Risk-Based Supervision – Strengthening Our Supervisory Approach

Risk-Based Supervision Page 1 of 20 RISK-BASED SUPERVISION STRENGTHENING OUR SUPERVISORY APPROACH

Risk-Based Supervision Page 2 of 20 should neither be considered nor construed as advice or in any way a commitment on the part of the MFSA. Should a conflict arise between this document and the applicable laws, regulations or rules, the laws regulations or rules shall prevail. The MFSA reserves the right to deviate from any of the processes set out in this document where it deems it to be necessary or appropriate.

Risk-Based Supervision Page 3 of 20 CONTENTS GLOSSARY .................................................................................................................................................................. 5 EXECUTIVE SUMMARY........................................................................................................................................... 6

1. INTRODUCTION.............................................................................................................................................. 7
2. PURPOSE........................................................................................................................................................... 7
3. RISK-BASED SUPERVISION......................................................................................................................... 8
4. THE MFSA APPROACH................................................................................................................................. 8 4.1 Key Principles.................................................................................................................................................. 8 4.2 Risk Assessment Framework ...................................................................................................................10 4.3 ML & FT Risks.................................................................................................................................................11
5. SUPERVISORY ENGAGEMENT.................................................................................................................13
6. RESOURCE ALLOCATION..........................................................................................................................13
7. AML/CFT RISK-BASED APPROACH.......................................................................................................13 7.1 Authorisations..............................................................................................................................................13 7.2 Supervision....................................................................................................................................................15 7.2.1 Ongoing supervision of higher risk firms...................................................................................15 7.2.2 Sampled review of other firms.......................................................................................................15 7.2.3 Thematic reviews of firms................................................................................................................16 7.2.4 Event-driven reviews of firms.........................................................................................................16
8. FUTURE ENHANCEMENTS........................................................................................................................16 8.1 Risk Ranking Methodology ......................................................................................................................16 8.2 Supervisory Quality Assurance...............................................................................................................17
9. AGENT OF THE FIAU...................................................................................................................................18
10. CONCLUDING REMARKS ...........................................................................................................................19

Risk-Based Supervision Page 4 of 20 REVISIONS LOG VERSION DATE ISSUED DETAILS 1.00 4 June 2020 Risk-Based Supervision Initial version

Risk-Based Supervision Page 5 of 20 GLOSSARY AML Anti-Money Laundering CASPAR Compliance and Supervision Platform for Assessing Risk CFT Combatting the Financing of Terrorism EBA European Banking Authority ECB European Central Bank FCC Financial Crime Compliance FIAU Financial Intelligence Analysis Unit Firm(s) Persons licensed and regulated by the MFSA including Credit Institutions, Financial Institutions, Insurance Companies and Insurance Intermediaries, Investment Services Companies and Collective Investment Schemes, Securities Markets, Recognised Investment Exchanges, Trust Management Companies, Company Services Providers, Pension Schemes, Virtual Financial Assets Agents and Virtual Financial Assets Service Providers. FT Financing of Terrorism MFSA Malta Financial Services Authority ML Money Laundering NCA(s) National Competent Authority PQ Personal Questionnaire PMLA Prevention of Money Laundering Act, Cap. 373 of the Laws of Malta Risk Appetite MFSA Risk Appetite Statement (link) SSM Single Supervisory Mechanism Supervisory Priorities MFSA Supervisory Priorities for 2020 (link)

