INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) REGULATIONS

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

SUBSIDIARY LEGISLATION 370.48

INVESTMENT FIRMS DIRECTIVE

(ADMINISTRATIVE PENALTIES, MEASURES AND

INVESTIGATORY POWERS) REGULATIONS

11th February, 2022 *

LEGAL NOTICE 23 of 2022, as amended by Legal Notice 156 of

2025.

(1)

The title of these regulations is the Investment

Firms Directive (Administrative Penalties, Measures and Investigatory

Powers) Regulations.

(2)

The scope of these regulations is to transpose Articles 18,

19, 20, 21, 22, and 23 of Directive (EU) 2019/2034 of the European

Parliament and of the Council of 27 November 2019 on the prudential

supervision of investment firms and amending Directives 2002/87/EC,

2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU.

(1)

In these regulations, unless the context otherwise

requires -

"the Act" means the Investment Services Act;

"competent authority" means the Malta Financial Services

Authority established by article 3 the Malta Financial Services

Authority Act;

"CRD" means Directive 2013/36/EU of the European

Parliament and of the Council of 26 June 2013 on access to the activity

of credit institutions and the prudential supervision of credit

institutions, amending Directive 2002/87/EC and repealing Directives

2006/48/EC and 2006/49/EC, as amended from time to time, and

includes any implementing measures that have been or may be issued

thereunder;

"CRR" means Regulation (EU) No 575/2013 of the European

Parliament and of the Council of 26 June 2013 on prudential

requirements for credit institutions and amending Regulation (EU) No

648/2012, as amended from time to time, and includes any

implementing measures that have been or may be issued thereunder;

"financial holding company" shall have the same meaning as

that assigned to it in point (20) of Article 4(1) of the CRR;

"the IFD" means Directive 2019/2034 of the European

Parliament and of the Council of 27 November 2019 on the prudential

supervision of investment firms and amending Directives 2002/87/EC,

* See Legal Notice 60 of 2022.

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU,

as amended from time to time, and includes any implementing

measures that have been or may be issued thereunder;

"the IFR" means Regulation 2019/2033 of the European

Parliament and of the Council of 27 November 2019 on the prudential

requirements of investment firms and amending Regulations (EU) No

1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/

2014, as amended from time to time, and includes any implementing

measures that have been or may be issued thereunder;

"investment firm" means a person who holds an investment

services licence issued by the competent authority under the Act and

which is subject to the requirements of the IFR and the IFD;

"mixed financial holding company" shall have the same

meaning as that assigned to it in point (25) of Article 3(1) of the IFR.

(2)

Words and expressions used in these regulations shall

have the same meaning as that assigned to them in the Act.

The competent authority shall exercise its supervisory

powers and its powers to impose administrative penalties and

measures, in such a way as to ensure full and complete adherence to

the requirements and obligations arising out of the IFD and out of the

IFR, either directly or in collaboration with European regulatory

authorities and with overseas regulatory authorities, in terms of law

and as warranted by the relevant circumstances.

(1)

Without prejudice to the supervisory powers of

the competent authority referred to in regulation 3 and the IFD, the

competent authority shall impose administrative penalties and other

administrative measures in respect of breaches of

(a)

the provisions of the Act and, or of regulations

and, or Investment Services Rules made thereunder transposing

the provisions of the IFD; and, or

(b)

the provisions of the IFR,

including where an investment firm

(i)

fails to have in place internal governance

arrangements as set out in Article 26 of the IFD;

(ii) fails to report information or provides

incomplete or inaccurate information on compliance with

the obligation to meet own funds requirements set out in

Article 11 of the IFR to the competent authority, in

breach of point (b) of Article 54(1) of the IFR;

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

(iii) fails to report to the competent authority, in

breach of point (e) of Article 54(1) of the IFR,

information about concentration risk or provides

incomplete or inaccurate information;

(iv) incurs a concentration risk in excess of the

limits set out in Article 37 of the IFR, without prejudice

to Articles 38 and 39 of the IFR;

(v)

repeatedly or persistently fails to hold

liquid assets in breach of Article 43 of the IFR, without

prejudice to Article 44 of the IFR;

(vi) fails to disclose information, or provides

incomplete or inaccurate information, in breach of the

provisions set out in Part Six of the IFR;

