## 1mltea2019004

## Source details

**Canonical URL:** [1mltea2019004](https://www.imf.org/-/media/files/publications/cr/2019/1mltea2019004.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2019/1mltea2019004.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2019/1mltea2019004.pdf.json)

---

### EXECUTIVE SUMMARY
- Scope: Technical Note (TN) summarizes FSAP findings and recommendations on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) for the Republic of Malta, based on a targeted review focusing on the banking sector. A full assessment against the current FATF standard was conducted by MONEYVAL in 2018; the Mutual Evaluation Report was published in July 2019.
- Overall finding: Significant legislative and institutional steps since the March 2012 MONEYVAL mutual evaluation, but overall effectiveness of the AML/CFT framework is still lacking.
- Key risk drivers identified by authorities: foreign proceeds of corruption, tax evasion, and fraud.
- Major implementation gaps:
  - Limited understanding and use of the risk-based approach by all concerned agencies and reporting entities; NRA results were not shared among all concerned agencies and did not comprehensively assess cross-border flows and cross-sectoral interconnectedness.
  - Weak operational cooperation among relevant agencies, including AML/CFT supervisors and law enforcement.
  - Banks’ implementation of preventive measures needs improvement, especially verification of beneficial ownership (BO) information, risk-sensitive ongoing monitoring of accounts, enhanced/specific measures for new technologies (e.g., virtual assets, remote gaming), and source of funds checks for the Individual Investor Program (IIP).
  - Weak compliance with enhanced due diligence for domestic and foreign politically exposed persons (PEPs), and with suspicious transaction reporting.
  - Deficiencies in AML/CFT supervision by the FIAU and MFSA: recent violations raise doubts about capacity to effectively identify and address compliance breaches; low number of sanctions and delays in sanctioning (notably Pilatus Bank) demonstrate weaknesses in the sanction regime and the absence of an EU-wide supervisory framework.
  - Registry of Companies Agency (ROC) collects BO information without proper verification, negatively impacting accuracy and credibility of BO registers.
- Policy direction: A multi-prong strategy focusing on stronger enforcement, stricter AML/CFT supervision, improved banks’ preventive measures, and consideration of a European-level AML/CFT supervisory arrangement.

### PROGRESS SINCE THE LAST ASSESSMENT
- 2012 MER findings: shortcomings including lack of convictions for ML of legal persons, low volume of confiscations, weak preventive measures for PEPs, low STRs by DNFBPs, and low numbers of sanctions on reporting entities.
- Reforms and actions since 2012:
  - Improvements to AML/CFT legislation and transposition of EU directives and regulations.
  - Conducted initial NRA in 2013–14; revised NRA in 2017.
  - Development of national AML/CFT strategy and a detailed action plan with more than 50 detailed action points.
  - Establishment of an AML/CFT National Coordinating Committee.
  - Increased resources for FIAU and MFSA, though not fully matching increased demands on financial intelligence and supervision.
- Assessment status: Malta was to be assessed against the prevailing FATF standard; MONEYVAL assessment ongoing (MER published July 2019).

### ML/TF RISK OVERVIEW AND SECTORAL VULNERABILITIES
- Structural risk drivers:
  - Malta’s open economy, large and well interconnected financial sector relative to GDP, and exposure to non-resident account holders create significant ML/TF risks.
  - Most illegal proceeds laundered in or through Malta’s financial sector and broader economy are generated from predicate offenses committed abroad; Malta is particularly vulnerable to foreign proceeds of corruption, tax evasion, and fraud transiting through Malta into Europe.
- Sectors and products of concern:
  - Banking sector, real estate, remote gaming, virtual assets, and the IIP (Individual Investor Program).
  - Real estate perceived to be used to launder illicit proceeds (including in cash) from areas of high risk (e.g., Italy and Libya).
  - Remote gaming: controls at low level; residual risks remain high; majority of transactions happen outside Malta limiting supervisor’s reach; Maltese banks lack strong understanding of industry operations and risks.
  - IIP: introduced in 2014; allows foreign individuals to acquire European citizenship in exchange for significant fees and investments; applicants could use illegal proceeds to pay contributions and launder funds via meeting investment criteria; NRA does not analyze IIP risks.
- TF and proliferation financing:
  - Understanding of TF and proliferation financing risks is generally poor.
  - NRA concluded TF risk is medium-high but did not base this on TF threat analysis; TF risks could be associated with migrants from conflict zones and transit of funds used for TF through Malta.

### RISK ASSESSMENT FRAMEWORK AND NRA ISSUES
- NRA 2017 characteristics and gaps:
  - Updated in 2017, based on a limited range of data and sectors; results were neither published nor communicated to all key authorities and the private sector.
  - Relied mostly on STRs, investigations, international cooperation requests, trade, and limited financial flows data; did not comprehensively assess foreign/cross-border flows or cross-sector interconnectedness.
  - Focused on detected cases; did not rely sufficiently on typology studies, CBRs, transportation of cash, or financial soundness data.
  - Lacked quantitative or measurable estimates of proceeds of crime laundered through and in Malta.
  - Noted threat from foreign proceeds of crime as high and listed country groupings by risk level, but basis for country-level risk assignments unclear.
- Institutional coordination:
  - National AML/CFT Strategy (April 2018) and prioritized action plan published; National Coordinating Committee established but secretariat under-resourced.
  - Operational coordination among AML/CFT supervisors (FIAU and MFSA) and between FIAU and law enforcement remains weak.
  - Post-September 2018: MoU between FIAU and MFSA was upgraded and joint supervisory procedures adopted.

