CRD (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) REGULATIONS

SUBSIDIARY LEGISLATION 370.25

CRD (ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS) REGULATIONS

24th January, 2014

LEGAL NOTICE 32 of 2014, as amended by Legal Notices 31 of 2022

and 251 of 2024.

(1) The title of these regulations is the CRD

(Administrative Penalties, Measures and Investigatory Powers)

Regulations.

(2) The purpose of these regulations is to implement Articles

64(2), 65, 67, 68, 69, 70, 71 and 72 of the CRD.

(Regulation 6)

The provisions of regulation 6 shall apply at least in any of the

following circumstances

(a) an investment firm fails to have in place governance

arrangements required by the competent authority in

accordance with the provisions of the Investment

Services Act (Supervisory Review) Regulations, 2013

which transpose the requirements of Article 74 of the

CRD;

(b) an investment firm fails to report information or

provide incomplete or inaccurate information on

compliance to meet own funds requirements set out in

Article 92 of the CRR to the competent authority, in

breach of Article 99(1) of the CRR;

(c) an investment firm fails to report or provides

incomplete or inaccurate information to the competent

authority in relation to the data referred to in Article

101 of the CRR;

(d) an investment firm fails to report information or

provides incomplete or inaccurate information about a

large exposure to the competent authority in breach of

Article 394(1) of the CRR;

(e) an investment firm fails to report or provides

incomplete or inaccurate information on liquidity to

the competent authority in breach of Article 415(1)

and (2) of the CRR;

(f)

an investment firm fails to report information or

provides incomplete or inaccurate information on the

leverage ratio to the competent authority in breach of

Article 430(1) of the CRR;

(g) an investment firm repeatedly or persistently fails to

hold liquid assets in breach of Article 412 of the CRR;

(h) an investment firm incurs exposure in excess of the

limits set out in Article 395 of the CRR;

(i)

an investment firm is exposed to the credit risk of a

securitisation position without satisfying the

conditions set out in Article 405 of the CRR;

(j)

an investment firm fails to disclose information or

provides incomplete or inaccurate information in

breach of Article 431(1), (2) and (3) or Article 451(1)

of the CRR;

(k) an investment firm makes payments to holders of

instruments included in the own funds of the

investment firm in breach of the Investment Services

Rules transposing Article 141 of the CRD or in cases

where Articles 28, 51 or 63 of the CRR prohibit such

payments to holders of instruments included in own

funds;

(l)

an investment firm is found liable for a serious breach

of the Prevention of Money Laundering Act and the

regulations issued thereunder;

(m) an investment firm allows one or more persons not

complying with Article 91 of the CRD to become or

remain a member of the management body.

CRD (ADMINISTRATIVE PENALTIES

MEASURES AND INVESTIGATORY POWERS)

(n) a parent institution, a parent financial holding company

or a parent mixed financial holding company fails to take

any action that may be required to ensure compliance

with the prudential requirements set out in Part Three,

Four, Six and Seven of the CRR or imposed under point

(a) of Article 104(1) or Article 105 of the CRD as

transposed in the Investment Services Act (Supervisory

Review) Regulations on a consolidated or sub-

consolidated basis.

(1)

In these regulations, unless the context otherwise

requires -

"the Act" means the Investment Services Act;

"competent authority" means the Malta Financial Services

Authority established by the Malta Financial Services Authority

Act;

"CRD" means Directive 2013/36/EU of the European Parliament

and of the Council of 26 June 2013 on access to the activity of

c r e d it in s t it u ti o ns a n d t h e p r u de n t ia l su pe r vi s i on of c r e d it

institutions and investment firms amending Directive 2002/87/EC

and repealing Directives 2006/48/EC and 2006/49/EC, as amended

from time to time, and includes any implementing measures that

have been or may be issued thereunder;

"CRR" means Regulation (EU) No 575/2013 of the European

Parliament and of the Council of 26 June 2013 on prudential

requirements for credit institutions and investment firms and

amending Regulation (EU) No 648/2012, as amended from time to

time, and includes any implementing measures that have been or

may be issued thereunder;

"DORA Regulation" means Regulation (EU) 2022/2554 of the

European Parliament and of the Council of 14 December 2022 on

digital operational resilience for the financial sector, and amending

Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/

2014, (EU) No 909/2014 and (EU) 2016/1011, as may be amended

from time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;

"financial holding company" shall have the same meaning as that

assigned to it in point (20) of Article 4(1) of the CRR;

"investment firm" means a person who holds an investment

services licence issued by the competent authority under the Act

and which is subject to the requirements of the CRD and the CRR;

"mixed financial holding company" shall have the same meaning

as that assigned to it in regulation 2 of the Financial Conglomerates

Regulations.

