## 1mltea2019006 ## Source details **Canonical URL:** [1mltea2019006](https://www.imf.org/-/media/files/publications/cr/2019/1mltea2019006.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2019/1mltea2019006.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2019/1mltea2019006.pdf.json) --- ### Executive summary — scope and main findings - Mission focus: - Supervision of less significant institutions (LSIs) not directly supervised by the European Central Bank (ECB), and on non-European Union (EU) branches. - Supervision of all banks’ AML/CFT policies and procedures (no AML/CFT tasks conferred to the Single Supervisory Mechanism (SSM)). - Coordination with 2018 euro area FSAP and FSAP missions in France and Italy. - Progress since 2003: - National transposition and implementation of EU directives and regulations closed several gaps identified in 2003 and noted in a 2011 independent assessment. - Related parties definition broadened; administrative penalties and measures set in Subsidiary Legislation. - MFSA empowered to issue binding regulations (e.g., requiring banks to submit NPL reduction plans). - Introduction of the SSM increased supervisory intensity for significant institutions (SI). - Persisting concerns: - Resources materially under-resourced for effective banking supervision; difficulties with planning and execution for LSIs (postponed inspections; many recovery plans and ICAAP/ILAAP documents await review; difficulty maintaining regular contact with all LSIs). - Need for different skill sets: “experts with extensive credit risk experience, IT risk experts, statisticians, etc.” - Operational independence gaps (funding uncertainty, recruitment autonomy constraints, proposed reorganization concentrating powers). ### Resources, independence, and capacity - MFSA resource actions and targets: - Decision to increase staff by 150 (50 percent) in the next three years (including 20 for the MFSA’s Banking Supervision Unit and 20 for the Enforcement Unit). - Formalize a new human resources strategy. - Improve remuneration. - Operational independence concerns: - Recent funding model change requires MFSA to negotiate government and parliamentary approval of its budget yearly. - MFSA lacks full autonomy over recruitment: projected budget for HR must be endorsed yearly by the Ministry of Finance (MFIN); recruitments must be approved case-by-case by the Office of the Parliamentary Secretary for Financial Services, Digital Economy, and Innovation (PSFSDEI). - Proposed reorganization would transfer supervisory powers from a supervisory council to an executive committee chaired by the CEO, concentrating powers and potentially reducing supervisory expertise in decision-making. - Budget and financial projections (exact figures): - MFSA Revenues: - 2016: 23,038 - 2017: 25,053 - 2018: 16,108 (1,2/) - 2019: 12,331 - 2020: 13,448 - 2021: 14,625 - Government Subventions: - 2016: - - 2017: - - 2018: 4,869 - 2019: 12,915 - 2020: 14,698 - 2021: 16,311 - Expenditures: - 2016: (15,183) - 2017: (17,615) - 2018: (20,996) - 2019: (25,247) - 2020: (28,186) - 2021: (30,937) - of which HR: - 2016: (9,445) - 2017: (10,831) - 2018: (11,603) - 2019: (13,730) - 2020: (15,370) - 2021: (16,840) - Recruitment, retention, and compensation: - Turnover rate: 10.5 percent in 2017. - External audit findings: entry-level remuneration compares favorably with banking industry; management functions slightly below or significantly below industry benchmarks. - New Human Resources Strategy: recruitment streamlined; salary scale adjusted upward (by 5 percent in the best case); variable remuneration scheme introduced. - Mission recommendations (priority and timing preserved as in source): - Develop a five-year plan to increase MFSA’s budgetary resources, supported by a strong, publicly stated government commitment. (Priority: H; Timing: I; Responsible: OPM, MFIN, MFSA) - Precisely quantify resources needed for risk-based supervision, map required skills, and assess regularly whether strategy and compensation address recruitment and retention. (Priority: MH; Timing: NT; Responsible: MFSA) - Grant full autonomy to the MFSA over the recruitment process and streamline recruitment. (Priority: H; Timing: I; Responsible: OPM, MFIN, MFSA) - Assess regularly whether the total compensation package is sufficiently attractive. (Priority: M; Timing: MT; Responsible: MFSA) - Maintain a dedicated statutory committee focused solely on supervisory issues and reinforce the committee’s independence. (Priority: H; Timing: I; Responsible: OPM, MFSA) ### Supervisory approach, tools, and practices - Current practices: - Mix of on- and offsite supervisory elements used to assess banks’ risks. - Annual Supervisory Priorities document prepared for LSIs and shared with the ECB (for information). - First Supervisory Review and Evaluation Process (SREP) carried out for one high-priority (HP) LSI; led to a conservative capital surcharge commensurate with the bank’s risk levels and controls. - Onsite inspection reports are well written and issued shortly after investigation phase. - Significant attention to corporate governance; regular meetings with CEOs of HP LSIs and largest non-HP LSIs. - Measures addressing credit risk (NPL reduction plans) have helped decrease stock of NPLs. - Shortcomings and needs: - Low frequency of onsite inspections at LSIs; SREP rollout incomplete for all HP LSIs. - Need for more intrusive approach to risk-management processes (asset recovery, related-party transactions, forbearance measures, collateral valuation). - Improve oversight of non-EU branches. - Related parties framework still exhibits significant gaps with Basel Core Principles. - Supervisory follow-up delays: significant delays between end of onsite investigation and supervisory council decisions; low number and limited monetary sanctions; no sanctions against natural persons by MFSA; 27 pending appeals to the Financial Services Tribunal (some dating back to 2009) which have suspensive effects. - Specific supervisory recommendations: - Finalize the SREP for all HP LSIs and start the process for non-HP LSIs; analyze recovery plans submitted by all LSIs; review all ICAAP and ILAAP documents and provide feedback. (Priority: H; Timing: NT; Responsible: MFSA) - Comply with minimum engagement level and increase frequency of supervisory interactions with LSIs’ Boards, Board committees, and managing directors. (Priority: MH; Timing: NT; Responsible: MFSA) - Increase number of onsite inspections of LSIs and make onsite inspections more risk-oriented—assess credit risk, liquidity risk, compliance risk, and adequacy of risk management. (Priority: H; Timing: NT; Responsible: MFSA) - Intensify and harmonize follow-up to post-onsite inspection remedial action. (Priority: H; Timing: NT; Responsible: MFSA) - Enhance supervision of third-country branches. (Priority: MH; Timing: NT; Responsible: MFSA) ### Ongoing supervision, SREP implementation, and data systems - Risk assessment methodology: - Supervisory methodologies aligned with SSM Supervisory Manual for SIs, applied proportionately to LSIs. - For non-HP LSIs, an in-house risk assessment tool (RAT) based on EBA SREP guidelines is used. - Outcome: a 1–4 risk score (risk assessment score (RAS)) where 1 = “low risk” and 4 = “high risk.” - By 2020, all LSIs shall be subject to the SSM methodology. - SREP status and timeline: - A full SREP completed for one HP LSI. - MFSA slightly behind schedule; exercise likely to be finalized in Q1 2019 for the three HP LSIs. - Initial plan: full SREP on all HP LSIs by end of 2018, SREP on remaining LSIs by end-2020; thereafter annual for HP LSIs, once every two years for medium-priority LSIs, once every three years for low-priority LSIs. - MFSA applied a 1 percent floor to Pillar 2 guidance (P2G). - Prudential reporting, data quality, and KRIs: - Checks on returns carried out manually or semi-automatically. - MFSA intends to build an automated tool to run EBA and ECB tests for all banks; completion date unconfirmed. - Key risk indicators (KRI) developed, fed by COREP and FINREP. ### Credit risk, NPLs, provisioning, and IFRS 9 - Main findings: - Supervisory focus needed on credit risk, liquidity risk, and compliance risk. - Onsite examinations of credit risk rarely carried out since 2013; only one comprehensive credit-file review performed by onsite examiners in 2016 (ECB-led mission). - MFSA not legally empowered to require change in risk classification and/or additional provisions. - NPL reduction plans and outcomes: - BR/09 amended in December 2016 to introduce NPL-reduction plans; credit institutions bound to maintain an NPL ratio below 6 percent. - Seven banks required to draw up a multiyear NPL reduction plan. - Sectoral NPLs declined from more than 5 percent in December 2014 to 3 percent at end-2017. - Notable issues: - One bank: NPLs increased to 9.6 percent at end-December 2017; as of September 2018 no final decision on requiring a plan. - One bank: NPL share 40.2 percent in September 2017 and 4.7 percent in December 2017; MFSA did not request a plan on assumption data inaccurate. - Another bank: NPL reduction plan not approved; MFSA did not request reserve for excessive NPLs despite NPLs above 16 percent. - Reserve for General Banking Risks: - Established by BR/09 equal to 2.5 percent of the regulatory allocation (difference between NPLs and specific reserves). - Where a credit institution has total CET 1 exceeding a threshold determined by authority, only half (50 percent) of appropriation required from profits. - Further clarity needed on threshold and tie to Pillar 2 surcharge calibration. - IFRS 9 and ECL: - IFRS 9 implemented January 2018; ECL approach adopted. - Impact on CET1 not measured at time of mission. - MFSA should develop technical capabilities and collaborate with external legal auditors to assess banks’ ECL calculation methods. - Credit risk in mortgages and construction loans: - Housing-related lending roughly 60 percent of total lending to private sector; mortgages 45 percent of total lending. - Mortgage features: long tenors up to 40 years; “balloon repayment” features (one bank: 24 percent of newly originated mortgages). - Issues: varied lending standards, lack of professional appraisers, lengthy court proceedings, difficulties realizing collateral. - Credit-related recommendations: - Undertake sector-wide review of credit underwriting standards for mortgages and construction loans, including sampling loan files. (Priority: MH; Timing: NT; Responsible: MFSA) - Give explicit powers to MFSA to require changes in risk classification and/or additional provisions. (Priority: MH; Timing: NT; Responsible: MFSA) - Specify how the “Reserve for General Banking Risks” ties with the general SSM methodology on Basel Pillar 2. (Priority: M; Timing: MT; Responsible: MFSA) - Develop technical capabilities to assess banks’ methods to calculate expected credit losses under IFRS 9. (Priority: MH; Timing: MT; Responsible: MFSA) - Intensify follow-up of NPLs’ reduction plans and take further actions (e.g., activation of the reserve for excessive NPLs) if needed; reconsider exclusion of two banks. (Priority: H; Timing: I; Responsible: MFSA) ### Related-party transactions and governance - Findings: - Related-party framework improved since 2011 but still has significant gaps relative to Basel Core Principles. - Need to strengthen oversight of related-party lending, expand definition of related-party transactions, and extend requirements to banks’ sister companies. - Governance weaknesses: - Inadequate Board composition and Board committee functioning in some LSIs. - Ownership concentration issues: some LSIs have a single ultimate beneficial owner who is a private individual. - Fit-and-proper evaluations: no regular ongoing reassessment; powers to change Board composition exist but rarely used. - Recommendations: - Strengthen framework for related-party lending; expand definition; extend requirements to sister companies; strengthen Board involvement; increase MFSA information and powers to mitigate risks. (Priority: H; Timing: NT; Responsible: MFSA) - Conduct regular updated fit-and-proper evaluations of relevant persons, notably when onsite inspections identify serious concerns (e.g., potential breaches of AML requirements). (Priority: H; Timing: NT; Responsible: MFSA) ### Liquidity risk supervision - Reporting and legal basis: - Liquidity Coverage Ratio (LCR) submitted monthly; Net Stable Funding Ratio (NSFR) submitted