### PREVENTIVE MEASURES IN BANKS — BENEFICIAL OWNERSHIP, PEPS, AND REPORTING OF SUSPICIOUS TRANSACTIONS
- Beneficial ownership (BO)
  - Main risks: non-resident customers, new technologies (virtual assets, remote gaming), and investments from the IIP.
  - Banks’ verification of BO information needs strengthening; unclear if banks properly identify and verify BO of Maltese companies with non-resident BOs or customers outside Malta.
  - Implementation of key preventive measures, including BO identification and verification, appears inadequate.
  - Pilatus Bank exposed serious shortfalls in CDD implementation.
  - Banks lack consistency in verifying BO through complex ownership chains and sometimes over-rely on introducers.
  - Ongoing monitoring regarding BO and non-resident clients, opaque companies, PEPs, new technologies, and source of funds from the IIP is weak.
- Politically Exposed Persons (PEPs)
  - Laundering of proceeds of domestic and foreign corruption is a main risk for Maltese banks.
  - PEP legal requirements align with international standards, but implementation effectiveness is uneven.
  - Gaps in verification and ongoing monitoring of PEPs, family members, and close associates; low numbers of PEPs identified by some banks may reflect weak identification capacity.
  - Some banks do not establish source of wealth for foreign PEPs.
- Suspicious Transaction Reports (STRs)
  - Half of STRs received by the FIAU are filed by banks; primarily related to ML activities, but reporting overall is relatively low.
  - STR numbers increased over the last five years and quality has improved; FIAU disseminates financial intelligence reports to law enforcement.
  - FIAU provides feedback on STR quality since 2014; further guidance on typologies is needed.
  - Recent leaks of financial analysis reports (including STR information) could have discouraged reporting.
- Key STR statistics (Table 2)
  - 2013: 66
  - 2014: 112
  - 2015: 136
  - 2016: 344
  - 2017: 398
  - Note: In 2017, 51.2 percent of total reports received from reporting entities were received from banks.

### AML/CFT SUPERVISION OF BANKS — RISK-BASED APPROACH AND SANCTIONS
- Supervisory capacity and practice
  - FIAU and MFSA implemented milestones since mid-2017, but recent violations expose weaknesses in identifying and addressing AML/CFT breaches.
  - Pilatus Bank case highlights failure of domestic supervisors to respond to emerging problems and limitations arising from absence of a common EU-wide AML/CFT supervision framework.
- Risk-based supervision improvements needed (NT = Near Term)
  - Devote more resources to AML/CFT risk-based supervision of banks.
  - Increase the number of onsite AML/CFT compliance examinations of banks.
  - Make AML/CFT compliance examinations broader in scope, longer in duration, and more intrusive.
  - Shorten turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision.
  - Strengthen internal controls to ensure confidentiality and prevent leakage of supervision reports.
- Onsite supervision: frequency, scope, timeliness
  - FIAU and MFSA conduct a low number of onsite AML/CFT reviews (two to three a year) of 21 banks in Malta.
  - Number of onsite reviews: five in 2017, three in 2016, three in 2015 (conducted solely by MFSA or jointly).
  - The five largest banks by assets have not been inspected since 2015.
  - Typical onsite examination limited to a couple of days; recent methodology led to two latest onsite examinations lasting five months and being more comprehensive.
  - Delays in finalizing reports: up to 1.5 years in some cases from end of onsite to final report.
- Sanctions: practices and issues
  - FIAU administrative sanctions imposed: none in 2015, three in 2016, one in 2017.
  - Sanctions low and not dissuasive (e.g., average € 30,000 cited); examples: €40,000 against HSBC, €20,000 against BoV.
  - FIAU cannot withdraw a bank license for egregious violations.
  - Sanctions often challenged and imposed after long delay.
  - Selected penalty table (as presented):
    - November 3, 2017 — Penalty: €38,750 — Failure to establish source of wealth, scrutinize a transaction and submit a suspicious transaction report.
    - December 6, 2016 — Penalty: €20,000 — Failure to establish source of funds.
    - September 28, 2016 — Penalty: €4,000 — Failure to establish source of wealth and source of funds and make a suspicious transaction report.
    - January 7, 2016 — Penalty: €40,000 — Failure to adequately scrutinize transactions on an ongoing basis; failure to establish source of funds of a PEP client and conduct enhanced ongoing monitoring.
  - MFSA has imposed a limited number of sanctions and no sanctions on grounds of weak AML/CFT internal controls; regulatory responses often delayed (up to three years from concluding an onsite inspection).
- EBA investigation (Pilatus Bank)
  - July 2018: EBA found FIAU breached Union laws in the Pilatus Bank case and issued recommendations.
  - EBA findings: FIAU failed to ensure one credit institution put in place adequate and appropriate AML/CFT policies and procedures as required under Article 34 of AMLD3; FIAU neither imposed effective, proportionate and dissuasive sanctions nor other supervisory measures to correct deficiencies.
  - EBA noted findings revealed a general practice of the FIAU; EBA did not open a breach of Union law investigation into the MFSA but expressed significant concerns about MFSA actions in some areas.
  - FIAU’s Action Plan was judged insufficient by the EBA to resolve deficiencies.

### TRANSPARENCY AND BENEFICIAL OWNERSHIP OF LEGAL PERSONS IN MALTA
- Legal framework and registers
  - Malta established registers of BO information for companies and trusts and adopted a new legal framework on BO information.
  - December 2017: Companies Act (Register of Beneficial Owners) and The Trusts and Trustees Act (Register of Beneficial Owners) Regulations issued to transpose 4AMLD provisions.
  - Regulations entered into force on January 1, 2018, except article 7 of the Companies Act Regulations (access to the register of beneficial owners), which came into force on April 1, 2018.
  - Since January 1, 2018, incorporation of a company in Malta requires BO information to be provided to the ROC: name, date of birth, nationality, country of residence, official identification document number indicating type and country of issue, and nature and extent of the beneficial interest held.
  - Companies formed before regulation in force must send a BO report on the anniversary of registration falling due after July 1 or where there is any change after July 1, whichever is earlier; the register of BO should have BO information regarding all obliged companies and partnerships by August 2019 at the latest.
- Availability and reliability of basic company information
  - ROC collects and updates basic company information and maintains a public online website.
  - Basic items collected: Company name, legal status, address of registered office, basic regulating powers, names, addresses and official identification document numbers of all shareholders, partners, directors and company secretaries.
  - Memorandums of association and deeds of partnership are available online for a small fee.
  - Concerns exist about accuracy as many inactive companies do not update basic information.
- Gaps, exemptions, and verification limitations
  - ROC collects BO information without verifying accuracy; ROC considers it has sufficient legal powers to verify but lacks sufficient resources in practice.
  - Exemptions: reporting requirements do not apply to listed companies and to companies where all registered shareholders are natural persons; this exemption may not account for control by third parties.
  - Three avenues to obtain BO information for competent authorities: (i) financial institutions and DNFBPs; (ii) the legal entity itself; and (iii) the register of BO.
  - Given uneven compliance across sectors, resourcing and capacity development for the ROC to conduct verification is key.
- Access to BO information
  - Designated AML/CFT authorities (including tax authorities) and reporting entities defined in PMLFTR can access BO information held by the ROC.
  - Any person or organization that can satisfactorily demonstrate and justify a legitimate interest can access name, month and year of birth, nationality, country of residence, and extent and nature of beneficial interest of beneficial owners.
  - Law enforcement and supervisors rely heavily on BO information collected by banks and TCSPs, but quality concerns persist.
- Types and numbers of legal entities and TCSP sector
  - Number of legal entities registered in Malta increased from 37,050 in 2007 to over 51,000 in early 2018, including 1,284 partnerships.
  - Maltese authorities estimate approximately 48 000 of these companies are currently active.
  - Approximately half of all companies incorporated in Malta have at least one non-resident shareholder.
  - Number of legal entities beneficially owned or controlled by non-residents is unknown.
  - Trustees licensed in Malta administered 3,529 trusts as of August 31, 2018.
  - Malta has 186 legal and natural persons registered as Company Service Providers (CSPs).
  - Malta has 171 persons licensed as trustees.
  - Around 20 percent of the companies hold shares on a mandate/fiduciary basis with CSPs.
  - Only about five percent of companies are registered without the use of an intermediary.
- Trusts coverage
  - Authorities indicated the register by the end of 2019 will cover all trusts, not only those generating tax consequences, as a result of implementing the Fifth Anti-Money Laundering Directive.

