MALTA FINANCIAL SERVICES AUTHORITY ACT (SECURITISATION) REGULATIONS (securitisation)

(SECURITISATION)

SUBSIDIARY LEGISLATION 330.14

MALTA FINANCIAL SERVICES AUTHORITY ACT

(SECURITISATION) REGULATIONS

26th March, 2021

LEGAL NOTICE 118 of 2021.

(1)

The title of these regulations is the Malta

Financial Services Authority Act (Securitisation) Regulations.

(2)

The purpose of these regulations is to implement the

relevant provisions of the Securitisation Regulation as herein defined,

and they shall be interpreted and applied accordingly.

(1)

In these regulations, unless the context otherwise

requires

"the Act" means the Malta Financial Services Authority Act;

"Securitisation Regulation" means Regulation (EU) 2017/2402

of the European Parliament and of the Council of 12 December 2017

laying down a general framework for securitisation and creating

specific framework for simple, transparent and standardised

securitisation, and amending Directives 2009/65/EC, 2009/138/EC

and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No

648/2012, as may be amended from time to time, and includes any

implementing measures, implementing technical standards, regulatory

technical standards, guidelines and similar measures that have been or

may be issued thereunder;

"subject person" means any institutional investor, originator,

sponsor, original lender and securitisation special purpose entities

("SSPE") as defined in the Securitisation Regulation.

(2)

Words and expressions used in these regulations which

are also used in the Securitisation Regulation but which are not

defined herein, shall have the same meaning assigned to them in the

Securitisation Regulation.

These regulations shall apply to subject persons involved

in securitisations.

The Malta Financial Services Authority, established by

the Act shall be the designated competent authority in Malta for the

purposes of implementing the relevant provisions of the Securitisation

Regulation, and any reference in these regulations to the competent

authority shall be read and construed accordingly.

(SECURITISATION)

(1)

The competent authority shall exercise all the

functions, obligations and powers and shall satisfy all the requirements

imposed on competent authorities in accordance with the Securitisation

Regulation.

(2)

Without prejudice to sub-regulation (1), the competent

authority may, for the better implementation of the Securitisation

Regulation, exercise any of the powers assigned to it under the Act.

The Authority may issue Rules in terms of article 16(2)(a)

and article 20A(3) of the Act for the better carrying out of these

regulations and the Securitisation Regulation.

(1)

The competent authority shall exercise its

supervisory powers and its powers to impose administrative penalties

and other administrative measures, in such a way as to ensure full and

complete adherence to the requirements and obligations arising out of

the Act, any regulations issued thereunder, any Rules issued by the

competent authority and the Securitisation Regulation, either directly,

in collaboration with other authorities or by applications to the

competent judicial authorities, in terms of the law as warranted by the

relevant circumstances.

(2)

The competent authority shall ensure that administrative

penalties and other administrative measures imposed on subject

persons are effectively implemented.

(3)

The administrative penalties and other administrative

measures imposed on subject persons shall be effective, proportionate

and dissuasive.

(4)

When determining the type of administrative penalties or

other administrative measures and the level of administrative penalties

to be imposed on subject persons, the competent authority shall take

into account the extent to which the breach is intentional or results from

negligence and all other relevant circumstances including, where

appropriate

(a)

the materiality, gravity and the duration of the

breach;

(b)

the degree of responsibility of the natural or legal

person responsible for the breach;

(c)

the financial strength of the natural or legal person

responsible for the breach;

(d)

the importance of profits gained or loses avoided

by the natural or legal person responsible for the breach insofar

as they can be determined;

(SECURITISATION)

(e)

the losses for third parties caused by the breach

insofar as they can be determined;

(f)

the level of co-operation of the natural or legal

person responsible for the breach with the competent authority;

(g)

previous breaches by the natural or legal person

responsible for the breach.

(5)

Where obligations imposed in terms of the Act, any

regulations issued thereunder, any Rules issued by the competent

authority or the Securitisation Regulation apply to a subject person

which is a legal person, the competent authority may impose

administrative penalties and other administrative measures on

members of the management body of such legal entity and to other

individuals who are responsible for the breach of such obligations.

Without prejudice to the powers of the competent

authority under the Act or any other law, the competent authority shall

impose administrative penalties and other administrative measures for

breaches of the Act, any regulations issued thereunder, any Rules

issued by the competent authority and the Securitisation Regulation.

(1)

Without prejudice to the generality of regulation

8, the competent authority shall impose administrative penalties and

other administrative measures for the following breaches

(a) an originator, sponsor or original lender has failed

to meet the requirements provided for in Article 6 of the

Securitisation Regulation;

(b)

an originator, sponsor or SSPE has failed to meet

the requirements provided for in Article 7 of the Securitisation

Regulation;

(c)

an originator, sponsor or original lender has failed

to meet the criteria provided for in Article 9 of the

Securitisation Regulation;

(d)

an originator, sponsor or SSPE has failed to meet

the requirements provided for in Article 18 of the Securitisation

Regulation;

(e)

a securitization is designated as STS and an

originator, sponsor or SSPE of that securitization has failed to

meet the requirements provided for in Articles 19 to 22 or

Articles 23 to 26 of the Securitisation Regulation;

(f)

an originator or sponsor makes a misleading

notification pursuant to Article 27(1) of the Securitisation

Regulation;

(SECURITISATION)

(g)

an originator or sponsor has failed to meet the

requirements provided for in Article 27(4) of the Securitisation

Regulation; or

(h)

a third party authorized pursuant to Article 28 of

the Securitisation Regulation has failed to notify changes to the

information provided in accordance with Article 28(1) of the

Securitisation Regulation, or any other changes that could

reasonably be considered to affect the assessment of the

competent authority.