Risk-Based Supervision Page 6 of 20 EXECUTIVE SUMMARY The MFSA is responsible for continuously regulating, monitoring and supervising firms in the financial services industry in Malta. This is key to safeguarding the integrity, prosperity, innovation and trust in the Maltese financial services sector. To increase our supervisory effectiveness, we adopt a risk-based approach to supervision that considers potential macro and micro prudential, conduct and financial crime risks associated with the firms we oversee. Risk-based supervision revolves around the idea that as a regulator we have a finite number of resources that must be deployed where they can make the greatest difference. Adopting a risk￾based approach therefore allows us to allocate resources on firms which are most significant and on the risks that pose the greatest threat to consumers and financial market stability. Risk-based supervision is a dynamic and continuous process that involves planning, risk assessment, execution of the supervisory programme and regular monitoring and evaluation on a risk-based cycle. Our risk-based supervisory approach is based on three main principles being supervisory judgement-based, forward-looking and focused on key risks. Across all of these principles we apply proportionality to ensure our interventions do not go beyond what is necessary in order to achieve our objectives. The adoption of a risk-based approach to supervision provides us with a basis for assessing risks across and within sectors. It allows us to assess, within a forward-looking perspective, the most important prudential, conduct and ML/FT risks posed by firms to our supervisory objectives and the extent to which firms can manage and contain these. AML and CFT now sits at the core of our risk assessment framework. One of our key commitments is to increase our engagement with the industry and the public. This document is being published to increase our accountability and transparency, enabling industry and consumers to better understand our supervisory work and priorities. Through this publication we also aim to describe the principal features of risk-based supervision whilst communicating our risk-based supervisory approach, setting out the future work to be conducted for enhancing our risk-based approach and clarifying how AML and CFT has been integrated therein.

Risk-Based Supervision Page 7 of 20

1. INTRODUCTION The MFSA is responsible for the regulation, monitoring and supervision of firms in the financial services sector in Malta. This is key to safeguarding the integrity, prosperity, innovation and trust in the Maltese financial services sector. To increase effectiveness, we adopt a risk-based approach to financial supervision considering the potential macro and micro prudential, conduct and financial crime risks associated with the firms it oversees. The MFSA focuses its supervisory and regulatory activities on those areas which pose the greatest risk to the financial market with the aim of minimising the occurrence of breaches and ultimately protecting consumer interests and safeguarding integrity and confidence in the financial market. Supervision is guided by the proportionality principle and the extent of supervision depends on the nature and scope of the business activities and the corresponding overall risk profile. Our regulatory and supervisory processes are not aimed at achieving a zero-failure regime, but rather to ensure that we minimise impacts of failure and that any failures occurring in the market, are handled in a systematic way, thereby ensuring minimal harm to the financial market and its consumers.
2. PURPOSE The aim of this document is to describe the principal features and objectives of risk-based supervision whilst also communicating the risk-based supervisory approach adopted by the MFSA. It also sets out the future work to be conducted for enhancing this approach and strengthening our supervisory framework. Through the publication of this document, we also aim to provide an overview of how AML and CFT have been integrated into our risk-based approach to supervision. In Malta, the FIAU is the government agency responsible for monitoring compliance with the relevant AML and CFT legislative provisions. Our primary remit in this respect, is to ensure that regulated firms have in place broader, overarching systems and controls. AML and CFT arrangements are, however, a crucial component of these systems and controls, and one set cannot be considered without t and prudential arrangements are often a symptom of AML and CFT shortfalls, too. We therefore have an obligation to consider ML and FT risks in authorised firms with our supervisory work, as well as cooperating with the FIAU as part of joint AML and CFT supervision. One of our key commitments is to increase our engagement with industry and the public. By virtue of this publication we are increasing accountability and transparency, enabling industry and consumers to better understand our supervisory work and priorities.

