A. Scope and Approach

1. The purpose of this note is to present the mission’s assessment of banking supervision based on the discussions that took place during the 2018 FSAP mission in Malta. The analysis took into consideration the legal and regulatory framework in place, the supervisory practices employed, and other conditions as they existed in September 2018. This note uses the 2012 edition of the “Basel Core Principles for Effective Banking Supervision” (BCP) as the reference framework, but it does not contain a formal BCP assessment.

The mission focused on selected topics. They include key aspects of organization and resources of the supervisory authority (referring to Core Principles (CPs) 1 and 2) in relation to the supervision of LSIs, which are not directly supervised by the ECB, and non-EU branches, focusing in particular on (1) the supervisory approaches and tools (CPs 8 and 9); (2) the enforcement and sanctioning framework (CP 11); (3) banks’ governance and risk management (CPs 14 and 15); (4) the assessment of risks and capital adequacy (CPs 16, 17, 18, 22, and 23); (5) the transactions with related parties (CP 20); and (6) the analysis of liquidity risk (CP 24). The supervision of all banks’ AML/CFT policies was also included (as part of CP 29). Conversely, licensing (CP 4) was not included, as the ECB is the authority in charge of all banking authorizations in the EA, whether banks are large or small, and no new license has been granted in Malta since the establishment of the SSM of the eurozone.

3. The mission maintained its consistency with other FSAPs in the EA. The mission took account of the findings and recommendations formulated by the 2018 EA FSAP and coordinated closely with two other FSAP missions organized for France and Italy.

4. The IMF team wishes to thank the authorities and private sector participants for their excellent cooperation. The mission held extensive meetings with the Maltese officials and had access to high-quality documentation. The FSAP review team benefited greatly from the inputs received and exchanges of views during meetings with supervisors, banks’ representatives, and legal auditors.

B. Institutional Setting

5. Banking activities are regulated mainly under EU rules. The prudential framework for credit institutions in the EU is set out in EU regulation and EU legislation transposed into national laws, but a harmonized approach is currently lacking in some key risk areas, particularly major acquisitions and transactions with related parties.

6. With the introduction of the SSM of the eurozone in November 2014, the scope of intervention of the MFSA changed significantly. Under the first pillar of the European banking union, the SSM comprises the ECB and the National Competent Authorities (NCAs) of the participating countries (the member states of the eurozone).² Within the SSM framework, the ECB directly supervises 129 SIs. The other banks’ LSIs are supervised by the NCAs under the oversight of the ECB. National authorities continue to be responsible for AML/CFT in both SIs and LSIs, as the associated tasks have not been conferred to the ECB.

7. The MFSA is the supervisory authority for Malta’s financial system and NCA in charge of the banking sector within the SSM. The MFSA is tasked with supervising banks, insurers, and insurance intermediaries, collective investment schemes, and pension funds. Three Maltese banks are designated as SIs, the day-to-day offsite supervision is being conducted by the joint supervisory teams (JSTs) led by coordinators at the ECB.³ The MFSA has responsibility for the direct supervision of LSIs, comprising 18 banks, and of two non-EU branches. For the LSIs, the ECB receives mandatory reporting by the NCAs and ex ante notifications on certain supervisory actions, these being more granular for the HP LSIs.

8. The MFSA is an autonomous body constituted by the Malta Financial Services Authority Act (MFSA Act) and reports annually to parliament. In terms of governance, the MFSA is headed by a chairperson appointed by the prime minister and a Board of Governors, which sets policy and general direction. Beside the chairperson, the Board of Governors comprises eight members appointed by the prime minister, and a CEO designated by the Board. The chairperson’s and Board members’ terms of office shall not exceed five years. A Board member may be relieved of office by the prime minister on the grounds of inability to perform the functions, or of misbehavior. The appointment of Board members and their termination of office or resignation, including the reason from removal, are notified in the government gazette.

9. The MFSA’s supervisory council is responsible for the issuance of various authorizations for the monitoring and supervision of licensees and for taking actions. The council is composed of the director-general in charge of supervision and of each of the directors responsible, respectively, for authorization, banking supervision, conduct supervision, securities and markets supervision, insurance and pensions supervision, and regulatory development. Up until now, directors have been appointed by the chairperson. The grounds for removal/dismissal of directors are those applicable to any employee in terms of general employment law in Malta. Reasons for removal are not subject to public disclosure.

10. The MFSA has its own budget and is empowered to impose fees and levy charges. The authorities’ source of funding was recently changed. Separation of the Registry of Companies from the MFSA in April 2018 redirects the registry’s revenues—accounting for 58 percent of the MFSA’s funding source in 2017—to the government. The MFSA’s resources are provided by the government’s consolidated fund and fees payable in respect of its supervisory functions.

C. Market Structure

11. Malta’s financial system is large and heavily connected with the world. Together banks, insurance companies, and investment funds amounted to about 6½ times GDP in 2017, of which banks stood at 4⅓ times GDP. Nonresident deposits—an important funding source for banks—may be vulnerable to tax and legal changes abroad, as well as to reputational risk.

12. Maltese banks vary considerably in their business models. For analytical purposes, the authorities classify the banks into three categories:

• Core domestic banks are mainly exposed to the domestic economy. They attract household and corporate deposits and lend mostly domestically, accounting for all mortgages to residents. The three largest banks (Bank of Valletta, HSBC Bank Malta, and MeDirect) hold 87 percent of category assets (42 percent of total bank assets) and account for 80.5 percent of all mortgages.

• Noncore domestic banks are small, foreign-owned, primarily funded from wholesale markets and nonresident deposits and have some exposure to residents. Business models vary widely (syndication, factoring, trade finance, private banking, and conventional lending).

• International banks are foreign owned, with insignificant domestic exposures. They rely mostly on wholesale funding (including intragroup) and focus on activities for their group (custodian services, trade finance, investment banking). Two branches of Turkish banks account for 83 percent of this category’s assets (39 percent of total bank assets).

13. For supervisory purposes, the European SSM classifies banks into two groups. The three largest core domestic banks are classified as SIs. The remaining banks are classified as LSIs (18 banks, 16 percent of system assets), a branch and a subsidiary of other EA country banks (one parent entity is an LSI and one as a SI), and non-EU branches. On aggregate, HP LSIs are as large as the smallest SI, and their business models may encompass complex features. For some banks, asset size has increased rapidly. An adequate supervision of LSIs is therefore paramount.

Table 2.

Malta: Banking System Assets, at end -2017

Sources: Maltese authorities and IMF staff calculations.

^1/These banks are a branch and a subsidiary of banks of other EA countries and are classified under the home state of their respective group parent.

Table 2.

Malta: Banking System Assets, at end -2017

		Number of banks	Assets
			EUR, billion	Percent of GDP	Percent of system
Authorities’ classification
	Core domestic banks	6	23	203	48
	Non-core domestic banks	5	2	19	5
	International banks	14	23	202	47
ECB’s classification
	SIs	3	20	176	42
	LSIs	18	8	70	16
	Third-country branches	2	19	167	39
	Other 1/	2	1	12	3

Sources: Maltese authorities and IMF staff calculations.

^1/These banks are a branch and a subsidiary of banks of other EA countries and are classified under the home state of their respective group parent.

View Table

Table 2.

Malta: Banking System Assets, at end -2017

		Number of banks	Assets
			EUR, billion	Percent of GDP	Percent of system
Authorities’ classification
	Core domestic banks	6	23	203	48
	Non-core domestic banks	5	2	19	5
	International banks	14	23	202	47
ECB’s classification
	SIs	3	20	176	42
	LSIs	18	8	70	16
	Third-country branches	2	19	167	39
	Other 1/	2	1	12	3

Sources: Maltese authorities and IMF staff calculations.

^1/These banks are a branch and a subsidiary of banks of other EA countries and are classified under the home state of their respective group parent.

A. Progress Since the Previous FSAP

14. Major structural changes have taken place since 2003 and had a positive impact on the prudential regulation and supervision of banks. First, Malta became a member of the EU in May 2004, and both the transposition of the EU legislation into Maltese legislation and the implementation of EU regulation led to the alignment with high regulatory standards. Second, Malta adopted the euro as the national currency in 2008 and the Central Bank of Malta (CBM) became a member of the European System of Central Banks. Third, the establishment of the SSM in 2014, in which the MFSA participates as a NCA, significantly transformed banking supervision in the EA, enhancing the consistency of supervisory practices across the EA.

15. The Maltese authorities have undertaken significant action to implement the recommendations of the 2003 FSAP. Thanks to the authorities’ commitment, the national transposition and implementation of EU directives and regulations helped close several gaps identified in 2003, as noted by an independent assessment undertaken in 2011. Also, following this review, the definition of related parties has been broadened, the administrative penalties and measures have been set out in subsidiary legislation, and supervisory resources have increased in the recent period.