quarterly. - Article 86 of CRD IV transposed into Annex 2B of the BR/12 requires sufficient liquidity and robust liquidity management frameworks. - Key liquidity metrics (exact figures, LCR as of end-2017): - Core domestic banks: 183.8 percent - Noncore domestic banks: 263.9 percent - International banks: 280.7 percent - Customer loan-to-deposit ratio (exact figures): - Core domestic banks: 58.9 percent - Noncore domestic banks: 47 percent - Findings: - Despite high LCRs and low loan-to-deposit ratios on average, vulnerability exists due to reliance on wholesale funding and substantial share of deposits held by nonresidents. - Liquidity risk oversight needs strengthening through more frequent engagement with non-HP LSIs. - Recommendations: - Organize more frequent meetings on liquidity risks with non-HP LSIs. (Priority: MH; Timing: MT; Responsible: MFSA) - Increase frequency of onsite assessments of liquidity risk; consider a horizontal review. (Priority: MH; Timing: MT; Responsible: MFSA) - Review ILAAP documents and provide feedback to banks. ### Enforcement, sanctioning, judicial appeals, and timeliness - Enforcement powers and limits: - MFSA can impose administrative penalties: up to €5 million for a natural person; up to 10 percent of total annual net turnover for a legal person. - Remedial measures powers include requiring own funds in excess, restricting activities, requiring restoration plans, and more. - Evidence and issues: - Limited number of sanctions in past five years; low pecuniary penalties limit deterrence; MFSA has never imposed sanctions against natural persons. - Significant delays between end of onsite investigations and supervisory council decisions (up to one year); delays in final decisions can be up to three years. - Pending appeals to the Financial Services Tribunal: 27 (some dating back to 2009); appeals have suspensive effects, undermining deterrence. - Selected administrative measures and penalties (Table 6 entries, exact dates and figures): - 7/6/2018 — Satabank — Penalty of EUR 65,000 - 4/3/2018 — Ferratum Bank — Penalty of EUR 188,445 - 3/21/2018 — Pilatus Bank — Bank directed not to allow any banking transactions for shareholders, Board members, senior management, or connected persons - 7/18/2018 — HSBC Bank Malta — Penalty of EUR 10,000 - 4/27/2016 — Nemea Bank — Appointment of a competent person to take charge of assets and assume control - 3/29/2016 — FimBank — Restrictions on expansion and further investment - Recommendations on enforcement and appeals: - Use proactive, preventative, and earlier corrective actions to address risk-management issues. (Priority: H; Timing: NT; Responsible: MFSA) - Make more use of monetary fines as part of the sanctioning regime and increase penalty amounts. (Priority: H; Timing: NT; Responsible: MFSA) - Take action in a timely manner by reducing delay between finalization of onsite inspections and supervisory measures. (Priority: H; Timing: NT; Responsible: MFSA) - Ensure supervisory action is not delayed through judicial appeal; explore legal amendments to limit suspensive effects or circumscribe remedies; consider increasing Financial Services Tribunal resources and capabilities. (Priority: MH; Timing: NT; Responsible: MFIN) ### AML/CFT supervision — shortcomings and required intensification - Institutional setup and resources: - FIAU: independent government agency under Article 15 PMLA; FIAU receives STRs and is sole authority for reviewing cases and taking decisions on breaches and sanctions. - Enforcement Unit of MFSA acts as an agent of FIAU for onsite supervision of MFSA license holders (Article 26(5) PMLA). - Planned staffing changes: - FIAU planning to expand from 20 to 56 staff by end-2020, 19 dedicated to AML/CFT supervision. - MFSA planned increase from nine supervisors (June 2018) to 30 by end-2018; MFSA team size reduced to six supervisors due to three resignations. - Core findings: - AML/CFT supervisory framework has several serious deficiencies. - Onsite compliance examinations by MFSA or jointly with FIAU were extremely low: five in 2017, three in 2016, three in 2015. - Onsite compliance examinations short: durations from one to five days. - Sample sizes in previous compliance reviews: 10 to 30 clients (examples of small sampling—one review covered 33 accounts). - In-depth assessment of banks’ ongoing monitoring and transaction screening not conducted. - Turnaround time for providing banks with findings of onsite compliance exams may take up to two years; finalizing onsite reports may take up to 1.5 years; regulatory responses may be delayed up to three years. - Few administrative sanctions by FIAU: none in 2015, three in 2016, and one in 2017. - In several instances, severe compliance findings resulted in no sanctions; MFSA has not used prudential enforcement measures solely based on AML/CFT deficiencies. - EBA findings and consequences: - EBA investigation into FIAU actions related to Pilatus Bank found FIAU failed to ensure adequate AML/CFT policies and did not impose effective, proportionate, and dissuasive sanctions; EBA adopted recommendations. - EBA decided not to open a breach-of-Union-law investigation into MFSA but identified significant concerns about MFSA actions in some areas. - Recommendations to strengthen AML/CFT supervision (priority items 22–31 preserved): - 22. Use proactive, preventative, and earlier corrective actions to address risk-management issues. (Priority: H; Timing: NT; Responsible: MFSA) - 23. Make more use of monetary fines as part of the sanctioning regime for credit institutions and increase the amount of penalties. (Priority: H; Timing: NT; Responsible: MFSA) - 24. Ensure supervisory action is not delayed through judicial appeal, including by amending the law if needed. (Priority: MH; Timing: NT; Responsible: MFIN) - 25. Increase the number of onsite AML/CFT compliance examinations of credit institutions. (Priority: H; Timing: I; Responsible: FIAU, MFSA) - 26. Revise the scope, duration, depth, intrusiveness, and methodology of the AML/CFT compliance examinations. (Priority: H; Timing: NT; Responsible: FIAU, MFSA) - 27. Shorten the turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision. Impose remedial actions. (Priority: H; Timing: I; Responsible: FIAU, MFSA) - 28. Simplify the decision-making process. (Priority: H; Timing: NT; Responsible: FIAU) - 29. Make more use of monetary fines as part of the sanctioning regime for credit institutions and increase the amount of penalties in case of breach of AML/CFT requirements. (Priority: H; Timing: NT; Responsible: FIAU) - 30. Devote more resources to consider AML/CFT risk in risk assessments and supervision of banks. (Priority: H; Timing: I; Responsible: MFSA) - 31. Take supervisory measures solely based on AML/CFT-related risk management and operational risk deficiencies. (Priority: H; Timing: NT; Responsible: MFSA) - Additional AML/CFT recommendations: - Significantly increase the number of onsite compliance examinations; lengthen duration and broaden scope and sample sizes; ensure in-depth assessment of transaction screening and ongoing monitoring. - Impose time-bound remedial action plans systematically; simplify FIAU decision-making to speed sanctioning. - MFSA to use prudential measures based on AML/CFT deficiencies where appropriate. - Consider EA (or EU) level AML/CFT supervision as a more comprehensive solution (as emphasized in EA FSAP). ### Supervision of non-EEA (third-country) branches - MFSA responsibilities and issues: - MFSA directly responsible for supervision of all non-EEA branches. - MFSA signed MoUs with 30 foreign authorities. - Two Turkish branches licensed in Malta operate under agreements exempting them from Maltese prudential rules on grounds NPLs taken by Head Office. - Deficiencies: - Limited understanding of Turkish branches’ business models. - No onsite inspections of these branches since 2010 and 2012 respectively. - Latest onsite AML/CFT visit occurred in 2014 for one branch; the other never had a compliance exam. - MFSA does not participate in non-EEA supervisory colleges for these branches; insufficient receipt of home supervisor inspection reports. - These two branches account for 39 percent of total banks’ assets (the three SIs account for 42 percent). - Domestic liabilities negligible and deposits not covered by Malta’s deposit insurance scheme; reputational risk exposure. - Recommendation: - Effectively supervise third-country branches and include them in the onsite inspection program (onsite visits or spot checks). Going forward, supervision of systemically important third-country branches should be transferred to the SSM, as recommended by the EA 2018 FSAP. ### Key operational figures and statistics (preserved verbatim) - Planned MFSA staff increase: 150 (50 percent) in the next three years (including 20 for the Banking Supervision Unit and 20 for the Enforcement Unit). - Onsite compliance examination durations: from one to five days. - Sample sizes in previous compliance reviews: 10 to 30 clients. - FIAU administrative sanctions: none in 2015, three in 2016, and one in 2017. - Pending appeals to Financial Services Tribunal: 27 (some dating back to 2009). - BSU FTEs (total): - 2015: 34 - 2016: 42 - 2017: 45 - Onsite inspections at LSIs (number by year): - 2015: six missions - 2016: five (including two follow-up missions) - 2017: two - LCR as of end-2017: - Core domestic banks: 183.8 percent - Noncore domestic banks: 263.9 percent - International banks: 280.7 percent - Customer loan-to-deposit ratio: - Core domestic banks: 58.9 percent - Noncore domestic banks: 47 percent *Source: 1mltea2019006 — IMF staff report text provided.* ### 2018. Further information on the FSAP program can ### 2018. Further information on the FSAP program can ### Executive summary — scope and main findings - Mission focus: - Supervision of less significant institutions (LSIs) not directly supervised by the European Central Bank (ECB), and on non-European Union (EU) branches. - Supervision of all banks’ AML/CFT policies and procedures (no AML/CFT tasks conferred to the Single Supervisory Mechanism (SSM)). - Coordination with 2018 euro area FSAP and FSAP missions in France and Italy. - Progress since 2003: - National transposition and implementation of EU directives and regulations closed several gaps identified in 2003 and noted in a 2011 independent assessment. - Related parties definition broadened; administrative penalties and measures set in Subsidiary Legislation. - MFSA empowered to issue binding regulations (e.g., requiring banks to submit NPL reduction plans). - Introduction of the SSM increased supervisory intensity for significant institutions (SI). - Persisting concerns: - Resources materially under-resourced for effective banking supervision; difficulties with planning and execution for LSIs (postponed inspections; many recovery plans and ICAAP/ILAAP documents await review; difficulty maintaining regular contact with all LSIs). - Need for different skill sets: “experts with extensive credit risk experience, IT risk experts, statisticians, etc.” - Operational independence gaps (funding uncertainty, recruitment autonomy constraints, proposed reorganization concentrating powers). ### Resources, independence, and capacity - MFSA resource actions and targets: - Decision to increase staff by 150 (50 percent) in the next three years (including 20 for the MFSA’s Banking Supervision Unit and 20 for the Enforcement Unit). - Formalize a new human resources strategy. - Improve remuneration. - Operational independence concerns: - Recent funding model change requires MFSA to negotiate government and parliamentary approval of its budget yearly. - MFSA lacks full autonomy over recruitment: projected budget for HR must be endorsed yearly by the Ministry of Finance (MFIN); recruitments must be approved case-by-case by the Office of the Parliamentary Secretary for Financial Services, Digital Economy, and Innovation (PSFSDEI). - Proposed reorganization would transfer supervisory powers from a supervisory council to an executive committee chaired by the CEO, concentrating powers and potentially reducing supervisory expertise in decision-making. - Mission recommendations (priority and implementation timing preserved as in source): - Develop a five-year plan to increase MFSA’s budgetary resources, supported by a strong, publicly stated government commitment. (Priority: H; Timing: I; Responsible: OPM, MFIN, MFSA) - Precisely quantify resources needed for