Circular addressed to Limited Company Service Providers on the Submission of the Annual Compliance Return

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Circular addressed to Limited Company Service Providers on the submission of the Annual Compliance Return The Authority refers to the changes made to the Company Service Providers Act (Cap. 529 of the Laws of Malta) by virtue of Act X of 2025 published on 16 May 2025 which inter alia introduced a new category of company service providers namely Limited Company Service Providers (‘Limited CSP’). Pursuant to such changes a new Limited CSP Rulebook was issued laying down specific obligations for Limited CSPs including with respect of regulatory submissions. In this regard, reference is made to the Annual Compliance Return (‘ACR’) which Limited CSPs are required to submit on an annual basis as part of their regulatory submissions to the Authority. The ACR is a single return issued jointly by the MFSA and the FIAU covering data required by both authorities as part of their supervision of Limited CSPs. Limited CSPs are hereby being informed that the ACR template is now available on the MFSA website and is to be submitted through the LH Portal. Limited CSPs are reminded of their obligation to abide by the statutory deadline set out in the Limited CSP Rulebook with respect of their regulatory submissions namely 30 April of each calendar year. All data should cover the previous calendar year. In the case of Limited CSPs which were previously authorised as Under Threshold Class B CSPs but which converted to Limited CSPs on 23 December 2025, should ensure that the data contained in the ACR covers both their status as Under Threshold Class B CSP from 1 January 2025- 22 December 2025 and their status as Limited CSPs from 23 December 2025 - 31 December 2025. The Authority reminds Limited CSPs of their obligation to provide complete and accurate data in the ACR submitted. A. Naming Conventions Limited CSPs are to submit the below documentation, in the folder of each uploaded Zip file made through the LH Portal and are to be guided by the below naming conventions, accordingly. As outlined below, the ACR is to be submitted only in excel format. Furthermore, signed copy of Sheet 8 of the ACR is to be attached following the naming convention as ‘Other Documents’. 20 March 2026

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Name of Document Files - Naming Convention Annual Compliance Return LHCode_2025_LimitedACR.xlsx Declaration (found on Sheet 8 of the ACR) LHCode_2025_OTH-Declaration.pdf Other documents (if applicable) LHCode_2025_OTH-Name of document.pdf B. Uploading of Annual Compliance Return Upon completion of the ACR, the documentation needs to be zipped into one zip file using the following naming convention: LHCode_2026.zip1 . Limited CSPs are then required to upload the completed zip file through the LH Portal, under the Limited CSPs Annual Returns Project. Kindly refrain from including sub-folders within the zip file. Submissions are to be uploaded in .zip format only. 1 The “.zip” is not to be included in the file name as this is automatically created once the documents being submitted have been compressed into a Zip File.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Limited CSPs will receive the following via e-mail if the above guidelines are followed and the submission of the ACR has been submitted successfully. Please note that it may take a few minutes or longer for the automated confirmation email to be received. Should you not receive any confirmation email within 24 hours, you are kindly requested to ensure that you reach out to the Company Service Providers Supervision Function on cspssupervision@mfsa.mt. C. Possible Errors while uploading documentation on LH Portal The hereunder are some possible errors that Limited CSPs might encounter should the above naming conventions not be adhered to. Consequently, the file will be rejected and will not be uploaded through the system. You are therefore kindly requested to ensure that the user uploading the relevant returns checks their inbox to ensure that a file upload result email is received, and to address any of the possible errors as outlined below at the earliest, as otherwise the submission will not be deemed complete. Scenario 1: In the event that the Zip file contains the correct naming convention, however the files within the zip file do not follow the above guidelines on the naming convention of each document, the following email will be received, and the submission will fail:

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Scenario 2: In the event that the Zip file name does not follow the above guidelines, the following email is received: Should you not be in a position to rectify the error after following the guidance provided in this Circular, please direct your queries to the Company Service Providers Supervision Function by sending an email to cspssupervision@mfsa.mt. D. Submission of the Signed Declaration The declaration contained in sheet 8 of the ACR is to be signed by the Limited CSP and submitted to the Authority. As communicated in the Circular issued by the Authority on 15 November 2022, the Authority accepts electronically signed documents, provided that in this case the declaration is signed with a qualified electronic signature in accordance with Regulation (EU) No 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC’ (‘eIDAS’). Declarations signed with an eIDAS compliant qualified signature do not have to be mailed to the Authority. However, should the declaration not be signed with the said qualified electronic signature, the signed declaration would have to be mailed in original to the Authority to the attention of the Company Service Providers Supervision Function.