(2)

Without prejudice to the generality of regulation 8, the

competent authority shall have the power to impose the following

administrative penalties and other administrative measures for the

breaches indicated in sub-regulation (1)

(a)

a public statement which indicates the identity of

the natural or legal person and the nature of the infringement in

accordance with Article 37 of the Securitisation Regulation;

(b)

an order requiring the natural or legal person to

cease the conduct and to desist from a repetition of that conduct;

(c)

a temporary ban preventing any member of the

originator’s, sponsor’s or SSPE’s management body or any other

natural person held responsible for the infringement from

exercising management functions in such undertakings;

(d)

in the case of an infringement as referred to in

paragraphs (e) and (f) of sub-regulation (1) a temporary ban

preventing the originator and sponsor from notifying under

Article 27(1) that a securitisation meets the requirements set out

in Articles 19 to 22 or Articles 23 to 26 of the Securitisation

Regulation;

(e)

in the case of a natural person, administrative

penalties of up to five million euro (€5,000,000);

(f)

in the case of a legal person, administrative

penalties of up to five million euro (€5,000,000) or of up to 10%

of the total annual net turnover of the legal person according to

the last available audited accounts approved by the management

body; where the legal person is a parent undertaking or a

subsidiary of the parent undertaking which has to prepare

consolidated financial accounts in accordance with Directive

2013/34/EU of the European Parliament and of the Council, the

relevant total annual net turnover shall be the total net annual

turnover or the corresponding type of income in accordance with

the relevant accounting legislative acts according to the last

available consolidated accounts approved by the management

(SECURITISATION)

body of the ultimate parent undertaking;

(g)

administrative penalties of at least twice the

amount of the benefit derived from the infringement where that

benefit can be determined, even if that exceeds the maximum

amounts in paragraphs (e) and (f) of this sub-regulation;

(h)

in the case of an infringement as referred to in

paragraph (h) of sub-regulation (1), a temporary withdrawal of

the authorisation referred to in Article 28 for the third party

authorised to check the compliance of a securitisation with

Articles 19 to 22 or Articles 23 to 26 of the Securitisation

Regulation.

(1)

The competent authority shall publish any

decision imposing an administrative penalty or any other

administrative measure for breaches of the provisions of the Act, any

regulations issued thereunder, any Rules issued by the competent

authority and the Securitisation Regulation from which there is no

appeal on its website without undue delay after the person on whom

the penalty or measure was imposed has been informed of that

decision. The publication referred to in this sub-regulation shall

include at least information on the type and nature of the breach and

the identity of the persons responsible.

(2)

Where the publication of the identity of the legal persons

or of the personal data of the natural persons is considered by the

competent authority to be disproportionate following a case-by-case

assessment, or where the competent authority considers that the

publication jeopardises the stability of the financial markets or an

ongoing investigation, or where the publications would cause, insofar

as can be determined, disproportionate damages to the person

involved, the competent authority shall either

(a)

defer the publication of the decision to impose the

administrative penalty or any other administrative measure

until the reasons for non-publication cease to exist;

(b)

publish the decision to impose the administrative

penalty or any other administrative measure on an anonymous

basis in a manner which complies with Maltese law; or

(c)

not publish the decision to impose an

administrative penalty or any other administrative measure in

the event that the options laid down in paragraphs (a) and (b)

are considered to be insufficient to ensure

(i)

that the stability of the financial markets

would not be put in jeopardy;

(ii)

the proportionality of the publication of

(SECURITISATION)

such decisions with regard to measures which are deemed

to be of a minor nature.

(3)

In the case of a decision to publish an administrative

penalty or any other administrative measure on an anonymous basis,

the publication of the relevant data may be postponed.

(4)

Where the decision to impose an administrative penalty or

any other administrative measure is subject to appeal before the

relevant judicial or other authorities, the competent authority shall also

publish immediately on its website such information and any

subsequent information on the outcome of such an appeal. Any

decision annulling a previous decision to impose an administrative

penalty or any other administrative measure shall also be published.

(5) The competent authority shall ensure that any publication

in accordance with this regulation shall remain on its official website

for a period of at least five years from its publication

Provided that personal data contained in the publication

shall be kept on the official website of the competent authority only for

the period which is necessary in accordance with the applicable data

protection legislation.

A right of appeal to the Financial Services Tribunal shall

lie from the decisions which the competent authority shall take under

these regulations and the provisions of article 21 of the Act shall

mutatis mutandis apply.