### MAIN FSAP RECOMMENDATIONS FOR AML/CFT (SUMMARIZED AND PRIORITIZED)
- Assessing and Understanding ML/TF Risks, and National Coordination
  - i. Improve the relevant authorities’ assessment and understanding of ML/TF risks, particularly those related to the banking sector and interconnected sectors (e.g., real estate, remote gaming, virtual assets, IIP). Priority: NT
  - ii. Enhance operational coordination and cooperation among relevant agencies, including AML/CFT supervisors and law enforcement agencies. Priority: MT
- AML/CFT Preventive Measures for Banks
  - Improve banks’ understanding of ML/TF risks. Priority: NT
  - Enhance banks’ compliance in applying CDD including BO information and ongoing monitoring commensurate with their risks, including by applying enhanced or specific measures for new technologies (e.g., virtual assets, remote gaming), and source of funds for the IIP. Priority: NT
  - Enhance banks’ compliance in applying enhanced measures for domestic and foreign PEPs, their family members, and close associates. Priority: NT
  - Provide guidance on typologies and timely feedback to banks to increase the quantity and improve the quality of STRs in line with ML/TF risks. Priority: MT
- AML/CFT Supervision
  - Enhance implementation of licensing controls (fit and proper tests) of banks to prevent criminals and their associates from holding or being a beneficial owner of a significant or controlling interest or holding management function. Priority: NT
  - Improve FIAU and MFSA identification and understanding of ML/TF risks and develop further risk-based approach tools for offsite and onsite supervision, with focus on high-risk clients (including non-resident depositors and opaque companies). Priority: NT
  - Ensure effective application of a broad range of sanctions against banks that are dissuasive and proportionate; specific near-term actions listed in the report. Priority: NT
  - Support establishing a European-level AML/CFT supervisory arrangement. Priority: MT
- Entity Transparency and Availability of BO Information
  - Improve the accuracy of BO information of legal persons by requiring and adequately resourcing the ROC to verify BO information submitted to it. Priority: NT
  - Ensure robust implementation of sanctions against persons who do not comply with (basic and BO) information requirements. Priority: MT

### CONCLUSIONS AND POLICY DIRECTIONS (NUMBERED CONCLUSIONS FROM SOURCE)
- 42. The MFSA should enhance implementation of licensing controls (i.e., fit and proper tests) to prevent criminals and their associates from holding or being a BO of a significant or controlling interest or holding management function in a bank.
- 43. The FIAU and MFSA should improve their identification and understanding of ML/TF risks. The results of NRA should be shared with banks. Supervision should be risk-sensitive and focus on high-risk clients, including non-resident clients, and opaque companies, BO requirements, PEPs, and new technologies.
- 44. The FIAU and MFSA should increase their resources to develop further risk-based tools for offsite monitoring and onsite AML/CFT supervision and ensure timely delivery and confidentiality of inspection reports. More precisely, they should:
  - (i) devote more resources to fully implement a risk-based approach for supervision of banks;
  - (ii) significantly increase the number of onsite AML/CFT compliance examinations of banks;
  - (iii) implement the revised methodology to deepen the scope of the AML/CFT compliance examinations for banks;
  - (iii) shorten the turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision;
  - (iv) strengthen internal controls to ensure confidentiality and prevent leakage of supervision reports.
- 45. The FIAU and the MFSA should impose a broad range of sanctions against banks that are dissuasive and proportionate to the severity of the AML/CFT violations. More precisely:
  - FIAU should shorten the period between detection of violations and imposition of sanctions and make more use of monetary fines as part of the sanctioning regime for banks and increase the amount of penalties for breaches of AML/CFT requirements.
  - Time-bound remedial action plans should be imposed at a minimum in a systematic fashion when findings are made by onsite examiners.
  - MFSA and FIAU should shorten the turnaround time from the final report to imposition of remedial actions and sanctions.
- 46. Establishing a regional AML/CFT supervisory arrangement could enhance convergence of supervisory practices and minimize regulatory arbitrage. An euro area (or EU) level AML/CFT supervisory arrangement should be considered as a more comprehensive solution.

*This technical note reflects findings and discussions during the September 2018 FSAP mission and is prepared as part of the Financial Sector Assessment Program.*

### 2018. Further information on the FSAP program can be

### MALTA

### EXECUTIVE SUMMARY
- Scope: Technical Note (TN) summarizes FSAP findings and recommendations on Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) for the Republic of Malta, based on a targeted review focusing on the banking sector. A full assessment against the current FATF standard was conducted by MONEYVAL in 2018; the Mutual Evaluation Report was published in July 2019.
- Overall finding: Significant legislative and institutional steps since the March 2012 MONEYVAL mutual evaluation, but overall effectiveness of the AML/CFT framework is still lacking.
- Key risk drivers identified by authorities: foreign proceeds of corruption, tax evasion, and fraud.
- Major implementation gaps:
  - Limited understanding and use of the risk-based approach by all concerned agencies and reporting entities; NRA results were not shared among all concerned agencies and did not comprehensively assess cross-border flows and cross-sectoral interconnectedness.
  - Weak operational cooperation among relevant agencies, including AML/CFT supervisors and law enforcement.
  - Banks’ implementation of preventive measures needs improvement, especially verification of beneficial ownership (BO) information, risk-sensitive ongoing monitoring of accounts, enhanced/specific measures for new technologies (e.g., virtual assets, remote gaming), and source of funds checks for the Individual Investor Program (IIP).
  - Weak compliance with enhanced due diligence for domestic and foreign politically exposed persons (PEPs), and with suspicious transaction reporting.
  - Deficiencies in AML/CFT supervision by the FIAU and MFSA: recent violations raise doubts about capacity to effectively identify and address compliance breaches; low number of sanctions and delays in sanctioning (notably Pilatus Bank) demonstrate weaknesses in the sanction regime and the absence of an EU-wide supervisory framework.
  - Registry of Companies Agency (ROC) collects BO information without proper verification, negatively impacting accuracy and credibility of BO registers.
- Policy direction: A multi-prong strategy focusing on stronger enforcement, stricter AML/CFT supervision, improved banks’ preventive measures, and consideration of a European-level AML/CFT supervisory arrangement.