Risk-Based Supervision Page 8 of 20 3. RISK-BASED SUPERVISION Risk-based supervision is a continuous process that involves planning, risk assessment, execution of a supervisory plan and regular monitoring and evaluation. The concept behind risk based supervision is that we can increase our supervisory effectiveness and efficiency by focusing our efforts on those firms and on the risks that pose the greatest threat to consumers of financial services and financial stability without ignoring less significant or lower risk firms. As the single regulator of financial services in Malta, we need to allocate our limited number of resources to the areas of greatest risk. Allocating resources in a risk-driven manner is a more effective way to safeguard the stability of our financial markets, since the various firms we regulate pose different risks to our financial services sector. Therefore, firms with the potential of having the greatest potential adverse impact on consumers of financial services and financial stability will receive a high level of supervision under structured engagement plans, leading to early intervention measures necessary to mitigate potential risks. Conversely, those firms having the lowest potential adverse impact will be supervised reactively or through thematic assessments, with targeted enforcement action being taken against firms across all impact categories, whose poor behaviour puts the 4. THE MFSA APPROACH 4.1 Key Principles Our supervisory risk-based approach is based on three main principles: Supervisory Judgement Based We rely on an element of human decision-making when taking decisions. Forward-Looking Firms are assessed not just against current risks, but also against any possible future risks. Focused on Key Risks The focus is on those firms that are likely to impose the greatest risks towards the achievement of our supervisory objectives.

Risk-Based Supervision Page 9 of 20 Moreover, our risk-based approach to supervision is: • consistent in its application. Although firms receive different amounts of supervisory attention depending on their impact and the risks they pose, decisions about these matters are taken on a consistent and systematic basis; • taking account of relevant information both from within and outside of the MFSA. Some examples include information about the wider economy which may have a bearing on risk, intelligence regarding the wider industry or sector and supervisory information about the wider financial group which the firm may form part of; • supported by a common framework throughout the organisation. This consists of the tools, documentation and decision-making processes that support risk-based supervision along with the approach to assessing and acting upon identified risks; • supplemented with oversight and quality control mechanisms enabling peers and managers to review assessments and decisions in order to ensure consistency of approach; • that risks are classified in accordance to supervisory priorities. This allows resources to be allocated appropriately and remedial action to be proportionate to the risk identified; • used to address prudential, conduct and ML and FT risks; • concerned with outcomes. The focus is more broadly on the promotion of good outcomes (such as ensuring that customers are treated fairly) and the avoidance of bad ones (such as losses to users of financial services resulting from firm failures). Risk is assessed in this broad context and remedial tools are more often used pre-emptively to promote desired outcomes; • supported by enforcement action. The MFSA has over the past year significantly increased resources in this area, seeking to enhance and facilitate such action. We apply the above principles proportionately to ensure that our interventions do not go beyond what is necessary to achieve our objectives. The adoption of a risk-based approach to supervision provides us with a basis for assessing risks across and within sectors. Through our risk-based supervisory approach we seek to assess, within a forward-looking perspective, the most important prudential, conduct and ML/FT risks posed by firms to our supervisory objectives and the extent to which firms can manage and contain these.

Risk-Based Supervision Page 10 of 20 4.2 Risk Assessment Framework Our risk assessment framework is both qualitative and quantitative in nature, necessitating an element of human decision-making and supervisory judgement to be applied at some stage of the process. Such judgement will partly reflect our supervisory risk appetite. The key factors taken into consideration when forming our judgements include the type of organisation, the governance. However, the use of databases and dashboards identifying trends, risk exposures and shifts in exposures to key markets, sectors, products or activities are integrated into our qualitative decision-making process and are usually one of the departure points in arriving at sound risk-based judgements. The objective of our risk assessment process is to identify those activities within firms posing the greatest risk. These differ across sectors. For example, for the banking sector, credit and market risk usually constitute the key risks. For life insurers, key risks will include the possibility that returns on assets fail to match those on its long-term obligations to policy holders and the liquidity risk arising from uncertainty about the timing of redemptions. On the other hand, any firm, from whatever sector, with retail customers runs the risk of its products being mis-sold. This risk is particularly critical where products are complex and/or of long maturity so that the consequences of mis-selling may not be apparent for several years. Similarly, firms in all sectors are susceptible to financial crime or being used for money laundering. Diagram 1: MFSA Risk Assessment Framework

