And Investigatory Powers) Regulations, 2022

Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 20,774, 27 ta’ Jannar, 2022 B 203

L.N. 23 of 2022

INVESTMENT SERVICES ACT

(CAP. 370)

Investment Firms Directive (Administrative Penalties, Measures

And Investigatory Powers) Regulations, 2022

IN EXERCISE of the powers conferred by article 12 of the

Investment Services Act, the Minister responsible for the regulation of

Financial Services, acting on the advice of the Malta Financial

Services Authority, has made the following regulations

(1) The title of these regulations is the Investment Firms Citation, scope

Directive (Administrative Penalties, Measures and Investigatory and

commencement.

Powers) Regulations, 2022.

(2) The scope of these regulations is to transpose Articles 18,

19, 20, 21, 22, and 23 of Directive (EU) 2019/2034 of the European

Parliament and of the Council of 27 November 2019 on the prudential

supervision of investment firms and amending Directives 2002/87/EC,

2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU.

(3) These regulations shall come into force on such date as the

Minister may by notice in the Gazette establish.

(1)

In these regulations, unless the context otherwise Interpretation.

requires -

"the Act" means the Investment Services Act;

"competent authority" means the Malta Financial Services Cap. 330.

Authority established by article 3 the Malta Financial Services

Authority Act;

"CRD" means Directive 2013/36/EU of the European Parliament

and of the Council of 26 June 2013 on access to the activity of credit

institutions and the prudential supervision of credit institutions,

amending Directive 2002/87/EC and repealing Directives 2006/48/EC

and 2006/49/EC, as amended from time to time, and includes any

implementing measures that have been or may be issued thereunder;

"CRR" means Regulation (EU) No 575/2013 of the European

Parliament and of the Council of 26 June 2013 on prudential

requirements for credit institutions and amending Regulation (EU) No

648/2012, as amended from time to time, and includes any

implementing measures that have been or may be issued thereunder;

"financial holding company" shall have the same meaning as that

assigned to it in point (20) of Article 4(1) of the CRR;

"the IFD" means Directive 2019/2034 of the European

Parliament and of the Council of 27 November 2019 on the prudential

supervision of investment firms and amending Directives 2002/87/EC,

2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU,

as amended from time to time, and includes any implementing

measures that have been or may be issued thereunder;

"the IFR" means Regulation 2019/2033 of the European

Parliament and of the Council of 27 November 2019 on the prudential

requirements of investment firms and amending Regulations (EU) No

1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/

2014, as amended from time to time, and includes any implementing

measures that have been or may be issued thereunder;

"investment firm" means a person who holds an investment

services licence issued by the competent authority under the Act and

which is subject to the requirements of the IFR and the IFD;

"mixed financial holding company" shall have the same meaning

as that assigned to it in point (25) of Article 3(1) of the IFR.

(2) Words and expressions used in these regulations shall have

the same meaning as that assigned to them in the Act.

The competent authority shall exercise its supervisory

powers and its powers to impose administrative penalties and

measures, in such a way as to ensure full and complete adherence to

the requirements and obligations arising out of the IFD and out of the

IFR, either directly or in collaboration with European regulatory

authorities and with overseas regulatory authorities, in terms of law

and as warranted by the relevant circumstances.

(1) Without prejudice to the supervisory powers of the

competent authority referred to in regulation 3 and the IFD, the

competent authority shall impose administrative penalties and other

administrative measures in respect of breaches of

(a) the provisions of the Act and, or of regulations and,

or Investment Services Rules made thereunder transposing the

provisions of the IFD; and, or

(b)

the provisions of the IFR,

including where an investment firm

(i) fails to have in place internal governance

arrangements as set out in Article 26 of the IFD;

(ii) fails to report information or provides incomplete

or inaccurate information on compliance with the

obligation to meet own funds requirements set out in

Article 11 of the IFR to the competent authority, in breach

of point (b) of Article 54(1) of the IFR;

(iii) fails to report to the competent authority, in

breach of point (e) of Article 54(1) of the IFR, information

about concentration risk or provides incomplete or

inaccurate information;

(iv) incurs a concentration risk in excess of the

limits set out in Article 37 of the IFR, without prejudice to

Articles 38 and 39 of the IFR;

(v) repeatedly or persistently fails to hold liquid

assets in breach of Article 43 of the IFR, without prejudice

to Article 44 of the IFR;

