Compliance Outcomes-Based Supervision: The Internal Liquidity Adequacy Assessment Process

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta 16 June 2026 Banking Supervision Office Tel: (356) 2144 1155 Dear Chief Executive Officer, Re: Compliance Outcomes-Based Supervision − The Internal Liquidity Adequacy Assessment Process (‘ILAAP’) The Malta Financial Services Authority (‘MFSA’ or ‘the Authority’) is issuing this letter to Chief Executive Officers of credit institutions to communicate the key outcomes of its recent supervisory assessment of the ILAAP framework across a sample of LSIs. This communication forms part of the MFSA’s Compliance Outcomes-Based Supervision approach and is intended to provide institutions with clear insight into observed practices, identified deficiencies, and the Authority’s expectations in relation to liquidity and funding risk management. Institutions are encouraged to carefully consider the findings outlined in this letter and to take timely and effective action, where necessary, to address any relevant gaps and strengthen their overall liquidity resilience. 1.0 BACKGROUND INFORMATION AND SCOPE The MFSA continues to enhance its supervisory framework through the wider implementation of its Compliance Outcomes-Based Supervision approach, which is now embedded across all of its supervi￾sory functions. As outlined in the MFSA’s Supervisory Priorities for 2025, the Authority is placing in￾creased emphasis on ensuring that supervised entities deliver tangible regulatory outcomes that pro￾mote financial stability, sound governance, and enhanced consumer protection.1 Within this context, the ILAAP remains a key component of supervisory engagement with credit institu￾tions, particularly as the MFSA intensifies its focus on governance arrangements, risk management practices, and the broader resilience of supervised entities. In this regard, the MFSA undertook a targeted review of the LSIs’ frameworks around the ILAAP, as well as liquidity and funding-related risks, across a selected sample of LSIs. The selection followed a risk￾based and proportionate approach, with the objective of driving meaningful and measurable improve￾ments in the institutions’ liquidity resilience. The institutions in scope were determined based on a com￾bination of key liquidity indicators, as well as their reliance on Online Deposit Platforms (‘ODPs’). This exercise assessed how institutions have translated regulatory requirements and supervisory ex￾pectations into practice, with a particular focus on the adequacy and effectiveness of institutions’ in￾ternal controls, risk management frameworks, and the extent of their alignment with applicable regula￾tory requirements and supervisory expectations. 1 Malta Financial Services Authority, ‘Supervision Priorities 2025’ (2025). Available at: https://www.mfsa.mt/wp content/uploads/2025/02/MFSA-Supervisory-Priorities-2025.pdf

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta The institutions within scope were requested to: − complete a self-assessment questionnaire based on their level of compliance across sev￾eral sections in line with the respective regulations, and − develop a remediation plan outlining specific, actionable measures, supported by clearly de￾fined timelines for implementation. The MFSA subsequently conducted a desk-based review to assess whether the reported outcomes were evidence-based, credible, and aligned with supervisory expectations, considering each institu￾tion’s size, nature, and business model complexity. Under this approach, the MFSA identified key priority areas and assessed institutions’ performance against predetermined outcomes. The assessment covered key areas, namely:

1. Internal governance;
2. The risk appetite framework (‘RAF’);
3. Internal audit;
4. Risk management and internal controls;
5. ODPs;
6. The liquidity contingency plan (‘LCP’); and
7. The stress testing framework. While the results indicate generally strong levels of compliance in certain areas, including examples of best practices amongst some institutions, the review also identified some material weaknesses. A sig￾nificant proportion of institutions were assessed as non-compliant or only partially compliant across some of the areas reviewed. The key findings and supervisory expectations are set out in the subse￾quent section of this letter. As part of this assessment, particular attention was given to institutions’ adherence to liquidity and funding risk requirements arising from: − The repeal of Banking Rule BR/05 on Liquidity Requirements of Credit Institutions; − Banking Rule BR/24 on Internal Governance of Credit Institutions; − Banking Rule BR/26 on Stress Testing Requirements of Credit Institutions2 ; − Commission Delegated Regulation (EU) 2015/61 of 10 October 2014, to Supplement Regu￾lation (EU) No 575/2013 of the European Parliament and the Council, on the Liquidity Cov￾erage Requirement for Credit Institutions (hereinafter ‘LCR Delegated Regulation’)3 ; and − Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on Prudential Requirements for Credit Institutions and Investment Firms and Amend￾ing Regulation (EU) No 648/2012 (hereinafter ‘Capital Requirements Regulation’ or ‘CRR’) 4 . 2 Malta Financial Services Authority, Credit Institutions, Rules. Available at: https://www.mfsa.mt/our-work/credit￾institutions/#CIs 3 Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to Supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to Liquidity Coverage requirement for Credit Institutions. Available at: Delegated regulation - 61/2015 - EN - EUR-Lex 4 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on Prudential Requirements for Credit Institutions and Investment Firms and Amending Regulation (EU) No 648/2012. Available at: Regulation - 575/2013 - EN - Capital Requirements Regulation - EUR-Lex