Risk-Based Supervision Page 11 of 20 Supervisory judgement is then exercised to assess the severity of each risk and to manually adjust the risk score for each of these risks necessary for establishing an updated entity risk ranking. This is conducted on an annual basis. To facilitate the process, supervisory functions make use of their own risk assessment systems which seek to capture a mix of prudential, conduct and ML and FT risk variables. Diagram 2 below depicts our risk assessment model. 4.3 ML & FT Risks Our risk assessment framework originally addressed prudential and conduct risks. This has been revamped with the aim of minimising the ML and FT risks posed to the safety of our society, the integrity of our financial system and the stability of our economy. AML and CFT now sits at the core of our risk assessment framework. Our prudential and conduct risk assessment models now incorporate the ML and FT CASPAR1 risk scores provided by the FIAU, for those subject persons who are regulated and supervised by the MFSA. These scores have been integrated within our risk assessment models on the basis of a weighting reflecting the vulnerability of the different sectors under our supervision to ML and FT. The MFSA conducted an additional sectoral risk assessment with the objective of determining sector specific susceptibility to a set of vulnerabilities, including inter alia AML and CFT. Further detail on this risk assessment is provided under Section 8.1. This has been used as a basis for determining the weighting to be adopted for inclusion of the FIAU CASPAR risk score into our prudential and conduct risk assessment models. 1 CASPAR is a risk-scoring system which gathers information from multiple sources. It incorporates an integrated, tailor-made risk engine which translates the information gathered from various sources into risk indicators. It provides inherent risk and control effectiveness scores which result in the overall residual risk of each subject person. Throughout the year, re-evaluation of the risk is done in response to new information received. Diagram 2: RiskAssessment Model

Risk-Based Supervision Page 12 of 20 The MFSA contributes to the ML and FT CASPAR risk scores, through the ongoing submission of data to the FIAU, both through the provision of prudential information as well as when acting as an agent of the FIAU. Diagram 3 below illustrates how our supervisory work in relation to AML and CFT integrates with the work of the FIAU. Further detail on the role of the MFSA as agent of the FIAU is provided under Section 9 of this document. In the case of the banking sector, the implementation of the SSM (in November 2014) created a new system of banking supervision comprising the ECB and the NCAs of participating EU upervises significant banks while less significant banks continue to be supervised by NCAs, such as the MFSA. Following money laundering issues which recently arose in Europe, the ECB has been working closely with the EBA on including AML and CFT considerations in the prudential risk assessment of banks. The MFSA follows closely the work being carried out in this respect, also through our active participation on an ECB working group discussing such matters. In this regard, we have decided to extend the ECB risk assessment (where possible) on less significant institutions that are under our direct supervision. Consequently, our Business Model Analysis Procedures for less significant institutions now incorporate the ECB AML and CFT risk assessment. Further t brought the three pillars of our supervisory strategy - prudential, conduct and financial crime compliance (FCC) supervision - within the remit of the Supervision Directorate. This was considered crucial towards our holistic approach to supervision. Our prudential and conduct supervision teams have intensified their collaboration with the FCC Function and joint supervisory work has become standard practice. Any findings in relation to AML and CFT are shared and such information would inform our overall entity risk score. Diagram 3: MFSA input to FIAU CASPAR Risk Score