risk-based supervision, map required skills, and assess regularly whether strategy and compensation address recruitment and retention. (Priority: MH; Timing: NT; Responsible: MFSA) - Grant full autonomy to the MFSA over the recruitment process and streamline recruitment. (Priority: H; Timing: I; Responsible: OPM, MFIN, MFSA) - Assess regularly whether the total compensation package is sufficiently attractive. (Priority: M; Timing: MT; Responsible: MFSA) - Maintain a dedicated statutory committee focused solely on supervisory issues and reinforce the committee’s independence. (Priority: H; Timing: I; Responsible: OPM, MFSA) ### Supervisory approach, tools, and practices - Current practices: - Mix of on- and offsite supervisory elements used to assess banks’ risks. - Annual Supervisory Priorities document prepared for LSIs and shared with the ECB (for information). - First Supervisory Review and Evaluation Process (SREP) carried out for one high-priority (HP) LSI; led to a conservative capital surcharge commensurate with the bank’s risk levels and controls. - Onsite inspection reports are well written and issued shortly after investigation phase. - Significant attention to corporate governance; regular meetings with CEOs of HP LSIs and largest non-HP LSIs. - Measures addressing credit risk (NPL reduction plans) have helped decrease stock of NPLs. - Shortcomings and needs: - Low frequency of onsite inspections at LSIs; SREP rollout incomplete for all HP LSIs. - Need for more intrusive approach to risk-management processes (asset recovery, related-party transactions, forbearance measures, collateral valuation). - Improve oversight of non-EU branches. - Related parties framework still exhibits significant gaps with Basel Core Principles. - Supervisory follow-up delays: significant delays between end of onsite investigation and supervisory council decisions; low number and limited monetary sanctions; no sanctions against natural persons by MFSA; 27 pending appeals to the Financial Services Tribunal (some dating back to 2009) which have suspensive effects. - Specific supervisory recommendations (excerpted to preserve phrasing and priorities): - Finalize the SREP for all HP LSIs and start the process for non-HP LSIs; analyze recovery plans submitted by all LSIs; review all ICAAP and ILAAP documents and provide feedback. (Priority: H; Timing: NT; Responsible: MFSA) - Comply with minimum engagement level and increase frequency of supervisory interactions with LSIs’ Boards, Board committees, and managing directors. (Priority: MH; Timing: NT; Responsible: MFSA) - Increase number of onsite inspections of LSIs and make onsite inspections more risk-oriented—assess credit risk, liquidity risk, compliance risk, and adequacy of risk management. (Priority: H; Timing: NT; Responsible: MFSA) - Intensify and harmonize follow-up to post-onsite inspection remedial action. (Priority: H; Timing: NT; Responsible: MFSA) - Enhance supervision of third-country branches. (Priority: MH; Timing: NT; Responsible: MFSA) ### Credit risk, NPLs, and provisioning - Findings: - Need to focus supervisory work on main risks: credit risk, liquidity risk, and compliance risk. - Recommendation to review credit files to challenge risk classification and provisioning; intensify follow-up on remediation progress. - Recommendations from Table 1 (credit-related): - Undertake a sector-wide review of credit underwriting standards of mortgages and construction loans, including sampling loan files. (Priority: MH; Timing: NT; Responsible: MFSA) - Give explicit powers to the MFSA to require changes in risk classification and/or additional provisions. (Priority: MH; Timing: NT; Responsible: MFSA) - Specify how the “Reserve for General Banking Risks” ties with the general SSM methodology on Basel Pillar 2. (Priority: M; Timing: MT; Responsible: MFSA) - Develop technical capabilities to assess banks’ methods to calculate expected credit losses under IFRS 9. (Priority: MH; Timing: MT; Responsible: MFSA) - Intensify follow-up of NPLs’ reduction plans and take further actions (e.g., activation of the reserve for excessive NPLs) if needed; reconsider exclusion of two banks. (Priority: H; Timing: I; Responsible: MFSA) ### Related-party transactions and governance - Findings: - Related-party framework improved since 2011 but still has significant gaps relative to Basel Core Principles. - Need to strengthen oversight of related-party lending, expand definition of related-party transactions, and extend requirements to banks’ sister companies. - Recommendation: - Strengthen framework for related-party lending; expand definition; extend requirements to sister companies; strengthen Board involvement; increase MFSA information and powers to mitigate risks. (Priority: H; Timing: NT; Responsible: MFSA) - Governance recommendation: - Conduct regular updated fit-and-proper evaluations of relevant persons, notably when onsite inspections identify serious concerns (e.g., potential breaches of AML requirements). (Priority: H; Timing: NT; Responsible: MFSA) ### Liquidity risk supervision - Findings: - Liquidity risk oversight needs strengthening through more frequent engagement with non-HP LSIs. - Recommendation: - Organize more frequent meetings on liquidity risks with non-HP LSIs. (Priority: MH; Timing: MT; Responsible: MFSA) ### Enforcement, sanctioning, and judicial appeals - Findings: - Decisive supervisory actions have been taken in several instances but not timely. - Long delays between finalization of onsite inspections and supervisory measures. - Low number of monetary sanctions limits deterrent effect; MFSA has never imposed sanctions against natural persons. - Financial Services Tribunal appeals suspend sanctions; MFSA has 27 pending appeals, some dating to 2009, impeding dissuasive sanction policy. - Recommendation: - Take action in a timely manner by reducing the delay between finalization of onsite inspections and supervisory measures. (Priority: H; Timing: NT; Responsible: MFSA) - Authorities encouraged to explore ways to eliminate delays in supervisory action due to judicial appeals, including amending the law if needed. ### AML/CFT supervision — shortcomings and required intensification - Core findings: - AML/CFT supervisory framework has several serious deficiencies. - Number of onsite compliance examinations conducted solely by MFSA, or jointly with FIAU, has been extremely low; onsite review plan not commensurate with banks’ risk profile. - Onsite compliance examinations were short (from one to five days); investigations limited to interviews with Money Laundering Risk Officer and analysis of limited account samples (10 to 30 clients). - In-depth assessment of banks’ ongoing monitoring and transaction screening processes not conducted. - Lengthy process for providing banks with findings of onsite compliance exams—may take up to two years—weakens effectiveness. - Few administrative sanctions imposed by FIAU: none in 2015, three in 2016, and one in 2017; amounts not dissuasive. - Instances where severe compliance exam findings resulted in no sanctions; some banks were not formally instructed to take remedial actions. - MFSA has not used prudential enforcement measures based solely on AML/CFT-related risk management and operational deficiencies. - Recommendation: - Authorities must take a more forceful approach to ensure all banks effectively implement AML/CFT legislation and regulation; recent steps (two in-depth onsite reviews under way at time of mission) should be significantly intensified because money laundering risks remain elevated. ### Key statistics and operational figures (preserved verbatim) - Planned MFSA staff increase: 150 (50 percent) in the next three years (including 20 for the Banking Supervision Unit and 20 for the Enforcement Unit). - Onsite compliance examination durations: from one to five days. - Sample sizes in previous compliance reviews: 10 to 30 clients. - FIAU administrative sanctions: none in 2015, three in 2016, and one in 2017. - Pending appeals to Financial Services Tribunal: 27 (some dating back to 2009). *Source: 1mltea2019006 - 2018. Further information on the FSAP program can be found at http://www.imf.org/external/np/fsap/fssa.aspx (November 6, 2019)* ### 22. Use proactive, preventative, and earlier corrective actions to address risk- ### 22. Use proactive, preventative, and earlier corrective actions to address risk- ### Priority supervisory and AML/CFT recommendations (items 22–31) - 22. Use proactive, preventative, and earlier corrective actions to address risk-management issues. - Priority: H; Timing: NT; Responsible: MFSA - 23. Make more use of monetary fines as part of the sanctioning regime for credit institutions and increase the amount of penalties. - Priority: H; Timing: NT; Responsible: MFSA - 24. Ensure supervisory action is not delayed through judicial appeal, including by amending the law if needed. - Priority: MH; Timing: NT; Responsible: MFIN - 25. Increase the number of onsite AML/CFT compliance examinations of credit institutions. - Priority: H; Timing: I; Responsible: FIAU, MFSA - 26. Revise the scope, duration, depth, intrusiveness, and methodology of the AMFL/CFT compliance examinations. - Priority: H; Timing: NT; Responsible: FIAU, MFSA - 27. Shorten the turnaround time of AML/CFT reviews from initiation to final report, and from the report to final decision. Impose remedial actions. - Priority: H; Timing: I; Responsible: FIAU, MFSA - 28. Simplify the decision-making process. - Priority: H; Timing: NT; Responsible: FIAU - 29. Make more use of monetary fines as part of the sanctioning regime for credit institutions and increase the amount of penalties in case of breach of AML/CFT requirements. - Priority: H; Timing: NT; Responsible: FIAU - 30. Devote more resources to consider AML/CFT risk in risk assessments and supervision of banks. - Priority: H; Timing: I; Responsible: MFSA - 31. Take supervisory measures solely based on AML/CFT-related risk management and operational risk deficiencies. - Priority: H; Timing: NT; Responsible: MFSA ### Introduction — scope and approach - Purpose: present the mission’s assessment of banking supervision based on discussions during the 2018 FSAP mission in Malta. - Reference framework: 2012 edition of the “Basel Core Principles for Effective Banking Supervision” (BCP) used, but no formal BCP assessment contained. - Focus areas: organization and resources of the supervisory authority (CPs 1 and 2) for LSIs and non-EU branches; supervisory approaches and tools (CPs 8 and 9); enforcement and sanctioning framework (CP 11); banks’ governance and risk management (CPs 14 and 15); assessment of risks and capital adequacy (CPs 16, 17, 18, 22, and 23); transactions with related parties (CP 20); liquidity risk analysis (CP 24); AML/CFT supervision (part of CP 29). Licensing (CP 4) not included. - Timing of assessment: legal, regulatory framework, and supervisory practices as they existed in September 2018. - Coordination: consistent with other FSAPs in the EA and coordinated with missions for France and Italy. ### Institutional setting and MFSA role - EU and SSM context: - Banking activities regulated mainly under EU rules; harmonized approach lacking in some risk areas, particularly major acquisitions and transactions with related parties. - With SSM introduction in November 2014, MFSA’s scope changed: ECB directly supervises 129 SIs; NCAs supervise LSIs under ECB oversight. - National authorities remain responsible for AML/CFT in both SIs and LSIs. - MFSA responsibilities and structure: - MFSA is the supervisory authority for Malta’s financial system and the NCA for banking within the SSM. - MFSA supervises three Maltese banks designated as SIs (day-to-day offsite supervision conducted by JSTs led by ECB coordinators). - MFSA directly supervises LSIs: 18 banks, and two non-EU branches. - For LSIs, the ECB receives mandatory reporting by NCAs and ex ante notifications on certain supervisory actions; more granular for HP LSIs. - Governance and funding: - MFSA is autonomous under the MFSA Act; headed by a chairperson and Board of Governors; CEO designated by the Board. Terms of office not to exceed five years. - Supervisory council issues authorizations and takes actions; composed of director-general in charge of supervision and directors for key supervision areas. - Funding: MFSA has its own budget; separation of Registry of Companies in April 2018 redirected registry revenues (accounting for 58 percent