REPORTING OF INFRINGEMENTS REGULATIONS

SUBSIDIARY LEGISLATION 476.04

REPORTING OF INFRINGEMENTS REGULATIONS

2nd December, 2016

LEGAL NOTICE 405 of 2016.

(1) The title of these regulations is the Reporting of

Infringements Regulations.

(2) The purpose of these regulations is to implement Article

32(1) of the Market Abuse Regulation and the Commission

Implementing Directive on the reporting to competent authorities

of actual or potential infringements, and they shall be interpreted

and applied accordingly.

(3) These regulations specify the procedures set out in Article

32(1) of the Market Abuse Regulation, including arrangements for

reporting and for following-up reports, and measures for the

protection of persons working under a contract of employment and

measures for the protection of personal data.

(1) In these regulations unless the context otherwise

requires

"the Act" means the Prevention of Financial Markets Abuse Act;

"Commission Implementing Directive " means Commission

Implementing Directive (EU) 2015/2392 of 17 December 2015 on

Regulation (EU) No 596/2014 of the European Parliament and of

the Council as regards reporting to competent authorities of actual

or potential infringements of that Regulation;

"Market Abuse Regulation" means Regulation (EU) No 596/2014

of the European Parliament and of the Council of the 16 April 2014

on market abuse (market abuse regulation) and repealing Directive

2003/6/EC of the European Parliament and of the Council and

Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/

EC;

"report of infringement " means a report submitted by the

reporting person to the competent authority regarding an actual or

potential infringement of the Market Abuse Regulation;

"reported person" means a person who is accused of having

committed, or intending to commit, an infringement of the Market

Abuse Regulation by the reporting person;

"reporting person " means a person reporting an actual or

potential infringement of the Market Abuse Regulation to the

competent authority.

(2) Words and expressions used in these regulations shall have

the same meaning as is assigned to them in the Market Abuse

Regulation and the Commission Implementing Directive unless

otherwise defined herein.

The Malta Financial Services Authority established by the

Malta Financial Services Authority Act shall be the designated

competent authority in Malta for the purposes of implementing

Article 32(1) of the Market Abuse Regulation and the relevant

provisions of the Commission Implementing Directive, and any

reference therein to the competent authority shall be deemed and

construed accordingly.

The competent authority shall exercise all the functions,

obligations and powers that are established in the Commission

Implementing Directive and shall satisfy all the requirements

imposed on competent authorities by the Commission

Implementing Directive.

For the better carrying out of Article 32(1) of the Market

Abuse Regulation and the provisions of the Commission

Implementing Directive or these regulations, the competent

authority may, from time to time, issue and publish Prevention of

Financial Markets Abuse Rules which shall be binding on all

persons that may be specified therein and as the competent

authority may consider appropriate.

(1) The competent authority shall ensure that dedicated

staff members are appointed who can handle reports of

infringements. Dedicated staff members shall be trained for the

purposes of handling reports of infringements.

(2) Dedicated staff members shall exercise the following

functions

(a) providing any interested person with information on

the procedures for reporting infringements;

(b) receiving and following-up reports of infringements;

(c) maintaining contact with the reporting person where

the latter has identified itself.

(1) The competent authority shall publish on its website in

a separate, easily identifiable and accessible section the

information regarding the receipt of reports of infringements set

out in sub-regulation (2).

(2) The information referred to in sub-regulation (1) shall

include all of the following

(a) the communication channels for receiving and

following-up the reporting of infringements and for

contacting the dedicated staff members in accordance

with regulation 9(1), including

(i)

the phone numbers, indicating whether

conversations are recorded or unrecorded when

using those phone lines;

(ii) dedicated electronic and postal addresses, which

are secure and ensure confidentiality, to contact

the dedicated staff members;

(b) the procedures applicable to reports of infringements

referred to in regulation 8;

(c) the confidentiality regime applicable to reports of

infringements in accordance with the procedures

applicable to reports of infringements referred to in

regulation 8;

(d) the procedures for the protection of persons working

under a contract of employment;

(e) a statement clearly explaining that persons making

information available to the competent authority in

accordance with the Market Abuse Regulation are not

considered to be infringing any restriction on

disclosure of information imposed by contract or by

any legislative, regulatory or administrative provision,

and are not to be involved in liability of any kind

related to such disclosure.

(3) The competent authority may publish on its website more

information regarding the receipt and the follow-up of

infringements set out in sub-regulation (2).

(1) The procedures applicable to reports of infringements

referred to in regulation 7(2)(b) shall clearly indicate all of the

following information

(a) that reports of infringements can also be submitted

anonymously;

(b) the manner in which the competent authority may

require the reporting person to clarify the information

reported or to provide additional information that is

available to the reporting person;

(c) the type, content and time-frame of the feed-back

about the outcome of the report of infringement that

the reporting person can expect after the reporting;

(d) the confidentiality regime applicable to reports of

infringements, including a detailed description of the

circumstances under which the confidential data of a

reporting person may be disclosed in accordance with

Articles 27, 28 and 29 of the Market Abuse

Regulation.

(2) The detailed description referred to in sub-regulation (1)(d)

shall ensure awareness of the reporting person concerning the

exceptional cases in which confidentiality of data may not be

ensured, including where the disclosure of data is a necessary and

proportionate obligation required under European Union law or

Maltese law in the context of investigations or subsequent judicial

proceedings or to safeguard the freedoms of others including the

right of defence of the reported person, and in each case subject to

appropriate safeguards under such laws.