Risk-Based Supervision Page 13 of 20 5. SUPERVISORY ENGAGEMENT The extent and frequency of our supervisory work, both onsite and offsite, is guided by our risk￾based supervisory framework. We will engage with firms at a level that corresponds to their risk grading category: the higher the risk, the higher the level of engagement. This engagement consists of a variety of reviews, assessments and meetings. This is our means of obtaining sound intelligence about a firm in order to accurately assess the risks that it poses. Different sets of engagement tasks are adopted for: [i] high risk firms; [ii] medium risk firms; and [iii] low risk firms. These would vary in the depth of assessment required to obtain an the risk category of the respective firm. While there is commonality of engagement tasks where this makes sense (e.g. submission of data through statutory return), the intensity and frequency of these tasks are proportionate to the amount of resources available based on the risk classification. Further detail on the structure of the risk-based approach adopted by the MFSA, is provided under Section 7. Although this Section is focused on explaining our risk-based approach in terms of AML/CFT, the same approach is applied for prudential and conduct supervision. In addition, enforcement action will be taken by the MFSA against any firm that fails to meet appropriate prudential and consumer protection standards. 6. RESOURCE ALLOCATION The number of staff resources allocated to the supervision of a firm depends on the level of risk posed by that firm. A high-risk firm requires more staff to be focused thereon than a firm with a lower risk profile. That being stated, resource allocation is dependent on our supervisory priorities, budgetary constraints and/or new demands. 7. AML/CFT RISK-BASED APPROACH deterring ML and FT is reflected in our authorisation and supervision arrangements. These arrangements work together with the broader national institutional framework to minimise the risk that ML and FT pose to the safety of our society, the integrity of our financial system, and the stability of our economy. A risk-based approach is also adopted for ML and FT risks associated to the firms we authorise and oversee. 7.1 Authorisations The assessment of of the MFSA with respect to AML and CFT sits at the heart of our evaluation processes, and our conditions for authorisation. The MFSA seeks to ensure that only fit and proper firms and individuals enter our financial system. We are responsible for carrying out probity screenings in

Risk-Based Supervision Page 14 of 20 relation to all qualifying beneficial owners as well as key functionaries within a licensed firm. A risk-based approach is adopted, both at on-boarding and on an ongoing basis, to verify that applicants and approved persons are of good repute. In light of the above, we have implemented a risk rating calculator to establish an overall risk rating for an applicant at onboarding. This combines checks performed to ensure that an individual is fit for the role as well as results from checks performed to ensure that an individual is proper for a role. Checks performed to ensure that an individual is fit for a role predominantly relate to educational background, work experience, reputation and time commitment. On the other hand, checks performed to ensure that an individual is proper for a role include due diligence checks done through a combination of third-party risk intelligence tools, general web searches, FIAU reports and internal databases held by our supervision functions. These checks are now being conducted by a newly set up specialised Due Diligence function housed within our Enforcement Directorate. As part of our improved authorisation arrangements, our Authorisation teams have also intensified their collaboration with the FCC function, prior to onboarding an applicant entity. Indeed, it has become standard practice for our Authorisation teams to consult our FCC team, at authorisation stage, on the business and operating models of an applicant entity. Subsequently, there is also cooperation with the FIAU. Therefore, at authorisation stage, applications are inter alia being assessed in terms of the wider ML and FT implications of the models being proposed. Diagram 4: Risk Assessment Onboarding of Applicants -Individual Involvements

Risk-Based Supervision Page 15 of 20 7.2 Supervision prudential arrangements often pave the way to financial crime risk, making firms more vulnerable targets for criminals seeking to disguise proceeds of crime or to support the financing of terrorism. The MFSA therefore has an obligation to consider ML and FT risks in authorised firms as part of our supervisory work. Our risk-based approach to AML and CFT supervision, established with the FIAU, in principle reflects the risk-based approach adopted by the MFSA for prudential and conduct supervision across sectors. This is structured as follows: 7.2.1 Ongoing supervision of higher risk firms Consistent with our risk-based approach to prudential and conduct supervision, where a firm is identified as being associated with a higher level of ML and FT risk, it is included within the regime of ongoing supervision. As previously noted, the AML and CFT risk assessment of firms is carried out jointly with the FIAU and feeds into the risk assessment models operated by both institutions. This regime includes major firms with large customer bases, firms which are models or customer bases and firms where systems or control weaknesses relating to AML or CFT are identified. Ongoing supervision includes regular touchpoints with the firm (including regular supervisory interactions) as well as the regular provision by the firm of management and other relevant information. Where firms undertake remedial or corrective action plans to remedy identified AML and CFT deficiencies, ongoing supervision envisages the conduct of onsite inspections. 7.2.2 Sampled review of other firms In addition to ongoing supervision of high-risk firms, reviews of other firms are also carried out, to enable all parts of the financial services industry to be covered through the risk-based supervisory cycle. Firms are selected subject to a tailored review of the highest risk areas of their Diagram 5: Risk Assessment Onboarding of Applicants Business & Operational Models