### PROGRESS SINCE THE LAST ASSESSMENT
- 2012 MER findings: shortcomings including lack of convictions for ML of legal persons, low volume of confiscations, weak preventive measures for PEPs, low STRs by DNFBPs, and low numbers of sanctions on reporting entities.
- Reforms and actions since 2012:
  - Improvements to AML/CFT legislation and transposition of EU directives and regulations.
  - Conducted initial NRA in 2013–14; revised NRA in 2017.
  - Development of national AML/CFT strategy and a detailed action plan with more than 50 detailed action points.
  - Establishment of an AML/CFT National Coordinating Committee.
  - Increased resources for FIAU and MFSA, though not fully matching increased demands on financial intelligence and supervision.
- Assessment status: Malta was to be assessed against the prevailing FATF standard; MONEYVAL assessment ongoing (MER published July 2019).

### ASSESSING AND UNDERSTANDING ML/TF RISKS
- Findings:
  - Some authorities have a good understanding of ML/TF threats and vulnerabilities, but overall understanding is limited by reliance on the recent NRA and insufficient assessment of foreign and cross-border flows of criminal proceeds.
  - The NRA did not comprehensively assess risks related to foreign and cross-border flows or cross-sector interconnectedness; this could understate criminal proceeds in other sectors (e.g., remote gaming, virtual assets).
  - Policy coordination was initiated via the National Coordinating Committee, but operational cooperation among agencies remains weak.
- Implication: Improved risk assessment (including cross-border and cross-sectoral analysis) and wider sharing of NRA results are required to better inform risk-based supervision and reporting.

### PREVENTIVE MEASURES IN BANKS — BENEFICIAL OWNERSHIP, PEPS, AND REPORTING OF SUSPICIOUS TRANSACTIONS
- Beneficial ownership (BO):
  - Banks’ verification of BO information needs strengthening.
  - ROC collects BO information without adequate verification, affecting registry accuracy and credibility.
- Politically Exposed Persons (PEPs):
  - Compliance needs improvement for enhanced due diligence measures for domestic and foreign PEPs, their family members, and close associates.
- Suspicious transaction reporting (STRs):
  - Compliance with STR requirements is insufficient.
  - Authorities should provide guidance on typologies and timely feedback to banks to increase the quantity and improve the quality of STRs in line with ML/TF risks.
- Recommendations summarized in Table 1 (see AML/CFT Preventive Measures and Supervision sections).

### AML/CFT SUPERVISION OF BANKS — RISK-BASED APPROACH AND SANCTIONS
- Supervisory capacity and practice:
  - FIAU and MFSA have implemented milestones since mid-2017, but recent violations expose weaknesses in identifying/addressing AML/CFT breaches.
  - Pilatus Bank case highlights failure of domestic supervisors to respond to emerging problems and the limitations from the absence of a common EU-wide AML/CFT supervision framework.
- Risk-based supervision improvements needed (NT = Near Term):
  - Devote more resources to AML/CFT risk-based supervision of banks.
  - Increase the number of onsite AML/CFT compliance examinations of banks.
  - Make AML/CFT compliance examinations broader in scope, longer in duration, and more intrusive.
  - Shorten turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision.
  - Strengthen internal controls to ensure confidentiality and prevent leakage of supervision reports.
- Sanctions:
  - Low number of sanctions and delays (e.g., Pilatus) demonstrate sanction regime weaknesses.
  - Ensure effective application of a broad range of sanctions that are dissuasive and proportionate.
  - Specific actions (NT):
    - Shorten turnaround time from final report to imposition of remedial actions and sanctions, and simplify decision-making for imposing AML/CFT sanctions at the FIAU.
    - Make more use of monetary fines and impose higher penalties for breaches of AML/CFT requirements.
- Longer-term: Support establishing a European-level AML/CFT supervisory arrangement (MT = Medium Term).

### TRANSPARENCY AND BENEFICIAL OWNERSHIP OF LEGAL PERSONS IN MALTA
- Legal framework and registers:
  - Malta has established registers of BO information for companies and trusts and adopted a new legal framework on BO information.
- Key weakness:
  - ROC collects BO information without conducting proper verification; this undermines accuracy of BO registers.
- Recommendations:
  - Improve accuracy of BO information by requiring and adequately resourcing the ROC to verify BO information submitted to it (NT).
  - Ensure robust implementation of sanctions against persons who do not comply with basic and BO information requirements (MT).

### MAIN FSAP RECOMMENDATIONS FOR AML/CFT (as presented)
- Assessing and Understanding ML/TF Risks, and National Coordination:
  - i. Improve the relevant authorities’ assessment and understanding of ML/TF risks, particularly those related to the banking sector and interconnected sectors (e.g., real estate, remote gaming, virtual assets, IIP). Priority: NT
  - ii. Enhance operational coordination and cooperation among relevant agencies, including AML/CFT supervisors and law enforcement agencies. Priority: MT
- AML/CFT Preventive Measures for Banks:
  - Improve banks’ understanding of ML/TF risks. Priority: NT
  - Enhance banks’ compliance in applying CDD including BO information and ongoing monitoring commensurate with their risks, including by applying enhanced or specific measures for new technologies (e.g., virtual assets, remote gaming), and source of funds for the IIP. Priority: NT
  - Enhance banks’ compliance in applying enhanced measures for domestic and foreign PEPs, their family members, and close associates. Priority: NT
  - Provide guidance on typologies and timely feedback to banks to increase the quantity and improve the quality of STRs in line with ML/TF risks. Priority: MT
- AML/CFT Supervision:
  - Enhance implementation of licensing controls (i.e., fit and proper tests) of banks to prevent criminals and their associates from holding or being a beneficial owner of a significant or controlling interest or holding management function. Priority: NT
  - Improve FIAU and MFSA identification and understanding of ML/TF risks and controls and develop further risk-based approach tools for offsite and onsite supervision, with focus on high-risk clients (including non-resident depositors and opaque companies). Specific near-term actions listed in the report. Priority: NT
  - Ensure effective application of a broad range of sanctions against banks that are dissuasive and proportionate; specific actions listed in the report. Priority: NT
  - Support establishing a European-level AML/CFT supervisory arrangement. Priority: MT
- Entity Transparency and Availability of BO Information:
  - Improve the accuracy of BO information of legal persons by requiring and adequately resourcing the ROC to verify BO information submitted to it. Priority: NT
  - Ensure robust implementation of sanctions against persons who do not comply with (basic and BO) information requirements. Priority: MT