(vii) makes payments to holders of instruments

included in the own funds of the investment firm where

Article 28, 52 or 63 of the CRR prohibit such payments

to holders of instruments included in own funds;

(viii) is found liable for a serious breach of

national provisions adopted pursuant to Directive (EU)

2015/849 of the European Parliament and of the Council

of 20 May 2015 on the prevention of the use of the

financial system for the purposes of money laundering or

terrorist financing, amending Regulation (EU) No 648/

2012 of the European Parliament and of the Council, and

repealing Directive 2005/60/EC of the European

Parliament and of the Council and Commission Directive

2006/70/EC;

(ix) allows one or more persons who do not

comply with Article 91 of the CRD to become or remain

a member of the management body.

(2)

The administrative penalties and other administrative

measures taken pursuant to sub-regulation (1) shall be effective,

proportionate and dissuasive.

(3)

The competent authority may impose administrative

penalties and other administrative measures relating to breaches of the

provisions of the Act and any regulations and Investment Services

Rules issued thereunder transposing the requirements of the IFD, and

of the IFR to the members of the management body of such companies

and to other natural persons who under Maltese law are responsible for

the breach.

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

The competent authority shall have all the information

gathering powers and investigatory powers which are necessary for the

exercise of its functions. Without prejudice to other relevant

provisions laid down in the Act, the IFD and in the IFR these powers

shall include

(a)

the power to require information from the

following natural or legal persons

(i)

investment firms established in Malta;

(ii)

investment holding companies established

in Malta;

(iii) mixed

financial

holding

companies

established in Malta;

(iv) mixed-activity

holding

companies

established in Malta;

(v)

persons belonging to the entities referred to

in sub-paragraphs (i) to (iv);

(vi) third parties to whom the entities referred

to in sub-paragraphs (i) to (iv) have outsourced

operational functions or activities;

(b)

the power to conduct all necessary investigations

of any person referred in paragraph (a) established or located in

Malta where necessary to carry out the tasks of the competent

authority including

(i)

the right to require the submission of

documents by the persons referred to in paragraph (a);

(ii)

the right to examine the books and records

of the persons referred to in paragraph (a) and the right to

take copies or extracts from such books and records;

(iii) the right to obtain written or oral

explanations from any person referred to in paragraph (a)

or their representatives or staff; and

(iv) the right to interview any other person who

consents to be interviewed for the purpose of collecting

information relating to the subject matter of an

investigation;

(c)

the power to conduct all necessary inspections at

the business premises of the legal persons referred to in

paragraph (a) and any other undertakings included in the

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

supervision of compliance with the group capital test, where the

competent authority is the group supervisor, subject to the prior

notification of other competent authorities concerned.

Where an investment firm is found by the competent

authority to have committed any of the breaches referred to in

regulation 5, the administrative penalties and other administrative

measures which the competent authority may impose shall include at

least the following

(a)

a public statement which identifies the natural or

legal person, investment firm, financial holding company or

mixed financial holding company and the nature of the breach;

(b)

an order requiring the natural or legal person

responsible to cease the conduct and to desist from repeating

that conduct;

(c)

the withdrawal of the investment firm’s

investment services licence, in accordance with article 7 of the

Act;

(d)

subject to the provisions of regulation 4(3), a

temporary ban against a member of the investment firm’s

management body or any other natural person, who is held

responsible, from exercising functions within investment firms;

(e)

in the case of a legal person, administrative

penalties of up to 10% of the total annual net turnover including

the gross income consisting of interest receivable and similar

income, income from shares and other variable or fixed-yield

securities, and commissions or fees of that legal person in the

preceding business year

Provided that, where the investment firm subject

to the administrative penalty is a subsidiary of a parent

undertaking, the relevant gross income shall be the gross

income resulting from the consolidated account of the ultimate

parent undertaking in the preceding business year;

(f)

in the case of a legal person, administrative

penalties of up to twice the amount of the profits gained or

losses avoided due to the breach where those profits or losses

can be determined; and

(g)

in the case of a natural person, administrative

penalties of up to EUR 5,000,000.