Risk-Based Supervision Page 16 of 20 business model whereas other firms are selected on a randomised basis. Review of AML and CFT arrangements is a key part of our reviews and our members of staff are trained to identify indicators of AML and CFT weaknesses within broader corporate arrangements. 7.2.3 Thematic reviews of firms From time to time, thematic reviews are conducted across firms operating within a particular sector of the financial services industry, or in relation to a particular aspect of AML and CFT. Thematic reviews typically include onsite inspections of multiple firms and requests for data. Consistent with our principle of open communication, and in the interests of promoting a culture of best practice within the financial services industry, we, in conjunction with the FIAU, may make use of the results of thematic reviews to provide guidance to firms. 7.2.4 Event-driven reviews of firms Event-driven supervision consists of as-needed reviews of firms where specific control weaknesses have been identified or breaches have occurred. Event-driven reviews may be mandated where the aforementioned reviews have identified the need for further information • other regulatory or law enforcement bodies within the National Institutional Framework; • overseas regulators; • whistle-blowers; • self-reporting by firms; and • publicly available information. These reviews may result in a regulatory or law enforcement action against the firm concerned within the National Institutional Framework, and potentially a recommendation that enforcement action be taken against the firm or any individuals involved in the event. The above approach allows us to respond in an agile way to emerging ML and FT risks, and anticipate and counteract new methods, products and markets being employed by money launderers and funders of terrorism. 8. FUTURE ENHANCEMENTS 8.1 Risk Ranking Methodology As part of our continuous efforts to strengthen our supervisory approach and enhance the risk assessment process, the MFSA has, late last year, conducted a sectoral risk assessment whereby supervisory priorities. These vulnerabilities include susceptibility of the sector to:

Risk-Based Supervision Page 17 of 20 • money laundering and terrorism financing; • duty of care; • cyber risk; • effectiveness of governance and risk management practices; • adverse reputational impact from exposure outside Malta; and • criticality of services offered. The output from the sectoral risk assessment will act as a critical input to our wider risk -based supervision approach. The MFSA is also currently working to develop one holistic entity level risk ranking methodology that stratifies firms into a five-point scale to determine the level of risk associated with each firm. This model will allow the MFSA to score firms both upon their authorisation as well as on an on￾going basis in line with our supervisory work. This will allow further consistency across supervisory functions in the way of thinking about risk. The entity risk score will be determined on pre-defined key risk indicators that align with the vulnerabilities used for establishing the sectorial risk score and risk weightings that reflect the perceived importance of the risk indicators. The model to be developed will encompass data that is currently not being taken into consideration by the MFSA in its risk-based approach such as information on cyber security. These developments will provide the MFSA with a more consistent approach for, analysing the risk scores by comparing entities to peers, looking at specific sectors of the financial markets to manage emerging systemic risk across the wider economy and accordingly prioritise its resources. This translates into the adoption of a more consistent approach to supervision by the MFSA across sectors. 8.2 Supervisory Quality Assurance The MFSA recognises that any system for evaluating risk has potential weaknesses. We have adopted a system which requires supervisors to make judgements having evaluated appropriate quantitative and qualitative information. In order to mitigate the risk that a firm could be exposed to inappropriate judgements by a single supervisor, following an internal restructuring which took place early this year, the MFSA has created a new function which focuses on supervisory quality assurance. The main role of this function centres around the review of supervisory approaches in order to safeguard the consistency and quality of supervisory activities, while acting as a key contributor to the development of homogeneity across supervisory functions. From a quality assurance perspective, it ensures the proper use and continuous enhancement of the holistic supervisory framework and promotes supervisory standards in line with international best practices and the emerging risks and deficiencies in the internal supervisory processes and offering recommendations to address shortcomings.