*This technical note reflects findings and discussions during the September 2018 FSAP mission and is prepared as part of the Financial Sector Assessment Program.*

### 8.      Malta is a regional and international financial center and an important gateway to

### Malta is a regional and international financial center and an important gateway to Europe

### ML/TF risk overview and sectoral vulnerabilities
- Malta’s open economy, a large and well interconnected financial sector relative to GDP, and exposure to non-resident account holders create significant ML/TF risks.
- Increasing flows from abroad, including from countries generally considered to pose greater ML/TF risks, may exploit vulnerabilities in:
  - the banking sector,
  - real estate,
  - remote gaming,
  - virtual assets,
  - the IIP (Individual Investor Program).
- Most illegal proceeds laundered in or through Malta’s financial sector and broader economy are generated from predicate offenses committed abroad; Malta is particularly vulnerable to foreign proceeds of corruption, tax evasion, and fraud transiting through Malta into Europe.
- The real estate sector is perceived to be used to launder illicit proceeds (including in cash) stemming from organized crime and corruption from geographic areas of high risk (e.g., Italy and Libya).
- Remote gaming:
  - Controls in the remote gaming industry are at low level and not sufficient to mitigate ML/TF risks; residual risks remain high after application of controls.
  - Remote gaming transactions are mostly conducted through the financial sector but the majority of transactions happen outside Malta, limiting the supervisor’s ability to ensure payments come from financial institutions subject to adequate AML/CFT obligations.
  - Maltese banks serving remote gaming do not have a strong understanding of this industry’s operations and risks.
- Individual Investor Program (IIP):
  - Introduced in 2014; allows foreign individuals to acquire European citizenship in exchange for significant fees and investments, which entails ML risks.
  - Applicants could use illegal proceeds to pay contributions and to launder funds via fulfilling investment criteria.
  - Malta Individual Investor Program Agency is generally aware of ML risks and considers risks are mitigated by its agents conducting due diligence, but private-sector agents face key limitations (e.g., inability to request information from applicant’s country of origin).
  - Banks processing contributions often perceive IIP business as low risk; the NRA does not analyze IIP risks.
- TF and proliferation financing:
  - Understanding of TF and proliferation financing risks by authorities and the private sector is generally poor.
  - The NRA concluded TF risk is medium-high but this conclusion was not based on analysis of TF threats and focused mostly on probability of terrorism acts.
  - TF risks could be mainly associated with migrants from conflict zones and with transit of funds used for TF through Malta.

### Risk assessment framework and NRA issues
- Malta updated its NRA in 2017, based on a limited range of data and sectors; results were neither published nor communicated to all key authorities and the private sector.
- The NRA:
  - is generally of good quality and recognizes main areas of threats and vulnerabilities,
  - mostly relies on analysis of STRs, investigations, international cooperation requests, trade, and, to a limited extent, financial flows data,
  - involved a broad range of entities coordinated by the FIAU, but results were communicated to few authorities and not published initially.
- A later review with an external consultant had limited ownership and involvement from concerned agencies, leading to lack of internalization and comprehension of results.
- The NRA focused on detected cases (overall number of detected and investigated cases are low) and did not extend to all relevant sectors; it did not rely on typology studies and strategic analysis conducted by the FIAU, data on CBRs, transportation of cash, or financial soundness data, and did not properly identify vulnerabilities of products and clients faced by banks.
- The NRA noted the threat posed by foreign proceeds of crime to Malta is high and listed four groups of several countries by level of risk, but basis for country-level risk assignments is unclear.
- Authorities lack quantitative or measurable estimates on the amount of proceeds of crime possibly laundered through and in Malta.
- Transposition of EU Directive 2015/849 (4AMLD):
  - Maltese authorities reported being in final stages of transposition.
  - Malta amended framework intending to transpose 4AMLD in 2017; following an opinion by the European Commission (July 2018) that transposition is not complete, authorities engaged with the European Commission and aim to complete transposition of 4AMLD by the end of first quarter of 2019.

### Institutional understanding and coordination
- Understanding of ML risks varies significantly among authorities, financial institutions, and DNFBPs from moderate to basic and sometimes differs significantly from NRA findings.
- Each competent authority has its own picture of ML risks based on practical experience which often do not match with each other; understanding is rarely based on sufficient analysis and mostly relies on limited data points or perceptions.
- Private sector understanding of ML risks is generally rudimentary and uneven; a few banks and reporting entities demonstrate moderate understanding.
- Authorities’ understanding of vulnerabilities is reasonable but less so for ML/TF threats; no single authority possessed a comprehensive picture of all vulnerabilities.
- National AML/CFT Strategy and coordination:
  - In April 2018, authorities published a National AML/CFT Strategy and a comprehensive and prioritized action plan.
  - A National Coordinating Committee was established to oversee implementation but its secretariat still needs proper resourcing.
  - National coordination on operational matters is less effective than on policy matters; apparent lack of effective operational cooperation and coordination among AML/CFT supervisors (FIAU and MFSA) and between FIAU and law enforcement agencies.
  - After the FSAP team on-site visit in September 2018, the Memorandum of Understanding between the FIAU and MFSA was upgraded and joint supervisory procedures were adopted.

### Conclusions and high-level recommendations (policy direction)
- Authorities are making efforts to identify and understand ML risks, but a more granular understanding is required to effectively mitigate Malta’s ML/TF risks, particularly regarding offshore activities.
- Recommendations (directional, as reflected in text):
  - Improve understanding of ML/TF risks in the banking sector and other vulnerable sectors such as real estate, remote gaming, virtual assets, and the IIP.
  - Communicate and share results of the NRA with relevant stakeholders in the private sector and competent agencies.
  - Build on recent progress in national AML/CFT coordination and enhance operational coordination among MFSA, FIAU, and law enforcement agencies.