B. Organization, Powers, and Independence

16. The authority to exercise banking supervision is vested in the MFSA, according to the Banking Act and the MFSA Act. The MFSA is defined by the Banking Act as the “Competent Authority” in charge of ensuring that credit institutions carrying out activities in Malta comply with the Act (as well as with any regulations, directives, and banking rules made or issued thereunder), the EU Capital Requirements Regulations (CRR), and the conditions of their respective licenses. The MFSA was established by the MFSA Act, which provides that the power of the competent person to monitor and supervise license holders is vested in the MFSA’s supervisory council.

Organization

17. The MFSA’s internal organization reflects its role of an integrated supervisor, and several units are involved in supervision and/or enforcement.

• The Banking Supervision Unit (BSU) is responsible for the supervision of credit and financial institutions;

• the Conduct Supervision Unit is responsible for securing appropriate consumer protection in financial services;

• the Insurance and Pensions Supervision Unit is in charge of the supervision of insurance companies, insurance intermediaries, retirement schemes, retirement funds, and retirement service providers;

• the Securities and Markets Supervision Unit is tasked with the supervision of investment services companies, collective investment schemes, fund management, and related fund services operations;

• the Regulatory Development Unit (RDU) monitors systemic risk across all areas of financial services;

• the Authorization Unit manages and coordinates the processing of applications for authorization under the various sectorial legislation; and

• the Enforcement Unit is responsible for (1) AML supervision; and (2) reviewing the actions and, where necessary, conducting investigations of license holders who have, or are suspected of having, committed serious compliance failures, serious misconduct, market abuse, breach of listing rules, or any other serious breaches of the law.

18. The MFSA has undergone various organizational changes in recent years. This includes setting up the Enforcement Unit in 2012, and the separation between the supervision of conduct of business and prudential supervision in 2015. Following the introduction of the SSM in the EA, the BSU has gone through a restructuring. Concerning SIs, whereas until the early part of 2016, each analyst in the offsite function was responsible for two to three banks, the function was restructured so that analysts would be responsible for two to three risk areas. Each analyst reports to a sub-coordinator working for the MFSA and to a coordinator at the ECB, who are in a position to form a bank-wide view. Concerning LSIs, the ongoing (offsite) supervision is placed under the responsibility of a deputy director, as depicted in the organizational chart below. A similar setup, with analysts in charge of risk areas, was applied in 2017 for the assessment of one of the HP LSIs and is being applied in 2018 on the remaining HP LSIs. Onsite examiners of LSIs report to another deputy director, while a team in charge of policy issues and the supervision of nonbanks is placed under the responsibility of a third deputy director.

19. A new organizational structure of the MFSA has been proposed recently (see organization chart). The reorganization, which has not yet been implemented, has several positive aspects. Bringing the AML/CFT team under the umbrella of supervision will facilitate information sharing with the BSU. Developing resources devoted to enforcement will enable the unit to spend less time on the preparation of the sanctions and more time on ongoing supervisory monitoring. Involving the head of enforcement and the General Counsel in the decision-making process is positive. However, as already mentioned, the reorganization project, which requires a modification of the MFSA Act, raises some concerns (see paragraph 22).

View Full Size

Malta: MFSA Organization

Citation: IMF Staff Country Reports 2019, 347; 10.5089/9781513520841.002.A001

Source: MFSA.^1/ The CEO, the Chief Officers, and the General Counsel will be members of the Executive Committee.

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Source: MFSA.

• Download Figure
• Download figure as PowerPoint slide

Powers and Independence

20. Banking activities are governed by several key pieces of legislation and regulation. These basically include EU legislation, notably, the fourth Capital Requirements Directive (CRD IV) and the CRR, the Banking Act and Subsidiary Legislation under this Act, and the banking rules. ⁴ Issued by the MFSA, the banking rules are binding measures having the force of law and are applicable to regulated credit institutions. Over the past years, extensive amendments have been made to the banking rules to implement the European directives and guidelines issued by the European Banking Authority (EBA). Overall, prudential standards have been enhanced significantly.

21. The MFSA has at its disposal a broad range of legal powers, but this assessment also highlights a number of gaps. The MFSA has a broad range of legal powers to address situations where banks do not comply with regulations. Apart from the withdrawal or restriction of license, supervisory measures may include fines and penalties, directives to comply with particular instructions or to desist from a particular activity, and the removal of managers (as further detailed in Section J).⁵ The MFSA also has the power to require a credit institution to take the necessary measures at an early stage to address problems in cases where either the credit institution does not meet the requirements or the authorities have evidence that the credit institution is likely to breach a regulation. However, some legal powers are not included in the MFSA’s toolkit.

• The MFSA does not have the authority to force a bank or a banking group to change its organizational structure. While the MFSA is authorized to require any person who directly or indirectly possesses qualifying shareholding in the credit institution to divest himself of all or part of that holding in accordance with Article 9(3)(b) of the Banking Act, it is unclear how the MFSA could impose or facilitate a merger or a purchase of a credit institution. As specified by Article 17E of the Banking Act, the MFSA has the power to require a credit institution to take measures at an early stage to address problems. Article 17E states that the powers shall include those as specified in Regulation 9 of the Banking Act (Supervisory Review) Regulations (Subsidiary Legislation 371.16), which does not include the power to change the organization or impose a merger. The authorities have argued that it does not necessarily mean that these are the only powers vested in the MFSA. This is not entirely convincing, as the regulations and banking rules are quite detailed in Malta. The fact remains that neither the law nor the regulation explicitly empowers the MFSA to impose the measures mentioned earlier.

• Banks are not specifically required to communicate to the MFSA any substantive changes or materially adverse developments. That said, in the corporate questionnaire submitted by an applicant as part of the authorization process, it is specified that banks have to notify the MFSA in such instances. This, however, does not replace an explicit provision included in the law or regulation.

• The MFSA does not have the power to review the activities of companies affiliated with a bank’s parent company to determine their impact on the bank’s safety and soundness.⁶

• Banks are not required to notify the MFSA as soon as they become aware of any material information that may negatively affect the suitability, fitness, and propriety of a significant shareholder or party that has controlling interest.

• Concerning major acquisitions, a credit institution cannot, without the consent of the MFSA, acquire or hold shares in another company, which is not a credit institution, when the share exceeds 5 percent of that company's issued share capital (Art. 15.1(d) of the Banking Act). Also, unless there is written consent from the MFSA, no credit institution is allowed to open a new branch, agency, or representative office, or set up or acquire any subsidiary in any place outside Malta (Art. 11(2) of the BA). However, when a credit institution licensed in Malta wants to acquire a minority stake in the capital of a bank located abroad, no authorization or prior notification is specified in the legislation or the regulation. More broadly, there is no applicable regime governing major investment. Moreover, there is no available internal procedure or criteria for assessment of major acquisitions by credit institutions, including whether the acquisitions may expose the credit institution to undue risks or hinder effective supervision.

22. The MFSA, largely, has the supervisory authority to carry out its tasks, but aspects of operational independence are of concern. The necessary preconditions for operational independence are not fully met.

• The need to annually negotiate for governmental and parliamentary approvals of the budget introduces a degree of uncertainty, especially in a context where expenditures will have to increase to support the expansion of staff resources, as currently envisaged by the MFSA. International standards require budgetary processes that do not undermine autonomy and adequacy of resources. Until recently, the budget was funded solely from the MFSA’s own resources, that is, supervisory fees and revenues from the Registry of Companies. This is no longer the case since the separation of the registry from the MFSA, which resulted from the latest revision of the MFSA Act in 2018. Supervisory fees only covered 40 percent of the MFSA’s total expenses (in 2017) and, to allow the MFSA to carry out its functions going forward, the funding shortfall will be paid out of the Maltese government’s consolidated fund. The MFSA budget for 2019 has been endorsed by the government and remains to be approved by the Parliament. The MFSA has also prepared a multiyear forecast (2019–2021), which shows a significant increase of expenditures, requiring higher government contributions. The MFSA has explained that these projections have been approved verbally by the MFIN, but no written document materializing this commitment has been shared with the mission

• The MFSA does not have full autonomy over the recruitment process. In accordance with a Maltese directive (Directive 7), which applies to “all public administration organizations which are not government departments and which have a distinct legal personality,” (1) projected budgets to be allocated for human resources have to be approved on a yearly basis by the MFIN; (2) the remuneration package (salary scale, etc.) has to be endorsed by the Industrial Relations Unit (part of public administration); and, on top of that, (3) all the recruitments have to be approved on a case-by-case basis by of the PSFSDEI.⁷ The mission became aware of instances where the recruitment process was affected by external influence. It is worth mentioning that this directive is not applicable to several entities (CBM, Malta Stock Exchange, University of Malta, etc.), but the MFSA has not been excluded from the scope of application of this directive.

Table 3.

Malta: Budget and Financial Projections for the MFSA, 2016–2021

(in thousands of euros)

Source: MFSA.

^1/Until 2017, revenues were higher than expenses, and the MFSA passed on the balance to the consolidated fund.

