Providers) Regulations, 2023

L.N. 272 of 2023

VALUE ADDED TAX ACT

(CAP. 406)

Value Added Tax (Reporting Obligations for Payment Service

Providers) Regulations, 2023

IN EXERCISE of the powers conferred by article 55A and 75 of

the Value Added Tax Act , the Minister responsible for finance, has

made the following regulations:-

(1) The title of these regulations is the Value Added Tax

(Reporting Obligations for Payment Service Providers) Regulations,

commencement.

2023. (2) These regulations transpose the provisions of Article 1 of

Council Directive (EU) 2020/284 of 18 February 2020 amending

Directive 2006/112/EC as regards introducing certain requirements for

payment service providers.

(3) The purpose of these regulations is to require payment

service providers to keep sufficiently detailed information of payees

and payments in relation to the payment services they provide and to

submit such information to the Commissioner to enable the competent

authorities of the Member States to carry out controls of the supplies of

goods and services which, in accordance with the provisions of Title V

of Council Directive 2006/112/EC, are deemed to take place in a

Member State, in order to achieve the objective of combating VAT

fraud.

These regulations shall come into force on 1 st January

(4)

2024.

(1)

In these regulations, unless the context otherwise

requires

"the Act" means the Value Added Tax Act;

"BIC" shall have the meaning assigned to it in point (16) of

Article 2 of Regulation (EU) No 260/2012 of the European

Parliament and of the Council of 14 March 2012 establishing

technical and business requirements for credit transfers and

direct debits in euro and amending Regulation (EC) No 924/

2009;

"CESOP" shall mean the "central electronic system of

payment information" established by Council Regulation (EU)

2020/283 of 18 February 2020 amending Regulation (EU) No

904/2010 as regards measures to strengthen administrative

cooperation in order to combat VAT fraud;

"home Member State" shall have the meaning assigned to it

in article 2(1) of the Financial Institutions Act;

"host Member State" shall have the meaning assigned to it

in article 2(1) of the Financial Institutions Act;

"IBAN" shall have the meaning assigned to it in point (15)

of Article 2 of Regulation (EU) No 260/2012 of the European

Parliament and of the Council of 14 March 2012 establishing

technical and business requirements for credit transfers and

direct debits in euro and amending Regulation (EC) No 924/

2009;

"payee" shall have the meaning assigned to it in article 2(1)

of the Financial Institutions Act;

"payer" shall have the meaning assigned to it in article 2(1)

of the Financial Institutions Act;

"payment" means a "payment transaction" or a "money

remittance" as defined in article 2(1) of the Financial Institutions Cap. 376.

Act, subject to the exclusions referred to in article 3(2A) of that

Act;

"payment account" shall have the meaning assigned to it in

article 2(1) of the Financial Institutions Act;

"payment service provider" means any of the categories of

payment service providers listed in paragraphs (a) to (e) of the

definition "payment service provider" included in article 2(1) of

the Financial Institutions Act or a natural or legal person Cap. 376.

benefitting from an exemption in accordance with Article 32 of

Directive (EU) 2015/2366 of the European Parliament and of the

Council of 25 November 2015 on payment services in the

internal market, amending Directives 2002/65/EC, 2009/110/EC

and 2013/36/EU and Regulation (EU) No 1093/2010, and

repealing Directive 2007/64/EC;

"payment service" means any of the business activities

listed in points (c) to (f) of paragraph 2 of the Second Schedule

to the Financial Institutions Act;

(2)

In these regulations, save as provided in sub-regulation (1),

all words and phrases shall have the meaning as prescribed in the Act.

(1) Payment service providers whose home Member

State or host Member State is Malta shall keep detailed information on

payees and on payments in relation to the payment services they

provide for each calendar quarter in Malta as set out in these

regulations.

(2) The requirement referred to in sub-regulation (1) shall

apply only to payment services provided as regards cross-border

payments. A payment shall be considered a cross-border payment

when the payer is located in a Member State and the payee is located in

another Member State, in a third territory or in a third country.

(3) For the purposes of these regulations and without prejudice

to the provisions of the Third Schedule to the Act, the location of the

payer shall be considered to be in the Member State corresponding to

the IBAN of the payer’s payment account or any other identifier which

unambiguously identifies, and gives the location of the payer

Provided that where the payment service provider has

various identifiers available that provide a different location for the

payer, the identifier which best reflects the location of the payer shall

be chosen

Provided further that in the absence of the identifiers

referred to in the first paragraph of this sub-regulation, the Member

State corresponding to the BIC or any other business identifier code

that unambiguously identifies, and gives the location of the payment

service provider acting on behalf of the payer shall be considered to be

the location of the payer.