### Preventive measures in banks — Beneficial ownership, PEPs, and reporting of suspicious transactions

Beneficial ownership (BO)
- Main risks for banks are associated with non-resident customers and business activities, new technologies (e.g., virtual assets and remote gaming), and investments from the IIP.
- Unclear if banks have access to or properly identify and verify identity of customers including beneficial owners of Maltese companies with non-resident beneficial owners or customers located outside Malta.
- Banks do not always develop and apply appropriate AML/CFT policies and CDD measures commensurate with the risks they face.
- Implementation of key preventive measures, including BO identification and verification, appears inadequate.
- Pilatus Bank’s case exposed serious shortfalls in implementation of AML/CFT preventive measures, including CDD.
- Banks lack consistency in processes for verifying beneficial owners through complex ownership chains of foreign legal persons and sometimes over-rely on due diligence by introducers, resulting in deficient client profiles for ongoing monitoring.
- Ongoing monitoring regarding beneficial owners is identified by authorities as a shortcoming; CDD often does not focus sufficiently on verification of BO and monitoring of non-resident clients, opaque companies, PEPs, new technologies, and source of funds from the IIP.

Politically Exposed Persons (PEPs)
- Laundering of proceeds of domestic and foreign corruption is one of the main risks faced by Maltese banks.
- PEP requirements are in line with international standards, but effectiveness in implementation is uneven across banks.
- Some banks have proper policies and procedures to address relations with PEPs; others do not conduct proper verification and ongoing monitoring.
- Gaps in verification and ongoing monitoring of PEPs undermine banks’ effectiveness in addressing related risks.
- Low number of PEPs identified by some banks may reflect weak capacity to identify and verify customers as PEPs, their family members, close associates, and PEPs who are beneficial owners.
- Some banks do not take appropriate measures to establish source of wealth of customers identified as foreign PEPs.

Reporting of Suspicious Transactions (STRs)
- Half of the STRs received by the FIAU are filed by banks and are primarily related to ML activities, but the overall level of reporting is still relatively low.
- Requirements for banks to report suspicious transactions are in line with international standards.
- Number of STRs has increased in the last five years and quality has improved, leading to disseminations of financial intelligence reports from the FIAU to law enforcement agencies.
- The FIAU provides feedback on STR quality with the FIAU supervision unit and the MFSA; however, number of STRs still seems low relative to size of banking sector.
- Recent financial analysis reports including information on STRs were leaked, which could potentially have discouraged banks from reporting.
- The FIAU has provided feedback to reporting entities on the quality and outcome of their reports since 2014; further guidance on typologies is needed to nudge banks toward reporting suspicious activities in line with Malta’s risk profile.

Key statistics on STRs filed by banks (Table 2)
- 2013: 66
- 2014: 112
- 2015: 136
- 2016: 344
- 2017: 398
- Note: In 2017, 51.2 percent of total reports received from reporting entities were received from banks.

*Source: IMF staff report content provided.*

### 28.      Supervisors should ensure that  banks improve their understanding of ML/TF  risks and

### 28.      Supervisors should ensure that  banks improve their understanding of ML/TF  risks and enhance their compliance with specific AML/CFT  requirements

### Supervisory expectations and banks' risk understanding
- The National Coordinating Committee should share the results of the NRA with banks to improve their understanding of risks.
- Supervisors should enhance resources and capacity for risk-sensitive supervision to ensure banks enhance compliance in applying CDD commensurate with their risks.
- Focus areas for enhanced or specific measures:
  - Non-resident customers.
  - New technologies (e.g., virtual assets, remote gaming).
  - Ascertaining the source of funds for the IIP.
- Banks’ compliance with PEPs requirements is weak; banks should enhance application of appropriate measures for domestic and foreign PEPs, their family members, and close associates.

### FIAU guidance and STR reporting
- The FIAU could provide additional guidance on specific typologies to further increase the quantity of STRs in line with ML/TF risks.
- Suggested focus areas for additional feedback (in consultation with the MFSA):
  - Risks related to virtual assets.
  - E-casinos.
  - Tax evasion techniques.
  - Use of legal persons to hide the identity of beneficial owners.

### Roles, structure, and resources of supervisors (FIAU and MFSA)
- The FIAU is the main AML/CFT supervisor in Malta, responsible for supervising and ensuring subject persons’ compliance with the PMLA, the PMLFTR and the Implementing Procedures.
- The FIAU’s Compliance Section achieves compliance through onsite examinations and offsite assessments of subject persons.
- The MFSA carries out AML/CFT oversight of the financial services sector as an agent of the FIAU; the Enforcement Unit of the MFSA conducts onsite supervision of MFSA license holders acting as an agent of the FIAU.
- Staffing and restructuring plans:
  - FIAU planned expansion from 20 to 56 staff members by the end of 2020, 19 of which will be dedicated to AML/CFT supervision.
  - MFSA recruitment planned from 9 supervisors working on AML/CFT in June 2018 to 30 by the end of 2018.
  - At the time of the FSAP mission, MFSA team size reduced to 6 supervisors (due to 3 resignations); the plan to recruit 23 people (20 new and 3 replacements) by end-2018 seemed over optimistic.
- FIAU developed new methodology for supervision in June 2017 and initiated development of risk-based supervisory tools piloted in 2018.

### Risk-based supervision: current status and gaps
- FIAU and MFSA understanding of banks’ ML/TF risks is generally good, but supervision remains predominantly compliance-based rather than risk-sensitive.
- Consequences of compliance-based approach:
  - Focus more on regulatory deficiencies than aligning supervisory resources to bank risk profiles.
  - Limits effective supervision given resource constraints in FIAU’s compliance unit and limited number of qualified AML/CFT supervisors at MFSA.
  - Inspection reports are provided to banks with long delays (e.g., one year).
  - Banks reported examinations are neither regular nor demanding.
- Risk-based supervisory tools expected to be used as of the 2019 inspection cycle.