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Further to the above, the MFSA expects institutions to take into account relevant international stand￾ards and supervisory guidelines, including: − The European Banking Authority (‘EBA’) Guidelines on Common Procedures and Methodol￾ogies for the SREP and Supervisory Stress Testing (EBA/GL/2022/03), March 20225 − The European Central Bank (‘ECB’) Guide to the Internal Liquidity Adequacy Assessment Process, November 20186 ; − The ECB, SSM Supervisory Statement on Governance and Risk Appetite, June 20167 ; − The Financial Stability Board (‘FSB’) Principles for an Effective Risk Appetite Framework, November 20138 ; − The Basel Committee on Banking Supervision (‘BCBS’) Principles for Sound Liquidity Risk Management and Supervision (BCBS 144), September 20089 ’ − The BCBS: ‘The Internal Audit Function in Banks’ (BCBS 223), June 201210; and − The BCBS Stress Testing Principles (d450), October 201811 . While this review was conducted on a selected sample of institutions, the MFSA is issuing this commu￾nication to set out supervisory expectations applicable to all credit institutions operating under the Banking Act, Chapter 371 of the Laws of Malta. 2.0 SUPERVISORY ASSESSMENT AND KEY FINDINGS The supervisory assessment provides a consolidated view of observed practices across the institutions in scope, highlighting both areas of strength and common deficiencies. While the exercise was con￾ducted on a selected sample of banks, its outcomes are intended to serve as a useful benchmarking reference for credit institutions. All institutions are encouraged to assess their own frameworks against the findings outlined herein, with a view to identifying potential gaps, enhancing existing practices, and aligning more closely with supervisory expectations in relation to the ILAAP, and the broader liquidity risk management framework. 5 European Banking Authority, Guidelines on Common Procedures and Methodologies for the Supervisory Review and Evaluation Process (SREP) and Supervisory Stress Testing (EBA/GL/2022/03). Available at: BoS 2018 xx Revised SREP GL including amendment for reference.docx 6 European Central Bank, Guide to the International Liquidity Assessment Process (ILAAP), November 2018. Available at: https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.ilaap_guide_201811.en.pdf 7 European Central Bank, SSM supervisory statement on governance and risk appetite, June 2016. Available at: https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm_supervisory_statement_on_governance_and_risk_appetite_2016 06.en.pdf 8 Financial Stability Board, Principles for an Effective Risk Appetite Framework, November 2013. Available at: https://www.fsb.org/uploads/r_131118.pdf 9 Basel Committee on Banking Supervision, Principles for Sound Liquidity Risk Management and Supervision (BCBS 144), September 2008. Available at: https://www.bis.org/publ/bcbs144.pdf 10 Basel Committee on Banking Supervision, The Internal Audit Function in Banks (BCBS 223), June 2012. Available at: https://www.bis.org/publ/bcbs223.pdf 11 Basel Committee on Banking Supervision, Stress Testing Principles (d450), October 2018. Available at: https://www.bis.org/bcbs/publ/d450.pdf

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta 2.1 Internal Governance and Oversight The MFSA assessed institutions’ internal governance frameworks, with a focus on:

