CENTRALISED BANK ACCOUNT REGISTER REGULATIONS

ACCOUNT REGISTER

SUBSIDIARY LEGISLATION 373.03

CENTRALISED BANK ACCOUNT

REGISTER REGULATIONS

20th October, 2020

LEGAL NOTICE 401 of 2020, as amended by Legal Notice 83 of

2026 * .

(1)

The title of these regulations is the Centralised

Bank Account Register Regulations.

(2) The scope of these regulations is to implement the

provisions of Directive (EU) 2018/843 of the European Parliament

and of the Council of 30 May 2018 and of Directive (EU) 2019/1153

of the European Parliament and of the Council of 20 June 2019

relative to centralised automated mechanisms allowing for the

identification, in a timely manner, of any natural or legal persons

holding or controlling payment accounts and bank accounts identified

by IBAN, or making use of safe custody services provided by credit

institutions.

(1)

In these regulations, unless the context otherwise

requires

"Act" means the Prevention of Money Laundering Act;

"beneficial owner" shall have the same meaning as assigned to

it under the Prevention of Money Laundering and Funding of

Terrorism Regulations;

"competent authority" shall have the same meaning as

assigned to it under the Prevention of Money Laundering and

Funding of Terrorism Regulations;

"credit institution" means any one of the following

(a)

a person or institution who is for the time being

licensed under the provisions of the Banking Act;

(b)

a branch in Malta of any person or institution

who has been granted an equivalent licence or authorisation

under the laws of any other jurisdiction; and

(c)

the Central Bank of Malta;

"customer" shall have the same meaning as assigned to it under

the Prevention of Money Laundering and Funding of Terrorism

Regulations;

*Vide Regulation 5 of Legal Notice 83 of 2026.

ACCOUNT REGISTER

"financial institution" means any one of the following

(a)

a person or institution who is for the time being

licensed under the provisions of the Financial Institutions Act;

and

(b)

a branch in Malta of any person or institution

who has been granted an equivalent licence or authorization

under the laws of any other jurisdiction;

"IBAN" means an international payment account number

identifier, which unambiguously identifies an individual payment

account, the elements of which are specified by the International

Organisation for Standardisation;

"register" means the centralised automated mechanism referred

to in article 16(1)(n) of the Act;

"safe custody" means the holding of tangible assets on behalf of

customers;

"serious criminal offences" means tax evasion, an offence

under the National Interest (Enabling Powers) Act and any other

offence listed in Annex I to Regulation (EU) 2016/794.

(2) Words and expressions used in these regulations which

are also used in the Act shall have the same meaning as assigned to

them in the Act.

(1)

Where a credit or financial institution provides an

account identified by IBAN, or where a credit institution provides safe

custody services, the credit or financial institution shall, for the

purposes of these regulations, maintain an electronic record of such

data and information as may be prescribed by the Unit in relation to

the following

(a)

the customer and, where applicable,

(i)

any agent thereof authorized to act on the

customer’s behalf; and

(ii)

the beneficial owner of the customer;

(b)

the IBAN associated with any such account or the

alphanumeric code used to identify safe deposit boxes or any

items entrusted to a credit institution when providing any safe

custody services as are referred to hereabove;

(c)

the length of time for which any account or safe

custody services are provided as set out hereabove; and

ACCOUNT REGISTER

(d)

any other data or information on bank or

payment accounts or safe custody services provided by credit

institutions as the Unit may set out from time to time in

procedures issued under regulation 5.

(2) Credit and financial institutions shall ensure that any

data that they may be required to hold in terms of sub-regulation (1)

is at all times adequate, accurate and up to date, and the electronic

record thereof shall be updated immediately upon the credit or

financial institution being informed or otherwise becoming aware

that any of the data or information required to be held has changed.

(3) Regulation 13 of the Prevention of Money Laundering

and Funding of Terrorism Regulations shall be equally applicable to

the retention of the data and information that credit and financial

institutions may be required to hold in terms of sub-regulation (1).

(1)

The Unit shall establish, manage and administer

the register wherein there shall be retained data and information on

accounts identified by IBAN held by credit and financial institutions

and on safe custody services provided by credit institutions, which

data and information is to allow for the timely identification of any

person or persons holding or controlling any such accounts or assets

held under safe custody, or who may have held or controlled any such

accounts or assets.