^2/The revenues in 2018 include fees (full year) and revenues from the ROC (perceived until May 2018).

Table 3.

Malta: Budget and Financial Projections for the MFSA, 2016–2021

(in thousands of euros)

	2016	2017	2018	2019	2020	2021
MFSA Revenues	23,038	25,053	16,108(1,2/)	12,331	13,448	14,625
Government	-	-	4,869	12,915	14,698	16,311
Subventions
Expenditures	(15,183)	(17,615)	(20,996)	(25,247)	(28,186)	(30,937)
of which HR	(9,445)	(10,831)	(11,603)	(13,730)	(15,370)	(16,840)

Source: MFSA.

^1/Until 2017, revenues were higher than expenses, and the MFSA passed on the balance to the consolidated fund.

^2/The revenues in 2018 include fees (full year) and revenues from the ROC (perceived until May 2018).

View Table

Table 3.

Malta: Budget and Financial Projections for the MFSA, 2016–2021

(in thousands of euros)

	2016	2017	2018	2019	2020	2021
MFSA Revenues	23,038	25,053	16,108(1,2/)	12,331	13,448	14,625
Government	-	-	4,869	12,915	14,698	16,311
Subventions
Expenditures	(15,183)	(17,615)	(20,996)	(25,247)	(28,186)	(30,937)
of which HR	(9,445)	(10,831)	(11,603)	(13,730)	(15,370)	(16,840)

Source: MFSA.

^1/Until 2017, revenues were higher than expenses, and the MFSA passed on the balance to the consolidated fund.

^2/The revenues in 2018 include fees (full year) and revenues from the ROC (perceived until May 2018).

23. Elements of a proposed reorganization of the MFSA raises concern, as all supervisory powers would be transferred to the MFSA’s executive committee in charge of the day-to-day management of the Authority. ⁸ This proposal requires amendments to the MFSA Act and has already been sent to the parliament. The executive committee would be headed by the CEO and comprise the general counsel and several chief officers in charge of, respectively, (1) supervision; (2) strategy, policy, and innovation; (3) enforcement; and (4) operations, including human resources. While involving the general counsel and the head of the Enforcement Unit in the supervisory process is welcome (currently neither participate in the meetings of the supervisory council), other aspects of the reform are of concern.

• The executive committee would include members who do not have any supervisory experience. Conversely, the directors of the supervisory units (including the director of the BSU, who is a member of the SSM Supervisory Board) would no longer participate in the decision-making process.

• More important, decisions on supervisory measures and sanctions require an in-depth assessment and, potentially, lengthy meetings to weigh the pros and cons. In that regard, creating a decision-making body in charge of all aspects (managerial, operational, human resources, etc.) might not be the best way to achieve this objective and ensure that enough attention, time, and resources at the highest level are devoted to supervisory measures on individual credit institutions.

• Last, but no less important, apart from the CEO, the executive committee would be solely composed of chief officers who would report to the same person (the CEO) and could be removed, leading de facto to high concentration of power in a single individual. As is the case with the existing supervisory council, there would not be any external member who might be able to bring an independent view (this is already the case with the existing structure). Further, no ex post report on the activities of the executive committee would be sent to the MFSA Board of Governors, as is the case today.

• That said, the current situation is far from ideal. Checks and balances, and guarantees of independence in the decision-making process, require enhancement, which the proposed new organization is unlikely to achieve. Issues to address include: (1) there is no legal provision in the MFSA Act conferring operational independence upon the supervisory council, which plays a key role; and (2) there are no predetermined criteria outlining the conditions under which the council’s members can be removed. The MFSA has explained that in such instances, the MFSA Staff Handbook would be used as a reference. However, members of a committee in charge of making supervisory decisions should not be treated like any other staff member; (3) there is no explicit provision in the legislation for the members of the Board or of the supervisory council not to take or seek instructions from the government or other state authorities; and (4) while the reasons behind removal of MFSA Board members is notified in the government gazette, this procedure is not applicable to council members.⁹

24. The cooling-off period for staff leaving the MFSA for the private sector is short and is rarely implemented. Staff from the supervisory units who are resigning or terminating their employment for any reason (including dismissal) shall not work for any entity that is licensed and regulated by the MFSA for an aggregate period of six months after they demit office. Further, for staff employed prior to October 2005 (that is, the most experienced people, who may belong to senior staff), the cooling-off period is reduced to two months after they demit office. Additionally, the cooling-off period is not applicable when staff members including employees holding very senior positions join entities or firms that are not regulated by the MFSA, such as professional associations, audit firms, or consultancy firms. This happened in practice. According to the MFSA’s Ethics Framework (Article 9.9), “members should avoid creating conflict of interest in any activities they may undertake following the termination of their employment.” However, no mechanism is in place (for example, preliminary examination by an ethics committee) to ensure that this provision is rigorously enforced.

C. Supervisory Resources

25. Resourcing of the banking supervisory function is currently insufficient despite recent progress. While the resources available to bank supervision have increased since 2003, they have not kept pace with the increased demands on supervision from EU directives, the Basel Committee, the EBA, and other international bodies, and higher expectations of supervisors. An independent report highlighted in 2017 that: (1) the integration into the SSM has led to a relative reduction of resources available for the supervision of LSIs; and (2) the Enforcement Unit required additional staff.¹¹ Regarding SIs, concerns about the adequacy of staffing were expressed by the chairperson of the SSM Supervisory Board in 2015. Corrective measures have been taken by the MFSA, and fulltime employees (FTEs) devoted to banking supervision have significantly increased since 2015, as illustrated in the following table. However, resources are still insufficient for the nature and range of tasks the MFSA must carry out for effective banking supervision. The lack of resources is evidenced by the difficulties with planning and execution of supervision actions for LSIs (inspections postponed, most of the recovery plans and ICAAP documents need to be reviewed, and it has been difficult to maintain regular contacts will all LSIs). Resources are also inadequate to achieve an acceptable frequency of supervisory inspections at LSIs. It is worth noting that the MFSA intends to increase the BSU’s staff by 20 people over the next three years, which is a positive sign. However, there are no assurances that the proposed increase in headcount has been adequately calibrated, or that the MFSA will be able to recruit the required profile.

26. Resources needed for banking supervision have been roughly estimated. The MFSA has not yet carried out a mapping of the skills that are needed in its supervisory process, nor does it conduct annual planning exercises to assess the impact of supervisory priorities on staffing and capacity-building needs. Such a gap analysis (current resources compared to tasks and skills that are needed) remains to be conducted.

Table 4.

Malta: FTEs Available for the Banking Supervision Unit (BSU), 2015–2017

Source: MFSA (FTEs approved).

Table 4.

Malta: FTEs Available for the Banking Supervision Unit (BSU), 2015–2017

	2015	2016	2017
Financial institutions	3	4	5
Ongoing	9	12	13
JSTs	6	10	9
Onsite	10	9	8
Other	6	7	10
Total	34	42	45

Source: MFSA (FTEs approved).

View Table

Table 4.

Malta: FTEs Available for the Banking Supervision Unit (BSU), 2015–2017

	2015	2016	2017
Financial institutions	3	4	5
Ongoing	9	12	13
JSTs	6	10	9
Onsite	10	9	8
Other	6	7	10
Total	34	42	45

Source: MFSA (FTEs approved).

27. Recruitment is challenging. In a small labor market characterized by a shortage of people with specific skills (for example, IT specialists, experts in risk management, statisticians), the MFSA is in strong competition with the banking industry. The compensation structure used within the MFSA is independent and different from public servant’s salary and CBM salary scales and was originally devised to be competitive with the private sector. An external audit of the MFSA’s human resources systems and practices, carried out by ThinkTalent in 2017, highlighted that salaries and compensation at entry level (for junior staff) compare favorably with the banking industry. However, for management functions (senior analyst to director), remuneration scales are slightly below or even significantly below industry benchmarks. Also, the report indicated that the MFSA’s recruitment process is excessively rigid, bureaucratic, and too lengthy. As a result, the MFSA has encountered difficulties in attracting, and also in retaining, qualified staff. It is worth noting that the turnover rate increased over the past years and stood at 10.5 percent in 2017, which remains an issue considering the MFSA’s willingness to increase its staffing resources. A high turnover necessarily results in a need for high levels of new hires.

28. A new Human Resources Strategy has been formalized by the MFSA. Positive changes have occurred in practice: the recruitment process has been streamlined; the salary scale adjusted upward (by 5 percent in the best case); a variable remuneration scheme has been put in place; and the MFSA works closely with recruitment agencies, which was not the case until recently. The recent enhancements are steps in the right direction, although some time is needed to yield results, and additional measures may need to be taken to achieve the desired goal (for example, the gap analysis mentioned in paragraph 26). Going forward, it will be necessary to assess the impact of these measures on a regular basis and ensure that the employee value proposition is attractive enough and effectively addresses the difficulty in recruiting and retaining employees with appropriate experience and skills sets for particular positions.

