Circular addressed to Corporate Service Providers Classified as Class C

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Reference is made to the amendments to the Company Service Providers Act CSP , introduced by virtue of Act L of 2020, and which came into force on 16 March 2020. This was communicated to the public by means of a Circular dated 15 March 2021. The amendments to the CSP Act should also be read in conjunction with the Company Service Providers ( ) Rulebook. These Rules deal with various requirements which a company service as long as it remains authorised. One of the new requirements introduced by the amendments to the CSP Rulebook relates to the establishment and maintenance of a Risk Management Function. Every CSP holding a Class C authorisation is required to establish and maintain a Risk Management Function which independently carries out the following tasks: i. The implementation of policy and procedures as referred to in Rule R3-7,1; and ii. The provision of reports and advice to senior management. Rule R3-7.2 provides that the Authority may allow the CSP to establish and maintain a risk management function which does not operate independently, provided this does not give rise to conflicts of interest and the CSP demonstrates to the MFSA that the establishment and maintenance of a dedicated independent risk management function with sole responsibility for the risk management function is not appropriate and proportionate in view of the nature, scale and complexity of its business and the nature and range of the CSP services and activities undertaken in the course of that business. For this purpose, and in order for a CSP classified as Class C to avail from this derogation, the CSP is required to submit a Request Form which is downloadable from the MFSA website and submit such a request to the Authority. The CSP will nonetheless be required to indicate a person who will be taking on the Risk Management Function, as also provided for in the Request Form. Any CSP in possession of a registration to act as a Company Service Provider in terms of the Company Service Providers Act, 2013, prior to the date of coming into force of the amendments introduced by Act L of 2020 and the amendments to the CSP Rulebook are expected to take all necessary measures to comply with the updated Rules within six (6) months from the date of the publication of the said Rules. Therefore, any previously registered CSP which has now been classified as a Class C CSP, is requested to ensure that the Risk Management Function is in place by 16 September 2021, and any application for a derogation as outlined in this circular should be submitted prior to such date. Should you have any queries, please contact the Authority on fiduciariesoffsite@mfsa.mt. 01 June 2021