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

(1)

The competent authority, without undue delay,

shall publish on its official website and, or on any other media, as

deemed appropriate, any administrative penalties and measures which

are imposed for breaches of the Act, regulations and Investment

Services Rules issued thereunder transposing the requirements of the

IFD, and of the IFR. Such publication shall include information on the

type and nature of the breach and the identity of the natural or legal

person on whom the penalty or measure is imposed. The information

shall only be published by the competent authority after that person

has been informed of those administrative penalties or measures and to

the extent that the publication is necessary and proportionate

Provided that, in cases where an appeal has been filed by

the person on whom such administrative penalties or measures have

been imposed, the competent authority shall, without undue delay, also

publish on its official website information on the status of the appeal

and the outcome thereof.

(2)

The competent authority shall publish the penalties or

measures imposed in terms of these regulations, on an anonymous

basis, in any of the following circumstances

(a)

where the penalty or measure is imposed on a

natural person and, following an obligatory prior assessment,

the publication of personal data is found to be disproportionate;

(b)

where publication would jeopardise the stability

of financial markets or an ongoing criminal investigation; or

(c)

where publication would cause, insofar as it can

be determined, disproportionate damage to the investment

firms, or natural persons involved

Provided that, where the circumstances referred to in

paragraph (a) are likely to cease within a reasonable period of time,

publication in terms of sub-regulation (1) may be postponed for such

period of time.

(3)

Information published in terms of this regulation shall

remain on the official website of the competent authority for a period

of not less than five years. Personal data shall be retained on the

official website of the competent authority only for the period

necessary, in accordance with the provisions of Maltese legislation on

data protection.

The competent authority shall inform the EBA of all

administrative penalties and measures it imposes under these

regulations. It shall also provide information regarding any appeal in

relation thereto and the outcome therefrom for the purpose of

publication on the EBA database of sanctions which the competent

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

authority shall consult where appropriate in the carrying out of its

functions and duties.

When determining the type of administrative penalties or

other administrative measures and the level of administrative penalties

to be imposed in terms of these regulations, the competent authority

shall take into account all relevant circumstances including, where

appropriate

(a)

the gravity and the duration of the breach;

(b)

the degree of responsibility of the natural or legal

person responsible for the breach;

(c)

the financial strength of the natural or legal person

responsible for the breach, including the total turnover of a

legal person or the annual income of a natural person;

(d)

the importance of profits gained or losses avoided

by the natural or legal person responsible for the breach;

(e)

the damages for third parties caused by the

breach;

(f)

the level of co-operation of the natural or legal

person responsible for the breach with the competent authority;

(g)

previous breaches by the natural or legal person

responsible for the breach; and

(h)

any potential systemic consequence of the breach.

(1)

The competent authority shall establish effective

and reliable mechanisms to encourage the reporting to it of potential or

actual breaches of the provisions of the Act, regulations and

Investment Services Rules issued thereunder transposing the

requirements of the IFD, and of the provisions of the IFR.

(2)

The mechanisms referred to in sub-regulation (1) shall

include at least

(a)

specific procedures for the reception, treatment

and following up of such reports, including the establishment of

secure communication channels;

(b)

appropriate protection against retaliation,

discrimination or other types of unfair treatment by the

investment firm for employees of investment firms who report

breaches committed within the investment firm;

(ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS)

(c)

protection of personal data concerning both the

person who reports the breaches and the natural person who is

allegedly responsible for a breach, in accordance with the

Maltese legislation on data protection and Regulation (EU)

2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to

the processing of personal data and on the free movement of

such data, and repealing Directive 95/46/EC (General Data

Protection Regulation);

(d)

clear rules that ensure that confidentiality is

guaranteed in all cases in relation to the person who reports the

breaches committed within the investment firm, unless

disclosure is required by national law in the context of further

investigations or subsequent judicial proceedings.

(3)

Investment firms shall have in place appropriate

procedures for their employees to report breaches internally through a

specific independent channel. Those procedures may be provided for

by the social partners provided that those procedures offer the same

protection as the protection referred to in paragraphs (b), (c) and (d) of

sub-regulation (2).

Subject to the provisions of the Act, any person in

respect of whom a decision is taken by the competent authority under

these regulations may appeal to the Financial Services Tribunal in

terms of article 19 of the Investment Services Act.