(2) The register shall contain an electronic record of the data

and information that credit and financial institutions are required to

hold in terms of regulation 3(1), which data and information is to be

made available by credit and financial institutions in such format and

with such frequency as may be prescribed by the Unit, with credit and

financial institutions to retain such records as may be necessary to

show that they have fulfilled any such obligations for a period of five

(5) years from the date on which data and information was submitted

or was required to be submitted, whichever is the earlier.

(3) In carrying out the functions referred to in sub-

regulation (1), the Unit shall have regard to the highest technological

standards and shall ensure that any of its officers or employees

responsible for its management and administration are of high

integrity and receive proper and regular training as to the

confidentiality and data protection obligations applicable to the

register.

(4) Any data or information contained in the register shall

be so held for five (5) years following the closure of the account or

the termination of the safe custody service as may be applicable,

upon the expiry of which the data and information so held shall be

deleted

Provided that the period of five (5) years may be further

ACCOUNT REGISTER

extended, up to a maximum retention period of ten (10) years, where

such extension would be considered necessary for the purposes of the

prevention, detection, analysis, investigation or prosecution of money

laundering, associated predicate offences, funding of terrorism or any

other serious criminal offence.

(5) The rights of the data subject referred to in regulation 4

of the Restriction of the Data Protection (Obligations and Rights)

Regulations, in particular the right of access, shall be restricted,

partially or completely, where such a restriction is necessary and

proportionate for the Unit to ensure the proper functioning of the

register and avoid causing prejudice to any action being undertaken by

any of the authorities that are to be allowed access thereof in terms of

regulation 6 in the course of its functions at law.

The Unit may issue procedures and guidance as may be

necessary for the purpose of prescribing anything required under these

regulations and to ensure the proper functioning of the register, with

any such procedures being binding on credit and financial institutions.

(1)

The data and information held in the register

shall be directly accessible, in line with procedures set out by the Unit,

by the following authorities

(a)

the Unit;

(b)

national

authorities

conducting

criminal

investigations into or prosecutions of money laundering,

associated predicate offences, funding of terrorism or any other

serious criminal offence, including when supporting

investigations concerning any of the said offences;

(c)

the Asset Recovery Bureau;

(d)

the Commissioner for Revenue;

(e)

the Sanctions Monitoring Board; and

(f)

the Security Service.

(2) Each of the authorities listed in sub-regulation (1) shall

access and make use of the data and information contained in the

register on a case-by-case basis and to the extent that this may be

necessary for the prevention, detection, investigation or prosecution

of money laundering, associated predicate offences funding of

terrorism or any other serious criminal offence, and for the avoidance

of any doubt this shall include supporting investigations concerning

any such offence, including the identification, tracing and freezing of

the assets related to such investigation

Provided that the above shall be without prejudice to any

ACCOUNT REGISTER

access to data and information held in the register that the Unit may

require for the proper carrying out of its functions under regulation

4(1).

(3) In addition to the access referred to in sub-regulation

(2), the data and information contained in the register may also be

used to produce such aggregate or statistical data as may be required

by the authorities referred to hereabove for the same purposes as are

referred to in sub-regulation (2).

(4) The data and information contained in the register may

also be accessed and made use of

(a)

by the Financial Intelligence Analysis Unit to reply

to justified requests for information received from a

competent authority not listed in sub-regulation (1);

and

(b)

by any of the authorities listed in sub-regulation (1)

to reply to justified requests for information

received from foreign or supranational bodies

having similar functions after they have ascertained

that the requesting body applies confidentiality and

data protection requirements equivalent to those

applicable to them

Provided that the authorities referred to in

paragraphs (a) and (b) shall disclose to the register

the requesting body to which any such data and

information shall be disclosed

Provided further that the authorities referred to in

(a) and (b) may provide for specific procedures for

the receipt of any request of information and may

impose such conditions and restrictions as they

may consider necessary when replying to any such

request for information.

(5) Each of the authorities listed in sub-regulation (1) shall

designate one or more of their officers or employees that are to have

access to and carry out searches in the register, with each designated

officer or employee being granted the said rights only upon

undergoing such registration or accreditation process as may be

established by the Unit.

