a committee can revisit the reasoning and an independent reviewer can test whether the promised control actually operated. The system does not collapse when one senior person leaves or becomes unavailable.

The announcement does not name sampled companies, count the businesses showing each weakness or impose a fine. It cannot support a headline claiming Malta found widespread governance breaches. It supports a narrower sector-level finding about patterns and stronger practice.

Nor does concentration prove misconduct. It describes fragility: what happens when a key person is absent, conflicted, wrong or unwilling to be challenged.

A follow-up review could show whether businesses changed committee structure, delegation and decision records. A named decision could show which themes the MGA treats as a breach rather than an improvement opportunity.

Until then, the useful lesson is practical. Governance is not strong because senior people are experienced. It is strong when the business can question, replace and audit their decisions.