of MFSA’s funding source in 2017) to the government; MFSA resources now provided by the government’s consolidated fund and supervisory fees. ### Market structure — size and bank categories - System size and exposure: - Banks, insurance companies, and investment funds amounted to about 6½ times GDP in 2017, of which banks stood at 4⅓ times GDP. - Nonresident deposits are an important funding source and may be vulnerable to tax, legal changes abroad, and reputational risk. - Banks classified by authorities into three categories: - Core domestic banks: mainly domestic exposures; attract household and corporate deposits and lend mostly domestically; account for all mortgages to residents. The three largest banks (Bank of Valletta, HSBC Bank Malta, and MeDirect) hold 87 percent of category assets (42 percent of total bank assets) and account for 80.5 percent of all mortgages. - Noncore domestic banks: small, foreign-owned, primarily funded from wholesale markets and nonresident deposits; business models vary. - International banks: foreign owned, insignificant domestic exposures; rely on wholesale funding and focus on group activities. - ECB classification for supervisory purposes: - SIs: 320 (EUR, billion?) — presented in source table; SIs include the three largest core domestic banks. - LSIs: 188 (EUR, billion?) and comprise 18 banks (16 percent of system assets). - Third-country branches: 219 (EUR, billion?), other: 21 (EUR, billion?); note: the table in source lists assets and percent of GDP and percent of system but should be read directly in the source for precise alignment. ### Main findings — progress and organization - Progress since previous FSAP: - Major structural changes since 2003: EU membership (May 2004), euro adoption (2008), establishment of SSM (2014) improved prudential regulation and supervision. - Authorities implemented many 2003 FSAP recommendations: transposition/implementation of EU directives and regulations, broadened definition of related parties, set administrative penalties in subsidiary legislation, increased supervisory resources. - MFSA organization and powers: - MFSA internal units (as named in source): Banking Supervision Unit (BSU); Conduct Supervision Unit; Insurance and Pensions Supervision Unit; Securities and Markets Supervision Unit; Regulatory Development Unit (RDU); Authorization Unit; Enforcement Unit (responsible for AML supervision and investigations). - Recent organizational changes: Enforcement Unit set up in 2012; separation of conduct and prudential supervision in 2015; BSU restructuring after SSM introduction; analysts reallocated to risk-area responsibilities; proposed new organizational structure (not yet implemented) would bring AML/CFT team under supervision and strengthen enforcement resources; change requires modification of MFSA Act and raises concerns. - MFSA has broad legal powers (withdrawal/restriction of license, fines and penalties, directives, removal of managers). Article 17E of the Banking Act empowers measures at an early stage (referencing Regulation 9 of Supervisory Review Regulations Subsidiary Legislation 371.16). - Identified legal and supervisory gaps: - MFSA lacks explicit authority to force a bank or banking group to change organizational structure, or to impose/ facilitate a merger or purchase of a credit institution; Article 17E references powers but regulations do not explicitly include power to change organization or impose a merger. - No explicit legal requirement for banks to communicate substantive changes or materially adverse developments to the MFSA, although corporate questionnaire at authorization asks for such notification. - MFSA lacks power to review activities of companies affiliated with a bank’s parent to determine impact on bank safety and soundness. - No explicit requirement to notify MFSA when banks become aware of material information negatively affecting suitability, fitness, and propriety of significant shareholders or controllers. - Concerning major acquisitions: a credit institution cannot, without MFSA consent, acquire or hold shares in another company (not a credit institution) when share exceeds 5 percent of that company's issued share capital (Art. 15.1(d) Banking Act). No authorization or prior notification specified when a Maltese credit institution wants to acquire a minority stake in a bank abroad. No comprehensive regime governing major investment or internal procedures/criteria for assessing major acquisitions by credit institutions. *Source: IMF technical note prepared for the 2018 FSAP mission on Malta (assessment of banking supervision, period September 12–27, 2018).* ### 22. The MFSA, largely, has the supervisory authority to carry out its tasks, but aspects of ### 22. The MFSA, largely, has the supervisory authority to carry out its tasks, but aspects of operational independence are of concern. The necessary preconditions for operational independence are not fully met. ### Operational independence — findings - The need to annually negotiate for governmental and parliamentary approvals of the budget introduces a degree of uncertainty, especially in a context where expenditures will have to increase to support the expansion of staff resources, as currently envisaged by the MFSA. - International standards require budgetary processes that do not undermine autonomy and adequacy of resources. - Until recently, the budget was funded solely from the MFSA’s own resources, that is, supervisory fees and revenues from the Registry of Companies. This is no longer the case since the separation of the registry from the MFSA, which resulted from the latest revision of the MFSA Act in 2018. - Supervisory fees only covered 40 percent of the MFSA’s total expenses (in 2017) and, to allow the MFSA to carry out its functions going forward, the funding shortfall will be paid out of the Maltese government’s consolidated fund. - The MFSA budget for 2019 has been endorsed by the government and remains to be approved by the Parliament. - The MFSA has prepared a multiyear forecast (2019–2021), which shows a significant increase of expenditures, requiring higher government contributions. - The MFSA has explained that these projections have been approved verbally by the MFIN, but no written document materializing this commitment has been shared with the mission. ### Budget and financial projections (Table 3: Malta: Budget and Financial Projections for the MFSA, 2016–2021 (in thousands of euros)) - MFSA Revenues: - 2016: 23,038 - 2017: 25,053 - 2018: 16,108 (1,2/) - 2019: 12,331 - 2020: 13,448 - 2021: 14,625 - Government Subventions: - 2016: - - 2017: - - 2018: 4,869 - 2019: 12,915 - 2020: 14,698 - 2021: 16,311 - Expenditures: - 2016: (15,183) - 2017: (17,615) - 2018: (20,996) - 2019: (25,247) - 2020: (28,186) - 2021: (30,937) - of which HR: - 2016: (9,445) - 2017: (10,831) - 2018: (11,603) - 2019: (13,730) - 2020: (15,370) - 2021: (16,840) - Source note highlights: - 1/ Until 2017, revenues were higher than expenses, and the MFSA passed on the balance to the consolidated fund. - 2/ The revenues in 2018 include fees (full year) and revenues from the ROC (perceived until May 2018). ### Governance and proposed reorganization — findings and concerns - Elements of a proposed reorganization would transfer all supervisory powers to the MFSA’s executive committee in charge of day-to-day management; this proposal requires amendments to the MFSA Act and has already been sent to the parliament. - The proposed executive committee composition: - Headed by the CEO and comprise the general counsel and several chief officers in charge of: (1) supervision; (2) strategy, policy, and innovation; (3) enforcement; and (4) operations, including human resources. - Positive aspect noted: - Involving the general counsel and the head of the Enforcement Unit in the supervisory process is welcome (currently neither participate in meetings of the supervisory council). - Key concerns: - The executive committee would include members who do not have any supervisory experience; directors of supervisory units (including the director of the BSU, who is a member of the SSM Supervisory Board) would no longer participate in decision-making. - Decisions on supervisory measures and sanctions require in-depth assessment and potentially lengthy meetings; creating a decision-making body in charge of all aspects (managerial, operational, human resources, etc.) might not ensure enough attention, time, and resources at the highest level for supervisory measures on individual credit institutions. - Apart from the CEO, the executive committee would be solely composed of chief officers who report to the CEO and could be removed, leading de facto to high concentration of power in a single individual. - No external member would be included who might bring an independent view; no ex post report on the activities of the executive committee would be sent to the MFSA Board of Governors, unlike the current practice. - Structural independence gaps identified: - (1) There is no legal provision in the MFSA Act conferring operational independence upon the supervisory council. - (2) There are no predetermined criteria outlining the conditions under which the council’s members can be removed; the MFSA explained the MFSA Staff Handbook would be used as a reference, but committee members making supervisory decisions should not be treated like any other staff member. - (3) There is no explicit provision in the legislation for the members of the Board or of the supervisory council not to take or seek instructions from the government or other state authorities. - (4) Reasons behind removal of MFSA Board members are notified in the government gazette, but this procedure is not applicable to council members. ### Cooling-off period and conflicts of interest — findings - Cooling-off period rules: - Staff from supervisory units who are resigning or terminating their employment shall not work for any entity that is licensed and regulated by the MFSA for an aggregate period of six months after they demit office. - For staff employed prior to October 2005, the cooling-off period is reduced to two months after they demit office. - The cooling-off period is not applicable when staff members join entities or firms that are not regulated by the MFSA, such as professional associations, audit firms, or consultancy firms. - Implementation issues: - The cooling-off period is short and is rarely implemented. - MFSA’s Ethics Framework (Article 9.9) states “members should avoid creating conflict of interest in any activities they may undertake following the termination of their employment.” No mechanism (for example, preliminary examination by an ethics committee) is in place to ensure rigorous enforcement. - Footnote development: - Following discussions and after completion of the field mission, the MFSA has proposed and the government has agreed to introduction of an independent enforcement decisions committee in the amendments to the MFSA Act currently before parliament; the FSAP mission did not review these new amendments, and the assessment was based on information available as of September 26, 2018. ### Recommendations (independent and governance) - Amend the legal framework and increase the MFSA’s legal powers and banks’ obligations in relation to: - (1) the change of legal structures; - (2) major acquisitions; - (3) review of the activities of companies affiliated to banks’ parent companies; - (4) communication of materially adverse developments. - Maintain a dedicated statutory committee focusing solely on supervisory issues and reinforce the supervisory council’s independence. - Ensure the MFSA’s Board of Governors is fully informed on a regular basis about the individual conditions of banks and detailed supervisory decisions made by the council. - Consider involving independent external members in the supervisory council. - Develop a five-year plan to increase the MFSA’s budgetary resources and capacity to reflect the size and importance of the financial sector in Malta; it should be supported by a strong, publicly announced commitment from the government, including a multiyear budget commitment to address lack of budgetary certainty in the current annual process. - Grant the MFSA full autonomy over the recruitment process. - Reduce potential conflicts of interest by: - (1) imposing a longer cooling-off period when staff leave the MFSA to join the banking industry; and - (2) setting up an ethics committee. ### Supervisory