ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS REGULATIONS

SUBSIDIARY LEGISLATION 371.05

ADMINISTRATIVE PENALTIES, MEASURES AND

INVESTIGATORY POWERS REGULATIONS

10th April, 2015

LEGAL NOTICE 131 of 2015, as amended by Legal Notices 491 of 2021,

254 of 2024 and 46 of 2025.

(1) The title of these regulations is the Administrative

Penalties, Measures and Investigatory Powers Regulations.

(2) The purpose of these regulations is to implement Articles

64(2) and 65 to 72 of the CRD.

(1)

In these regulations, unless the context otherwise

requires -

"the Act" means the Banking Act;

"the CRD" means Directive 2013/36/EU of the European

Parliament and of the Council of 26 June 2013 on access to the

activity of credit institutions and the prudential supervision of credit

institutions a m e n d i n g D i r e c t i v e 2 0 0 2 / 8 7 / E C a n d r e p e a l i n g

Directives 2006/48/EC and 2006/49/EC, as amended from time to

time, and includes any binding legal instruments, guidelines and other

measures that have been or may be issued thereunder;

"the CRR" means Regulation (EU) No 575/2013 of the European

Parliament and of the Council of 26 June 2013 on prudential

requirements for credit institutions and amending Regulation (EU)

No 648/2012, as amended from time to time, and includes any

binding legal instruments, guidelines and other measures that have

been or maybe issued thereunder;

"DORA Regulation" means Regulation (EU) 2022/2554 of the

European Parliament and of the Council of 14 December 2022 on

digital operational resilience for the financial sector and amending

Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/

2014, (EU) No 909/2014 and (EU) 2016/1011, as may be amended

from time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;

"mixed activity holding company" shall have the same meaning

as that assigned to it in point (22) of Article 4(1) of the CRR;

"subsidiary" shall have the same meaning as that assigned to it in

point (16) of Article 4(1) of the CRR.

(2) Words and expressions used in these regulations which are

also used in the Act but which are not defined herein, shall have the

same meaning as in the Act

Provided that, in accordance with article 2(1A) of the Act, for

the purposes of applying the requirements and supervisory powers

laid down in these regulations on a consolidated or sub-consolidated

basis in accordance with the Act and any regulations and Banking

Rules made or issued thereunder transposing the CRD, with any

binding legal instruments issued under the CRD and with the CRR,

the terms "parent institution" and "parent undertaking" shall also

include the entities listed in paragraphs (a), (b) and (c) of article

2(1A) of the Act

Provided further that, for the purposes of applying the

requirements and supervisory powers laid down in regulations 4(3),

5(1)(a)(i), 6(i), 7(1), (2)(a), (2)(c) and (2)(d), 10(2)(b), (2)(d) and (3)

on a consolidated or sub-consolidated basis in accordance with the

Act and any regulations and Banking Rules made or issued

thereunder transposing the CRD, with any binding legal instruments

issued under the CRD and with the CRR, the term "credit institution"

shall also include the entities listed in paragraphs (a), (b) and (c) of

article 2(1B) of the Act.

Part I - Powers of the competent authority

The competent authority shall exercise its supervisory

powers and its powers to impose penalties in such a way as to

ensure full and complete adherence to the requirements and

obligations arising out of the Act and any regulations made and

Banking Rules issued thereunder, out of binding legal instruments

issued under the CRD and out of the CRR, either directly or in

collaboration with overseas regulatory authorities, in terms of law

and as warranted by the relevant circumstances, and shall take all

measures necessary to ensure that such administrative penalties are

implemented.

(1) Without prejudice to articles 35 and 35A of the Act, to

any regulations made under article 3(1)(e) of the Act and to the

supervisory powers of the competent authority referred to in

regulation 3, the competent authority shall impose administrative

penalties and other administrative measures in respect of breaches

of

(a) the provisions of the Act and, or of any regulations

made and, or Banking Rules issued thereunder, and, or

any binding legal instruments issued under the CRD,

and, or

(b) the provisions of the CRR.

(2) The administrative penalties and other administrative

measures taken pursuant to sub-regulation (1) shall be effective,

proportionate and dissuasive.