1. The involvement of the Board of Directors and Senior Management in the ILAAP;
2. The adequacy of governance structures;
3. The effectiveness of the risk identification process;
4. The effectiveness of the Risk Committee; and
5. Robustness of reporting and escalation mechanisms. Across the institutions reviewed, the Authority noted that, in most cases, the Board formally approves the ILAAP and the accompanying documentation through a structured and well-documented process. Nonetheless, in a number of instances such approval was not sufficiently evidenced. In addition, dis￾cussions on ILAAP-related matters, particularly those concerning liquidity and funding risks, were gen￾erally limited at Board level. In approximately 75% of institutions assessed, key aspects of the ILAAP, such as the methodology, underlying assumptions, and parameters used for risk measurement, were not escalated for Board con￾sideration and remained at senior management level. This restricts the Board’s ability to exercise ef￾fective oversight and challenge, which is essential for ensuring robust governance over liquidity risk. The review also revealed that while most institutions outline the adoption of the three lines model and describe the roles and responsibilities of the Board, key Committees, and relevant functions, the ILAAP documentation often lacks sufficient detail on the processes used to identify material liquidity risks. Furthermore, in around half of the institutions under assessment, the ILAAP does not adequately ex￾plain how key risk assumptions and parameters are determined, nor how these align with the institu￾tion’s risk appetite and prevailing market conditions. The documentation frequently fails to clearly demonstrate how the different types of liquidity risks are mitigated through the internal control frame￾work. These shortcomings limit the Authority’s ability to assess the effectiveness of governance struc￾tures in supporting sound liquidity risk management. The MFSA emphasises that an effective Board Risk Committee is essential to ensuring the institution’s resilience. While institutions generally meet required meeting frequencies and have established formal Terms of Reference, the depth and quality of discussions remain insufficient, or not sufficiently min￾uted, in several cases. In particular, ILAAP-related discussions and those concerning liquidity and fund￾ing risks are often not sufficiently comprehensive to enable robust oversight and effective challenge. The MFSA also highlights the importance of integrating ILAAP outputs into periodic reporting to the Board of Directors and Senior Management. Although periodic reporting is generally in place, in several cases, it does not sufficiently reflect key ILAAP outcomes nor adequately support strategic deci￾sion-making. In addition, where shortcomings have been acknowledged by some institutions, these are not always accompanied by clear remediation plans and timelines, thus raising concerns regarding the commitment to enhancing the quality and effectiveness of internal reporting frameworks. Furthermore, approximately 75% of institutions captured in the sample did not provide sufficient evi￾dence of how the Risk Management Function promotes awareness and understanding of ILAAP meth￾odologies, results, and implications across different business units and functions. The MFSA encour￾ages institutions to address this aspect through targeted training and knowledge-sharing initiatives, ensuring that the ILAAP is properly understood and appropriately embedded across relevant functions.

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Collectively, these findings highlight the need for institutions to strengthen their internal governance frameworks. Enhancements are required to ensure effective Board oversight, improve risk identification processes, strengthen internal challenge, and fully integrate the ILAAP into decision-making processes. This is further reflected in the overall assessment results, where institutions achieved, on average, only 38% compliance with the key areas assessed, with the remainder assessed as partially compliant or non-compliant. These outcomes demonstrate that substantial enhancements are required to meet the Authority’s supervisory expectations and to support a sound and resilient liquidity risk management framework. Ensure effective Board oversight of the ILAAP, including the review and challenge of key assumptions and methodologies, in line with Banking Rule BR/24 Maintain robust governance and escalation frameworks for liquidity and funding risks, consistent with the CRR and the EBA Guidelines on SREP Ensure the Risk Committee provides effective oversight of liquidity risk, supported by regular and substantive discussions in line with Banking Rule BR/24 and broader governance expectations under the CRR and EBA Guidelines on SREP Ensure ILAAP frameworks adequately identify and assess material liquidity risks, including clear documentation of underlying assumptions and parameters, in line with the ECB Guide to the ILAAP Embed ILAAP outputs into internal reporting and decision-making, in line with the ECB ILAAP Guidelines 2.2 Risk Appetite Framework The MFSA notes that this area recorded the lowest level of compliance across all components as￾sessed, with institutions achieving only 25% compliance in the key areas reviewed. These areas include:

1. The articulation of the Risk Appetite Statement (‘RAS’) and tolerance levels,
2. The coverage of institution-specific liquidity risks;
3. The governance arrangements supporting the framework; and
4. The consistency of thresholds and limits. The assessment highlighted significant shortcomings in how institutions define and document their liquidity RAS and corresponding tolerance levels within the ILAAP. Although these documents are gen￾erally subject to periodic review, in many cases the RAS remains overly narrow, focusing mainly on regulatory thresholds and the survival period, without reflecting critical institution-specific risks such as concentration and maturity mismatches. Supervisory Expectations – Internal Governance and Oversight