(vi) fails to disclose information, or provides

incomplete or inaccurate information, in breach of the

provisions set out in Part Six of the IFR;

(vii) makes payments to holders of instruments

included in the own funds of the investment firm where

Article 28, 52 or 63 of the CRR prohibit such payments to

holders of instruments included in own funds;

(viii) is found liable for a serious breach of national

provisions adopted pursuant to Directive (EU) 2015/849 of

the European Parliament and of the Council of 20 May

2015 on the prevention of the use of the financial system

for the purposes of money laundering or terrorist financing,

amending Regulation (EU) No 648/2012 of the European

Parliament and of the Council, and repealing Directive

2005/60/EC of the European Parliament and of the Council

and Commission Directive 2006/70/EC;

(ix) allows one or more persons whodo not comply

with Article 91 of the CRD to become or remain a member

of the management body.

(2) The administrative penalties and other administrative

measures taken pursuant to sub-regulation (1) shall be effective,

proportionate and dissuasive.

(3) The competent authority may impose administrative

penalties and other administrative measures relating to breaches of the

provisions of the Act and any regulations and Investment Services

Rules issued thereunder transposing the requirements of the IFD, and

of the IFR to the members of the management body of such companies

and to other natural persons who under Maltese law are responsible for

the breach.

The competent authority shall have all the information

gathering powers and investigatory powers which are necessary for the

exercise of its functions. Without prejudice to other relevant provisions

laid down in the Act, the IFD and in the IFR these powers shall

include

(a) the power to require information from the following

natural or legal persons

(i)

investment firms established in Malta;

(ii)

investment holding companies established in

Malta;

(iii) mixed financial holding companies established

in Malta;

(iv) mixed-activity holding companies established

in Malta;

(v) persons belonging to the entities referred to in

sub-paragraphs (i) to (iv);

(vi) third parties to whom the entities referred to in

sub-paragraphs (i) to (iv) have outsourced operational

functions or activities;

(b) the power to conduct all necessary investigations of

any person referred in paragraphs (a)(i) to (iv) established or

located in Malta where necessary to carry out the tasks of the

competent authority including

(i) the right to require the submission

of

documents by the persons referred to in paragraph (a);

(ii) the right to examine the books and records of

the persons referred to in paragraphs (a)(i) to (iv) and the

right to take copies or extracts from such books and

records;

(iii) the right to obtain written or oral explanations

from any person referred to in paragraphs (a)(i) to (iv) or

their representatives or staff; and

(iv) the right to interview any other person who

consents to be interviewed for the purpose of collecting

information relating to the subject matter of an

investigation;

(c) the power to conduct all necessary inspections at the

business premises of the legal persons referred to in paragraphs

(a)(i) to (iv) and any other undertakings included in the

supervision of compliance with the group capital test, where the

competent authority is the group supervisor, subject to the prior

notification of other competent authorities concerned.

Where an investment firm is found by the competent Penalties.

authority to have committed any of the breaches referred to in

regulation 5, the administrative penalties and other administrative

measures which the competent authority may impose shall include at

least the following

(a) a public statement which identifies the natural person,

investment firm, financial holding company or mixed financial

holding company and the nature of the breach;

(b) an order requiring the natural or legal person

responsible to cease the conduct and to desist from repeating that

conduct;

(c) the withdrawal of the investment firm’s investment

services licence, in accordance with article 7 of the Act;

(d) subject to the provisions of regulation 4(3), a

temporary ban against a member of the investment firm’s

management body or any other natural person, who is held

responsible, from exercising functions within investment firms;

(e) in the case of a legal person, administrative penalties

of up to 10% of the total annual net turnover including the gross

income consisting of interest receivable and similar income,

income from shares and other variable or fixed-yield securities,

and commissions or fees of that legal person in the preceding

business year

Provided that, where the investment firm subject to the

administrative penalty is a subsidiary of a parent undertaking, the

relevant gross income shall be the gross income resulting from the

consolidated account of the ultimate parent undertaking in the

preceding business year;

(f) in the case of a legal person, administrative penalties

of up to twice the amount of the profits gained or losses avoided

due to the breach where those profits or losses can be

determined; and

(g) in the case of a natural person, administrative

penalties of up to EUR 5,000,000.