(3) Where the obligations arising under the Act or under any

regulations made or Banking Rules issued thereunder and the CRR,

Banking Rules issued thereunder, under any binding legal instruments

issued under the CRD, and under the CRR, a p p l y t o c r e d i t

institutions, financial holding companies and mixed financial

holding companies, in the event of a breach of any such obligation

or of a failure to comply with a directive issued by the competent

authority under the Act, or any regulations made or Banking Rules

issued thereunder and under the CRR, Banking Rules issued

thereunder, under any binding legal instruments issued under the CRD,

and under the CRR, the competent authority may, subject to the

conditions laid down in Maltese law, by notice in writing and

without recourse to a court hearing, impose administrative

penalties on directors, and on other natural persons who under

Maltese law are responsible for the breach or for the failure to

comply with any such directive.

(4) The competent authority may impose administrative

penalties or other administrative measures aiming to end observed

breaches or the causes of such breaches, on financial holding

companies, mixed financial holding companies, and mixed activity

ho ld i ng c om p a ni e s , o r t he i r e ff e c ti ve m a n a g e r s , w h ic h a r e

responsible for the breach of the provisions of the Act and any

regulations made and Banking Rules issued thereunder transposing

the requirements of Chapter 3 of Title VII of the CRD.

(1) The competent authority shall have all the information

gathering powers and investigatory powers which are necessary for

the exercise of its functions. Without prejudice to other relevant

provisions laid down in the Act, in any regulations made and

Banking Rules issued thereunder, in the CRD, in any binding legal

instruments issued under the CRD and in the CRR, the powers shall

include

(a) the power to require the following natural or legal

persons to provide all information that is necessary in

order to carry out the tasks of the competent authority,

including information to be provided at recurring

intervals and in specified formats for supervisory and

related statistical purposes

(i) credit institutions established in Malta;

(ii) financial holding companies established in

Malta;

(iii) mixed financial holding companies established

in Malta;

(iv) mixed activity holding companies established in

Malta;

(v) persons belonging to the entities referred to in

sub-paragraphs (i) to (iv);

(vi) third parties to whom the entities referred to in

sub-paragraphs (i) to (iv) have outsourced

functions or activities, including ICT third-party

service providers referred to in Chapter V of the

DORA Regulation;

(b) the power to conduct all necessary investigations of

any person referred to in paragraph (a)(i) to (vi)

established or located in Malta where necessary to

carry out the tasks of the competent authority,

including the right to

(i) require the submission of documents;

(ii) examine the books and records of the persons

ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS

referred to in paragraph (a)(i) to (vi) and the

right to take copies or extracts from such books

and records;

(iii) obtain written or oral explanations from any

person referred to in paragraph (a)(i) to (vi) or

their representatives or staff; and

(iv) interview any other person who consents to be

interviewed for the purpose of collecting

information relating to the subject matter of an

investigation;

(c) the power, subject to other conditions set out in

European Union law, to conduct all necessary

inspections at the business premises of the legal

persons referred to in paragraph (a)(i) to (vi) and any

other undertaking included in consolidated supervision

where the competent authority is the consolidating

supervisor, subject to the prior notification of the

overseas regulatory authorities concerned.

Where a natural or legal person is found by the competent

authority to have committed any of the following breaches

(a) carrying out the business of taking deposits or other

repayable funds from the public without being a credit

institution, in breach of article 5 of the Act;

(aa) carrying out at least one of the activities referred to in

point (1)(b) of Article 4(1) of the CRR and meeting the

threshold indicated in that Article without obtaining a

licence as a credit institution, in breach of article 6A of

the Act;

(b) commencing activities as a credit institution without

obtaining a licence, in breach of article 5 of the Act;

(c) acquiring, directly or indirectly, a qualifying holding

in a credit institution licensed in terms of the Act or

further increasing, directly or indirectly, such a

qualifying holding, as a result of which the proportion

of the voting rights or of the capital held would reach

or exceed the thresholds referred to in article 13(1) of

the Act or so that such credit institution would become

its subsidiary, without notifying in writing the

competent authority, during the assessment period, or

notwithstanding the refusal of the competent authority,

in breach of article 13(1) of the Act;

(d) disposing, directly or indirectly, of a qualifying

holding in a credit institution licensed in terms of the

Act or reducing a qualifying holding so that the

proportion of the voting rights or of the capital held

would fall below the thresholds referred to in article

13(3) of the Act or so that such credit institution would

cease to be a subsidiary, without notifying in writing

the competent authority;

(e) failing to apply for approval in breach of article 11B of

the Act or any other breach of the requirements set out in

that article,

the administrative penalties and other administrative measures

which the competent authority may apply on such a person shall

include at least the following

(i)

a public statement which identifies the natural

person, credit institution, financial holding

company or mixed financial holding company

responsible and the nature of the breach;