(6) The authorities listed in sub-regulation (1) shall

implement the necessary safeguards to ensure that data and

information held in the register is accessed and made use of only

when this is strictly required for the purposes set out in this

regulation.

ACCOUNT REGISTER

(7) In meeting their obligation under sub-regulation (6), and

having due regard to the sensitivity of the data and information

involved, the authorities listed in sub-regulation (1) shall, as a

minimum

(a)

ensure that they maintain high professional

standards of confidentiality and adherence with the applicable

data protection requirements, including through monitoring

compliance with the said standards, and that all of their officers

and employees are of high integrity;

(b)

provide any officer or employee designated in

terms of sub-regulation (5), or any officer or employee able to

request any such employee to carry out searches in the register,

with the necessary training on how to handle data and

information accessible through the register in line with data

protection requirements;

(c)

establish internal policies and procedures setting

out the conditions and circumstances in which data and

information is to be obtained from the register, including

safeguards to avoid unauthorized or unjustified access thereto,

and monitoring the application of the same;

(d)

apply technical and organisational measures to

ensure the security of the data to high technological standards;

and

(e)

ensure that the Unit is promptly informed

whenever an officer or employee is no longer to be considered

as a designated employee in terms of sub-regulation (5).

(8) Where any of the authorities becomes aware that the data

or information held in the register is not correct or is otherwise not up

to date, the authority concerned shall immediately inform the Unit.

(9) Each authority listed in sub-regulation (1) shall hold

statistical data on the number of searches carried out through the

register and shall make the same available to the Unit or to the

European Commission upon request or in line with such procedures as

may be established.

(1)

The Unit shall establish such procedures as it

may deem proper to monitor and regulate the access and the carrying

out of searches for data and information contained in the register,

which procedures shall include the retention of the following

information with respect to each search

(a)

the case reference number;

(b)

the date and time of the query or search;

ACCOUNT REGISTER

(c)

the type of data used to launch the query or

search;

(d)

the unique identifier of the results;

(e)

the name of the authority consulting the registry;

(f)

the unique user identifier of the designated

officer or employee referred to in regulation 6(5) and, where

applicable, of the official who ordered the query or search and,

as far as possible, the unique user identifier of the recipient of

the results of the query or search.

(2) The information referred to in sub-regulation (1)(a) to

(f) shall be

(a)

held only to monitor confidentiality and data

protection requirements, including checking the admissibility

of a request and the lawfulness of data processing, and for

ensuring data security;

(b)

accessible only to the data protection officer of

the Unit, who shall check the same on a regular basis, and,

upon request, to the Information and Data Protection

Commissioner; and

(c)

protected by appropriate measures against

unauthorised access and shall be erased five (5) years after its

creation, unless it is required for monitoring procedures that

are ongoing.

(3) Any data or information obtained through the register

shall be kept confidential by the authorities and by their officers,

employees or agents, past and present, and any use thereof other than

for the purposes set out in regulation 6 shall be considered to be an

unauthorised disclosure of the same.

(4) In the event that the authorities listed in regulation 6(1)

become aware of any unauthorised or unjustified access to, or use of,

the register, they shall promptly inform the Unit and provide it with

any information in relation to any such unauthorised or unjustified

access or use as may be requested by the Unit.

(5) The Unit may, where it considers that any of the

authorities are not implementing the necessary safeguards to prevent

unauthorised or unjustified access to, or use of, the register and of the

data and information contained therein, or are otherwise failing to

comply with any of their obligations under these regulations, restrict,

suspend or terminate the authority’s access and only reinstate the

same again once the authority has implemented the necessary

measures to prevent the same from occurring again.

ACCOUNT REGISTER

(1)

The Unit shall be responsible to monitor that

credit and financial institutions meet their obligations under these

regulations and any procedures and guidance issued under regulation

5. (2) For the purposes of carrying out its functions under sub-

regulation (1), the Unit may exercise any of the powers granted to it

under article 26 of the Act as well as carry out data quality checks on

the data and information provided by credit and financial institutions

for inclusion in the register as it may deem fit and give such directions

as may be necessary to redress any issues identified with respect to

such data and information.