resources — findings - Resourcing of the banking supervisory function is currently insufficient despite recent progress. - Resources increased since 2003 but have not kept pace with increased demands from EU directives, the Basel Committee, the EBA, and other international bodies, and higher expectations of supervisors. - An independent report (2017) highlighted: - (1) integration into the SSM has led to a relative reduction of resources available for the supervision of LSIs; and - (2) the Enforcement Unit required additional staff. - Corrective measures taken by the MFSA; full-time employees (FTEs) devoted to banking supervision have significantly increased since 2015, but resources remain insufficient for effective banking supervision. - Evidence of resource constraints: - difficulties with planning and execution of supervision actions for LSIs (inspections postponed; most recovery plans and ICAAP documents need to be reviewed; difficulty maintaining regular contacts with all LSIs); - inadequate frequency of supervisory inspections at LSIs. - MFSA intends to increase the BSU’s staff by 20 people over the next three years, but there are no assurances the proposed increase in headcount has been adequately calibrated or that MFSA will be able to recruit the required profile. - The MFSA has not yet carried out a mapping of the skills needed in its supervisory process, nor conducts annual planning exercises to assess the impact of supervisory priorities on staffing and capacity-building needs. ### BSU FTEs (Table 4: Malta: FTEs Available for the Banking Supervision Unit (BSU), 2015–2017) - Financial institutions: - 2015: 3 - 2016: 4 - 2017: 5 - Ongoing: - 2015: 9 - 2016: 12 - 2017: 13 - JSTs: - 2015: 6 - 2016: 10 - 2017: 9 - Onsite: - 2015: 10 - 2016: 9 - 2017: 8 - Other: - 2015: 6 - 2016: 7 - 2017: 10 - Total: - 2015: 34 - 2016: 42 - 2017: 45 - Source: MFSA (FTEs approved). ### Recruitment, retention, and compensation — findings - Recruitment is challenging in a small labor market with shortages of specific skills (IT specialists, experts in risk management, statisticians); MFSA competes with the banking industry. - Compensation: - MFSA compensation structure is independent and different from public servant’s salary and CBM salary scales; originally devised to be competitive with the private sector. - External audit (ThinkTalent, 2017) found salaries and compensation at entry level compare favorably with the banking industry; for management functions (senior analyst to director), remuneration scales are slightly below or significantly below industry benchmarks. - MFSA recruitment process was identified as excessively rigid, bureaucratic, and too lengthy, causing difficulties in attracting and retaining qualified staff. - Turnover rate increased over the past years and stood at 10.5 percent in 2017. - New Human Resources Strategy: recruitment streamlined; salary scale adjusted upward (by 5 percent in the best case); a variable remuneration scheme introduced; MFSA works closely with recruitment agencies. - Additional measures and time will be needed to yield results; impact should be regularly assessed to ensure employee value proposition effectively addresses recruitment and retention difficulties. ### Recommendations (resourcing and staffing) - Continue increasing the number of supervisory staff and broaden the skills mix to include IT and risk management; initiate a thorough evaluation of staffing and capacity-building needs and carry out a mapping of needed skills. - Further streamline the recruitment process, make it more flexible, and reduce time needed for new hires to become operational. - Assess on a regular basis whether the whole compensation package is attractive enough and whether it effectively addresses the difficulty in recruiting and retaining staff members. ### Supervisory approach — LSIs (findings) - The MFSA uses a reasonable range of techniques and tools to implement its supervisory approach, including monitoring macroeconomic and sector-wide developments and a mix of on- and offsite supervisory elements to assess banks’ risks. - In accordance with SSM procedures, a distinction is made between three HP LSIs (and another bank treated as a HP LSI) and the others; classification is carried out using the SSM LSI prioritization methodology. - The BSU prepares an annual Supervisory Priorities document for LSIs assessing key risks and expected developments; 2016–2018 priorities included business models, internal governance, credit risk and NPLs, and capital adequacy. - Shortcomings in translating priorities into actions: - Example: 2016 priority on credit risk/NPLs and concentration risk envisaged visits to assess NPL situation and adherence to EBA ITS on forbearance and NPE — in practice only one visit was organized. - Example: 2017 priority to assess business model of online banking — FSAP mission team did not see evidence of such analyses. - The MFSA relies on a four-level minimum engagement level (MEL) framework to decide intensity of SREP assessment (frequency, scope, granularity); levels 1–2 subject banks to more intense supervisory approach. - While meetings are organized regularly and in line with MEL for HP LSIs and largest non-HP LSIs (70 meetings in 2017), BSU has struggled to maintain similar contact with Boards of the smallest credit institutions due to lack of resources. *Source: MFSA; content as presented in the referenced IMF document.* ### 32. The ongoing supervision function is tasked with undertaking regular analyses of ### 32. The ongoing supervision function is tasked with undertaking regular analyses of ### Ongoing supervision and risk assessment methodology - Supervisory methodologies are intended to be fully aligned with the SSM Supervisory Manual for SIs but applied on a somewhat proportionate basis. - For HP LSIs, the BSU intends to undertake an in-depth analysis of: - risk level (quantitative) and risk controls (qualitative) in line with the SSM’s SREP Methodology for LSIs. - For non-HP LSIs, the BSU uses an in-house risk assessment tool (RAT), which is based on the EBA SREP guidelines and aligned to the extent possible to the SSM SREP Methodology for LSIs. - Outcome of risk assessment systems: - A 1–4 risk score (the risk assessment score (RAS)), based on EBA definitions. - RAS score grading: 1 = “low risk” to 4 = “high risk.” - Risk level and risk control grades are averaged for each category, weighted by business model and risk profile, with material risks assigned a higher weight, and summed to an overall score from 1 to 4. - By 2020, in line with SSM requirements, all LSIs shall be subject to the SSM methodology. ### Recovery plans and crisis management - The BSU has collected recovery plans for all LSIs. - Initial review in 2017 revealed recovery plans were heterogeneous and not always in line with supervisory expectations; MFSA provided feedback. - Thorough analysis was performed on the recovery plan prepared by one HP LSI as part of the SREP exercise. - Review of recovery plans for other LSIs has not yet been completed, largely due to a lack of resources. - A distinct crisis management team within the LSI ongoing supervision section did not provide expected results; decision made to merge the crisis management team with the monitoring team of bank analysts, who will be charged with reviewing recovery plans. ### Prudential reporting, data quality, and key risk indicators - Checks on accuracy and consistency of prudential returns are carried out manually or semi-automatically, which is time consuming. - Checks performed by the MFSA have been defined by the EBA and cover all banks. Additional controls defined and performed by the ECB solely cover SIs. - MFSA intends to build an automated tool that will run all tests (EBA and ECB) for all banks (SIs and LSIs); the date of completion of this IT project has not yet been confirmed. - The implementation team has developed key risk indicators (KRI) fed by the COREP and FINREP returns; this report signals trends and outliers. ### Onsite inspection frequency, scope, and follow-up - Target frequencies: - HP LSIs: onsite inspections on a yearly basis. - Non-HP LSIs: onsite visits based on a supervisory cycle of 24 to 36 months. - Actual frequency constrained by limited resources and SI priority; number of onsite inspections at LSIs: - six missions in 2015, - five (including two follow-up missions) in 2016, - two in 2017. - Onsite methodology aligned, with proportionality, to the SSM methodology; since 2016 eight thematic reviews of internal governance have been conducted through short onsite visits. - Focus of onsite inspections: - Primarily governance and ICAAP; much less focus on credit risk. - Few comprehensive in-depth onsite reviews assessing banks’ credit risk management policies and practices have been conducted since 2013. - Only one credit file review performed by onsite examiners (in 2016 as part of a mission led by the ECB). - Compliance risk has never been subject to an onsite inspection. - Follow-up weaknesses: - Remedial measures with timelines are not systemically requested. - Monitoring of remedial progress could be improved with follow-up tools (recommendation table, action plans, BSU analysis). - Involving the ongoing (offsite) team in follow-up is expected to improve monitoring. - BSU should spend less time debating findings with banks post-inspection and take a tougher stance on remedial actions. ### Sectoral analyses and risk monitoring - The RDU performs regular assessments of system-wide banking risks using the Banking Risk Dashboard extracting microdata from FINREP and COREP returns. - Dashboard capabilities: - Calculation of key indicators for each credit institution. - Aggregation by macro dimensions: entire banking system, core banks, noncore banks, and international banks. - Additional RDU tools: - Malta Financial Stress Index tracking key indicators relevant to banking system and real economy. - A credit-to-GDP gap indicator. - Various property price valuation metrics to assess the real estate market. - Main conclusions are formally communicated via the Financial Stability Monitor report and risk updates to the supervisory council. - Enhanced information sharing across MFSA units and further work is needed concerning mortgage loans. ### Supervision of non-EEA (third-country) branches - MFSA is directly responsible for supervision of all non-EEA branches. - MFSA has signed a Memorandum of Understanding (MoU) with 30 foreign authorities, including the Turkish Banking Regulation and Supervision Agency. - Two Turkish branches operate in Malta under licensing agreements exempting them from all prudential rules in Malta on grounds that non-performing loans would be taken over by Head Office. - Concerns and deficiencies: - MFSA has limited understanding of the Turkish branches’ business models. - BSU has not conducted onsite inspections of these branches since 2010 and 2012 respectively to verify compliance with licensing conditions; meetings with local management not organized regularly. - Latest onsite AML/CFT visit occurred in 2014 for one branch; the other has not been subject to a compliance examination. - MFSA does not participate in non-EEA supervisory colleges; has not always received copies of home supervisor inspection reports and has not communicated detailed expectations regarding governance, risk management, or assessment of local management. - These two branches account for 39 percent of total banks’ assets (the three SIs account for 42 percent). - Domestic liabilities are negligible and deposits are not covered by Malta’s deposit insurance scheme, but operations in Malta expose authorities to reputational risk. ### Recommendations (extract) - Finalize the SREP for all HP LSIs, start the process for non-HP LSIs, and review all recovery plans. - Increase the frequency of supervisory interactions with banks’ Boards of Directors, Board committees, and the managing directors of all LSIs. - Increase the number of onsite inspections of LSIs, and make onsite inspections more risk oriented, assessing the extent of credit risk, liquidity risk, and compliance risk, and the adequacy of risk management. - Intensify and harmonize follow-ups to post-onsite inspection remedial actions, define systematically the timeframe within which banks’ corrective actions must be taken, and involve the ongoing (offsite) team in monitoring remedial progress. - Effectively supervise third-country branches and include branches