This Act amends the Malta Financial Services Authority Act, Chapter 330 of the Laws of Malta. It represents a comprehensive restructuring of the MFSA's governance, internal organs, powers, enforcement mechanisms, and data-processing framework.

Article 2 makes general textual amendments throughout the principal Act: Maltese-language references to 'Sezzjoni għar-Riżoluzzjoni' are replaced with 'Taqsima ta' Riżoluzzjoni' in all grammatical forms, and the gender-neutral term 'Chairperson/chairperson' replaces 'Chairman/chairman' wherever those words appear.

Article 3 amends the definitions in article 2 of the principal Act extensively. The 'Audit Committee' is renamed the 'Audit and Risk Committee' (now established by article 12A). New definitions are introduced for 'authorisation' (any form of approval other than a licence, including registration, recognition and notification), 'Capital Markets Decisions Committee' (new article 10B), 'Deputy Chief Executive Officer' (new article 7D), 'MTF' (Multilateral Trading Facility), 'OTF' (Organised Trading Facility), and 'Regulatory Decisions Committee' (new article 10A). The definitions of 'Chief Executive Officer', 'Directorate', 'Executive Committee', 'Enforcement Decisions Committee', 'financial services' (now explicitly including crypto-asset services), 'General Counsel', and 'institution' are all substituted.

Article 4 amends article 3 of the principal Act to strengthen the autonomy provision: the Authority, including its decision-making bodies, shall be autonomous, act objectively and independently, and shall not seek or take instructions from, nor be subject to interference by, any other authority, body or person.

Article 5 amends article 4 (functions): paragraph (a) is widened to cover financial services 'provided in or from Malta'; paragraph (gA) is broadened to include financial literacy; sub-article (2) is replaced with an updated list of collaboration partners including ESMA, EBA, EIOPA, ESRB, ECB, AMLA, and SRB, and extends cooperation to law enforcement, intelligence, prosecutorial and judicial authorities. New sub-articles (2a) and (2b) empower the Authority to establish a training academy and public-private partnership initiatives. Sub-article (3) is amended to allow the Authority to charge interest (up to the legal maximum) on overdue fees, with a power to waive fees/charges/interest subject to approval of the Regulatory Decisions Committee.

Article 6 substitutes article 4A to restate and expand the principle that a licence is a concession and revocable privilege; adds fit-and-proper suitability assessments before and after granting a licence; imposes due-diligence obligations on professional advisers acting for applicants or holders; and creates a criminal offence (fine up to €50,000) for knowingly submitting false or misleading information or concealing adverse information relevant to a fit-and-proper assessment. Sub-article (5) extends these provisions to all licences and authorisations under any law administered by the Authority.

Articles 7–13 and 14–18 restructure the Authority's organs. Article 5 of the principal Act (amended by article 7 of this Act) lists the main organs as: Board of Governors, Executive Committee, Regulatory Decisions Committee, Enforcement Decisions Committee, Capital Markets Decisions Committee, and Resolution Committee. Article 6 of the principal Act (amended by article 8) increases the number of independent Board members to six, mandates appointment of a Deputy Chairperson by the Board, requires vacancies to be filled within three months, and updates grounds for removal of members (now including disqualification by professional/regulatory body and being charged with a 'relevant offence' under the Proceeds of Crime Act, Cap. 621). Article 7A of the principal Act is deleted (article 10). Article 7B is substituted (article 11) to re-establish the Resolution Committee with structural independence from other MFSA functions. A new article 7D (added by article 13) provides for appointment and duties of the Chief Executive Officer and Deputy CEOs, including a minimum five-member Executive Committee.

New articles 10A and 10B (added by article 15) create respectively the Regulatory Decisions Committee (responsible for licensing, authorisations, supervisory monitoring, urgent/precautionary regulatory decisions, but expressly excluded from imposing penalties or revoking licences) and the Capital Markets Decisions Committee (responsible for admissions to listing, prospectus approval, covered bonds, market integrity, and market-abuse monitoring, but expressly excluded from withdrawing covered-bond approvals, removing instruments from trading, appointing a special administrator, or imposing penalties). Article 11 of the principal Act is replaced (article 16) with a detailed Enforcement Decisions Committee regime: the Committee acts impartially and independently, decides enforcement cases referred by the Enforcement Directorate, can cancel/suspend/modify licences, impose administrative penalties, freeze assets, remove listed instruments from trading, and approve settlement agreements; hearings follow natural justice rules with a balance-of-probabilities standard.

