MFSA Guidance for MLROs in the Financial Services Sector

On 14 March 2024, the Malta Financial Services Authority (the “MFSA“) published a guidance note entitled ‘A Guidance for Money Laundering Reporting Officers in the Financial Sector‘ (the “Guidance“) motivated by observations gathered from interviews with applicants and from supervisory inspections.

The Guidance should be referred to by license holders when they are establishing, implementing and sustaining their financial crime compliance frameworks as it provides pragmatic guidance to the industry including on ancillary responsibilities.

The Guidance applies to all licence holders carrying out a relevant financial business or conducting a relevant activity and thus falling within the definition of ‘Subject Persons’ in terms of the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta), the Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01) and the FIAU’s Implementing Procedures.

The MFSA has emphasised that this Guidance should be read in conjunction with the Guidelines on the AML/CFT Compliance Officer issued by the European Banking Authority (click here to access) and with any guidance notes issued by the FIAU touching upon the functions of the MLRO.

The Guidance provides licence holders with a document which should be referred to in order to determine the requirements of the MFSA when it comes to the appointment of the MLRO, This is an important reference document as it sets out realistic requirements gathered by the MFSA from a number of actual encounters throughout the MFSA’s approvals of proposed individuals and supervision of approved officers.

The relevant obligations, requirements and regulatory expectations of proposed and incumbent MLROs are as follows:

Knowledge of the main ML/FT risks to which the country and the relevant sector are exposed to is indispensable, especially as to the specific risks relating to the products and/or services offered by the licence holder. This means that the proposed MLRO must be aware of how the licence holder seeks to mitigate, prevent and detect any such occurrences.

The MFSA expects proposed individuals to be familiar with the following:

• relevant risks, trends and typologies in ML/FT;
• relevant guidelines published by the European Banking Authority;
• relevant responsibilities  of MLROs emanating from local legislative and other binding instruments;
• relevant legislation and regulations pertaining to AML/CFT in Malta; and
• the business and operational model of the licence holder.

The MLRO is expected to maintain his expertise and skills actively. An important consideration is that the MFSA will not consider only academic qualifications and attendance of regular training but other factors such as relevant experience.

MLROs are expected to have good knowledge on good corporate governance practices relating to financial crime compliance. Sufficient familiarity with the MFSA’s Corporate Governance Code is essential.

Obviously, MLROs are expected to be fully aware of their functions resulting from the PMLFTR and the Implementing Procedures issued by the FIAU.

The governance structure of the licence holders should facilitate the independence of the MLROs whilst ensuring accountability. It is crucial that MLROs have the necessary independence and autonomy to carry out their functions effectively, without interference from the licence holder.

Whilst it is important that the MLROs have a direct line of communication with the Board of Directors, the Board of Directors should understand the relevant financial crime risks and ensure that effective control mechanisms are implemented to ensure compliance. The MLRO should be a key individual to facilitate the licence holder’s senior management and/or Board of Directors’ understanding of their ML/FT risks and related mitigating measures.

The Guidance lists several examples of good practices which licence holders are encouraged to incorporate.

The Guidance emphasises the importance that the MLRO function is fulfilled separately from other roles that may hinder the effectiveness and independence of such an important function.

Licence holders must establish and uphold internal protocols and practices to ensure that potential or actual conflicts of interest are effectively handled. Some good practices identified in the Guidance:

• the MLRO is fully engaged with fulfilling this single role as MLRO.
• the individual may fulfill other compliance-related roles that complement the MLRO-related duties.
• appropriate controls are applied to mitigate identified conflicts of interests.

It is imperative that a compliance function has the essential resources to be able to fulfill its duties so as to ensure the integrity of the licence holder. This also applies to the function of the MLRO which requires sufficient resources including stuffing, technological tools and financial support to effectively identify, assess and mitigate risks and suspicious activities.

Although proportionality is very relevant here, it is important that the MLRO dedicates sufficient time to fulfill his duties and obligations.

The Guidance should be very useful to licence holders as it provides various samples of self-assessment questions related to each of the expectations outlined above. This would assist licence holder in ensuring that good practices are in place.

The Guidance can be accessed from here.