Circular on the Obligation under Chapter 2 and Chapter 3 of the Financial Institutions Rulebook to Submit the Annual Compliance Report

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Circular on the Obligation under Chapter 2 and Chapter 3 of the Financial Institutions Rulebook to Submit the Annual Compliance Report Chapter 2 1 and Chapter 3 of the Financial Institutions Rulebook (‘FIR/02’ and ‘FIR/03’), set out the obligation that an Annual Compliance Report (‘ACR’) is to be drawn up by its Compliance Officer, which shall include: i. the Compliance Officer’s Annual Compliance Monitoring Plan (‘CMP’) as approved by the Board of Directors and the outcome of such plan; and ii. a list of regulatory breaches identified and their status This report would cover the preceding year; for instance, an ACR submitted with a deadline of end of April 2026, would cover 2025. FIR/02 and FIR/03 further set out that the ACR would be signed by at least one Director and may be countersigned by the Compliance Officer of the Institution. In view of these requirements, FinTech Supervision (‘FS’) received the first submissions in April 2025 for those Authorised Persons (‘APs’) which have a financial year end in December and consequently has carried out a thorough review of a sample of the submissions in order to communicate with the industry any shortcomings and findings. General Findings on the Compliance Report The compliance function should ensure that compliance monitoring is carried out through a structured and well-defined CMP and that the compliance policy is observed. The AP shall establish and maintain an effective compliance function which has, amongst other responsibilities, the duty to draw up and implement a compliance monitoring plan. 1 At the time of issuance of this circular, FIR/02 had not yet been updated to include the ACR. Accordingly, this circular and the associated guidance will become relevant to APs licensed under FIR/02 once the update is effected. APs licenced under FIR/02 are still being notified so to pre-emptively address the obligation. 27 January 2026

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt The following findings were identified during the review: Findings Constituting Breaches of FIR/03 i. The ACR must include the Board approved CMP. In many cases, the CMP was not submitted as part of the ACR, requiring FS to request it separately; ii. In several instances, the ACR was not submitted in a duly signed format; iii. There were occurrences where the CMP was not submitted at all, in which case FS deemed it to be absent. Additional Observations on Quality and Completeness While the matters outlined below do not constitute explicit obligations under FIR/03, they reflect the level of diligence, accuracy and completeness expected in the preparation and submission of ACRs, in line with established supervisory practices: i. The risk assessment carried out by the Compliance Officer when designing the CMP was missing in the majority of submissions; ii. Several CMPs lacked due dates for planned testing activities and/or failed to document evidence checks. These elements are critical for third-party review. In addition, certain compliance functions placed undue reliance on other departments for the testing of controls; iii. A number of CMPs omitted key regulatory obligations, including but not limited to: • outsourcing requirements and obligations; • Internal Audit plans and findings; • new and upcoming regulatory requirements, including gap analyses against recently implemented regulations; • MFSA regulatory submissions; • safeguarding of clients’ funds; • corporate governance; and • anti-money laundering obligations; iv. In some cases, the CMP focused solely on AML risks, while in others it lacked sufficient robustness and omitted standard required elements.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt FS also observed that regulatory breaches were not consistently reported. In several instances, information provided was incomplete and did not clearly explain the nature of the breach, its current status or the remedial actions being undertaken. Supervisory Expectations FS considers the above findings to be serious and indicative of weaknesses in the compliance frameworks of a number of APs, including some that have been licensed for several years. The Authority expects relevant parties to demonstrate an appropriate level of compliance maturity and to meet the applicable regulatory standards. APs are expected to conduct a comprehensive assessment of their operations and procedures to ensure that all aspects of their business, including all services offered under the LH’s licence, are effectively monitored and duly incorporated within the CMP. APs, in general, are required to allocate a greater level of attention to the development of the CMP and the corresponding testing plan. The CMP should not constitute a mere “tick-the-box” exercise, but rather an ongoing programme designed to monitor the various compliance obligations applicable. FS acknowledges that this is the first year in which the ACR has been requested and will therefore treat this year as a grace period. Notwithstanding this, all future submissions are expected to fully meet AP’s standards, which are aligned with universally accepted compliance requirements. Guidance In this regard, the Authority has issued Guidance outlining the obligations under Chapters 2 and 3 of the Financial Institutions Rulebook concerning the submission of the ACR. Further details are available here.