(3) In accordance with article 13 of the Act, any credit or

financial institution who contravenes any provision of these

regulations or of any procedure or guidance issued in terms of

regulation 5, as well as any direction given by the Unit, shall be liable

to an administrative penalty of not less than two hundred fifty euro

(€250) and not more than forty-six thousand five hundred euro

(€46,500) in respect of every separate breach.

(4)

Notwithstanding the provisions of sub-regulation (3), the

Unit may

(a)

with respect to minor contraventions and where

the circumstances so warrant, impose an administrative penalty

below the minimum established by these regulations but not

less than two hundred and fifty euro (€250) or issue a

reprimand in writing instead of an administrative penalty;

(b)

with respect to serious, repeated or systematic

contraventions, impose administrative sanctions that in total are

not to exceed one million euro (€1,000,000);

(c)

instead of or in conjunction with the imposition

of any administrative penalty as envisaged under this

regulation, require the credit or financial institution to take any

action or measure to remedy such contravention or to ensure

compliance with the provisions of these regulations or any

procedures issued by the Unit.

(5) Administrative measures under these regulations shall be

imposed by the Unit without recourse to a court hearing and in

accordance with policies and procedures established by the Board of

Governors referred to in the Act, with the Unit being able to impose

penalties either as a one-time fixed penalty or as a daily cumulative

penalty or both

Provided that an administrative penalty imposed on a

daily cumulative basis shall not be less than two hundred and fifty

ACCOUNT REGISTER

euro (€250) and the accumulated penalty shall not exceed the

maximum set out under sub-regulations (3) and (4)(b), as may be

applicable.

(6) Articles 13A to 13C, both inclusive, of the Act shall be

equally applicable in relation to any administrative measure imposed

on a credit or financial institution for any contravention of these

regulations or of any procedures or guidance issued in terms of

regulation 5.

(1)

In the course of determining the imposition of an

administrative penalty on a credit or financial institution, the

Financial Intelligence Analysis Unit may, in its own discretion but in

accordance with the policies and procedures referred to in article

13(2) of the Act, propose or agree to a request, to enter into a

settlement agreement with the subject person or individual

concerned.

(2)

The Financial Intelligence Analysis Unit shall not enter

into a settlement agreement where

(a)

the Financial Intelligence Analysis Unit believes

that doing so would not be in the public interest in

accordance with any policies and procedures as

may be established by the Board of Governors; or

(b)

two (2) years have not yet lapsed from the

conclusion of any corrective or remedial actions

undertaken by the credit or financial institution

concerned as part of a prior settlement agreement

Provided that the Financial Intelligence Analysis

Unit may apply this restriction either in general or

in relation to the different categories of actions that

may be undertaken in accordance with article 26 of

the Act but in any case it shall not enter into more

than two (2) settlement agreements with the same

subject person within a period of two (2) years

Provided further that where the credit or financial

institution forms part of a group, the said limitation

shall take into account any settlement agreement

entered into with any other subject person within

the group.

(3)

A settlement agreement shall be in writing, signed, and

shall be binding on the Financial Intelligence Analysis Unit and the

credit or financial institution concerned. The said settlement

agreement shall establish the terms and conditions of the agreement

and shall include

ACCOUNT REGISTER

(a)

a description of the contraventions identified by the

Financial Intelligence Analysis Unit and the

unconditional agreement therewith by the credit or

financial institution concerned;

(b)

a description of any corrective or remedial actions

which the Financial Intelligence Analysis Unit may

deem necessary to restore compliance, where

applicable;

(c)

an undertaking by the credit or financial institution

concerned to implement the corrective or remedial

actions required by the Financial Intelligence

Analysis Unit, within such time-frames and subject

to such conditions as may be set by or otherwise

agreed with the Financial Intelligence Analysis

Unit;

(d)

the administrative penalty which the Financial

Intelligence Analysis Unit was intent on imposing

on the credit or financial institution concerned, and

the amount by which the said administrative penalty

is reduced on condition that the credit or financial

institution concerned complies with the terms and

conditions of the settlement agreement;

(e)

an undertaking by the credit or financial institution

concerned to pay the reduced administrative penalty

in accordance with the terms established in the

settlement agreement;

(f)

a waiver by the credit or financial institution

concerned of any right to appeal, review or to

otherwise challenge the determination and

conclusions of the Financial Intelligence Analysis

Unit; and

(g)

a declaration by the credit or financial institution

concerned that the amount by which the

administrative penalty is reduced shall become due

and payable to the Financial Intelligence Analysis

Unit, upon the Financial Intelligence Analysis

Unit’s determination that any corrective or remedial

actions as are referred to in paragraph (c) have not

been completed as envisaged by the settlement

agreement.