in the onsite inspection program (onsite visits or spot checks). Going forward, the supervision of systemically important third-country branches should be transferred to the SSM, as recommended by the EA 2018 FSAP. ### Capital adequacy and SREP implementation - Prescribed capital requirements are subject to maximum harmonization in the EU under the CRR; CRD IV gives some national discretion on macroprudential buffers. - In Malta, the CBM is the macroprudential authority. A Joint Financial Stability Board (JFSB) comprises five voting members: the CBM governor (chairperson), the two CBM deputy governors, and the MFSA’s chairperson and CEO. - Malta’s macroprudential toolkit contains all instruments provided for in the EU CRR/CRD IV. Measures phased in include additional capital buffers for three banks identified as other systemically important institutions. - Countercyclical capital buffer framework implemented; buffer rate set at 0 percent given low and negative levels of the credit-to-GDP gap. - Total amount of CET1 that banks are expected to hold is determined by the SREP. Pillar 2 add-on comprises: - Pillar 2 requirement (P2R) — binding requirement. - Pillar 2 guidance (P2G) — non-binding but expected to be met; MFSA applies a 1 percent floor to P2G. - LSIs: SREP decisions are taken by NCAs and the ECB is informed. - MFSA implementation timeline and status: - MFSA has started to implement the SSM SREP methodology for LSIs. P2R and P2G are assigned on the basis of the SREP score and supervisory stress tests. - Initial plan: full SREP on all HP LSIs by end of 2018, SREP on remaining LSIs by end-2020; standard assessment frequency thereafter: annual for HP LSIs, once every two years for medium-priority LSIs, and once every three years for low-priority LSIs. - The LSIs SSM methodology relies on four elements: (1) business model and profitability assessment; (2) internal governance and risk management assessment; (3) risk-by-risk assessment of risks to capital; (4) risk-by-risk assessment of risks to liquidity and funding. - At the time of the FSAP mission: - A full SREP had been completed for one of the three HP LSIs. - MFSA is slightly behind schedule; exercise likely to be finalized in Q1 2019 for the three HP LSIs. - More resources will be needed to avoid deviating substantially from the initial plan and to start SREP for non-HP LSIs. - MFSA adopted a conservative stance on P2R and P2G for the one HP LSI assessed, assigning additional P2R well above the SSM average; thorough analyses and in-depth assessment were performed by the BSU with strong ECB support. - The MFSA applies a 1 percent floor to P2G. - Main challenge: replicate the same exercise annually while spending less than six to eight months to complete the process. - Table 5: Implementation of SREP: Tentative Calendar - Bank HP LSI 1 Done - HP LSI 2 Initial estimated SREP completion Q3 2018 - HP LSI 3 Initial estimated SREP completion Q3 2018 *Source: MFSA; INTERNATIONAL MONETARY FUND.* ### 46. The BSU has started to provide feedback to LSIs about the quality of their submitted ### 1mltea2019006 - 46. The BSU has started to provide feedback to LSIs about the quality of their submitted ### SREP implementation and ICAAP feedback - The BSU has started to provide feedback to LSIs about the quality of their submitted ICAAP documents; a first detailed and substantiated letter has been sent to one HP LSI (as part of the SREP). - For the one HP LSI with the first SREP completed: - A presentation of the findings of the 2017 SREP exercise took place in early 2018. - The official final SREP letter (with official notification of the outcome of the 2017 SREP) has not been sent yet to the ECB or to the bank. - The bank has already raised equity to comply with the P2R, which was communicated by the MFSA. - For this bank, the 2018 exercise has not yet started. Recommendations (from this section) - Finalize the implementation of the SREP for all LSIs. - Provide feedback on ICAAP submissions. ### Supervision of credit risk and problem assets — framework and assessment - The MFSA’s regulation on credit risk is detailed and comprehensive; definitions of NPLs and forbearance measures are aligned with CRR and EBA ITS, which Banking Rule BR/09 directly refers to. - Credit risk is assessed extensively as part of the SREP and is the main source of risk for HP LSIs; the score assigned to credit risk appears to be the main driver of the Pillar 2 capital requirement. - The BSU relies on methodologies laid down in the SSM SREP manual for LSIs and has developed an MFSA internal credit risk methodology providing further guidance. - Ad hoc questions and granular data requests are used to inform meetings with banks; BSU may request granular information concerning loans and collateral. Findings on onsite examinations and file reviews - Onsite examinations of credit risk have rarely been carried out since 2013; the ongoing assessment is to be complemented by onsite inspections. - MFSA description of examiners’ work includes selecting a sample of credits (including all internally classified credits) and evaluating underwriting standards, management oversight, and internal classification. - In practice, since 2013 only one targeted onsite inspection including comprehensive credit risk assessment (sample credit-file review and analysis of credit risk management policies and practices) has been conducted. - One credit file review was performed by onsite examiners in 2016 during a mission led by the ECB. - Limited sample reviews identified issues with quality of documentation but did not lead to adjustments in classification or provisioning. - Supervisory priorities for 2016 referred to onsite visits to assess the NPL situation and verify adherence to EBA ITS on forbearance and NPE, but such visits were not conducted. - The MFSA is not legally empowered to require a change in the risk classification and/or additional provisions when it is considered appropriate. ### NPL reduction plans and outcomes - BR/09 was amended in December 2016 to introduce NPL-reduction plans; credit institutions are bound to maintain a NPL ratio below 6 percent at any point in time. - Credit institutions whose two-year average NPL ratio exceeded 6 percent at the time the rule was published were required to submit multiyear NPL reduction plans. - The MFSA indicated unjustified deviations from phases of the reduction plan could lead to requiring banks to accumulate an additional capital reserve (reserve for excessive NPLs). - Seven banks were required to draw up a multiyear NPL reduction plan. - Sectoral NPLs declined from more than 5 percent in December 2014 to 3 percent at end-2017. Notable bank-specific issues - One bank did not submit a plan and after an initial drop in 2017 its NPLs increased to 9.6 percent at end-December 2017; as of September 2018 no final decision had been taken by BSU and RDU on requesting a plan. - For one bank the share of NPLs was 40.2 percent in September 2017 and 4.7 percent in December 2017; MFSA did not request a NPL reduction plan on assumption data were not accurate. - For another bank the NPL reduction plan was not approved and MFSA did not request the bank to calculate a reserve for excessive NPLs despite high NPLs (above 16 percent of exposures). - The impact of plans on NPL levels is assessed yearly by banks and MFSA; MFSA’s quarterly key risk indicators cannot check compliance with static-portfolio NPL reduction plans (static portfolio nonperforming share is only available at year-end). Process gaps - Onsite inspections or thematic reviews focused on plan implementation and credit file reviews to identify misclassification and under-provisioning were not used but could have improved assessment of plan effectiveness. - A memo summarizing main conclusions from plan reviews was not formalized and sent to the supervisory council. ### Reserve for General Banking Risks and Pillar 2 linkage - A Reserve for General Banking Risks was established by BR/09 equal to 2.5 percent of the regulatory allocation, defined as the difference between a credit institution’s level of NPLs less the specific reserves calculated under accounting rules (the uncovered portion of NPLs). - The MFSA considers the allocation of funds to this reserve as a Pillar 2 measure; appropriation to the Reserve for General Banking Risks shall be affected from the profits for the year. - Where a credit institution has total CET 1 which exceeds a threshold determined by the authority, only half (50 percent) of the appropriation has to be allocated to the Reserve for General Banking Risks from the profits for the year. - Further clarity is needed because (1) the threshold has not been defined by the MFSA; and (2) it is unclear how the calculation of this reserve ties with the general rules specifying the calibration of the Pillar 2 surcharge. ### IFRS 9 implementation and ECL - IFRS 9 implemented in January 2018 shifted measurement of accounting reserves from an incurred losses model to an expected credit losses (ECL) approach. - At the time of the FSAP mission, the impact of the new approach on CET1 had not been measured. - Under IAS 39 loss allowances were recorded for impaired exposures; IFRS 9 requires a 12-month ECL allowance for all credit exposures not measured at fair value through profit or loss (stage 1), larger allowance for significantly deteriorated exposures (stage 2), and stage 3 similar to IAS 39 impaired exposures. - The MFSA should develop technical capabilities and collaborate with external legal auditors to assess methods employed by credit institutions to calculate ECL and ensure loan-loss allowances are adequately calibrated. ### Credit risk from mortgages and construction loans - Exposure to the housing market (mortgages, construction loans, real estate activities) in the aggregate banking sector is roughly 60 percent of total lending to the private sector; mortgages comprise 45 percent of total lending. - Since 2016, RDU and CBM have undertaken a quarterly granular data-gathering exercise covering samples of new loans to assess lending practices and provide granular borrower information; the spreadsheet details characteristics of newly originated mortgage loans. - The spreadsheet revealed several banks are granting mortgages with long maturity (up to 40 years) and “balloon repayment” features; for one bank, mortgages with “balloon repayment” account for 24 percent of newly originated mortgage loans included in the survey. - The spreadsheet had not been shared internally with the BSU at the time of the FSAP mission and had not led to further analyses to assess accuracy or representativeness. - Industry view: a sharp decrease in real estate prices would not trigger increased default rates for primary residences, but buy-to-let mortgages and construction loans are more vulnerable. - Issues noted: some developers have limited experience managing construction costs and limited equity; lending standards differ substantially across banks; lack of professional appraisers (valuations often by architects, potential conflicts of interest); lengthy court proceedings and difficulty realizing collateral impede recovery (loans extended to developers who defaulted in 2008–2009 remain difficult to recover). - Few credit file reviews have been conducted by the MFSA; no review of collateral valuation processes and asset recovery functions has been carried out. Recommendations (credit risk, NPLs, IFRS 9, mortgages/construction) - Increase the frequency of onsite examinations assessing the extent of credit risk and the adequacy of risk management. - Intensify follow-up of banks’ implementation of NPL reduction plans (including increasing compliance assessment frequency from yearly to quarterly) and use further action, such as activation of the reserve for excessive NPLs, if needed. - Reconsider exclusion of one bank from submitting a NPL reduction plan after analyzing quality of data submitted to the MFSA. - Undertake a banking-sector-wide review (including sampling loan files) of credit underwriting standards of mortgages and construction loans (corporate loans to real estate developers). - Give explicit powers to the MFSA to require a change in risk classification and/or additional provisions when appropriate. - Specify how the Reserve for General Banking Risks ties with the general SSM methodology governing calculation of the Pillar 2 surcharge. - Intensify MFSA collaboration with legal auditors and develop MFSA technical capabilities to assess banks’ methods to calculate expected credit losses (ECL) under IFRS 9. *Source: 1mltea2019006 — IMF staff report text provided.