D. Supervisory Approach

E. Capital Adequacy

41. Prescribed capital requirements are subject to maximum harmonization in the EU. The CRR establishes the calculation of prescribed capital requirements, including thresholds by reference to which a bank might be subject to supervisory action, and which banks are required to satisfy at all times.²⁰ CRD IV gives EU member states some discretion on the application of macroprudential buffers and other measures to address systemic or macroprudential risks, as set out in the CRR and CRD IV, for which each member state determines a designated authority. In Malta, the CBM is the macroprudential authority with the hard power to formulate and implement macroprudential policy. A Joint Financial Stability Board (JFSB) has been established to ensure effective cooperation among relevant authorities for financial stability, comprising five voting members: the CBM governor (the chairperson), the two CBM deputy governors, and the MFSA’s chairperson and CEO.

42. Malta’s macroprudential policy toolkit contains all the instruments provided for in the EU CRR/CRD IV. The authorities have been phasing in several measures, including the additional capital buffers for the three banks identified as other systemically important institutions. The countercyclical capital buffer framework is also implemented, while the buffer rate has been set at 0 percent, given low and negative levels of the credit-to-GDP gap.

43. The total amount of Common Equity Tier 1 (CET1) capital that banks are expected to hold is determined by the SREP. Taking into consideration each bank’s risk profile and other elements of the SREP assessment, the capital decision takes the form of a Pillar 2 capital add-on on top of the Pillar 1 requirements. The Pillar 2 add-on is composed of a Pillar 2 requirement (P2R), which is a biding requirement, and a Pillar 2 guidance (P2G). Banks are expected to meet the P2G, which is set above the level of binding capital (minimum and additional) requirements and on top of the combined buffers. If a bank will not meet its P2G, this will not result in automatic action of the MFSA nor will this be used to determine the maximum distributable amount (MDA) trigger for dividends. However, this will be used in fine-tuning measures based on the bank’s individual situation. Concerning the LSIs, SREP decisions are taken by NCAs and the ECB is informed.

View Full Size

• Download Figure
• Download figure as PowerPoint slide

44. In this context, the MFSA has started to implement the SSM SREP methodology for LSIs. P2R and P2G are assigned on the basis of the SREP score and the results of supervisory stress tests (respectively). Initially, the MFSA planned to carry out a full SREP assessment on all HP LSIs by the end of 2018, and a SREP on the remaining LSIs by end-2020. Following that, the standard assessment frequency will be followed (that is, annual for HP LSIs, once every two years for mediumpriority LSIs, and once every three years for low-priority LSIs). The LSIs SSM methodology relies on four key elements: (1) business model and profitability assessment; (2) internal governance and risk management assessment; (3) risk-by-risk assessment of risks to capital; and (4) risk-by-risk assessment of risks to liquidity and funding.

45. At the time of the FSAP mission, a full SREP had been completed for one of the three HP LSIs. At this stage, the MFSA is slightly behind schedule, as the exercise is likely to be finalized in Q1 2019 for the three HP LSIs. More resources will therefore be needed in order to avoid deviating substantially from the initial internally defined plan (detailed in the Table 5) and to start the SREP process for non-HP LSIs. However, it is worth noting that the MFSA has adopted a conservative stance with respect to both P2R and P2G, assigning additional P2R, well above the SSM average in view of the nature of the business model of the one HP LSI for which it has completed the SREP. With respect to P2G, the MFSA applies a 1 percent floor. Also, materials shared with the FSAP mission team revealed that thorough analyses and in-depth assessment of this bank have been performed by the BSU, which relies on a skilled team with a diverse background. The team has also benefited from strong support from the ECB. The presentation to the bank clearly highlights the main supervisory concerns and the findings. The first result of the LSI SREP process therefore looks promising. Going forward, one of the main challenges will be to replicate the same exercise every year while spending less than six to eight months to complete the process.²¹

Table 5.

Malta: Implementation of SREP: Tentative Calendar

Source: MFSA.

Table 5.

Malta: Implementation of SREP: Tentative Calendar

Bank
HP LSI 1	Done
HP LSI 2	Initial estimated SREP completion Q3 2018
HP LSI 3	Initial estimated SREP completion Q3 2018

Source: MFSA.

View Table

Table 5.

Malta: Implementation of SREP: Tentative Calendar

Bank
HP LSI 1	Done
HP LSI 2	Initial estimated SREP completion Q3 2018
HP LSI 3	Initial estimated SREP completion Q3 2018

Source: MFSA.

46. The BSU has started to provide feedback to LSIs about the quality of their submitted ICAAP documents. A first detailed and substantiated letter has been sent to one HP LSI (as part of the SREP). Of course, a lot remains to be done to provide feedback to all LSIs, keeping in mind that the quality of ICAAP submissions differ widely from one bank to another.

F. The Supervision of Credit Risk and Problem Assets

47. The MFSA’s regulation on credit risk is detailed and comprehensive. The definitions of NPLs and forbearance measures are aligned with the applicable EU legal texts (CRR and EBA ITS), which the Maltese Banking Rule BR/09 directly refers to. The BR/09 provides for a detailed framework governing credit risk management.

48. Credit risk is assessed extensively as part of the SREP. Credit risk is the main source of risk for HP LSIs, and the score assigned to credit risk appears to be the main driver of the Pillar 2 capital requirement. In assessing credit risk, the BSU relies on the methodologies laid down in the SSM SREP manual for LSIs. Additionally, an MFSA internal credit risk methodology has been developed, providing further details and guidance on how to conduct the assessment. A number of ad hoc questions and data requests are made to a bank to inform the discussions during meetings held with the bank’s senior management. When deemed necessary, the BSU may also request granular information concerning the loans and collateral. Materials shared with the FSAP mission team confirm the thoroughness of the analyses undertaken as part of the first SREP carried out for an LSI.

49. Onsite examinations of credit risk have rarely been carried out since 2013. The ongoing assessment is to be complemented by onsite inspections. It is noted that:

• The MFSA has explained that “examiners assess the ongoing adequacy of banks’ policies, practices, and procedures through regular onsite examinations of credit risks. In addition to evaluating policies and procedures as indicated earlier, the examiners select a sample of credits, including all internally classified credits and any other subjectively chosen credits. Thereafter, they evaluate the underwriting standards, management oversight, and internal classification of the credit. In doing so for the selected set of credits, they draw conclusions about the nature of a bank’s credit risk exposures and of credit administration processes.” When conducting onsite inspections, examiners are to follow the procedures, the inspection’s objectives, and the inspection checks laid down in Chapter 6 of the SSM Manual, which covers the credit risk life cycle (granting, monitoring, risk classification, provisioning processes, etc.).

• In practice, based on the onsite reports shared with the FSAP mission team, it appears that since 2013 only one targeted onsite inspection—which included a comprehensive assessment of credit risk through the review of a sample of credit files and a thorough analysis of credit risk management policies and practices—has been conducted (one credit file review was performed by onsite examiners in 2016 during a mission led by the ECB). It could be argued that credit risk management can also be assessed as part of full scope inspections. However, such inspections do not provide enough time for the examiners to review files with a view to challenging the risk classification and the level of provisioning and verifying that adequate management information systems are in place. The review of a limited sample of loans, which were carried out in several instances, identified issues with the quality of document, but did not lead to any adjustments in the classification and the level of provisioning.

• As already mentioned, although supervisory priorities for 2016 referred to onsite visits to assess the NPL situation and verify adherence to the relevant EBA ITS on forbearance and NPE, such visits were not conducted.

• The MFSA is not legally empowered to require a change in the risk classification and/or additional provisions when it is considered appropriate.

50. High levels of NPLs are a source of concern for several banks that have been instructed to prepare a “multi-year NPL reduction plan.” Banking Rule BR/09 “on measures addressing credit risk arising from the assessment of the quality of asset portfolios of credit institutions” was amended in December 2016 to introduce the concept of NPL-reduction plans, and credit institutions are bound by an obligation to maintain a NPL ratio below 6 percent at any point in time. Credit institutions—whose two-year average NPL ratio exceeded the 6 percent threshold at the time when the new rule was published—were required to submit to the MFSA a multiyear NPL reduction plan targeting the decrease in these exposures. The MFSA has explained that unjustified deviations from any phase of the reduction plan, following review by the BSU, would led the Authority to require banks to reinforce their resiliency through the accumulation of an additional capital reserve (reserve for excessive NPLs). Seven banks were required to draw up a multiyear NPL reduction plan. Requiring banks to develop a strategy designed to facilitate NPL resolution was an appropriate decision and, overall, NPLs have declined significantly (from a sector average of more than 5 percent in December 2014 to 3 percent at end-2017). That said, at the time of the FSAP, it was noted that:

• One bank did not submit a plan to the MFSA, arguing that actions had already been taken. After an initial drop in 2017, this bank’s NPLs have started to increase substantially again (reaching 9.6 percent at end-December 2017), and the decision to allow the bank not to submit a plan probably needs to be reconsidered. In September 2018, no final decision had yet been taken by the BSU and the RDU as to whether a NPL reduction plan would be requested.