(ii) an order requiring the natural or legal person

responsible to cease the conduct and to desist

from a repetition of that conduct;

(iii) in the case of a legal person, administrative

pecuniary penalties of up to 10% of the total

annual net turnover including the gross income

consisting of interest receivable and similar

income, income from shares and other variable

or fixed-yield securities, and commissions or

fees receivable in accordance with Article 316 of

the CRR of the undertaking in the preceding

business year

Provided that where the legal person is a

subsidiary of a parent undertaking, the relevant

gross income shall be the gross income resulting

from the consolidated account of the ultimate

parent undertaking in the preceding business

year;

(iv) in the case of a natural person, administrative

pecuniary penalties of up to five million euro

(€5,000,000);

(v) administrative pecuniary penalties of up to twice

the amount of the benefit derived from the

breach where that benefit can be determined;

(vi) suspension of the voting rights of the

shareholder or shareholders held responsible for

the breaches referred to in this regulation;

(1) This regulation shall apply at least in any of the

following circumstances

(a) a credit institution has obtained a licence through false

statements or any other irregular means;

(b) a credit institution, on becoming aware of any

acquisitions or disposals of holdings in their capital

that cause holdings to exceed or fall below one of the

thresholds referred to in article 13(1) or article 13(3)

of the Act, fails to inform the competent authority of

those acquisitions or disposals in breach of article

13(5) of the Act;

(c) a credit institution listed on a regulated market as

referred to in the list to be published by the European

Securities and Markets Authority established by

Regulation (EU) No 1095/2010 in accordance with

ADMINISTRATIVE PENALTIES, MEASURES

AND INVESTIGATORY POWERS

Article 47 of Directive 2004/39/EC of the European

Parliament and of the Council of 21 April 2004 on

markets in financial instruments, does not, at least

annually, inform the competent authority of the names

of shareholders and members possessing qualifying

holdings and the sizes of such holdings in breach of

article 13(5) of the Act;

(d) a credit institution fails to have in place governance

arrangements required by the competent authority in

accordance with article 17B of the Act;

(e) a credit institution fails to report information or

provides incomplete or inaccurate information on

compliance with the obligation to meet own funds

requirements set out in Article 92 of the CRR to the

competent authorities in breach of Article 99(1) of the

CRR;

(f)

a credit institution fails to report or provides

incomplete or inaccurate information to the competent

authority in relation to the data referred to in Article

101 of the CRR;

(g) a credit institution fails to report information or

provides incomplete or inaccurate information about a

large exposure to the competent authority in breach of

Article 394(1) of the CRR;

(h) a credit institution fails to report information or

provides incomplete or inaccurate information on

liquidity to the competent authority in breach of

Article 415(1) and (2) of the CRR;

(i)

a credit institution fails to report information or

provides incomplete or inaccurate information on the

leverage ratio to the competent authority in breach of

Article 430(1) of the CRR;

(j)

a credit institution repeatedly or persistently fails to

hold liquid assets in breach of Article 412 of the CRR;

(k) a credit institution incurs an exposure in excess of the

limits set out in Article 395 of the CRR;

(l)

a credit institution is exposed to the credit risk of a

securitisation position without satisfying the

conditions set out in Article 405 of the CRR;

(m) a credit institution fails to disclose information or

provides incomplete or inaccurate information in

breach of Article 431(1), (2) and (3) or Article 451(1)

of the CRR;

(n) a credit institution makes payments to holders of

instruments included in the own funds of the

institution in breach of Article 141 of the CRD or in

cases where Articles 28, 51 or 63 of the CRR prohibit

such payments to holders of instruments included in

own funds;

(o) a credit institution is found liable for a serious breach

of the Prevention of Money Laundering Act and, or of

any regulations made thereunder;

(p) a credit institution allows one or more persons not

complying with article 14(2) and (2A) of the Act to

become or remain a director;

(q) a parent institution, a parent financial holding

company or a parent mixed financial holding company

fails to take any action that may be required to ensure

compliance with the prudential requirements set out in

Part Three, Four, Six or Seven of the CRR or imposed

under point (a) of Article 104(1) or Article 105 of the

CRD on a consolidated or sub-consolidated basis.