* ### 57. Liquidity requirements are subject to maximum harmonization in the EU. Banks submit ### 1mltea2019006 - 57. Liquidity requirements are subject to maximum harmonization in the EU. Banks submit ### Liquidity requirements and reporting - Liquidity Coverage Ratio (LCR) is submitted monthly; Net Stable Funding Ratio (NSFR) is submitted quarterly. - LCR and NSFR reporting and requirements follow EU rules and CRR provisions; CRR is supplemented by Commission Delegated Regulation (EU) 2015/61 for LCR calculation details. - Legal basis: Article 86 of CRD IV transposed into Annex 2B of the BR/12 requires credit institutions to maintain sufficient liquidity to withstand a range of stresses and to have robust liquidity management frameworks, covering intraday and multiple time horizons. - NSFR: "not yet a binding minimum standard in the EU" and is subject to an observation period. ### Approaches to assessment of liquidity and funding risks - Three complementary approaches: - The supervisory view based on SREP results, considering prudential ratios and internal risk controls and policies. - Banks’ perspective based on internal assessment of liquidity adequacy (ILAAP) and funding plans (only for the largest banks). - A forward-looking approach based on stress tests carried out by the CBM. ### SREP, supervisory practices, and coverage of LSIs - The SSM LSIs SREP methodology includes assessment of short-term liquidity risk and funding sustainability risk. - MFSA has its own detailed guidelines: “Procedures Notes—Assessment of Liquidity and Funding Risk” for offsite analysts. - Status of SREP reviews (as of the report): - A full SREP completed for one HP LSI; another SREP expected to be finalized shortly. - Reviews of the remaining HP LSI and another LSI expected to be completed by the end of Q1 2019. - By end-Q1 2019, MFSA expected to have significantly enhanced understanding of liquidity and funding risks faced by HP LSIs. - For other LSIs: - SREP had not yet started for non-HP LSIs at time of mission. - ILAAP documents had been submitted and were being analyzed by MFSA; no feedback provided yet. - Only one non-HP LSI had been requested to submit a funding plan (funding plans are required annually per BR/16 for institutions representing a material share of the banking system). - Liquidity risk is not subject to onsite inspections for many LSIs (no targeted inspection ever organized; full-scope inspections rather seldom). ### Key liquidity metrics (exact figures) - LCR as of end-2017: - Core domestic banks: 183.8 percent - Noncore domestic banks: 263.9 percent - International banks: 280.7 percent - Customer loan-to-deposit ratio: - Core domestic banks: 58.9 percent - Noncore domestic banks: 47 percent - Observations: - Despite high LCRs and low loan-to-deposit ratios on average, some banks are vulnerable due to reliance on wholesale funding and substantial share of deposits held by nonresidents. - The Financial Stability Risk Identification and Monitoring report (RDU, February 2018) highlighted a surge of deposits held by noncore and international banks and recommended close monitoring of funding models of LSIs and whether banks follow authorized business models. ### Identified gaps and rule inconsistencies - BR/05 on liquidity requirements is inconsistent with the CRR: it contains a minimum asset requirement and still refers to the Maltese lira. Recommendation to amend or remove BR/05. ### Recommendations on liquidity supervision - Organize more frequent meetings on liquidity risks with LSIs, which are subject to SREP once every two to three years. - Increase the frequency of onsite assessments of liquidity risk (targeted or full-scope missions); consider a horizontal review given resource constraints. - Review ILAAP documents and provide feedback to banks. ### Governance and risk management frameworks - BR/12 transposes CRD IV governance and risk management provisions: - Article 13: internal governance arrangements—clear organizational structure, processes to identify/manage/monitor/report risks, adequate internal controls. - Article 14: Board responsibility for business strategy, organization, internal controls, risk appetite, allocation of responsibilities, reporting lines, and organization of internal controls. - Proportionality principle applied; technical criteria detailed in Annex 2B. - EBA internal governance principles expected to be followed; these guidelines were not yet legally binding at the time (deadline for implementation mid-2018); MFSA committed to implementing them “in the near future.” ### Observed governance weaknesses - Onsite reports and offsite analyses identified deficiencies: - Inadequate Board composition and Board committee functioning (Board size not commensurate with risk profile; inappropriate mix of independent and non-independent directors). - Ownership concentration issues: some LSIs have a single ultimate beneficial owner who is a private individual—requiring enhanced supervisory oversight. - Limited awareness among Boards and senior management. - MFSA supervisory actions on governance: - Full-scope inspections always include governance review; targeted inspections and thematic reviews conducted. - Onsite inspectors guided by SSM Manual Chapter 6 and ECB Joint Standard on conduct of onsite inspections at LSIs. - Detected governance deficiencies have led to administrative penalties in two cases. - Little analysis so far on whether weak governance translated into excessive risk-taking. ### SREP role in governance assessment - SREP assesses: - Internal governance framework including key control functions (risk management, internal audit, compliance). - Risk-management framework and risk culture. - Risk infrastructure, internal data, and reporting. - Emphasis on adequacy, independence, and resourcing of risk management functions, and on the Chief Risk Officer (CRO) role and capabilities. - At time of assessment, only one full LSI SREP completed. ### ICAAP/ILAAP - Reviews and evaluations of ICAAP and ILAAP have commenced as part of annual SREP; outcomes feed into Pillar 2 capital and liquidity requirements. - Article 17C of the Banking Act transposes Article 73 of CRD IV requiring internal adequacy assessment processes. - ECB published supervisory expectations on ICAAP and ILAAP in January 2016 (directed at SIs); MFSA encouraged LSIs to refer to them. - MFSA has collected ICAAP and ILAAP for all LSIs; reviews of submissions not yet completed. ### Remuneration policies - BR/12 transposes Articles 92–95 of CRD into Annex 2E: remuneration policies for staff with material impact on risk profile must ensure consistency with sound and effective risk management and provide incentives for prudent and sustainable risk taking. - Disclosure requirements: detailed information on remuneration policies and aggregated amounts for staff with material impact. - Significant institutions must establish a remuneration committee. - MFSA conducts an annual remuneration exercise collecting aggregated data, remuneration for material risk takers, and remuneration of high earners; issues discussed with banks as needed. ### Fit-and-proper evaluations - Fit-and-proper decisions for LSIs are taken by national supervisors except for new bank licenses (where NCAs conduct initial reviews before ECB analysis). - National transposition: Article 14 of the Banking Act and Article 32 set suitability criteria and disqualifications (bankruptcy, interdiction, involvement in money laundering, conviction for a crime). - Information collected via a detailed Personal Questionnaire; no ongoing reassessment unless organizational changes occur. - Powers to change Board composition or remove a controller exist (Article 14(10) of the Banking Act) but have not been formally used in practice; MFSA has instructed some banks to include more independent directors or directors with specific expertise. - This practice is not aligned with EBA guidelines recommending ongoing suitability assessment by competent authorities. Recommendations on fit-and-proper and inspections - Increase the number of onsite inspections of LSIs and make them more risk-oriented in assessing adequacy of risk management. - Conduct regular updated fit-and-proper evaluations of relevant persons, especially when onsite inspections identify serious concerns (e.g., potential breaches of AML requirements). ### Enforcement and sanctioning framework - Sanctioning is shared between the ECB and the MFSA: - ECB: direct pecuniary penalties on SIs that breach directly applicable EU law or ECB decisions/regulations. - For breaches of national law implementing EU directives, breaches by natural persons, or non-pecuniary penalties, ECB may request MFSA to open proceedings. - MFSA has power to impose sanctions on LSIs and their management for breaches; ECB can impose enforcement measures on LSIs for ongoing breaches of ECB decisions/regulations. - MFSA has exclusive competence to impose sanctions for breaches of national laws not related to ECB tasks. - MFSA corrective and sanctioning powers include: - Imposing administrative penalties for breaches of the Banking Act, regulations, banking rules, CRR, or directives issued by MFSA (Article 35.A of the Banking Act). - Penalty maxima: up to €5 million for a natural person; up to 10 percent of the total annual net turnover for a legal person. - Requiring remedial measures at an early stage where institutions do not meet or are likely to breach requirements (Article 17E), including measures listed in Regulation 9 of the Banking Act (Supervisory Review) Regulations (Subsidiary Legislation 371.16), such as: - Requiring own funds in excess of requirements. - Requiring reduction of inherent risk in activities, products, systems. - Requiring presentation of a plan to restore compliance. - Restricting or limiting business, operations, or network; requesting divestment of activities posing excessive risk. - Limiting variable remuneration as a percentage of net revenues. - Imposing additional or more frequent reporting requirements. - Requiring additional disclosures. - Issuing written directives requiring a licensee to do or refrain from doing specified acts (Article 16 of the MFSA Act). - Taking control of a credit institution, appointing a competent person to take charge of assets or assume control, winding up business, appointing a liquidator (Article 29 of the Banking Act); license withdrawal is ultimate sanction. *Source: IMF country report content unit 1mltea2019006* ### 74. Decision-making powers rest with the MFSA supervisory council. When the final ### 1mltea2019006 - 74. Decision-making powers rest with the MFSA supervisory council. When the final ### Decision-making process and supervisory council role - Decision-making powers rest with the MFSA supervisory council for regulatory actions such as: - imposition of administrative penalties, - cancellation, suspension or restriction of license, - issuing of directives. - Process activation: - Relevant supervisory unit may bring matters to the supervisory council when regulatory action may be necessary. - Supervisory council memos are circulated to all team members, discussed during meetings, and contain detailed information (for example, details of any noncompliance issues, findings resulting from investigations) and normally include one or more recommendations or possible courses of action for the council’s consideration. - Legal procedural requirement for certain actions: - For restriction, suspension, or cancellation of a license, the law obliges the MFSA to first serve a written notice of its intention to do so to the licensee, specifying the grounds and stating a time period within which the licensee is entitled to submit its observations. - The decision to issue any such notice/minded letter is taken by the supervisory council. - In certain cases, the council has adopted the minded letter—representations—final decision procedure even when not strictly bound by law, for due process considerations and/or because of the serious nature of the proposed regulatory action (for example, when the MFSA intends to impose an administrative penalty). ### Sanctions framework and application - Regulatory guidance: - The Administrative Penalties, Measures and Investigatory Powers Regulations, Subsidiary Legislation 371.05 provides for factors that may affect the penalty