(1) The competent authority shall establish independent

and autonomous communication channels, hereinafter referred to as

"dedicated communication channels", which are both secure and

ensure confidentiality, for receiving and following-up the reporting

of infringements.

(2) Dedicated communication channels shall be considered

independent and autonomous, provided that they meet all of the

following criteria

(a) they are separated from general communication

channels of the competent authority, including those

through which the competent authority communicates

internally and with third parties in its ordinary course

of business;

(b) they are designed, set up and operated in a manner that

ensures the completeness, integrity and confidentiality

of the information and prevents access to non-

authorised staff members of the competent authority;

(c) they enable the storage of durable information in

accordance with regulation 10 to allow for further

investigations.

(3) The dedicated communication channels shall allow for

reporting of actual or potential infringements in at least all of the

following ways

(a) written report of infringements in electronic or paper

format;

(b) oral report of infringements through telephone lines,

whether recorded or unrecorded;

(c) physical meeting with dedicated staff members of the

competent authority.

(4) The competent authority shall provide the information

referred to in regulation 7(2) to the reporting person before

receiving the report of infringement, or at the moment of receiving

it at the latest.

(5) The competent authority shall ensure that a report of

infringement received by means other than dedicated

communication channels referred to in this regulation is promptly

forwarded without modification to the dedicated staff members of

the competent authority by using dedicated communication

channels.

(1) The competent authority shall keep records of every

report of infringement received.

(2) The competent authority shall promptly acknowledge the

receip t of writt en reports of i nfringement s t o the po st al or

electronic address indicated by the reporting person, unless the

reporting person explicitly requested otherwise or the competent

authority reasonably believes that acknowledging receipt of a

written report would jeopardise the protection of the reporting

person’s identity.

(3) Where a recorded telephone line is used for reporting of

infringements, the competent authority shall have the right to

document the oral reporting in the form of

(a) an audio recording of the conversation in a durable and

retrievable form; or

(b) a complete and accurate transcript of the conversation

prepared by the dedicated staff members of the

competent authority. In cases where the reporting

person has disclosed its identity, the competent

authority shall offer the possibility to the reporting

person to check, rectify and agree with the transcript

of the call by signing it.

(4) Where an unrecorded telephone line is used for reporting of

infringements, the competent authority shall have the right to

document the oral reporting in the form of accurate minutes of the

conversation prepared by the dedicated staff members of the

competent authority. In cases where the reporting person has

disclosed its identity, the competent authority shall offer the

possibility to the reporting person to check, rectify and agree with

the minutes of the call by signing them.

(5) Where a person requests a physical meeting with the

dedicated staff members of the competent authority for reporting an

infringement according to regulation 9(3)(c), the competent

authority shall ensure that complete and accurate records of the

meeting are kept in a durable and retrievable form. The competent

authority shall have the right to document the records of the

physical meeting in the form of

(a) an audio recording of the conversation in a durable and

retrievable form; or

(b) accurate minutes of the meeting prepared by the

dedicated staff members of the competent authority. In

cases where the reporting person has disclosed its

identity, the competent authority shall offer the

possibility to the reporting person to check, rectify and

agree with the minutes of the meeting by signing them.

(1) The competent authority shall put in place procedures

ensuring effective exchange of information and cooperation with

other European regulatory authorities and any other relevant

authority involved in the protection of persons working under a

contract of employment who report infringements of the Market

Abuse Regulation to the competent authority or are accused of such

infringements, against retaliation, discrimination or other types of

unfair treatment, arising due to or in connection with reporting of

infringements of the Market Abuse Regulation.

(2)

The competent authority shall ensure that

(a) reporting persons have access to comprehensive

information and advice on the remedies and

procedures available under Maltese law to protect

them against unfair treatment, including on the

procedures for claiming pecuniary compensation;

(b) reporting persons have access to effective assistance

from the competent authority before any relevant

authority involved in their protection against unfair

treatment, including by certifying the condition of

whistle-blower of the reporting person in employment

disputes.

(1) The competent authority shall ensure that the records

of every report of infringement received are stored in a confidential

and secure system and access to the data stored in such system shall

be available only to staff members of the competent authority for

whom access to that data is necessary to perform their professional

duties.

(2) The competent authority shall not disclose to any person,

either directly or indirectly, the identity of the reporting person or

reported person or any other references to circumstances that would

allow the identity of the reporting person or reported person to be

deduced, unless such transmission is in accordance with the

confidentiality regime referred to in regulation 8(1)(d).

(3) The competent authority shall put in place adequate

procedures for the transmission of data of the reporting person and

reported person inside and outside of the competent authority.

(1) Where the identity of reported persons is not known to

the public, the competent authority shall ensure that their identity is

protected at least in the same manner as for persons that are under

investigation by the competent authority.

(2) The procedures set out in regulation 12(1) shall also apply

for the protection of the identity of the reported persons.

The competent authority shall review the procedure for

receiving reports of infringements as established in these

regulations and their follow-up once every two years. In reviewing

such procedures the competent authority shall take account of its

experience and that of other European regulatory authorities and

adapt its procedures accordingly and in line with market and

technological developments.