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta The Authority also identified material gaps in institutions’ monitoring, review, and escalation processes. Several institutions did not adequately explain how adherence to the RAS is monitored, or outline the actions required in cases of breaches or prolonged deviations. Additionally, although periodic reporting is submitted to the Board of Directors, such reporting does not sufficiently incorporate key ILAAP out￾puts. Moreover, approximately 25% of the institutions assessed do not provide a comprehensive description of their RAF within the ILAAP, and around 50% do not clearly outline the roles and responsibilities within the bank’s risk management and control function. Evidence of the Board’s understanding and engage￾ment with the risks identified in the RAF was also limited. These observations may underly a restricted ability of the Board to exercise effective oversight and informed decision-making in relation to liquidity and funding risks. Despite some examples of sound monitoring practices, such as frequent Liquidity Coverage Ratio (‘LCR’) calculations and regular reporting through internal dashboards, the Authority identified persis￾tent structural gaps across many liquidity RAFs. A significant number of institutions rely predominantly on regulatory metrics, such as the LCR, the Net Stable Funding Ratio (‘NSFR’), the survival period, liquid asset levels, intraday liquidity thresholds, and the Loan-to-Deposit ratio. However, these metrics may not sufficiently reflect institution-specific risk drivers. In particular, institutions generally lack concentration limits by sector, counterparty, facility type, or ma￾turity buckets. The absence of such limits restricts the ability to identify vulnerabilities linked to depend￾ence on specific funding sources or clusters of short-term maturities. In several cases, institutions did not provide adequate documentation demonstrating how these risks are identified, assessed, moni￾tored, or escalated. In view of these findings, and considering the size, nature, and business models of the institutions as￾sessed, the Authority considers the overall level of compliance in this area to be weak. The Authority therefore expects institutions to significantly enhance their liquidity RAF to ensure a more comprehensive, forward-looking, and risk-sensitive approach to liquidity risk management. In particular, institutions should clearly document their liquidity RAS and associated tolerance levels within the ILAAP, ensuring alignment with the broader risk management framework. Institutions are also expected to introduce bank-specific metrics addressing concentration risk, maturity profiles, encumbrance lev￾els, liquidity buffers, and exposures across intraday, short-, medium-, and long-term horizons. Furthermore, limits for regulatory ratios should be set sufficiently above the minimum regulatory re￾quirements and be supported by well-defined monitoring, escalation, and remediation processes. Strengthening these elements will enhance governance, improve oversight by the Board, and promote more effective liquidity risk management across the institution.

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Establish a comprehensive liquidity RAS, including clearly defined tolerance levels, in line with Banking Rule BR/24 Ensure the RAF captures all material liquidity risks, including institution-specific risks, in line with the ECB Guide to the ILAAP Implement robust monitoring, escalation, and breach management processes, consistent with the CRR and the EBA Guidelines on SREP Define institution-specific liquidity risk metrics and limits, beyond regulatory ratios to support effective risk identification and management, in line with the ECB Guide to the ILAAP and BCBS 144 Ensure effective Board oversight and understanding of the RAF, in line with Banking Rule BR/24 2.3 Internal Audit Coverage and Effectiveness The MFSA assessed the adequacy of the Internal Audit Function (‘IAF’), including;

1. Its coverage of the ILAAP, liquidity and funding risks; and
2. The effectiveness of remediation processes. The Authority reminds institutions that the IAF must be adequately resourced and possess the neces￾sary capabilities to effectively review the ILAAP, taking into account the institution’s size, complexity, and risk profile. While the ILAAP is generally included within internal audit plans and audit reports are available in Board and relevant Committee packs, several institutions do not provide sufficient evidence justifying the choice of the depth and scope of the audit work performed. In 25% of cases, internal audit resources were assessed as limited, raising concerns about the func￾tion’s ability to conduct a sufficiently thorough and independent review. Furthermore, in 50% of institu￾tions, internal audit reports do not indicate whether independent validation of the liquidity risk method￾ologies and calculations has been carried out, thereby reducing the level of assurance provided over the robustness of the ILAAP framework. Institutions are expected to ensure that internal audit plans provide adequate and regular coverage of liquidity and funding risks, including the review of relevant policies, procedures, and control processes. The Authority notes that only 25% of internal audit plans include liquidity-related activities, such as Supervisory Expectations – Risk Appetite Framework

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta treasury reviews or recommendations to liquidity risk management, while coverage in the remaining institutions is either absent or insufficiently demonstrated. Furthermore, documentation often does not consistently demonstrate that internal audit systematically identifies and escalates breaches, nor that it performs formal reporting on the implementation of the RAF. The MFSA also observes delays in the remediation of audit findings related to liquidity and funding risks, with recommendations at times not being resolved in a timely or effective manner. Institutions are expected to ensure the prompt remediation of internal audit findings to maintain a robust control environment and strengthen their liquidity risk management framework. Ensure the IAF is adequately resourced and possesses appropriate expertise to provide independent assurance over the ILAAP, in line with Banking Rule BR/24 and BCBS 223 Ensure internal audit provides comprehensive and regular coverage of liquidity and funding risks, in line with the ECB Guide to the ILAAP Ensure independent validation of liquidity risk methodologies, models and calculations, in line with the ECB Guide to the ILAAP and the EBA Guidelines on SREP Ensure timely and effective remediation of internal audit findings, in line with BCBS 223 2.4 Risk Management and Internal Control Framework The MFSA assessed institutions’ liquidity and funding risk framework, including:

1. Governance and oversight arrangements;
2. Monitoring and reporting process; and
3. Data systems and levels of automation. Institutions are expected to establish comprehensive frameworks for the identification and measure￾ment of liquidity and funding risks, including the monitoring of intraday exposures and counterbalanc￾ing capacity across different time horizons. The Authority notes that such frameworks are not consist￾ently in place across all institutions. In several cases, institutions were unable to clearly identify or mon￾itor their counterbalancing capacity, nor adequately integrate it within the ILAAP and the RAF. Only 25% of institutions in the sample were found to forecast prospective cash flows and assess coun￾terbalancing capacity under both normal and stressed conditions within the ILAAP, while also monitor￾ing key liquidity parameters through the Asset and Liability Committee (‘ALCO’) on a quarterly basis. Institutions are therefore expected to strengthen their frameworks by integrating intraday liquidity risk into the RAF, ensuring regular monitoring, commensurate with the institution’s size, complexity, and business model, and embedding counterbalancing capacity assessments as a core component of both Supervisory Expectations – Internal Audit Coverage and Effectiveness

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta the ILAAP and the RAS. These enhancements are essential to enable institutions to anticipate liquidity needs and implement timely management actions. The MFSA also identified weaknesses in the monitoring and assessment of the funding risk profile. Institutions are expected to review their funding positions at least monthly and assess them against funding plans and risk appetite limits. 25% of the institutions are assessed as highly compliant and provide KRI monitoring reports showing that liquidity and funding metrics are monitored monthly, and more frequently when indicators fall into the amber range. However, the Authority notes that 75% of such reports lack sufficient qualitative information and, in some instances, omit key metrics included in the RAS, such as the survival period. Sole reliance on regulatory thresholds is inadequate, as it prevents institutions from forming a complete view of their actual risk profile, evaluating progress against strategic objectives, and effectively support decision-making. Institutions are therefore expected to enhance their risk management practices by increasing the frequency and depth of monitoring, ensuring that reporting is forward-looking, and incor￾porating qualitative insights to support strategic decision-making. In addition, the Authority notes that reporting is often performed on a quarterly rather than monthly basis, limiting its timeliness and effec￾tiveness. The Authority further notes that, while certain institutions have a liquidity risk policy that is reviewed on a regular basis, Board and Committee minutes often show limited discussion or challenge during the approval process. This raises concerns about the effectiveness of governance oversight in this area. In addition, significant deficiencies were identified in relation to data quality and systems. A majority of institutions continue to rely on manual data aggregation processes, often supported by Excel-based tools, with minimal controls in place to ensure data accuracy and integrity. This reliance increases operational risk and undermines the reliability of liquidity risk assessments. The Authority therefore emphasises the need for improved automation, stronger internal controls, and enhanced governance and documentation surrounding liquidity risk data. At the same time, the Authority acknowledges the good practices in some institutions, with 50% pre￾senting clear plans to reduce reliance on manual tools and further automate risk-monitoring processes. These initiatives represent positive steps toward enhancing data quality and strengthening the overall liquidity risk management framework. Institutions are encouraged to establish robust systems capable of monitoring intraday liquidity posi￾tions in real time, including the accurate measurement of expected daily inflows and outflows. Such systems should be forward looking, and, to the extent possible, modelled, enabling institutions to iden￾tify potential funding shortfalls throughout the day, thereby improving institutions’ ability to manage liquidity pressures proactively. The Authority notes that only 25% of institutions in the sample are cur￾rently compliant and have adequate systems in place to monitor intraday liquidity, while the majority continue to rely on manual processes to track cash flows. This reliance increases the likelihood of inaccuracies and operational risk, and limits institutions’ ability to produce fundamental intraday liquidity figures or assess expected flows with sufficient precision. Institutions are therefore strongly encouraged to implement automated liquidity-management tools, proportionate to the institution’s size, nature and complexity, supported by appropriate reporting and control structures, to strengthen oversight and ensure alignment with supervisory expectations.

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Establish comprehensive frameworks for identifying and measuring liquidity and funding risks, in line with the ECB Guide to the ILAAP Ensure regular and forward-looking monitoring and reporting of liquidity and funding risk, supported by qualitative analysis in line with the EBA Guidelines on SREP Ensure effective governance and oversight of liquidity risk frameworks, including active Board and Committee challenge, in line with Banking Rule BR/24 Strengthen data quality, internal controls, and automation of liquidity risk data and reporting processes, in line with the ECB Guide to the ILAAP and BCBS 239 Ensure robust monitoring of intraday liquidity positions and forecasting cash flows, supported by systems or processes proportionate to the institution’s size, nature and complexity, in line with the ECB Guide to the ILAAP 2.5 Online Deposit Platforms The MFSA placed particular emphasis on:

1. Institutions’ regulatory compliance and potential implications of the use of ODPs as funding strategies;
2. The integration of ODP-related risks within the RAF; and
3. Their incorporation into stress testing frameworks. The Authority reminds institutions to carefully consider the potential vulnerabilities ODP usage opens up for their funding strategies, particularly in relation to operational resilience risks such as platform availability, cyber threats, and potential IT failures. Institutions should also take into account the evolv￾ing regulatory landscape as well as the reputational considerations associated with reliance on cross-border deposits. In this context, the MFSA has recently published ‘The Nature and Art of Financial Supervision, The Su￾pervision of Online Deposit Platforms’, which, whilst not being part of the regulatory framework, outlines the Authority’s supervisory approach to ODPs and highlights key risks and expectations associated with their use. Institutions are expected to take this publication into account when assessing their reliance on ODP funding and when developing sustainable and resilient liquidity and funding strategies. 12 12 Malta Financial Services Authority, The Nature and Art of Financial Supervision on the Supervision of Online Deposit Platforms (2025). Available at: The Nature and Art of Financial Supervision - MFSA Supervisory Expectations – Risk Management and Internal Controls Framework

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta The Authority notes that institutions have acknowledged these risks within their ILAAP submissions and, in some cases, are reassessing their reliance on ODPs by increasing the share of locally sourced deposits. Furthermore, some institutions have developed dedicated stress testing scenarios assessing the impact of a sudden disruption or termination of ODP funding. However, significant deficiencies remain. In particular, in the LCR calculation, 66% of institutions re￾ported incorrect outflow rates for ODP deposits, despite the clear requirements. Institutions are there￾fore expected to ensure the accurate application of the relevant regulatory provisions governing the treatment of ODP-sourced funding, and to fully integrate operational, regulatory, and reputational con￾siderations into the development of sustainable and resilient funding strategies. The Authority also identified shortcomings in the integration of ODP-related risks within the RAF. Insti￾tutions are expected to explicitly capture exposures arising from the use of ODPs and ensure that risk tolerance levels are appropriately calibrated to reflect the concentration risk associated with such fund￾ing sources. Only 33% of institutions were assessed as highly compliant in this area. Strengthening the RAF through the inclusion of ODP-specific metrics, such as concentration limits, will support more ac￾curate risk assessment, improved oversight, and enhanced resilience. Additionally, institutions are expected to establish robust internal control frameworks to regularly mon￾itor and manage ODP exposures. The MFSA notes that all relevant institutions were assessed as either partially compliant or non-com￾pliant in relation to conducting regular assessments and audits of ODP-related activities, including the monitoring of ICT risks such as system availability, cyber threats, and operational disruptions. While certain institutions have controls and oversight mechanisms that function adequately for current oper￾ations, the absence of formalised audit or compliance reviews, as well as lack of documented ICT risk controls, limits the effectiveness of these frameworks. Institutions are therefore expected to strengthen their internal control frameworks by establishing systematic, well-documented reviews of ODP-related activities, supported by clear governance, oversight, and independent assurance. Institutions are encouraged to strengthen their stress testing frameworks by explicitly incorporating risks associated with ODPs. This should include dedicated scenarios or sensitivity analyses capturing potential disruptions to ODP funding, such as platform outages or sudden deposit withdrawals. These analyses are essential for supporting strategic decision-making, strengthening risk identification, and informing recovery planning. In this case, the Authority notes that only 33% of institutions in the sample that utilise ODPs currently discuss ODP-related matters at Board or Committee level and include ODP-related assumptions within their stress testing frameworks. Institutions are therefore encouraged to deepen governance discussions on ODP exposures and to integrate ODP-specific risks more fully into their stress testing architecture to ensure greater resilience to potential funding shocks.

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Ensure accurate application of regulatory requirements for ODP-sourced funding, in line with the CRR and the LCR Delegated Regulation Integrate ODP-related risks within the RAF, in line with the ECB Guide to the ILAAP Establish robust internal controls and independent assurance over ODP-related activities, including ICT and operational risks, in line with Banking Rule BR/24 and the EBA Guidelines on SREP Incorporate ODP-related risks into stress testing, including severe but plausible disruption scenarios, in line with the ECB Guide to the ILAAP and the BCBS Stress Testing Principles 2.6 Liquidity Contingency Plan The MFSA highlights that institutions are required to have in place a formal and comprehensive Liquid￾ity Contingency Plan (‘LCP’) that includes a sufficiently qualified and granular analysis of the viability and feasibility of all contingency funding options. The Authority notes that 50% of the institutions in the sample were assessed as non-compliant, as they do not maintain a formal LCP. While other institutions have established an LCP, these often lack suffi￾cient analysis to determine the practicality and effectiveness of the proposed contingency measures. In particular, 75% of the institutions did not provide estimates of the amounts that could realistically be obtained from each contingency funding source, nor did they assess the feasibility of accessing such funds during periods of stress. Furthermore, the lead times required to mobilise contingency funding, an essential element in as￾sessing the operational effectiveness of contingency arrangements, were not consistently docu￾mented. Institutions are therefore expected to enhance their LCPs by incorporating detailed quantita￾tive and qualitative assessments of all contingency funding options, including feasibility, potential amounts, activation procedures, and expected lead times, to ensure the credibility and operational read￾iness of their liquidity contingency arrangements. The Authority also identified deficiencies in contingency-related monitoring and reporting. Liquidity con￾tingency reporting is expected to include indicators capturing the stock of central bank-eligible unen￾cumbered assets, available collateral, and collateral mobilisation capabilities, enabling institutions to assess the credibility and readiness of contingency funding sources. However, several institutions do Supervisory Expectations – Online Deposit Platforms