to be meted out against the licensee.31 - Use of prompt remedial actions: - Thresholds at which supervisory action is required have not been defined, even though the BSU may make use of automated KRIs. - Progressive remedial process: - MFSA employs a progressive remedial process, applying gradual responses rather than immediately resorting to coercive measures. - Tools and processes should be in place to (1) address supervisory concerns proactively and timely, including escalation to senior management and the Board as appropriate, and (2) ensure adequate and timely follow-up of actions taken by banks. - Remediation progress and completion were noted as insufficiently monitored and documented. - Evidence of enforcement: - Despite wide corrective measures and powers in legislation, evidence of effective application is limited. - In the past five years, the MFSA has imposed a limited number of sanctions (illustrated in Table 6). - Low pecuniary penalties on banks have limited deterrent effect. - The MFSA has never exacted sanctions against natural persons. - No actions have been decided on grounds of insufficient internal controls to prevent money laundering risks. ### Timeliness and scope of supervisory measures - Decisive but delayed: - MFSA has taken decisive action in several instances, but actions may not have been as timely as desirable. - More supervisory measures have been decided since 2015, mainly following an onsite inspection. - Significant delays observed between end of investigation phase and supervisory council decisions (up to one year). - Onsite inspection frequency and scope: - Frequency of onsite inspections is low; several banks have not been inspected over the past five years. - Main risks faced by Maltese banks (credit risk, liquidity risk, and compliance risk) are not subject to in-depth onsite inspections, reducing opportunities to detect problems and take appropriate measures. - Example: For one bank, a competent person was appointed in 2016 following an onsite inspection jointly carried out with the ECB (joint inspection revealed excessive related-parties’ exposures and under-provisioning). - Example: A 2015 MFSA onsite inspection emphasized serious governance shortcomings but did not include an in-depth review of credit risk, related-parties’ transactions, or adequacy of provisions. ### Table 6 — Administrative Measures and Penalties Against Credit Institutions, 2013–2018 (selected entries) - 7/6/2018 — Satabank — Breaches of provisions on governance and internal control — Penalty of EUR 65,000 - 4/3/2018 — Ferratum Bank — Breaches of various provisions on governance — Penalty of EUR 188,445 - 3/21/2018 — Pilatus Bank — Bank directed not to allow any banking transactions, including withdrawals or deposits held with the bank by the shareholders, members of the Board of Directors, and senior management officials of the bank, or any connected persons or related persons - 7/18/2018 — HSBC Bank Malta — The bank, as custodian, has failed to carry out appropriate monitoring on one fund — Penalty of EUR 10,000 - 4/27/2016 — Nemea Bank — Regulatory shortcomings identified during an OSI — Appointment of a competent person to take charge of the assets and assume control of the bank - 3/29/2016 — FimBank — Lack of appropriate governance — Restrictions through applying limitations on the expansion and further investment ### Appeal process and its effects - Any person aggrieved by an MFSA decision may appeal to the Financial Services Tribunal.32 - Appeals against pecuniary penalties have suspensive effects. - The MFSA has 27 pending appeals, some dating back to 2009, which undermines a dissuasive sanction policy. - Financial Services Tribunal resources appear limited (no permanent secretariat; part-time judges are appointed). ### Recommendations on supervisory enforcement and sanctioning - Perform a thorough follow-up on banks’ implementation of supervisory recommendations. - Take action in a timely manner by reducing the delay between finalization of onsite inspections and date on which supervisory measures are taken. - Use proactive, preventative, and earlier corrective actions to address risk management issues. - Make more use of monetary fines as part of the sanctioning regime for credit institutions. - Ensure supervisory action is not delayed through judicial appeal and achieve greater certainty that actions would not be reversed by: - investigating ways to limit circumstances in which actions could be stayed (including through a revision of the legal framework for judicial review of supervisory actions), - circumscribing remedies to monetary compensation if the authority is found to have acted in contravention of the law, - aiming the legal framework for judicial review of supervisory actions to incorporate well circumscribed limitations to strike a balance between due process and effectiveness of actions, - considering increasing the Financial Services Tribunal’s resources and capabilities (such as a permanent secretariat and full-time judges). ### Financial integrity and AML/CFT framework — threat and vulnerabilities - Money laundering threat to Malta is relatively high and driven mostly by laundering of foreign proceeds of crime. - Main vulnerabilities identified through the national risk assessment (NRA): - Malta’s open economy and large financial sector (banking and securities), - gaming sector (especially remote gaming), - designated nonfinancial business and profession (DNFBP) sector (particularly trust and company service providers, legal and accounting professionals, and the real estate sector). - Compounding factor: heavy use of cash and transferable checks; many sectors (construction and tourism) rely on cash transactions, rendering Malta a cash-intensive economy. ### AML/CFT institutional setup and resources - NRA actions and coordination: - Malta carried out an initial AML/CFT NRA in 2013–2014, updated in 2017, leading to an updated NRA Report and a national AML/CFT strategy with a detailed action plan including more than 50 detailed action points for implementation over three years. - A National Coordinating Committee on Combatting Money Laundering and Funding of Terrorism has been established. - FIAU role: - FIAU is the main AML/CFT supervisor, an independent government agency established under Article 15 of the Prevention of Money Laundering Act (PMLA). - FIAU receives Suspicious Transaction Reports (STRs), analyzes them, and when reasonable suspicion exists, sends analytical reports to the police. - FIAU has a supervisory role, assisted by the MFSA in AML/CFT oversight of the financial services sector (Article 26 of the PMLA). - The compliance section of the FIAU is responsible for onsite compliance examinations and offsite assessments of subject persons under the PMLFTR. - Onsite supervision of MFSA license holders is carried out by the Enforcement Unit of the MFSA, acting as an agent of the FIAU in accordance with Article 26(5) of the PMLA. - FIAU remains the sole authority responsible for reviewing cases and taking decisions on breaches and sanctions.34 - Planned staffing changes: - FIAU planning to expand human resources from 20 to 56 staff members by end-2020, 19 of whom will be dedicated to AML/CFT supervision. - MFSA recruitment planned to increase from nine supervisors working on AML/CFT as of June 2018 to 30 by end-2018.35 - At the time of the FSAP mission, MFSA team size was reduced to six supervisors (due to three resignations) and the plan to recruit 23 people (20 new and three replacements) by end-2018 may be over-optimistic. ### Supervisory shortcomings, EBA findings, and consequences - EBA review and actions: - In October 2017 the European Commission’s Director General for Justice and Consumers asked the EBA to investigate a possible breach of Union law related to apparent failure of the FIAU to apply effective, proportionate, and dissuasive sanctions for alleged infringements by Pilatus Bank under the Third EU Directive (AMLD3). - EBA found FIAU failed to ensure Pilatus Bank put in place adequate and appropriate AML/CFT policies and procedures (Article 34 AMLD3) and neither imposed effective, proportionate, and dissuasive sanctions nor other supervisory measures to correct shortcomings. - EBA decided not to open a breach of Union law investigation into the MFSA, reflecting recent MFSA supervisory actions and current Union law requirements, but identified significant concerns about MFSA actions in some areas. - EBA’s findings indicated a general practice issue at the FIAU and adopted recommendations aimed at remedying particular failings identified. - FIAU challenged the issuance of the recommendation, noting an Action Plan had been adopted; EBA considered the wide-ranging Action Plan evidence that prior procedures and policies were not appropriate and effective. ### AML/CFT supervisory deficiencies identified by the FSAP mission - Low number of onsite reviews: - Onsite visits at credit institutions solely by MFSA or jointly with FIAU: five in 2017, three in 2016, and three in 2015. - Yearly plan not commensurate with banks’ risk profiles; five largest banks by assets not inspected since 2015. - A commodity-trade finance bank potentially prone to money laundering has never been inspected. - Limited number of sanctions: - Few administrative sanctions by the FIAU (none in 2015, three in 2016, one in 2017); penalties not dissuasive.37 - In several instances, no sanction despite extremely severe findings; explanations not provided in final decisions. - No MFSA sanctions on grounds of insufficient internal controls and compliance checks. - Short duration and narrow scope of onsite reviews: - Onsite investigation phase often limited to a couple of days; reviews frequently limited to interviews and small samples (33 accounts for one of the largest banks). - Effectiveness of ongoing monitoring and transaction screening often not assessed. - Two latest reviews launched in 2018 lasted five months (not finalized at time of IMF mission). - Excessive delays in finalizing onsite reports: - May take up to 1.5 years to produce final report. - Complexity of FIAU internal procedures unlikely to fully justify delays. - Inadequate timeliness of regulatory response: - Delays in final decisions excessive (up to three years after concluding an onsite inspection). - Insufficient involvement from BSU on AML internal controls: - BSU did not routinely use onsite reviews of compliance with prudential requirements to act on a standalone basis without FIAU request. - BSU could ensure banks have adequate compliance and audit functions, AML internal policies subject to regular audits, internal audit conclusions communicated, internal follow-up of recommendations, AML included in risk mapping, AML integrated into overall risk management, and robust information systems — documentation shows such reviews not conducted regularly. - STRs are not communicated by banks to the MFSA when suspicious activities are material to safety, soundness, or reputation, and BSU does not conduct regular contact with banks’ money laundering risk officers. ### Recommendations to strengthen AML/CFT supervision - Significantly increase the number of onsite compliance examinations of credit institutions. - Significantly revise scope, duration, depth, and methodology of investigations to be less formal and more risk-oriented, ensuring banks identify, assess, monitor, and mitigate money laundering risk. - FIAU and MFSA should shorten turnaround time of supervisory reviews from initiation to final report, and from report to final decision; impose time-bound remedial action plans systematically when findings are made by onsite examiners; simplify FIAU decision-making to speed up sanctioning. - FIAU should make more use of monetary fines as part of the sanctioning regime for credit institutions and increase the amount of penalties. - MFSA should devote more resources to consider AML/CFT risk in risk assessments and supervision of banks. - MFSA should take supervisory measures based on AML/CFT-related risk management and operational risk deficiencies (instead of, at best, increasing capital requirements as part of the SREP). - Consideration of an EA (or EU) level AML/CFT supervision as a more comprehensive solution, as emphasized in the EA FSAP. *International Monetary Fund — Malta Financial Sector Assessment excerpts from provided chapter content.* --- _Source: https://www.imf.org/-/media/files/publications/cr/2019/1mltea2019006.pdf_