The Malta Financial Services Authority (the “MFSA” or the “Authority”) has recently published a consultation document proposing amendments to Chapter 2 of the Financial Institutions Rulebook (“FIR/02”). The proposed revisions seek to introduce a more proportionate and harmonised regulatory framework for financial institutions authorised under the Financial Institutions Act (Chapter 376 of the Laws of Malta) (the “Act”).
The revised framework would apply to financial institutions carrying out activities listed in the First Schedule to the Act, excluding activity 4 (payment services) and activity 10 (issuing of electronic money).
The proposed amendments aim to bring FIR/02 into closer alignment with Chapter 3 of the Financial Institutions Rulebook (“FIR/03”), whilst moving away from the application of banking rules towards a regulatory framework tailored to the nature, scale and activities of financial institutions.
One of the principal areas addressed by the proposed FIR/02 concerns corporate governance and the responsibilities of the Board of Directors. Under the proposed framework, licence holders would be required to maintain a Board comprising at least three directors, including at least one Independent Non-Executive Director and one director resident in Malta. The Board would be required to maintain an appropriate balance between executive and non-executive directors and meet at least quarterly.
Furthermore, the Chairperson of the Board would generally be required to be an Independent Non-Executive Director, subject to the possibility of a temporary derogation granted by the MFSA. The business would also have to be effectively directed from Malta by at least two individuals acting as executive directors and/or senior management.
The proposed rules also emphasise the importance of independent oversight, effective decision-making and the prevention of conflicts of interest. Licence holders would be required to establish appropriate internal governance arrangements, ensuring that responsibilities are clearly allocated and that internal control functions operate independently.
The proposed FIR/02 also establishes requirements concerning matters which must be notified to, or approved in advance by, the MFSA. Licence holders would be required to notify the Authority immediately of various developments, including changes in senior management and key function holders, material legal proceedings, regulatory breaches and other matters which may have a significant financial or reputational impact on the institution. Certain proposed changes would require the MFSA's prior written approval, including material amendments to the institution's business or organisational structure, changes in ownership and control, and the acquisition or establishment of subsidiaries or branches in or outside Malta as applicable.
The revised framework additionally sets out procedures governing the appointment and departure of approved persons. In particular, institutions would be required to notify the MFSA of the resignation or removal of an appointed person within the prescribed timeframe and provide the relevant reasons for departure and remedial measures.
The proposed FIR/02 introduces a detailed framework governing arrangements with third-party service providers. Licence holders would be required to assess the risks associated with outsourcing arrangements, conduct appropriate due diligence on service providers and maintain adequate oversight of outsourced functions.
Particular attention is given to critical or important operational functions. Under the proposed rules, institutions intending to outsource such functions would be required to submit an outsourcing notification to the MFSA at least 60 calendar days before entering into the arrangement. Non-critical operational outsourcing relating to licensed services would also require prior notification.
The proposed framework also addresses outsourcing policies, contractual requirements, ongoing monitoring, record-keeping and exit strategies. Importantly, outsourcing would not relieve the Board of Directors or senior management of their regulatory responsibilities.
The proposed amendments place considerable emphasis on establishing effective compliance and risk management frameworks proportionate to the institution's activities. Licence holders would be required to maintain an independent compliance function responsible for monitoring adherence to applicable regulatory requirements, advising relevant personnel and implementing a compliance monitoring plan.
The draft additionally provides for the submission of an annual Compliance Report to the MFSA, together with the annual audited financial statements, incorporating the results of the institution's compliance monitoring activities and details of identified regulatory breaches.
The proposed framework also introduces specific prudential requirements relating to liquidity, capital adequacy and third-party exposures, requiring licence holders to maintain adequate financial resources and comply with applicable exposure limits. Furthermore, institutions would be required to establish appropriate credit risk management frameworks, including risk assessment and monitoring procedures, whilst ensuring compliance with applicable ICT and security risk management requirements.
Existing licence holders should consider reviewing their corporate governance structures, internal policies, outsourcing arrangements and compliance procedures to identify any areas which may require amendment should the proposals be adopted.
Similarly, prospective applicants seeking authorisation under the Act should consider the proposed framework when preparing their business plans, determining their organisational structures and establishing their operational arrangements.
Although the amendments remain subject to consultation, early consideration of their potential implications may assist institutions in preparing for the eventual implementation of the revised rules.
Should you require assistance in assessing the implications of the proposed amendments, reviewing your institution's regulatory compliance framework or obtaining authorisation as a financial institution in Malta, please contact us at info@gtg.com.mt