(2) Words and expressions which are also used in the Act shall

have the same meaning as in the Act.

The competent authority shall exercise its supervisory

powers and its powers to impose penalties, in such a way as to

ensure full and complete adherence to the requirements and

obligations arising out of the CRD and out of the CRR, either

directly or in collaboration with European regulatory authorities

and with overseas regulatory authorities, in terms of law and as

warranted by the relevant circumstances.

(1) Without prejudice to the supervisory powers of the

competent authority referred in regulation 3, the competent

authority shall impose administrative penalties and other

administrative measures in respect of breaches of

(a) the provisions of the Act and, or of regulations and, or

Investment

Services

Rules

made

thereunder

transposing the provisions of the CRD, and, or

(b) the provisions of the CRR.

(2) The administrative penalties and other administrative

measures taken pursuant to sub-regulation (1) shall be effective,

proportionate and dissuasive.

(3) The competent authority may apply administrative penalties

or other administrative measures relating to breaches of the

provisions of the Act and any regulations and Investment Services

Rules issued thereunder transposing the requirements of the CRD,

and of the CRR applicable to financial holding companies and

m i xe d fi n a nc ia l ho ld in g c o m pa ni e s , to t he m e m b e r s o f t he

management body of such companies and to other natural persons

who under Maltese law are responsible for the breach.

(4) The competent authority may impose administrative

penalties or other administrative measures, in terms of these

regulations, aiming to end identified breaches or causes of such

breaches, on financial holding companies, mixed financial holding

companies and mixed activity holding companies or their effective

managers which are responsible for the breach of the provisions of

the Act and any regulations and Investment Services Rules issued

thereunder transposing the requirements of Chapter 3 of Title VII

of the CRD.

The competent authority shall have all the information

gathering powers and investigatory powers which are necessary for

the exercise of its functions. Without prejudice to other relevant

provisions laid down in the Act, the CRD and in the CRR these

powers shall include

(a) the power to require the following natural or legal

persons to provide all information that is necessary in

order to carry out the tasks of the competent authority,

including information to be provided at recurring

intervals and in specified formats for supervisory and

related statistical purposes

(i) investment firms established in Malta;

(ii) financial holding companies established in

Malta;

(iii) mixed financial holding companies established

in Malta;

(iv) mixed-activity holding companies established in

Malta;

(v) persons belonging to the entities referred to in

sub-paragraphs (i) to (iv);

(vi) third parties to whom the entities referred to in

sub-paragraphs (i) to (iv) have outsourced

functions or activities, including ICT third-party

service providers referred to in Chapter V of the

DORA Regulation;

(b) the power to conduct all necessary investigations of

any person referred in paragraph (a)(i) to (iv)

established or located in Malta where necessary to

carry out the tasks of the competent authority

including

(i)

the right to require the submission of

documents;

(ii) the right to examine the books and records of the

persons referred to in paragraph (a)(i) to (iv) and

the right to take copies or extracts from such

books and records;

(iii) the right to obtain written or oral explanations

from amy person referred to in paragraph (a)(i)

to (iv) or their representatives or staff; and

(iv) the right to interview any other person who

consents to be interviewed for the purpose of

collecting information relating to the subject

matter of an investigation.

Where an investment firm is found by the competent

authority to have committed any of the breaches referred to in the

Schedule, the administrative penalties and other administrative

measures which the competent authority may apply on such

investment shall include at least the following

(a) a public statement which identifies the natural person,

investment firm, financial holding company or mixed

financial holding company and the nature of the

breach;

(b) the withdrawal of the investment firm’s investment

services licence, in accordance with article 7 of the

Act;

(c) subject to the provisions of regulation 4(3), a

temporary ban against a member of the investment

firm’s management body or any other natural person,

who is held responsible, from exercising functions

within investment firms;

(d) in the case of a legal person, administrative pecuniary

penalties of up to 10% of the total annual net turnover

including the gross income consisting of interest

receivable and similar income, income from shares and

other variable or fixed-yield securities, and

commissions or fees receivable in accordance with

Article 316 of the CRR, of that legal person in the

preceding business year

Provided that where the investment firm subject to the

administrative pecuniary penalty is a subsidiary of a

parent undertaking, the relevant gross income shall be

the gross income resulting from the consolidated

account of the ultimate parent undertaking in the

preceding business year;

(e) in the case of a natural person, administrative

pecuniary penalties of up to EUR 5,000,000; and

(f)

administrative pecuniary penalties of up to twice the

amount of the profits gained or losses avoided because

of the breach, where those can be determined.