• For one bank, although the share of NPLs is high and fluctuating (40.2 percent in September 2017, 4.7 percent in December 2017), a NPL reduction plan was not requested by the MFSA on the assumption that the data were not accurate. This would have deserved to be supported by tangible evidence obtained from, for instance, a short onsite visit.

• For another bank, while the NPL reduction plan was not approved, the MFSA did not request the bank to calculate a reserve for excessive NPLs (as per paragraph 54 of the BR/09), despite high NPLs (above 16 percent of exposures).

• More broadly, the impact of the plans on NPLs level is only assessed by banks and by the MFSA on a yearly basis, a frequency that is probably too low to allow for a proactive intervention. Based on prudential reports, the BSU produces quarterly key risk indicators, which include the evolution of NPLs. However, these indicators cannot be used by the BSU to check compliance with the NPL reduction plans, because NPLs are calculated for the whole credit portfolio (including the new production of loans) while the nonperforming share of the static portfolio subject to the plan is only available at year-end (only a deviation of the NPLs for the static portfolio would provide grounds for action). At some point, onsite inspections (or thematic reviews) focused on the implementation of these plans, coupled with credit file reviews to identify misclassification and under-provisioning, could have been—but were not—used to better assess the effectiveness of these plans.

• A memo summarizing the main conclusions resulting from the reviews of these plans was not formalized and sent to the supervisory council.

51. A Reserve for General Banking Risks was established by the BR/09. This reserve is equal to 2.5 percent of the regulatory allocation, which is defined as the difference between a credit institution’s level of NPLs less the specific reserves calculated under the accounting rules (that is, the uncovered portion of NPLs). The MFSA considers the allocation of funds as a capital buffer via this methodology as a Pillar 2 measure. The appropriation to the Reserve for General Banking Risks shall be affected from the profits for the year. Where a credit institution has total CET 1, which exceeds a threshold determined by the authority, only half (50 percent) of the appropriation has to be allocated to the Reserve for General Banking Risks from the profits for the year. Further clarity is needed, as (1) the threshold has not been defined by the MFSA; and (2) it is unclear how the calculation of this reserve ties with the general rules specifying the calibration of the Pillar 2 surcharge.

52. The introduction of IFRS 9 raises new challenges. Following the implementation of IFRS 9 in January 2018, the measurement of accounting reserves shifted from an incurred losses model to an expected credit losses (ECL) approach. ²² At the time of the FSAP mission, the impact of the new approach on CET1 had not been measured. Going forward, the MFSA should develop technical capabilities and collaboration with external legal auditors to be able to assess the methods employed by credit institutions to calculate expected credit losses (ECL) and to ensure that loan-loss allowances are adequately calibrated.

53. Concerning credit risk arising from mortgages and construction loans, further analyses are required.²³

• Since 2016, the RDU has, jointly with the CBM, undertaken a granular data-gathering exercise to better assess potential risks to the financial system arising from banks’ exposures secured by real estate collateral. The objectives of the quarterly survey are (1) to assess banks’ lending practices in relation to real-estate exposures; and (2) to provide authorities with more granular information on the credit provided to different categories of borrowers. The survey covers a sample of new loans granted during the quarter under review, enabling analysis of key ratios such as the loan-to-value, loan-to-income, and debt service-to-income ratios, and of the maturity of loan facilities. The FSAP mission team had the opportunity to review the Excel spreadsheet, which details the characteristics of the newly originated mortgage loans. This spreadsheet, which provides extremely useful information, reveals that several banks are granting mortgages with a long maturity (up to 40 years) and “balloon repayment” features.²⁴ It is therefore unfortunate that (1) this spreadsheet has not been shared internally with the BSU at the time of the FSAP mission; and (2) it has not yet led to further analyses to assess the accuracy of the information and to confirm whether these mortgage loans are representative or not from the whole population of new loans. During the meetings with the industry, the banks’ representative highlighted that a sharp decrease of real estate prices would not trigger an increase in the default rates when borrowers are buying their primary residences. However, concerning buy-to-let mortgages, the borrowers’ repayment capacity would be clearly affected by a decrease of real estate prices and rental payments.

• With respect to construction loans granted to real estate developers who repay the loans by selling the properties upon completion of the construction projects, a decrease in real estate prices would obviously affect adversely the borrowers’ ability to repay the loans. During the meetings with the banks, it was emphasized that some developers have limited experience with managing construction costs and may not have enough equity to cope with lower selling prices. Further, it was mentioned that lending standards differ substantially from one bank to another (loose covenants and limited security packages could be an issue for some lenders). The lack of professional appraisers in Malta was also emphasized (valuations are performed by architects, who may be subject to conflicts of interest). Due to the length of court proceedings and the difficulty to realize collateral securing the loans, Maltese banks are still struggling to recover loans extended to developers who defaulted in 2008–2009 after a somewhat limited correction of house prices. Assessing the repayment capacity of the borrowers and the credit underwriting standards is therefore paramount in a context where real estate valuations are high and price reversal cannot be ruled out. In that respect, it is noted that few credit file reviews have been conducted by the MFSA. Similarly, no review of collateral valuation processes and asset recovery functions has been carried out.

G. Related Parties

54. There is no harmonized approach at the EU level for exposures to related parties. Definitions of the term “related parties” and restrictions for credits to related parties can be found in the national legislation of some EU member states, Malta being one of them.

55. The definition of related parties has been amended and expanded to address the recommendations made during the previous FSAP. Article 15(1)(b) of the BA provides restrictions on loans to directors and “anybody of persons in which the bank or any one or more of its directors jointly or severally maintains control” (all transactions must be done on an arm’s-length basis and transactions engaged by a bank with its directors cannot exceed on aggregate EUR 23 million, regardless of the size of the bank). Moreover, a banking rule adopted in 2011 (BR/11) to address one recommendation made by the team that performed the independent assessment in 2011 states that credit institutions shall apply the arm’s-length principle to: qualified and significant shareholders, auditors, or their respective spouses, whether jointly or severally, and to any commercial partnership in which such persons may have control; and officers and employees of the credit institution.

56. Despite improvements, the related-parties framework still exhibits significant gaps with the BCPs (CP 20):

• Limited scope of related parties. Entities having the same parent company as the credit institution and belonging to the same group (that is, sister companies) are not considered related parties. ²⁵

• Insufficient scope of transactions. Transactions with related parties solely include credit facilities and other “bank services,” but do not include all claims and dealings, such as service contracts, asset purchases and sales, construction contracts, lease agreements, etc. The term “transaction” is not interpreted broadly enough to incorporate not only transactions that are entered into with related parties, but also situations in which an unrelated party (with whom a bank has an existing exposure) subsequently becomes a related party.

• Lack of bank Boards’ involvement. The regulation in Malta does not require the prior approval of banks’ Boards before entering into transactions with related parties, writing off of related-party exposures exceeding specified amounts, or which otherwise pose special risks. Further, the regulation does not specify that Board members with conflicts of interest be excluded from the approval process of granting and managing related-party transactions. Last, the regulation does not state that (1) senior management monitors related-party transactions on an ongoing basis; (2) the Board provides oversight of these transactions; and (3) exceptions to policies, processes, and limits are reported to the appropriate level of a bank’s senior management and, if necessary, to the Board, for timely action.

• Insufficient policies and processes. The regulation does not state that banks shall have policies and processes to identify individual exposures to and transactions with related parties, as well as the total amount of exposures, and to monitor and report on them through an independent credit review or audit process.

• Limited powers to mitigate risks. Limits are not set on aggregate exposures to related parties. The MFSA does not have the power to deduct such exposures from capital when assessing capital adequacy, or to require collateralization of such exposures. ²⁶

• Limited information communicated to the MFSA. A report (Analysis of Loans) detailing the loans to directors and staff members is submitted by banks on a quarterly basis. Therefore, this report does not include transactions with all related parties.

• Insufficient reviews of related-parties’ transactions. In recent years, only one onsite inspection focused on related-parties’ exposures and reviewed a sample of transactions

H. Liquidity and Funding

57. Liquidity requirements are subject to maximum harmonization in the EU. Banks submit the Liquidity Coverage Ratio (LCR) on a monthly basis whereas the Net Stable Funding Ratio (NSFR) is submitted quarterly. ²⁷ The assessment of liquidity and funding risks relies on several approaches: (1) the supervisory view based on the results of the SREP, which takes into consideration the prudential ratios and the institution’s internal risk controls and policies; (2) the banks’ perspective, based on internal assessment of liquidity adequacy (ILAAP) and on funding plans (only for the largest banks); and (3) a forward-looking approach based on the results of stress tests (carried out by the CBM).