(4) For the purpose of these regulations and without prejudice

to the provisions of the Third Schedule to the Act, the location of the

payee shall be considered to be in the Member State, third territory or

third country corresponding to the IBAN of the payee’s payment

account or any other identifier which unambiguously identifies, and

gives the location of the payee

Provided that where the payment service provider has

various identifiers available that provide a different location for the

payee, the identifier which best reflects the location of the payee shall

be chosen

Provided further that in the absence of the identifiers

referred to in the first paragraph of this sub-regulation, the Member

State, third territory or third country corresponding to the BIC or any

other business identifier code that unambiguously identifies and gives

the location of the payment service provider acting on behalf of the

payee shall be considered to be the location of the payee.

(1) A payment service provider whose home Member Registration of

State or host Member State is Malta shall notify the Commissioner by payment

providers.

applying to be registered as a payment service provider for the purpose

of these regulations by not later than twenty-five (25) days from the

date of coming into force of these regulations or the date Malta

becomes its home Member State or host Member State as applicable,

whichever is the later.

(2) The notification in accordance with this regulation shall be

submitted electronically directly through the established web portal

designated by the Commissioner for the purpose of reporting under the

central electronic system of payment information ("CESOP"), and

shall contain the information requested therein.

(3) A payment service provider registered under this regulation

shall ensure that the information requested upon registration is updated

within fifteen (15) days from the date of occurrence of any changes in

said information by means of an electronic submission through the

web portal mentioned in sub-regulation (2).

(4) A payment service provider registered under this regulation

shall within fifteen (15) days from the date Malta ceases to be its home

Member State or host Member State notify the Commissioner by

means of an electronic submission through the web portal mentioned

in sub-regulation (2) to cancel its registration.

(5) Without prejudice to sub-regulation (1), where a

notification in accordance with sub-regulation (4) is made, the

Commissioner shall cancel the registration of that payment service

provider with effect from the date the notification in accordance with

sub-regulation (4) is received

Provided that where the Commissioner has reason to

believe that a notification in accordance with sub-regulation (4) should

have never been made by the payment service provider, the

registration in accordance with this regulation shall be deemed to have

never been cancelled

Provided further that this shall not prejudice the payment

service provider’s right to contest a decision taken by the Commissioner

in terms of the foregoing proviso, in accordance with paragraph (j) of

article 44 of the Act.

(1) The requirement to which payment service providers

are subject in accordance with regulation 3 shall apply where, in the

course of a calendar quarter, a payment service provider provides

payment services corresponding to more than twenty-five (25) cross-

border payments to the same payee

Provided that the number of cross-border payments referred

to in the first paragraph to this sub-regulation shall be calculated by

reference to the payment services provided by the payment service

provider per Member State and per payee identifier as referred to in

regulation 3(4)

Provided further that where the payment service provider

has information that the payee has several identifiers the calculation

shall be made per payee.

(2) The requirement laid down in regulation 3 shall not apply

to payment services provided by the payment service providers of the

payer as regards any payment where at least one (1) of the payment

service providers of the payee is located in a Member State, as shown

by that payment service provider’s BIC or any other business identifier

code that unambiguously identifies the payment service provider and

its location.

(3) Notwithstanding the provisions of sub-regulation (2), the

payment service providers of the payer shall include, in the calculation

referred to in sub-regulation (1), the payment services referred to in

sub-regulation (2).

(1) Where the requirement for payment service providers

laid down in regulation 3 is applicable in accordance with regulation 5,

the information shall be kept by the payment service provider in an

electronic format for a period of three (3) calendar years, from the end

of the calendar year of the date of the respective payment covered by

this requirement, and shall contain the following information

(a) the BIC or any other business identifier code that

unambiguously identifies the payment service provider;

(b) the name or business name of the payee, as it appears

in the records of the payment service provider;

(c) any available VAT identification number or other

national tax number of the payee;

(d) the IBAN or, if the IBAN is not available, any other

identifier which unambiguously identifies, and gives the location

of the payee;

(e) the BIC or any other business identifier code that

unambiguously identifies, and gives the location of, the payment

service provider acting on behalf of the payee where the payee

receives funds without having any payment account;

(f) any available addresses of the payee as they appear in

the records of the payment services provider, including e-mail

addresses, IP addresses, and web-page addresses;

(g) the details of any cross-border payment as referred to

in regulation 3;

(h) the details of any payment refunds identified as

relating to the cross-border payments referred to in paragraph

(2) The information referred to in paragraphs (g) and (h) of

sub-regulation (1) shall contain the following details

(a)

the date and time of the payment or of the payment

refund;

(b) the amount and the currency of the payment or of the

payment refund;

(c) the Member State of origin of the payment received

by or on behalf of the payee, the Member State of destination of

the refund, as appropriate, and the information used to determine

the origin or the destination of the payment or of the payment

refund in accordance with these regulations;

(d) any reference which unambiguously identifies the

payment;

(e) where applicable, information that the payment is

initiated at the physical premises of the merchant.