Article 17 substitutes article 12 of the principal Act to provide for a standalone Enforcement Directorate, responsible for investigating referrals, conducting administrative investigations, preparing enforcement recommendations, conducting proceedings before the Enforcement Decisions Committee, and representing the Authority before the Financial Services Tribunal and courts. Article 18 substitutes article 12A with an expanded 'Audit and Risk Committee' with two co-chairpersons, one additional Board-appointed member, and one external expert; it covers governance, controls, risk management, internal audit, and internal investigations.

Article 22 inserts new article 15A on settlement agreements: the Authority may, in its discretion, enter into written settlement agreements with licence/authorisation holders or persons subject to enforcement action, subject to numerous exclusions (unauthorised activity, serious/systematic AML breaches, ongoing criminal offences, public-interest grounds, fit-and-proper failures, lack of cooperation, a prior settlement within two years (with limited exceptions), repeat contraventions already subject to a prior settlement, or a final decision already issued). Settlement agreements must be approved by the Enforcement Decisions Committee, must include an acceptance of contraventions, agreed measures, reduced penalties and a waiver of appeal rights. Failure to comply forfeits all concessions, triggers the full unreduced penalty, and allows the Authority to sue in the Civil Court First Hall.

Article 23 fully substitutes article 16 of the principal Act with a consolidated 'Powers of the Authority' article. Key powers include: access to business premises and data (including outsourced data) at all times; duty on holders to keep records accessible; voiding of contractual gagging clauses that impede the Authority; duty on all regulated persons to assist and collaborate; power to issue written directives; power to appoint qualified persons, skilled persons, competent persons, administrators or inspectors (with public-procurement exemption for such appointments); asset-freezing orders including bank accounts; AML-triggered immediate regulatory action; administrative penalties up to €150,000 per breach; publication of enforcement decisions (with anonymisation available in defined exceptional circumstances approved by the Enforcement Decisions Committee); and a 15-day post-Tribunal-determination window before penalties become executive titles under the Code of Organization and Civil Procedure (Cap. 12).

Article 24 adds new articles 16B (obstruction offence, fine up to €50,000) and 16C (detailed data-protection framework: GDPR-compliant processing; secondary-purpose processing; data-retention policies; power to restrict GDPR Articles 12–22 and 34 rights where necessary for regulatory objectives, subject to proportionality assessment, DPO consultation, data-subject notification, and periodic review). Article 25 amends article 17 (disclosure and exchange of information): confidentiality obligations are extended to former officers; unauthorised disclosure becomes a criminal offence punishable by a fine up to €50,000 or imprisonment up to two years or both; cooperation partners are extended to include intelligence and prosecutorial authorities; a new requirement is introduced that requests for information must include a formal justification outlining purpose, relevance, necessity, and specificity.

Commencement: Article 1(2) provides that 'This Act shall come into force on such date or dates as the Minister responsible for the regulation of financial services may, by notice in the Gazette, establish and different dates may be established for different provisions and, or different purposes of this Act.' There is no fixed commencement date on the face of the Act.

Practical effects: Regulated entities and their professional advisers face new due-diligence and disclosure obligations with criminal liability for non-compliance. The MFSA's governance is overhauled with clearer separation between supervisory (Regulatory Decisions Committee), capital-markets (Capital Markets Decisions Committee), and enforcement (Enforcement Decisions Committee) functions. Enforcement procedures now include a formal settlement-agreement pathway with prescribed conditions and a balance-of-probabilities standard. Asset-freezing powers are consolidated and extended. Data-subject rights under the GDPR may be temporarily restricted by the MFSA in specified regulatory circumstances.

Malta Financial Services Authority (Amendment) Act (Act XV of 2026)