58. Requirements on the liquidity management frameworks are in line with EU rules. The legal basis requiring credit institutions to maintain sufficient liquidity to withstand a range of stresses and to have a robust liquidity management framework is established in Article 86 of CRD IV, which has been transposed into Annex 2B of the BR/12. It also provides that credit institutions shall have robust strategies, policies, processes, and systems for the identification, measurement, management, and monitoring of liquidity risk over an appropriate set of time horizons, including intraday, so as to ensure that institutions maintain adequate levels of liquidity buffers.

59. The assessment of “risk to liquidity and funding” is included in the SSM LSIs SREP methodology. It provides for an assessment of an institution’s capacity to meet its short-term financial obligations (short-term liquidity risk) and a longer-term assessment of the sustainability of its funding profile (funding sustainability risk). As a complement to the SSM methodology, the MFSA has developed its own guidelines (“Procedures Notes—Assessment of Liquidity and Funding Risk”), which are extremely detailed and provide a useful tool for offsite analysts.

60. As already emphasized, a full SREP has only been completed for one HP LSI. Another SREP should be finalized shortly, while the reviews of the remaining HP LSI and another LSI are expected to be completed by the end of Q1 2019. As part of the first SREP exercise, a thorough analysis of the risk profile and risk management has been performed, even though no specific targeted meetings have been held on liquidity issues. By the end of Q1 2019, the MFSA will have enhanced significantly its understanding of liquidity and funding risks faced by HP LSIs.

61. For the other LSIs, the situation is mixed. On average, the Maltese banks do report high LCRs, well above the regulatory minimum (LCR stood at 183.8 percent for the core domestic banks, 263.9 percent for the noncore domestic banks, and 280.7 percent for the international banks as of end-2017). Similarly, the customer loan-to-deposit ratio is low (58.9 percent for the core domestic banks, 47 percent for the noncore domestic banks). However, some banks are more vulnerable to liquidity shocks (reliance on wholesale funding, and a substantial share of deposits held by nonresidents). In this context, it is noted that (1) the SREP has not yet started for non-HP LSIs; (2) the ILAAP documents that had been submitted were being analyzed by the MFSA at the time of the FSAP mission, and no feedback has yet been provided to the industry; (3) only one non-HP LSI has been requested to submit a funding plan; and (4) liquidity risk is not subject to onsite inspections (no targeted inspection has ever been organized, and full-scope inspections have been rather seldom).²⁸ The BSU relies therefore on prudential returns and meetings that can be organized from time to time with non-HP LSIs. Also, the KRIs, which are based on prudential returns, adequately include the key metrics, including the share of deposits held by nonresidents. It is noteworthy that the Financial Stability Risk Identification and Monitoring report issued by the RDU in February 2018, which highlighted a surge of deposits held by noncore and international banks, recommended implementing a “close monitoring of funding models of LSIs to assess linkages to domestic economy” and to “monitor whether banks follow business models as defined at authorization stage.” In that respect, while maintaining a proportionality approach, more frequent meetings with banks could be organized with non-HP LSIs on liquidity risk issues. Given the potential volatility of deposits held by nonresidents, ongoing scrutiny of liquidity risk is needed.

62. The BR/05 on liquidity requirements is no longer consistent with the CRR, which is directly applicable. The BR/05 contains a minimum asset requirement and still refers to the Maltese lira. The rule deserves to be either amended or removed.

I. Governance and Risk Management

63. The MFSA’s regulation (BR/12) contains several detailed principles for good governance and risk management in banks.

• Transposing the provisions of CRD IV related to internal governance and risk management, the BR/12 states that a credit institution’s internal governance arrangements should include a clear organizational structure with well-defined, transparent, and consistent lines of responsibility; effective processes to identify, manage, monitor, and report the risks that it is, or might be exposed to; and adequate internal control mechanisms, including sound administrative and accounting procedures (Article 13).

• Further, it is specified that internal governance aims at ensuring that a credit institution’s management body (the Board of Directors) is explicitly and transparently responsible for its business strategy, organization, and internal controls. The Board is concerned mainly with setting the credit institution’s business objectives and its appetite for risk, how the business of the credit institution is organized, how responsibilities and authority are allocated, how reporting lines are set up, and what information they convey, and how internal controls (including risk control, compliance, and internal audit) are organized (Article 14).

• These arrangements, processes, and mechanisms shall be comprehensive and proportionate to the nature, scale, and complexity of the credit institution’s activities within the context of the principle of proportionality. Provisions are further detailed in Annex 2B (technical criteria on governance arrangements).

• Credit institutions are also expected to follow the principles on internal governance as issued by the EBA, but these guidelines are not legally binding, as they have not yet been implemented in the regulations (the deadline for implementation being mid-2018). The MFSA has committed itself to implementing these guidelines “in the near future.”

64. From a review of onsite reports and offsite analyses, signs of weak governance persist in several areas. In several instances, onsite examiners noted inadequate composition of Boards and functioning of Board committees (the size of the Board not commensurate with the risk profile, inappropriate mix between independent and non-independent directors). Ownership also represents a potential governance issue because some LSIs have a single ultimate beneficial owner in the form of a private individual, a form that requires enhanced supervisory oversight. Limited awareness among banks’ Boards and senior management was also emphasized during discussions with various parties. Overall, corporate governance practices in the LSIs still need to be significantly improved, but the BSU is aware of the challenges faced by banks.

65. The MFSA’s supervisory actions related to corporate governance policies generally stem either from onsite inspections or through ongoing supervision. Full-scope inspections of LSIs always include a review of governance. Several targeted inspections assessing governance and thematic reviews have also been conducted. All in all, a lot of attention has arguably been paid by the MFSA to corporate governance. Onsite inspectors are to be guided by SSM Manual Chapter 6, on Onsite Inspections and a Joint Standard issued by the ECB on the conduct of onsite inspections at the LSIs. Detected deficiencies in corporate governance, which included issues relating to policies, have also resulted in the application of administrative penalties in two cases. At some point, as a complement to the review of corporate governance, it would have been appropriate to assess whether weak governance structures have translated into excessive risk taking. Such an analysis remains, to a large extent, to be carried out (as already outlined).

66. The SREP methodology serves as an overall review of a credit institution’s operational and organizational structure, overall risk control, and risk-management framework. The assessment covers three main aspects: (1) the banks’ internal governance framework (including key control functions, such as risk management, internal auditing, and compliance); (2) the risk-management framework and risk culture; and (3) the risk infrastructure, internal data, and reporting. The BSU assesses whether the overall risk management framework is appropriate to both the scale and complexity of the institution, with a view to ensure that it is adequately staffed and sufficiently independent, both in terms of quality and quantity of human resources allocated to the function, and whether it maintains links with operational lines. There is particular emphasis on the Chief Risk Officer (CRO); the assessment criteria are, among others, whether the CRO has the necessary experience and skills, bears the responsibility for risk management, and is able to give the risk perspective significant weight within the institution with regard to significant business decisions. The BSU holds regular meetings with a number of representatives of the LSIs, including the CRO. However, as already discussed, only one full LSI SREP was completed at the time of the assessment.

67. Reviews and evaluations of ICAAP and ILAAP have commenced as part of the annual SREP (as explained earlier). The results of these assessments feed into the SREP assessment and are used for determining Pillar 2 capital and liquidity requirements for credit institutions. Also, the purpose of the ICAAP is to inform the Board of Directors of the ongoing assessment of the banks’ risks, how the banks intend to mitigate those risks, and how much current and future capital is necessary, having considered other mitigating factors. Article 17C of the Banking Act, which transposes Article 73 of the CRD IV, requires all banks to have in place an internal adequacy assessment process in relation to their risk profiles. The ECB published its supervisory expectations on ICAAP and ILAAP in January 2016. Although these expectations are directed at SIs, the LSIs have been encouraged by the MFSA to refer to the ECB Supervisory Expectations. At this stage, the MFSA has collected ICAAP and ILAAP for all LSIs, but reviews of these submissions have not yet been completed (as already mentioned).

68. As part of the internal governance framework, a licensed credit institution shall have in place a Board-approved policy for the remuneration of its management and staff members. Malta has transposed Articles 92 to 95 of the CRD (into Annex 2E of the BR/12) whereby credit institutions’ remuneration policies for staff members whose professional activities have material impact on the credit institutions’ risk profile; shall ensure that remuneration is consistent with sound and effective risk management; and provides an incentive for prudent and sustainable risk taking. Credit institutions shall also disclose detailed information on their remuneration policies, practices, and, for reasons of confidentiality, aggregated amounts for those members of staff whose professional activities have a material impact on the risk profile of the institution. Credit institutions that are significant in terms of their size, internal organization, and the nature, scope, and complexity of their activities shall establish a remuneration committee. The MFSA carries out an annual remuneration exercise (in line with ECB and EBA requirements) to collect remuneration information from all credit institutions, relating to aggregated data, remuneration for material risk takers, as well as remuneration of high earners. This information is reviewed and discussed with the banks, if necessary. In situations where issues arise, the MFSA discusses the matter with the bank to ensure that remuneration practices are in line with the requirements.