(1) The competent authority, without undue delay, shall

publish on its official website and, or on any other media, as deemed

appropriate, any administrative penalties and measures which are

imposed for breaches of the Act, regulations and Investment Services

Rules issued thereunder transposing the requirements of the IFD, and

of the IFR. Such publication shall include information on the type and

nature of the breach and the identity of the natural or legal person on

whom the penalty or measure is imposed. The information shall only

be published by the competent authority after that person has been

informed of those administrative penalties or measures and to the

extent that the publication is necessary and proportionate

Provided that, in cases where an appeal has been filed by

the person on whom such administrative penalties or measures have

been imposed, the competent authority shall, without undue delay, also

publish on its official website information on the status of the appeal

and the outcome thereof.

(2) The competent authority shall publish the penalties or

measures imposed in terms of these regulations, on an anonymous

basis, in any of the following circumstances

(a) where the penalty or measure is imposed on a natural

person and, following an obligatory prior assessment, the

publication of personal data is found to be disproportionate;

(b) where publication would jeopardise the stability of

financial markets or an ongoing criminal investigation; or

(c) where publication would cause, insofar as it can be

determined, disproportionate damage to the investment firms, or

natural persons involved

Provided that, where the circumstances referred to in

paragraph (a) are likely to cease within a reasonable period of time,

publication in terms of sub-regulation (1) may be postponed for such

period of time.

(3) Information published in terms of this regulation shall

remain on the official website of the competent authority for a period

of not less than five years. Personal data shall be retained on the

official website of the competent authority only for the period

necessary, in accordance with the provisions of Maltese legislation on

data protection.

The competent authority shall inform the EBA of all Exchange of

administrative penalties and measures it imposes under these information

penalties.

regulations. It shall also provide information regarding any appeal in

relation thereto and the outcome therefrom for the purpose of

publication on the EBA database of sanctions which the competent

authority shall consult where appropriate in the carrying out of its

functions and duties.

When determining the type of administrative penalties or Effective

other administrative measures and the level of administrative penalties application

penalties and

to be imposed in terms of these regulations, the competent authority exercise

powers to

shall take into account all relevant circumstances including, where impose penalties

by the

appropriate

competent

authority.

(a)

the gravity and the duration of the breach;

(b) the degree of responsibility of the natural or legal

person responsible for the breach;

(c) the financial strength of the natural or legal person

responsible for the breach, including the total turnover of a legal

person or the annual income of a natural person;

(d) the importance of profits gained or losses avoided by

the natural or legal person responsible for the breach;

(e)

the damages for third parties caused by the breach;

(f) the level of co-operation of the natural or legal person

responsible for the breach with the competent authority;

(g) previous breaches by the natural or legal person

responsible for the breach; and

(h)

any potential systemic consequence of the breach.

(1) The competent authority shall establish effective and Reporting of

reliable mechanisms to encourage the reporting to it of potential or breaches.

actual breaches of the provisions of the Act, regulations and

Investment Services Rules issued thereunder transposing the

requirements of the IFD, and of the provisions of the IFR.

(2) The mechanisms referred to in sub-regulation (1) shall

include at least

(a) specific procedures for the reception, treatment and

following up of such reports, including the establishment of

secure communication channels;

(b) appropriate

protection

against

retaliation,

discrimination or other types of unfair treatment by the

investment firm for employees of investment firms who report

breaches committed within the investment firm;

(c) protection of personal data concerning both the

person who reports the breaches and the natural person who is

allegedly responsible for a breach, in accordance with the

Maltese legislation on data protection and Regulation (EU)

2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the

processing of personal data and on the free movement of such

data, and repealing Directive 95/46/EC (General Data Protection

Regulation);

(d) clear rules that ensure that confidentiality is

guaranteed in all cases in relation to the person who reports the

breaches committed within the investment firm, unless

disclosure is required by national law in the context of further

investigations or subsequent judicial proceedings.

(3) Investment firms shall have in place appropriate procedures

for their employees to report breaches internally through a specific

independent channel. Those procedures may be provided for by the

social partners provided that those procedures offer the same

protection as the protection referred to in paragraphs (b), (c) and (d) of

sub-regulation (2).

Subject to the provisions of the Act, any person in respect

of whom a decision is taken by the competent authority under these

regulations may appeal to the Financial Services Tribunal in terms of

article 19 of the Investment Services Act.

€0.36