### EBA investigation (Pilatus Bank) — summary findings
- In July 2018, the EBA established that the FIAU had breached Union laws in the case of Pilatus Bank and issued recommendations.
- EBA findings included:
  - Failure to ensure that one credit institution (Pilatus Bank) put in place adequate and appropriate AML/CFT policies and procedures as required under Article 34 of AMLD3.
  - FIAU neither imposed effective, proportionate and dissuasive sanctions, nor other supervisory measures to correct identified shortcomings.
  - EBA noted the findings revealed a general practice of the FIAU and not only a failure in a particular case.
- The EBA decided not to open a breach of Union law investigation into the MFSA, reflecting recent supervisory actions taken by the MFSA and current Union law requirements, but expressed significant concerns about MFSA actions in some areas.
- FIAU challenged issuance of the Recommendation because it had already adopted an Action Plan; EBA noted the Action Plan was insufficient to satisfy that deficiencies were resolved.

### Onsite AML/CFT supervision: frequency, scope, and timeliness
- Number of onsite AML/CFT reviews:
  - FIAU and MFSA conduct a low number of onsite AML/CFT reviews (two to three a year) of 21 banks in Malta.
  - Number of onsite visits conducted solely by the MFSA or jointly with the FIAU: five onsite reviews in 2017, three in 2016, three in 2015.
  - The five largest banks in terms of assets have not been inspected since 2015.
  - A bank active in commodity-trade finance with significant foreign branches has never been inspected.
- Typical onsite review characteristics and limitations:
  - Onsite examination phase typically limited to a couple of days.
  - Preparatory work may be done prior, but short duration insufficient to examine many client accounts, extract data, and assess robustness of risk management and internal controls.
  - Until recently, onsite exams were limited to interviews and review of a limited sample of accounts (33 for one of the largest Maltese banks).
  - New methodology agreed between MFSA and FIAU in early 2018 led to two latest onsite examinations lasting five months and being more comprehensive, though not completely finalized at the time of the FSAP mission.
- Delays in finalizing reports:
  - In some cases, up to 1.5 years to produce the final examination report from the end of the on-site examination.
  - Lengthy process weakens effectiveness because discussions with inspected banks take place after finalization of the report.
- Outreach and sharing of risk information:
  - Results of the NRA were not shared with banks at the time of the onsite visit.
  - FIAU and MFSA took initiatives to engage with private sector and provide more training during 2017 and 2018, but do not conduct regular outreach about supervisory expectations to banks.

### Sanctions for AML/CFT violations: practices and issues
- FIAU sanctions activity:
  - Administrative sanctions imposed: none in 2015, three in 2016, one in 2017.
  - Instances where sanctions were imposed were low and not dissuasive (e.g., € 30,000 on average).
  - Examples of fines (public information disclosed on FIAU’s website): €40,000 against HSBC, €20,000 against BoV.
  - In several instances, no sanctions were applied despite extremely severe findings.
  - FIAU does not have the power to withdraw the license of a bank in case of egregious violations.
  - Sanctions often challenged before the appeal court and imposed after long delay from time of identification of breach.
  - In four instances in 2018, fines were determined against banks but are currently under review or judicial appeal.
    - Cases under appeal or consideration: one case for €327,500 and another for €199,500 under appeal; one case for €11,200 and another for €8,000 under consideration by the FIAU compliance monitoring committee.
- MFSA sanctions activity:
  - MFSA has imposed a limited number of sanctions in recent years.
  - No sanctions applied by MFSA on grounds of weak AML/CFT internal controls or compliance checks.
  - Regulatory response not timely and often inadequate; delays in final decision excessive (up to three years from concluding an onsite inspection).
- Table of selected penalties imposed by FIAU and MFSA (as presented):
  - November 3, 2017 — Penalty imposed on the bank: €38,750 — Summary: Failure to establish source of wealth, scrutinize a transaction and submit a suspicious transaction report to the FIAU in respect of a client.
  - December 6, 2016 — Penalty imposed on the bank: €20,000 — Summary: Failure to establish source of funds for a client.
  - September 28, 2016 — Penalty imposed on the bank: €4,000 — Summary: Failure to establish source of wealth and source of funds and make a suspicious transaction report in respect of a client.
  - January 7, 2016 — Penalty imposed on the bank: €40,000 — Summary: Failure to scrutinize adequately on an ongoing basis the transactions undertaken throughout a business relationship; failure to take sufficient measures to establish the source of funds of a PEP client and failure to conduct enhanced ongoing monitoring of a business relationship with a PEP.

### Conclusions and policy recommendations (numbered conclusions in source)
- 42. The MFSA should enhance implementation of licensing controls (i.e., fit and proper tests) to prevent criminals and their associates from holding or being a BO of a significant or controlling interest or of holding management function in a bank.
- 43. The FIAU and MFSA should improve their identification and understanding of ML/TF risks. The results of NRA should be shared with banks. Supervision should be risk-sensitive and focus on high-risk clients, including non-resident clients, and opaque companies, BO requirements, PEPs, and new technologies.
- 44. The FIAU and MFSA should increase their resources to develop further risk-based tools for offsite monitoring and onsite AML/CFT supervision and ensure timely delivery and confidentiality of inspection reports. More precisely, they should:
  - (i) devote more resources to fully implement a risk-based approach for supervision of banks;
  - (ii) significantly increase the number of onsite AML/CFT compliance examinations of banks;
  - (iii) implement the revised methodology to deepen the scope of the AML/CFT compliance examinations for banks;
  - (iii) shorten the turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision;
  - (iv) strengthen internal controls to ensure confidentiality and prevent leakage of supervision reports.
- 45. The FIAU and the MFSA should impose a broad range of sanctions against banks that are dissuasive and proportionate to the severity of the AML/CFT violations. More precisely:
  - FIAU should shorten the period between detection of violations and imposition of sanctions and make more use of monetary fines as part of the sanctioning regime for banks and increase the amount of penalties for breaches of AML/CFT requirements.
  - Time-bound remedial action plans should be imposed at a minimum in a systematic fashion when findings are made by onsite examiners.
  - MFSA and FIAU should shorten the turnaround time from the final report to imposition of remedial actions and sanctions.
- 46. Establishing a regional AML/CFT supervisory arrangement could enhance convergence of supervisory practices and minimize regulatory arbitrage. An euro area (or EU) level AML/CFT supervisory arrangement should be considered as a more comprehensive solution.

### Transparency and beneficial ownership of legal persons — key statistics and risks
- Types and numbers of legal entities:
  - Number of legal entities registered in Malta increased from 37,050 in 2007 to over 51,000 in early 2018, including 1,284 partnerships.
  - Maltese authorities estimate approximately 48 000 of these companies are currently active.
  - Approximately half of all companies incorporated in Malta have at least one non-resident shareholder.
  - Number of legal entities that are beneficially owned or controlled by non-residents is unknown.
  - Trustees licensed in Malta administered 3,529 trusts as of August 31, 2018.