J. Enforcement and Sanctioning

72. Sanctioning is a shared responsibility between the ECB and the MFSA. The ECB’s direct enforcement and sanctions powers are limited to pecuniary penalties on SIs, which breach directly applicable EU law or ECB decisions or regulations. In the event of breaches of national law implementing EU directives, breaches committed by natural persons, or when a non-pecuniary penalty has to be imposed, the ECB may request that the MFSA open proceedings with a view to impose penalties, if appropriate.³⁰ Concerning LSIs, the MFSA has the power to impose sanctions on the legal entities and their management for breaches. The ECB can also impose enforcement measures against LSIs for ongoing breaches of ECB decisions or regulations imposing an obligation vis-à-vis the ECB. The MFSA has exclusive competence to impose sanctions in relation to breaches by the SIs and LSIs, and their management of national laws that do not relate to the ECB’s tasks.

73. The MFSA has a broad range of corrective and sanctioning powers. They include:

• Imposing an administrative penalty when a credit institution (1) breaches any of the provisions of the Banking Act, or any regulation or banking rules issued thereunder, or the CRR; (2) does not comply with a directive issued by the MFSA under the BA; and/or (3) fails to comply with the conditions imposed in the licensing agreement (Article 35.A of the Banking Act). In determining the sanction or fine, the supervisory council is guided by the Administrative Penalties, Measures and Investigatory Powers Regulations (Subsidiary Legislation 371.05). An administrative penalty or measure may also be imposed on a natural person (senior management, for instance) and/or any director of a credit institution. The amounts are potentially dissuasive (up to €5 million for a natural person, up to 10 percent of the total annual net turnover in the case of a legal person).

• Requiring a credit institution to take the necessary measures at an early stage to address problems in cases where either the credit institution does not meet the requirements or is likely to breach the requirements of the Banking Act, regulations, or banking rules issued thereunder or of the CRR (Article 17E of the Act). This would include instances where risk governance, systems, and controls are not effective or adequate in terms of the legislative provisions referred to above. These measures may include those listed in Regulation 9 of the Banking Act (Supervisory Review) Regulations (Subsidiary Legislation 371.16), such as the possibility (1) to require a credit institution to hold its own funds in excess of the requirements; (2) to require the reduction of the risk inherent in the activities, products, and systems of credit institutions; (3) to require credit institutions to present a plan to restore compliance with supervisory requirements; (4) to restrict or limit the business, operations, or network of credit institutions, or to request the divestment of activities that pose excessive risks to the soundness of a credit institution; (5) to require a credit institution to limit variable remuneration as a percentage of net revenues where it is inconsistent with the maintenance of a sound capital base; (6) to impose additional or more frequent reporting requirements; and (7) to require additional disclosures.

• Issuing directives in writing requiring a licensee to do, or to refrain from doing, any act, including such prohibitions, restrictions, and conditions as may be specified in the directive (Article 16 of the MFSA Act).

• Taking control of a credit institution, by appointing a competent person to take charge of the bank’s assets or to assume control of the business, require the credit institution to wind up its business, and/or by appointing a liquidator (Article 29 of the Banking Act). Ultimately, the license can be withdrawn.

74. Decision-making powers rest with the MFSA supervisory council. When the final decision-making comes to the taking of regulatory action, such as the imposition of administrative penalties, cancellation, suspension or restriction of license, and the issuing of directives is conferred to the council, the process is normally activated by the relevant supervisory unit, which may bring matters to the attention of the supervisory council when it is perceived that regulatory action may be necessary.

• Supervisory council memos are circulated to all team members and are then discussed during meetings. They contain detailed information on the matter/concern, which is being brought to the attention of the council (for example, details of any noncompliance issues, findings resulting from investigations conducted by the relevant supervisory unit, and so on) and would normally also include one or more recommendations or possible courses of action for the supervisory council’s consideration.

• With regard to certain types of regulatory action (restriction, suspension, or cancellation of a license), the law obliges the MFSA to first serve a written notice of its intention to do so to the licensee, specifying the grounds upon which the MFSA intends to take that action and stating a time period within which the licensee is entitled to submit its observations. The decision to issue any such notice/minded letter is taken by the supervisory council. In certain cases, the council has adopted the approach of following the minded letter—representations—final decision procedure, even when not strictly bound to do so by law in view of due process considerations and/or because of the serious nature of the proposed regulatory action (for example, when the MFSA intends to impose an administrative penalty).

75. In determining the sanction or fine, the supervisory council is guided by a specific regulation. The Administrative Penalties, Measures and Investigatory Powers Regulations, Subsidiary Legislation 371.05 provides for factors that may affect the penalty that is to be meted out against the licensee.³¹ Concerning the use of prompt remedial actions (measures taken at an early stage, directives), it is noted that thresholds at which a supervisory action is required, have not been defined, even though the BSU may make use of automated KRIs.

76. Before making use of supervisory powers, the MFSA employs a progressive remedial process. Applying gradual responses rather than immediately resorting to more coercive measures is not questionable per se, as long as tools and processes are in place to: (1) address supervisory concerns with banks in a proactive and timely manner, including formal communication and escalation to senior management and the Board as appropriate; and (2) ensure adequate and timely follow-up of actions taken by banks. In that regard, it was noted that remediation progress and completion were insufficiently monitored and documented.

77. Despite the vast range of corrective measures and powers that the MFSA enjoys based on the legislation, evidence of effective application of all of these enforcement powers is somewhat limited. In the past five years, the MFSA has imposed a limited number of sanctions, as illustrated in Table 6. Further, the low pecuniary penalties imposed on banks have a limited deterrent effect. Also, the MFSA has never exacted sanctions against natural persons. Last, no actions have been decided on grounds of insufficient internal controls to prevent money laundering risks.

Table 6.

Malta: Administrative Measures and Penalties Against Credit Institutions, 2013–2018

Source : MFSA website (public information).

Table 6.

Malta: Administrative Measures and Penalties Against Credit Institutions, 2013–2018

Date	Entity	Subject	Measures/Public Notice
7/6/2018	Satabank	Breaches of provisions on governance and internal control	Penalty of EUR 65,000
4/3/2018	Ferratum Bank	Breaches of various provisions on governance	Penalty of EUR 188,445
3/21/2018	Pilatus Bank	Bank directed not to allow any banking transactions, including withdrawals or deposits held with the bank by the shareholders, members of the Board of Directors, and senior management officials of the bank, or any connected persons or related persons
7/18/2018	HSBC Bank Malta	The bank, as custodian, has failed to carry out appropriate monitoring on one fund	Penalty of EUR 10,000
4/27/2016	Nemea Bank	Regulatory shortcomings identified during an OSI	Appointment of a competent person to take charge of the assets and assume control of the bank
3/29/2016	FimBank	Lack of appropriate governance	Restrictions through applying limitations on the expansion and further investment

Source : MFSA website (public information).

View Table

Table 6.

Malta: Administrative Measures and Penalties Against Credit Institutions, 2013–2018

Date	Entity	Subject	Measures/Public Notice
7/6/2018	Satabank	Breaches of provisions on governance and internal control	Penalty of EUR 65,000
4/3/2018	Ferratum Bank	Breaches of various provisions on governance	Penalty of EUR 188,445
3/21/2018	Pilatus Bank	Bank directed not to allow any banking transactions, including withdrawals or deposits held with the bank by the shareholders, members of the Board of Directors, and senior management officials of the bank, or any connected persons or related persons
7/18/2018	HSBC Bank Malta	The bank, as custodian, has failed to carry out appropriate monitoring on one fund	Penalty of EUR 10,000
4/27/2016	Nemea Bank	Regulatory shortcomings identified during an OSI	Appointment of a competent person to take charge of the assets and assume control of the bank
3/29/2016	FimBank	Lack of appropriate governance	Restrictions through applying limitations on the expansion and further investment

Source : MFSA website (public information).

78. Review of supervisory measures in the broad sense suggests that the MFSA has taken decisive action in several instances, but such actions may not have been as timely as desirable. More supervisory measures have been decided since 2015. Such measures are mainly adopted following an onsite inspection. In that respect, it is worthwhile to note that over the past few years, significant delays were observed between the end of the investigation phase and the date on which decisions were taken by the supervisory council (up to one year). Additionally, as already emphasized, the frequency of onsite inspections is low, with several banks that have not been inspected over the past five years. The main risks faced by the Maltese banks (credit risk, liquidity risk, and compliance risk) are not subject to in-depth onsite inspections. By construction, this can only reduce the opportunities to detect problems and take appropriate supervisory measures. For one bank, a competent person was appointed in 2016 following an onsite inspection jointly carried out with the ECB. The joint inspection had revealed excessive related-parties’ exposures and under-provisioning. It is noted that while a 2015 onsite inspection carried out by the MFSA emphasized serious governance shortcomings, it did not include an in-depth review of credit risk, a thorough analysis of related-parties’ transactions, and a review of the adequacy of provisions.