(4)

The amount of the administrative penalty conditionally

r e d u c e d i n a c c o r da nc e wi t h su b- r e g u la t io n ( 3 )( d ) sh a l l b e

extinguished upon determination by the Financial Intelligence

ACCOUNT REGISTER

Analysis Unit that any corrective or remedial actions required by the

settlement agreement have been carried out.

(5)

In the event that a settlement agreement is not entered into

due to lack of interest or lack of cooperation by the credit or financial

institution concerned or within such time as may be set out by the

Financial Intelligence Analysis Unit, the Financial Intelligence

Analysis Unit shall proceed with the imposition of the administrative

penalty in the full amount that it was intent on imposing and the

imposition of such other measures as it is empowered by law to

impose and as it may deem necessary.

(6)

A settlement agreement shall be considered to be

completed when the said agreement is signed by both parties and the

credit or financial institution concerned has paid the full amount of

the reduced administrative penalty in accordance with the terms and

conditions established in the agreement, failing which, the Financial

Intelligence Analysis Unit shall proceed with the imposition of the

administrative penalty in the full amount it was intent on imposing

and the imposition of such other measures as it is empowered by law

to impose and as it may deem necessary.

(7)

In the event that, following the conclusion of a settlement

agreement, the Financial Intelligence Analysis Unit determines that

the credit or financial institution concerned failed, without

reasonable justification, to comply with the terms of the settlement

agreement or with any corrective or remedial action as required by

the agreement

(a)

the credit or financial institution concerned shall,

following a notice in writing from the Financial

Intelligence Analysis Unit, forfeit any concession

or other benefit arising from the agreement, and

the amount by which the administrative penalty

had been reduced shall become due and payable

to the Financial Intelligence Analysis Unit;

(b)

the Financial Intelligence Analysis Unit may by

notice in writing take such other measures as the

Financial Intelligence Analysis Unit is empowered

by law to take, and as may be deemed necessary in

the circumstances, including issuing directives in

writing requiring the credit or financial institution

concerned to do or to refrain from doing any act,

including such prohibitions, restrictions and

limitations under such conditions as may be

specified in the directives; and

(c)

the Financial Intelligence Analysis Unit may

institute an action before the Civil Court, First Hall,

ACCOUNT REGISTER

to recover from the credit or financial institution

concerned the amount by which the administrative

penalty had been reduced in terms of the settlement

agreement, and to enforce the completion of the

corrective or remedial actions that the Financial

Intelligence Analysis Unit had imposed through the

settlement agreement.

(8)

Any such action shall follow the procedure established in

articles 167 to 170 of the Code of Organization and Civil Procedure

Provided that where leave to defend the action is granted in

accordance with article 170 of the Code of Organization and Civil

Procedure or an appeal is otherwise filed from any decision of the

Civil Court, First Hall, the time-frames established in article 13A(3)

to (5) of the Act shall apply mutatis mutandis

Provided further that articles 13A(6) and 13C of the Act

shall also apply mutatis mutandis to any action referred to under this

sub-regulation or an appeal therefrom.

(9)

Where the Financial Intelligence Analysis Unit files an

action as referred to in sub-regulation (7)(d), it may also request the

court to impose on the credit or financial institution concerned

additional penalties which shall not exceed one thousand euro

(€1,000) for every day until the corrective or remedial actions are

completed.

* When the Financial Intelligence Analysis Unit exercises its

powers under regulations 8 and 9, it shall inform in a timely manner

the relevant supervisory authority or any other authority, body or

committee responsible for the authorisation, approval, licensing,

registration or regulation of, or the granting of a warrant to, the

subject person or individual concerned and shall provide all relevant

information on the contraventions committed as it deems necessary.

*Vide Regulation 5(3) of Legal Notice 83 of 2026.