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta not include these indicators in their regular reporting, and in some cases, contingency funding options are neither monitored nor tested. Furthermore, the IAF does not consistently cover the LCP within its audit plan, with 50% of institutions lacking such coverage. This limits the level of independent assurance over a critical component of li￾quidity risk management. Institutions are therefore expected to ensure that internal audit regularly re￾views the LCP and its supporting documentation, including the testing of contingency funding options and the controls governing collateral availability and eligibility assessments. Further to the above, institutions are expected to have in place comprehensive policies and procedures clearly outlining the actions to be taken upon activation of the LCP. These should detail the internal and external communication protocols, escalation procedures, roles and responsibilities, and disclosure re￾quirements that apply during a liquidity stress event. The Authority positively notes that 75% of the institutions within the sample maintain such policies and procedures, demonstrating a higher level of operational readiness to implement contingency measures effectively. Institutions are nevertheless encouraged to continue strengthening, formalising, and docu￾menting these processes to ensure that, should the LCP be activated, the organisation is able to re￾spond in a structured, timely, and coordinated manner. Establish and maintain a formal LCP, supported by detailed analysis of the feasibility and effectiveness of all contingency funding options, in line with the ECB Guide to the ILAAP Quantify and assess contingency funding sources, including accessibility under stress, in line with the ECB Guide to the ILAAP Monitor and test contingency funding options, in line with the EBA Guidelines on SREP Ensure independent review of the LCP by the IAF in line with BCBS 223 Establish clear governance, escalation, and communication procedures for LCP activation, in line with Banking Rule BR/24 2.7 Stress Testing Framework and Scenario Design The MFSA assessed the institutions’ stress testing frameworks, including compliance with regulatory expectations, scenario design and coverage, reverse stress testing practices, and governance arrange￾ments. Supervisory Expectations – Liquidity Contingency Planning

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Institutions are expected to maintain stress testing frameworks that are comprehensive, forward-look￾ing, and responsive to evolving risk conditions. Institutions should continuously assess whether their stress scenarios remain appropriate in light of changes in the economic and operating environment. This assessment should be conducted regularly (e.g. at least quarterly), and scenarios should be up￾dated promptly where they are no longer fit for purpose or when material new risks emerge. The Authority notes that, while all institutions have established formal stress testing frameworks, in￾cluding processes for the design, selection, use, and review of scenarios, supported by regular oversight and approval from the Board, 75% of the LSIs still exhibit significant shortcomings. These include frameworks that do not sufficiently describe how scenarios are developed and reviewed, stress testing exercises performed only on an annual basis even when material developments are taking place within the bank and/or the macroeconomic environment, and the absence of adequate data systems needed to support effective and reliable measurement of key inputs. At the same time, the Authority observed good practices, with a limited number of institutions demon￾strating the ability to incorporate changes in the environment and adapt their stress testing frameworks on a quarterly basis by integrating new risk drivers and emerging vulnerabilities. Institutions are there￾fore encouraged to enhance their scenario design, increase the frequency and depth of scenario as￾sessments, and ensure that underlying data systems support accurate, comprehensive, and timely monitoring. The Authority further notes that half of the institutions were assessed as non-compliant due to the absence of alternative scenarios or insufficient detail regarding how scenarios are selected, reviewed, and adapted in response to evolving market conditions and regulatory expectations. In some cases, even combined scenarios fail to produce a material impact on key liquidity metrics, such as the LCR, raising concerns regarding the severity and plausibility of the assumptions applied. Institutions are therefore expected to ensure that their stress testing scenarios are sufficiently severe, relevant, and tailored to their specific risk profiles. In addition, 50% of institutions within the sample assessed do not perform reverse stress tests. Where reverse stress testing is conducted, it is often unclear how the results are used to calibrate liquidity buffers, inform contingency funding plans, or assess the likelihood of extreme but plausible events. The Authority also notes that institutions do not consistently demonstrate how stress testing outcomes are integrated into liquidity risk management, including their use in setting limits, triggering escalation mechanisms, or informing contingency planning. Institutions are therefore expected to ensure that both alternative and reverse stress testing are fully embedded within their frameworks, supported by clear methodologies, robust governance, and explicit links to decision-making processes. Finally, the MFSA positively notes that the majority of institutions have established policies and proce￾dures outlining communication protocols during liquidity stress events. These generally outline roles and responsibilities, escalation procedures, and communication channels with the Authority, counter￾parties and other stakeholders. However, 25% of the institutions do not maintain a dedicated commu￾nication strategy. These institutions are therefore expected to enhance their documentation to ensure that communication arrangements are comprehensive, clearly articulated, and operationally effective in a stress situation.