(2) In the cases referred to in sub-regulation (1), the

administrative penalties and other administrative measures that can

be applied by the competent authority shall include at least the

following

(a) a public statement which identifies the natural person,

credit institution, financial holding company or mixed

financial holding company responsible, and the nature

of the breach;

(b) an order requiring the natural or legal person

responsible to cease the conduct and to desist from a

repetition of that conduct;

(c) in the case of a credit institution, withdrawal of the

licence of the said credit institution in accordance with

article 9 of the Act;

(d) subject to regulation 4(3), a temporary ban against a

director of the credit institution or any other natural

person, who is held responsible, from exercising

functions in credit institutions;

(e) in the case of a legal person, administrative pecuniary

penalties of up to 10% of the total annual net turnover

including the gross income consisting of interest

receivable and similar income, income from shares and

other variable or fixed-yield securities, and

commissions or fees receivable in accordance with

Article 316 of the CRR of the undertaking in the

preceding business year

Provided that where the legal person is a subsidiary of

a parent undertaking, the relevant gross income shall

be the gross income resulting from the consolidated

account of the ultimate parent undertaking in the

preceding business year;

(f)

in the case of a natural person, administrative

pecuniary penalties of up to five million euro

(€5,000,000);

(g) administrative pecuniary penalties of up to twice the

amount of the profits gained or losses avoided because

of the breach where those can be determined.

(1) Subject to professional secrecy requirements referred

to in article 34(4) of the Act, the competent authority shall inform

the EBA of all administrative penalties, including all permanent

prohibitions, imposed under these regulations, and including any

appeal in relation thereto and the outcome thereof for the purpose

of publication on the EBA central database of administrative

penalties, which the competent authority shall consult, where

appropriate, in the carrying out of its functions and duties.

(2) Where the competent authority assesses good repute for the

purposes of articles 7(1)(b), 7B(3) and (4) and 14(2), (2A) and (3) of

the Act, it shall consult the EBA database of administrative

penalties

Provided that the competent authority shall check, in

accordance with Maltese law, the existence of a relevant conviction

in the criminal record of the person concerned. For those purposes,

information shall be exchanged in accordance with European

Council Decision 2009/316/JHA and European Council Framework

Decision 2009/315/JHA.

When determining the type of administrative penalties or

other administrative measures and the level of administrative

pecuniary penalties, the competent authority shall take into account

all relevant circumstances, including, where appropriate

(a) the gravity and the duration of the breach;

(b) the degree of responsibility of the natural or legal

person responsible for the breach;

(c) the financial strength of the natural or legal person

responsible for the breach, as indicated, for example,

by the total turnover of the responsible legal person or

the annual income of the responsible natural person;

(d) the amount of profits gained or losses avoided by the

natural or legal person responsible for the breach,

insofar as they can be determined;

(e) the losses for third parties caused by the breach,

insofar as they can be determined;

(f)

the level of cooperation of the natural or legal person

responsible for the breach with the competent

authority;

(g) previous breaches by the natural or legal person

responsible for the breach;

(h) any potential systemic consequences of the breach.

(1) The competent authority shall establish effective and

reliable mechanisms to encourage reporting of potential or actual

breaches of the provisions of the Act, regulations made and

Banking Rules issued thereunder, of any binding legal instrument

issued thereunder and of the provisions of the CRR.

(2) The mechanisms referred to in sub-regulation (1) shall

include at least

(a) specific procedures for the receipt of reports on

breaches and their follow-up;

(b) appropriate protection for employees of credit

institutions who report breaches committed within the

credit institution against retaliation, discrimination or

other types of unfair treatment at a minimum;

(c) protection of personal data concerning both the person

who reports the breaches and the natural person who is

allegedly responsible for a breach, in accordance with

the Data Protection Act and any regulations made

thereunder;

(d) clear rules that ensure that confidentiality is

guaranteed in all cases in relation to the person who

reports the breaches committed within the credit

institution, unless disclosure is required by Maltese

law in the context of further investigations or

subsequent judicial proceedings.

(3) Credit institutions shall have in place appropriate

procedures for their employees to report breaches internally

through a specific, independent and autonomous channel. Such a

channel may also be provided through arrangements provided for

by social partners. The same protection as referred to in sub-

regulation (2)(b), (c) and (d) shall apply.

Part II - Right of Appeal

Any person subject to a decision taken by the competent

authority in terms of these regulations may appeal to the Financial

Services Tribunal established under the Malta Financial Services

Authority Act, against any decision and, or measure taken by the

competent authority under these regulations and, or under the CRR,

imposing upon such person an administrative penalty and, or

administrative measure.