When the competent authority takes a decision in the

exercise of its supervisory powers and powers to impose penalties,

it shall specify the reasons on which the said decision is based.

(1) The competent authority shall publish on its official

website any administrative penalties and sanctions which are

imposed for breaches of the Act, regulations and Investment

Services Rules issued thereunder transposing the requirements of

the CRD, and of the CRR. Such publication shall include

information on the type and nature of the breach and the identity of

the natural or legal person on whom the penalty is imposed, without

undue delay after that person is informed of those penalties

Provided that in cases where an appeal has been filed by the

person on whom such administrative penalties have been imposed,

the competent authority shall, without undue delay, also publish on

its official website information on the status of the appeal and the

outcome thereof.

(2) The competent authority shall publish the penalties

imposed in terms of these regulations, on an anonymous basis, in

any of the following circumstances

(a) where the penalty is imposed on a natural person and,

following an obligatory prior assessment, the

publication of personal data is found to be

disproportionate;

(b) where publication would jeopardise the stability of

financial markets or an ongoing criminal investigation;

or

(c) where publication would cause, insofar as it can be

determined, disproportionate damage to the investment

firms, or natural persons involved

Provided that, where the circumstances referred to in

paragraph (a) are likely to cease within a reasonable period of time,

publication in terms of sub-regulation (1) may be postponed for

such period of time.

(3) Information published in terms of this regulation shall

remain on the official website of the competent authority for a

period of not less than five years. Personal data shall be retained on

the official website of the competent authority only for the period

necessary, in accordance with the provisions of Maltese legislation

on data protection.

(1) Subject to the professional secrecy requirements

referred to in the article 26 of the Act, the competent authority shall

inform the EBA of all administrative penalties and sanctions it

imposes under these regulations, including all permanent

prohibitions imposed under regulations 4 and 6. It shall also

provide information regarding any appeal in relation thereto and

the outcome therefrom for the purpose of publication on the EBA

database of sanctions which the competent authority shall consult

where appropriate in the carrying out of its functions and duties.

(2) In the event of a change of status or a successful appeal

from a penalty imposed by the competent authority in terms of

these regulations, the competent authority shall request the EBA to

delete or update the relevant entries in the database held by the

EBA in terms of Article 69 of the CRD.

(3) Where the competent authority assesses good repute for the

purpo ses of th e I nvest men t S ervices Rul es transpo sing th e

requirements of Articles 91(1) and 121 of the CRD, it shall consult

the EBA database of administrative penalties

Provided that the competent authority shall check, the

existence of a relevant conviction in the criminal record of the

person concerned. For these purposes, information shall be

exchanged in accord ance with Decision 20 09/316/JH A and

Framework Decision 2009/315/JHA.

When determining the type of administrative penalties or

other administrative measures and the level of administrative

pecuniary penalties to be imposed on investment firms in terms of

these regulations, the competent authority shall take into account

all relevant circumstances including, where appropriate

(a) the gravity and the duration of the breach;

(b) the degree of responsibility of the natural or legal

person responsible for the breach;

(c) the financial strength of the natural or legal person

responsible for the breach, as indicated, for example,

by the total turnover of a legal person or the annual

income of a natural person;

(d) the importance of profits gained or loses avoided by

the natural or legal person responsible for the breach,

insofar as they can be determined;

(e) the losses for third parties caused by the breach,

insofar as they can be determined;

(f)

the level of co-operation of the natural or legal person

responsible for the breach with the competent

authority;

(g) previous breaches by the natural or legal person

responsible for the breach;

(h) any potential systemic consequence of the breach.

(1) The competent authority shall establish effective and

reliable mechanisms to encourage the reporting to it of potential or

actual breaches of the provisions of the Act, regulations and

Investment Services Rules issued thereunder transposing the

requirements of the CRD, and of the provisions of the CRR.

(2) The mechanisms referred to in sub-regulation (1) shall

include at least

(a) specific procedures for the receipt of reports on

breaches and their follow-up;

(b) appropriate protection for employees of an investment

firm who report breaches committed within the

investment

firm

itself

against

retaliation,

discrimination or other types of unfair treatment at a

minimum;

(c) protection of personal data concerning both the person

who reports the breaches and the natural person who is

allegedly responsible for a breach, in accordance with

the Maltese legislation on data protection;

(d) clear rules that ensure that confidentiality is

guaranteed in all cases in relation to the person who

reports the breaches committed within the investment

firm, unless disclosure is required by national law in

the context of further investigations or subsequent

judicial proceedings.

Subject to the provisions of the Act, any person in respect

of whom a decision is taken by the competent authority under these

regulations may appeal to the Financial Services Tribunal in terms

of article 19 of the Malta Financial Services Authority Act.