Risk-Based Supervision Page 18 of 20 9. AGENT OF THE FIAU The MFSA holds a crucial role in mitigating the ML and FT risks emanating from the Maltese financial services industry. Subsequently, the FIAU has requested the MFSA to carry out, on its behalf, on-site and off-site examinations on subject persons falling under the competence of the MFSA, pursuant to Article 27 of the PMLA which requires the reciprocal assistance and cooperation between the FIAU and other supervisory authorities. Article 27(3) of the PMLA states that the FIAU may request a supervisory authority to do all or any of the following and the supervisory authority shall not unreasonably withhold its assistance to: • provide the FIAU with such information of which the supervisory authority may become aware of in the course of its supervisory functions and which indicates that a subject person falling under the competence of the supervisory authority may not be in compliance with any requirements under the PMLA and any other Regulations; • carry out, on behalf of the FIAU, on-site examinations on subject persons falling under compliance with the provisions of the PMLA and any Regulations thereunder and to report to the FIAU accordingly. In doing so, the MFSA is considered to be an agent of the FIAU. The role held by the MFSA goes beyond the integration of AML and CFT within our supervisory risk assessment process. To this effect, a joint AML and CFT supervisory regime was established between the MFSA and FIAU to better coordinate and integrate AML and CFT supervisory efforts. This includes: • the establishment of a joint AML and CFT supervisory team which consists of officials from the MFSA FCC and FIAU; • a joint risk assessment methodology; • coordinated application of supervisory resources and supervisory actions; • a common set of procedures and coordinated approach for identification of AML and CFT breaches. The AML and CFT supervisory plan is compiled by the FIAU and accordingly communicated to the MFSA. However, the FIAU does not automatically delegate all AML and CFT on-site inspections of subject persons licensed by the MFSA, to the latter. Consequently, some of these inspections are carried out directly by the FIAU. Once the inspections are concluded and findings have been issued to firms, there is also an enforcement process which is coordinated by the FIAU, in terms of its powers under the PMLA.

Risk-Based Supervision Page 19 of 20 This coordination and cooperation is set out in a Memorandum of Understanding, entered into between both Authorities in August 2018, which, among other things, establishes the basis of supervisory cooperation. Therefore, in parallel with the supervisory work triggered by our own supervisory risk assessment framework, we execute a focused AML and CFT supervisory programme that is CASPAR Risk Scoring System. The role played by our FCC Team is key for the execution of both supervisory programmes. 10. CONCLUDING REMARKS The Authority recognises that focusing its supervisory efforts on firms and/or areas which are deemed to pose the highest risk is crucial. The adoption of a risk-based approach to supervision provides the MFSA with a framework for assessing and addressing risks proactively. Indeed, adopting a risk-based approach to supervision has allowed us to: • adopt a consistent way of thinking about risk across all supervised financial services sectors; • allocate resources based on the areas of greatest risk; • undertake a sufficient level of engagement with all higher impact firms; • assess firm risks in a systematic and structured fashion; • ensure that action is taken to mitigate unacceptable risks in firms; • • use quality control mechanisms to encourage challenge and sharpen our supervisory approach; and • analyse better management information about the risk profiles of the firms and sectors we supervise. Whilst the aim of this document is to provide the user with an understanding of the risk-based approach to supervision adopted by the MFSA, it should be noted that the principles of a risk￾based approach are not confined to supervision but are also applied by the MFSA in the exercise of other core functions such as authorisation and enforcement.

Risk-Based Supervision Page 20 of 20 Malta Financial Services Authority Triq L-Imdina, Zone 1 Central Business District, Birkirkara, CBD 1010, Malta communications@mfsa.mt www.mfsa.mt