(3) Without prejudice to the other provisions of these

regulations, sub-regulations (1) and (2) shall not apply where a payment

service provider registered in accordance with regulation 4 has no

information required to be reported for a calendar quarter in terms of the

other provisions of these regulations.

(1) Where the requirement for payment service providers Submission of

laid down in regulation 3 is applicable in accordance with regulation 5, information.

the information that shall be kept in accordance with regulation 6 shall

be submitted for every calendar quarter by means of an electronic

standard form to the Commissioner through the designated web portal

mentioned in regulation 4(2), or through other means as may be

approved by the Commissioner.

(2) The electronic standard form referred to in sub-regulation

(1) of this regulation shall be a form in a standardised XML format in

accordance with the data table in the Annex to Commission

Implementing Regulation (EU) 2022/1504 of 6 April 2022 laying

down detailed rules for the application of Council Regulation (EU) No

904/2010 as regards the creation of a central electronic system of

payment information (CESOP) to combat VAT fraud.

(3) The information required to be submitted in accordance

with sub-regulation (1) shall be submitted by no later than the 28th day

of the month following the calendar quarter to which the information

relates.

(4) Upon submission, the Commissioner may notify the

payment service provider that the information submitted is valid for

the purpose of onward submission to the CESOP, or otherwise

Provided that where the payment service provider is

notified before the deadline stipulated in sub-regulation (3), that the

information submitted is not valid, the payment service provider shall

take the necessary action to ensure that the information is resubmitted

correctly in its entirety and in accordance with these regulations by the

deadline stipulated in sub-regulation (3). Upon submission, the

procedure laid down in this sub-regulation shall apply.

(5) Notwithstanding any verification by the Commissioner in

accordance with sub-regulation (4), the Commissioner may also notify

the payment service provider to make any corrections as may be

necessary to the information submitted in accordance with these

regulations. Any such corrections shall be submitted within fifteen

(15) days from the deadline stipulated in sub-regulation (3) or the date

of a notification in terms of this sub-regulation, whichever is the later.

(6) For the purpose of this regulation, the Commissioner may

determine whether a resubmission with corrections of the entire

information submitted is required or whether it is only the information

subject to corrections which is required to be submitted.

(7) Where a payment service provider registered in accordance

with regulation 4 has no information required to be reported for a

calendar quarter in accordance with the other provisions of this

regulation, it shall be required to notify the Commissioner through the

submission of information to this effect through the web portal

mentioned in sub-regulation (2) of regulation 4, or through any other

means as may be approved by the Commissioner.

(8) The Commissioner reserves the right to store the

information collected in accordance with these regulations.

(1) Where the Commissioner has reasonable grounds to Other

suspect that any person is involved, directly or indirectly, in VAT information.

fraud, the Commissioner may request a payment service provider, in

accordance with the requirement laid down in regulation 3, to provide

the Commissioner within a date established by the Commissioner,

which shall be not less than fifteen (15) days from the date of service

of such request, with any such information and documentation which

the payment service provider may have relating to payment services

provided to that person for any period determined by the

Commissioner, but not being a period commencing earlier than six (6)

years from the date of such request.

(2) Any payment service provider who receives such request

shall provide the Commissioner with the information demanded in the

request and this notwithstanding anything to the contrary in the Act, in

the Professional Secrecy Act, any other obligation of secrecy or Cap. 377.

confidentiality, or any other restriction relating to the disclosure of

information whether arising from a provision of law or any agreement

or other arrangement.

(3) The information which may be requested by the

Commissioner in terms of this regulation shall be limited to the type of

information specified under paragraphs (a) to (g) of sub-regulation (1)

and paragraphs (a) to (e) of sub-regulation (2) of regulation 6 and shall

be submitted to the Commissioner in the same manner as stipulated in

regulation 7 or in a manner as may be directed by the Commissioner.

(4) If the payment service provider in receipt of a request in

accordance with this regulation does not have any information to

report, he shall inform the Commissioner accordingly and shall have

no further obligations in accordance with this regulation.

(5) The rights of the data subject referred to in regulation 4 of

the Restriction of the Data Protection (Obligations and Rights) S.L. 586.09.