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta Maintain comprehensive and forward-looking stress testing frameworks, including regular review and updating of scenarios, in line with the ECB Guide to the ILAAP Ensure stress testing scenarios are sufficiently severe, relevant, and tailored to the institution’s risk profile, including the use of alternative scenarios, in line with the EBA Guidelines on SREP Incorporate reverse stress testing into the overall framework, and ensure its outcomes inform risk management and contingency planning, in line with the ECB Guide to the ILAAP Ensure stress testing results are effectively integrated into liquidity risk management and decision-making processes, including limit setting and escalation mechanisms in line with ECB Guide to the ILAAP and the BCBS Stress Testing Principles Establish clear communication procedures for stress scenarios, including defined roles, escalation processes, and stakeholder engagement, in line with Banking Rule BR/24 3.0 CLOSING REMARKS The MFSA emphasises the importance of a well-implemented ILAAP, supported by robust processes for the identification, assessment, and management of liquidity risk. A sound ILAAP framework en￾hances transparency and strengthens confidence in an institution’s ability to meet its obligations, thereby contributing to overall market stability. The MFSA’s assessment indicates that 26% of the reviewed areas were found to be fully compliant with regulatory requirements and supervisory expectations, while 34% were assessed as partially compliant. The remaining were classified as non-compliant, thereby highlighting the need for significant improve￾ments across the sector. Both positive developments as well as areas requiring significant enhancement were identified during this review. Several institutions have demonstrated progress in establishing governance structures, im￾plementing communication procedures for liquidity stress events, and developing formal stress testing and liquidity contingency frameworks. Good practices were also observed in the gradual automation of certain processes, the inclusion of ODP-related scenarios within ILAAP assessments, and the regular monitoring of risk appetite metrics. Institutions demonstrating more advanced practices typically ex￾hibit stronger oversight by senior management, clearer escalation frameworks, and more comprehen￾sive stress testing methodologies. However, material gaps remain across a substantial proportion of institutions. Key weaknesses include deficiencies in the completeness and integration of RAFs, insufficient monitoring and testing of contin￾Supervisory Expectations – Stress Testing Framework and Scenario Design

(+356) 2144 1155 Malta Financial Services Authority info@mfsa.mt Triq l-Imdina, Zone 1 www.mfsa.mt Central Business District, Birkirkara, CBD 1010, Malta gency funding options, limited internal audit coverage, and continued reliance on manual data aggre￾gation processes, raising concerns regarding data quality and operational resilience. In addition, several institutions lack robust methodologies for scenario design, do not adequately perform or utilise reverse and alternative stress testing, and have not implemented sufficiently granular frameworks to manage risks arising from ODPs. Addressing these shortcomings, through strengthened governance, enhanced controls frameworks, im￾proved data quality, and more effective use of risk management tools, will be essential to ensure sound liquidity risk management, effective contingency preparedness, and alignment with supervisory expec￾tations. The MFSA expects credit institutions to give due consideration to the findings outlined in this letter, where relevant, to take timely and appropriate action to address identified gaps and ensure ongoing compliance with the applicable regulatory framework and supervisory expectations. As part of its Compliance Outcomes-Based Supervision approach, the MFSA will continue to monitor institutions’ progress in addressing the findings. This thematic exercise is conducted on a three-year cycle, with the next review scheduled for 2027 and, it is expected to cover the same sample of LSIs. This follow-up assessment will place particular emphasis on the extent to which institutions have ef￾fectively remediated the weaknesses identified and embedded sustainable improvements within their ILAAP frameworks. Yours sincerely, Malta Financial Services Authority Christopher P. Buttigieg Catherine Galea Chief Officer Supervision Head Office of Chief Officer Supervision Banking Supervision

The MFSA ensures that any processing of personal data is conducted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation), the Data Protection Act (Chapter 586 of the Laws of Malta) and any other relevant European Union and national law. For further details, you may refer to the MFSA Privacy Notice available on the MFSA webpage www.mfsa.mt.