79. The way the appeal procedure is handled has a negative effect on the effectiveness of the sanction policy. Any person who is aggrieved by a decision or measure taken by the MFSA may appeal to the Financial Services Tribunal. ³² Moreover, appeals against pecuniary penalties have suspensive effects, and it is noteworthy that the MFSA has 27 pending appeals, some of which date back to 2009. This is not conducive to implementing a dissuasive sanction policy. The Financial Services Tribunal’s resources appear to be limited (no permanent secretariat, and part-time judges are appointed).

K. Financial Integrity

80. According to the authorities, the money laundering threat to Malta is relatively high and driven mostly by the laundering of foreign proceeds of crime. The main vulnerabilities identified through the national risk assessment—NRA (see the following)—point toward Malta’s open economy and large financial sector (the banking and securities sectors in particular), gaming sector (especially remote gaming), and designated nonfinancial business and profession (DNFBP) sector (particularly trust and company service providers, legal and accounting professionals, and the real estate sector).³³ The NRA furthermore highlights Malta’s heavy use of cash and transferable checks as a compounding factor, with many sectors, such as construction and tourism, relying on cash transactions, rendering Malta a cash-intensive economy in general.

81. Several initiatives have been taken by the Maltese authorities over recent years. Malta carried out an initial AML/CFT NRA in 2013–2014, which was subsequently reviewed and updated in 2017. It led to an updated NRA Report, as well as a national AML/CFT strategy based on the findings. A detailed action plan, including more than 50 detailed action points, was devised for implementation of the strategy in the next three years. This national AML/CFT strategy has been published. A National Coordinating Committee on Combatting Money Laundering and Funding of Terrorism has also been established. An increase of resources devoted to money laundering prevention has been decided. Concerning the legal powers, it is worth reminding that the Report on Fourth Assessment Visit from the Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism (MONEYVAL) noted in 2012 that Malta has a comprehensive legal structure to combat money laundering.

82. The FIAU is the main AML/CFT supervisor in Malta. The FIAU is an independent government agency established in terms of Article 15 of the Prevention of Money Laundering Act (PMLA). The FIAU is the receiving agency for Suspicious Transaction Reports (STR). When, following an analysis of a STR, the FIAU has reasonable suspicion that the reported transaction, activity, or person could involve money-laundering or terrorism-funding activities or criminal proceeds, it shall send an analytical report to the police, as the law enforcement agency.

83. The FIAU also has a supervisory role and is assisted by the MFSA in the AML/CFT oversight of the financial services sector. As set out in Article 26 of the PMLA, the FIAU is responsible for monitoring and ensuring subject person compliance with the PMLA, the Prevention of Money Laundering and Funding of Terrorism Regulation (PMLFTR), and the implementing procedures. The compliance section of the FIAU is responsible for this task, which is achieved through onsite compliance examinations and offsite assessments of subject persons falling within the definitions of “relevant financial business” and “relevant activity” under the PMLFTR. Onsite supervision of MFSA license holders is carried out by the Enforcement Unit of the MFSA, acting as an agent of the FIAU in accordance with Article 26(5) of the PMLA. The FIAU remains the sole authority responsible for reviewing cases presented before it, and for taking decisions on any breaches and on the sanctions to be imposed.³⁴ In line with its 2017 restructuring plan, the FIAU is planning to expand its human resources (from 20 to 56 staff members by end-2020, 19 of whom will be dedicated to AML/CFT supervision). Similarly, recruitment is planned at the MFSA (from nine supervisors working on AML/CFT as of June 2018 to 30 by end-2018).³⁵ At the time of the FSAP mission, the size of the MFSA team was reduced to six supervisors (due to three resignations) and the plan to recruit 23 people (20 new and three replacements) by end-2018 may turn out to be over-optimistic.

84. The EBA pointed out in July 2018 general and systematic shortcomings in the FIAU’s application of the Third EU Directive on the prevention of AML/CFT.

• In October 2017, the European Commission’s Director General for Justice and Consumers asked the EBA to investigate a possible breach of Union law. This was related to the apparent failure of the FIAU to apply effective, proportionate, and dissuasive sanctions for alleged infringements by Pilatus Bank of Malta’s AML/CFT provisions in line with Article 39 of the Third EU Directive on the prevention of AML/CFT (Directive 2005/60/EC or “AMLD3”).

• According to the EBA, the FIAU failed to ensure that one credit institution (Pilatus Bank) put in place adequate and appropriate AML/CFT policies and procedures, as required under Article 34 of AMLD3; the FIAU neither imposed effective, proportionate, and dissuasive sanctions, nor any other supervisory measures, to correct the shortcomings it had identified to ensure the institution’s compliance with the directive’s requirements. The EBA decided not to open a breach of Union law investigation into the MFSA, reflecting the recent supervisory actions taken by the MFSA and the current requirements of Union law. Nonetheless, the EBA did identify significant concerns about the actions of the MFSA in some areas.

• As highlighted in the EBA’s Recommendations, “the findings from the EBA’s investigation reveal a general practice of the FIAU at the time of the case at issue and not only, as argued by the FIAU, a failure in this particular case.” The FIAU has informed the EBA of general actions that, as an Action Plan, it has already undertaken, or which are in train, to strengthen its supervision. The EBA noted that “while a move in the right direction, these measures are not enough to be satisfied that the deficiencies that led to a breach of Union law have been resolved” and, as a consequence, adopted recommendations aimed at remedying the particular failings that it had identified.

• The FIAU has challenged the issuance of the recommendation because an Action Plan had been already adopted by the FIAU to address these concerns. According to the EBA, “the need identified by the FIAU for such a wide-ranging nature Action Plan provides support for its findings that the procedures and policies applied at the time of the case at issue were not appropriate and effective.”

85. A swift implementation of the Action Plan is critical considering the AML/CFT supervisory framework has serious deficiencies. The FSAP mission’s review of onsite reports and enforcement measures taken revealed the following observations.³⁶

• Low number of onsite reviews. The number of onsite visits conducted at credit institutions solely by the MFSA or jointly with the FIAU, albeit slightly increasing, has been low over recent years (five onsite reviews in 2017, three in 2016, and three in 2015), and the yearly plan has not been commensurate with the banks’ risk profiles. The five largest banks in terms of assets have not been inspected since 2015. Similarly, a bank active in commodity-trade finance, which is potentially prone to money laundering, has never been inspected.

• Limited number of sanctions. Few administrative sanctions have been imposed on credit institutions by the FIAU (none in 2015, three in 2016, one in 2017) and the amount of penalties has not been dissuasive.³⁷ In several instances, no sanction was made despite extremely severe findings highlighted in compliance examination reports. Explanations were not provided in the final decisions. It is also noted that no sanction has been made by the MFSA on grounds of insufficient internal controls and compliance checks.

• Short duration of the onsite reviews and narrow scope of investigations. The mission team had the opportunity to review a sample of compliance examination reports. It appears that the onsite investigation phase was limited to a couple of days. Even though preparatory work can be carried out prior to the mission, the fact remains that this short duration does not give the examiners sufficient time to examine a large number of clients’ accounts and to extract data from the banks’ information systems for identification of potentially suspicious transactions. Until recently, investigations were limited to a series of interviews with the money laundering risk officers and the review of a limited sample of accounts (33 for one of the largest Maltese bank). Accordingly, the effectiveness of ongoing monitoring and transaction screening was not assessed. However, the two latest reviews launched in 2018 lasted five months (they were not finalized at the time of the IMF mission).

• Far too excessive delays to finalize the onsite reports. The IMF mission noted that it may take up to 1.5 years to produce the final report. The complexity of the FIAU internal procedure governing the conduct of onsite visits is unlikely to solely explain and justify these delays, keeping in mind that the discussion on the findings with the inspected entities takes place after the finalization of the report. This lengthy process of providing findings and recommendations to banks based on onsite examinations seriously weakens its effectiveness.

• Inadequate timeliness of the regulatory response. Delays in coming to a final decision are excessive (up to three years after concluding an onsite inspection).

• Insufficient involvement from the BSU regarding the effectiveness of internal controls related to AML risks. Onsite reviews of the compliance with prudential requirements on risk management, internal control, and internal audit could have been—but were not—used by the MFSA as a way to act on a standalone basis (without any request from the FIAU), and to take supervisory measures against banks found with inadequate internal controls and compliance frameworks. Additionally, the BSU could ensure that (1) banks have adequate compliance functions and audit functions dealing with all material risks, including AML/CFT; (2) AML internal policies and practices are subject to regular audits; (3) the conclusions of internal audit missions focusing on AML are adequately communicated to the relevant persons; (4) there is an internal follow-up of recommendations; (5) AML is included in the risk mapping; (6) AML policies and processes are integrated into the bank’s overall risk management; and (7) the information system is robust. Documentation shared with the FSAP mission shows that such reviews are not conducted on a regular basis. Also, STRs are not communicated by banks to the MFSA when suspicious activities are material to the safety, soundness, or reputation of banks, and the BSU does not conduct regular contact with the banks’ money laundering risk officers.