*IMF — AML/CFT SUPERVISION OF BANKS— RISK-BASED APPROACH AND SANCTIONS (Malta) — Extracted content.*

### 48.      Basic information about legal persons incorporated in Malta is generally available and

### 1mltea2019004 - 48.      Basic information about legal persons incorporated in Malta is generally available and easily accessible but may not be accurate.

### Availability and reliability of basic company information
- The ROC collects and updates basic information on a regular basis and holds a public online website that allows easy access for the general public.
- Basic items collected include: Company name, legal status, address of registered office, basic regulating powers, names, addresses and official identification document numbers of all shareholders, partners, directors and company secretaries.
- Memorandums of association and deeds of partnership are available online for a small fee; basic information is available online for free.
- Some authorities raised concerns about the accuracy of the information since a significant number of inactive companies do not update their basic information.

### Risks associated with legal persons, intermediaries, and trusts
- No assessment of ML/TF risks presented by the different types of legal persons and arrangements has been conducted.
- Authorities recognize that legal persons and arrangements can be misused for criminal purposes; legal entities established in Malta with foreign ownership generally represent a higher risk for misuse for criminal purposes.
- Malta statistics and sector features:
  - Malta has 186 legal and natural persons registered as Company Service Providers (CSPs).
  - Malta has 171 persons licensed as trustees.
  - Around 20 percent of the companies hold shares on a mandate/fiduciary basis with CSPs.
  - Incorporation of a legal entity does not require engagement of a CSP, but only about five percent of companies are registered without the use of an intermediary.
- The sector of TCSPs has grown in recent years and is recognized as one of the main vulnerabilities in the NRA.
- Trusts established in Malta are considered by authorities to pose a lower ML/TF risk than the legal persons; persons providing trustee or other fiduciary services require authorization from the MFSA under the Trusts and Trustees Act and are supervised by the MFSA.

### Legal framework developments and reporting requirements
- December 2017: Malta issued the Companies Act (Register of Beneficial Owners) and The Trusts and Trustees Act (Register of Beneficial Owners) Regulations to transpose relevant provisions on BO information of 4AMLD.
- Regulations entered into force on January 1, 2018, except article 7 of the Companies Act Regulations (access to the register of beneficial owners), which came into force on April 1, 2018.
- Since January 1, 2018, incorporation of a company in Malta has required BO information to be provided to the ROC, including:
  - name, date of birth, nationality, country of residence, official identification document number indicating the type of document and the country of issue, and the nature and extent of the beneficial interest held.
- If BO information is not provided, the Registrar would not register the company’s memorandum and articles (or a deed of partnership).
- Companies formed and registered before the Regulation came into force are required to provide BO information:
  - These companies should send a BO report on the anniversary of its registration falling due after July 1 or where there is any change in the BO occurring after July 1, whichever is earlier.
  - Therefore, the register of BO should have the BO information regarding all obliged companies and partnerships by August 2019 at the latest.
- Penalties:
  - Any officer, shareholder, or beneficial owner who knowingly or recklessly provides to the ROC BO information that is misleading, false or deceptive is liable to pay a fine up to €5,000 or to being imprisoned for up to six months or both fine and imprisonment.
  - Penalties are also established for other violations, such as failure to keep record of beneficial owners at the level of the firm or failure to provide information to the register.

### Gaps, exemptions, and verification limitations
- Exemptions and concerns:
  - Requirements to report BO to the register do not apply to listed companies and to companies where all the registered shareholders are natural persons.
  - The exemption for companies where all the shareholders are natural persons may not account for risk that shareholders could be controlled by third parties.
- Verification and resources:
  - The ROC collects BO information without verifying its accuracy.
  - The ROC considers it has sufficient legal powers to conduct verification (including requesting additional information) but does not have sufficient resources to do this in practice.
  - There are three avenues for competent authorities to obtain BO information: (i) financial institutions and DNFBPs; (ii) the legal entity itself; and (iii) the register of BO.
  - Given uneven compliance with BO-related requirements across sectors and reporting entities, providing resources and developing capacity of the ROC, particularly to conduct verification, seems key to ensuring accuracy and availability of BO information.
- Compliance and sanctions:
  - There was no evidence that effective sanctions are applied against persons who do not comply with the BO information requirements beyond sanctions for delayed submission.

### Access to BO information by competent authorities and reporting entities
- Law enforcement agencies and supervisors rely almost exclusively on the BO information collected by banks and TCSPs.
- Authorities report that BO information of corporate entities is mostly available from both banks and TCSPs and can be accessed by the competent authorities in a timely fashion.
- Given questionable quality of BO information obtained by banks and generally low compliance with BO-related requirements, the reported availability contrasts with experience in other jurisdictions.
- Regulations on Beneficial Ownership define persons who can access BO information held by the ROC:
  - designated AML/CFT authorities (including the tax authorities) and reporting entities as defined in PMLFTR.
  - Any person or organization that can satisfactorily demonstrate and justify a legitimate interest can access the name, the month and year of birth, the nationality, the country of residence, and the extent and nature of the beneficial interest of the beneficial owners of a company.

### Conclusions and policy recommendations
- Strengthen the ROC so it can verify BO information submitted to it:
  - Provide a more proactive mandate for the ROC and a corresponding increase in its resources.
- Conduct a risk assessment:
  - Authorities are encouraged to conduct an assessment of the risk that legal persons are misused for ML/TF purposes, including risks posed by legal persons established abroad and risks associated with various legal forms of entities available in Malta.
- Streamline the legal framework on BO information by removing loopholes:
  - Remove the exemption for companies where all the shareholders are natural persons from the BO reporting requirements.
  - Ensure robust application of sanctions for violations of reporting requirements related to both BO and basic information requirements.
- Operational improvement:
  - Authorities are encouraged to add BO information to the annual return submitted by companies so confirmation of BO information is required annually and false confirmations would attract criminal liability rather than a modest fine for not updating BO information.
- Broader coverage for trusts:
  - Authorities indicated that the register by the end of 2019 will cover all trusts, not only the ones that generate tax consequences, as a result of the implementation of the Fifth Anti-Money Laundering Directive.

*Source: 1mltea2019004 - IMF country report text provided.*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2019/1mltea2019004.pdf_