Regulations, in particular the right of access, shall be restricted,

partially or completely, where such a restriction is necessary and

proportionate for a payment service provider to adhere to his

obligations in accordance with this regulation.

(6) A payment service provider and any associate shall not

disclose to any person, whatsoever the fact that the Commissioner has

requested information, or that information has been delivered or may

be delivered to the Commissioner in accordance with this sub-

regulation. Any such disclosures shall constitute an offence and shall

on conviction be liable to a fine (multa) of not less than fifty thousand

euro (€50,000) and not more than one-hundred thousand euro

(€100,000), except for disclosures made in the following

circumstances

(a) disclosures to the Commissioner or to a person

authorised by the Commissioner;

(b) disclosures made by the payment service provider to

an associate or by an associate to another associate that are

necessary in order for it to comply with the Commissioner’s

request for information pursuant to this sub-regulation;

(c) disclosures made in the course of proceedings

instituted in any court or tribunal or administrative body against

the payment service provider or associate to the extent that the

disclosures are required for the proper defence of the payment

service provider or associate;

(d) disclosures made in the course of any proceedings in

any court or tribunal, or to any administrative body or authority,

as long as a waiver for such disclosure has been given in writing

by the Commissioner.

For the purpose of this sub-regulation, "associate" means

an employee, holder of office, representative, or delegate of the

payment service provider but shall not include the person or any of the

persons whose details are indicated in the request issued pursuant to

this regulation.

(1) The Commissioner shall transmit the information

collected pursuant to regulation 7 in accordance with Article 24b of

Council Regulation (EU) No 904/2010 of 7 October 2010 on

administrative cooperation and combating fraud in the field of value

added tax.

(2) Without prejudice to sub-regulation (1), any information

obtained by the Commissioner in terms of these regulations may be

used by the Commissioner for the purpose of any investigation being

carried out in connection with VAT fraud, evasion or avoidance, or in

the context of any proceedings under the Act

Provided that the Commissioner shall keep confidential any

information provided to him by the payment service provider in terms

of these regulations and shall not disclose such information to any

other person except where the Commissioner is bound at law to effect

such disclosure

Provided further that the Commissioner may report any act

or failure by the payment service provider to the relevant regulatory

authority which issued a licence or authorisation to such payment

service provider.

(1) Payment service providers responsible for submitting Delegation.

any information or notification required by these regulations may

delegate the task of submitting the required information or

notifications to an appointed third party on their behalf. Such

delegation shall not effect in any manner the obligations of the

payment service provider to report such information or be deemed to

shift in any way any liability to the appointed third party.

(2) Any payment service provider who delegates the task of

submitting any information or notification required by these

regulations in accordance with sub-regulation (1) shall ensure

(a) to notify the Commissioner of such delegation by

means of an electronic submission through the designated web

portal mentioned in regulation 4(2) and provide such details as

regards the delegated third party as may be requested;

(b) that the appointed third party is provided with all

information necessary to fulfil their delegated task

Provided that the Commissioner reserves the right to

accept, or otherwise, any third party appointed in terms of this

regulation and such decision shall not be contested in any appeal.

(1) Failure by any payment service provider to submit the Penalties for non-

information or notifications required within the time limits set out in compliance.

these regulations shall be liable to an administrative penalty in

accordance with article 38(2)(c) of the Act

Provided that this shall not prejudice the payment service

provider’s right to question the imposition of any such administrative

penalty in accordance with paragraph (k) of article 44 of the Act.

(2) In addition, and without prejudice to any administrative

penalties incurred in terms of sub-regulation (1), the failure by any

payment service provider to adhere to any of the requirements laid

down by these regulations subsequent to two (2) electronic reminders

sent by the Commissioner, in relation to the same required submission,

to a payment service provider over a three (3) month period

commencing on the date the payment service provider was required to

submit the required information or notification in accordance with

these regulations, or where the information submitted by the payment

service provider is found to be incorrect in such a way that it is

misleading, deceitful or false, every senior managing official of such

payment service provider shall be guilty of an offence and shall on

conviction be liable to a fine (multa) of not less than ten thousand euro

(€10,000) and not more than thirty thousand euro (€30,000) for each

offence and, on a request by the prosecution, the court shall order the

offender to comply with the law within a time sufficient for the

purpose of these regulations, but in any case not exceeding three (3)

months, and in default the offender shall be liable to the payment of a

further fine (multa) of fifty euro (€50) for every day that the default

continues after the lapse of the time fixed by the Court

Provided that where a payment service provider is

convicted of an offence against this sub-regulation, that payment

service provider shall not be guilty of an offence against the other

provisions of the Act in relation to the same offence.

€0.99