TITLE: Malta's Financial Intelligence Analysis Unit Imposes Administrative Penalties on Stanleybet Malta Limited for Anti-Money Laundering Failures BODY: On 23 March 2026, the Financial Intelligence Analysis Unit (FIAU) imposed significant administrative measures against Stanleybet Malta Limited, a remote gaming operator licensed by the Malta Gaming Authority (MGA) to provide Type 1 and Type 2 gaming services through a network of physical betting shops across the European Union. The FIAU's Compliance Monitoring Committee identified serious and systematic failures in the company's anti-money laundering and counter-terrorism financing (AML/CFT) compliance following a targeted review initiated in 2025. The primary breaches concerned customer due diligence (CDD), customer risk assessment (CRA), and transaction monitoring obligations under the Prevention of Money Laundering and Financing of Terrorism Regulations (PMLFTR) and the FIAU's Implementing Procedures. The Committee found that Stanleybet Malta Limited lacked adequate systems to cumulatively link customer transactions across its betting shop network to identify when the €2,000 deposit threshold was reached. The company only applied CDD measures when customers deposited €2,000 in a single transaction or met specific daily thresholds, relying on manual recognition by betting shop employees—a method presenting significant circumvention risks. Additionally, the company failed to maintain a complete customer list, preventing proper money laundering and terrorism financing risk assessments. Customer profiling information was generic and inadequate, with employment status limited to broad categories such as "employed" or "unemployed" and source of funds restricted to terms like "savings" or "wages." The FIAU imposed an administrative penalty of €225,730 under Regulation 21(1) of the PMLFTR, a periodic penalty payment of €2,000 per day under Regulation 21(5) until remediation is complete, and issued a Follow-Up Directive requiring the company to implement systems enabling cumulative transaction linking, establish clear transition points from occasional transactions to business relationships, and enhance customer profiling procedures. The company must submit an action plan detailing remediation measures. The penalty is subject to appeal before the Court of Appeal (Inferior Jurisdiction) within the prescribed timeframe.

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always generate an update. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and summarise it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. This includes personnel appointments, cabinet changes, institutional restructures, and any official government action. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. - Content scope is broad: generate updates for all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are an AI assistant generating Horizon scanning updates for government, regulatory, and institutional content. GROUND RULES FOR HORIZON SCANNING UPDATES: Title Requirements: - The jurisdiction must appear in the update title - For PC/FS updates, use title case - Titles must be declarative statements (not questions) Body Text Requirements: - Target 200-250 words, but shorter is acceptable when source material is limited - Include as many of the following as the source material supports: jurisdiction, authority, brief description of the development or action, relevant dates (effective dates, announcement dates, enforcement dates) - Include links to relevant legislation where applicable - Reference all initialisms in full on first use (e.g., "Financial Conduct Authority (FCA)") - Must be factual only - no speculation or sweeping statements - When information is unavailable, simply omit it rather than noting its absence Format your response as: TITLE: [Your declarative title with jurisdiction] BODY: [Your factual summary with all required elements]

Horizon Scanning Outline. Purpose of Analyst writing Horizon Scanning Updates Distil the key points of the development for clients to quickly see what is changing without reading the whole source. Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes. Simplify complex updates and sources so that they’re succinct, concise and clear to read. Consistently structure and write updates in the same format. Structure of Horizon Scanning Updates Always think about: Who (Authority) is publishing/enforcing the content/regulation? Where (Jurisdiction)? What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed? Who is this update applicable to (credit, e-money institutions, etc.)? Why is this update noteworthy? What is its significance? When is the update applicable? Title Describe what the update is about. Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what). All titles should be written in present tense. Avoid using acronyms Approx 10 - 20 words Example Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance Paragraph 1 Open with the date of the update (When) Name the authority that released the update (Who) Summarise the release (What) Example On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets. Paragraph 2 Summarise key points. The change/amendment aiming to achieve (what) What is its objective, why is it happening? Why is it significant? (why) Who does it impact or concern? (Who) The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document. Example SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to: Study Indian and global best practices. Prepare the guidelines. Address the concerns and issues arising from AI/ML usage. SEBI is consulting on the following principles to develop the guidelines: Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models. Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information. Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results. Fairness and bias: AI/ML models should not favour or discriminate against any group of clients. Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security. Paragraph 3 Acts as a “Call To Action”. Provide forward looking context: What actions need to be taken? Who needs to take action? Next steps to the development. Include any relevant dates (When) Response dates - should always be provided for consultations Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted. Example The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026. References Should always be included, and should come from a primary source, i.e., an authority, not a news source. General Style Notes: 200-250 words Active voice Authorities and companies referenced as a single entity (“It”, not “they”) Titles in title case Internal Vixio vocabulary guide Content Style Guide Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content. A Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA). Act - when just referring to “the act”, it does not need a capital a. Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell). - advice (noun) - give formal suggestions (for example, I gave them advice). Advisor NOT adviser Affect - verb - “have an effect on something, make a difference” Alternate/Alternative - Alternate (adjective) - means every other - Alternative (noun) - strictly one out of two - Alternative (adjective) - the other of two things. Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”. AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT Among/while NOT Amongst/whilst API - application programming interface Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act. Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”. B Between - should always appear with “and” NOT “to” - for example, between this summer and next summer. Big tech - two words, breaks convention of other tech words Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522). Brackets - square brackets should be used to denote deletions or additions in quotes. Buy now, pay later - no hyphens Bullet points - see Lists C Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a) Cardrooms not card rooms Cases - legal cases should appear in italics, with a v for versus. Casino-resorts NOT casino resorts or resort-casinos Chief executive NOT chief executive officer Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes) Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000) Comparisons - compare with (highlighting differences) - compare to (highlighting similarities) Companies/organisations - singular entities (it NOT they) should be followed by “which/that” rather than “who” Ltd, not Limited Complement - to accompany something/add value Compliment - give praise (complimentary = free) Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings) Comprise/comprising - should NOT be followed with “of”, as it means to “consist of” Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,) Continually - if something occurs repeatedly/regularly in the same way Continuously - if something occurs without interruption or gaps Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone) Contrast - by contrast - when comparing one thing to another - in contrast - simply noting a difference Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting Court of Justice of the European Union (CJEU) rather than ECJ Cryptocurrency - one word, not hyphenated. Crypto-assets - hyphenated Cybersecurity - one word, not hyphenated CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar) m for million, bn for billion, trn for trillion. D Date format - Month, Day, Year (e.g., March 7, 2019) For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…” For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...” For NIBs: always use dates rather than days. Department for Digital, Culture, Media & Sport - ampersand Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2) - try to use widely known titles rather than just numbers to ensure the directives are more easily recognised. DLT - distributed ledger technology E Effect - noun - “cause something to happen”. Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–). Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”. esports NOT eSports or e-sports Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”. F fintech NOT FinTech Footnotes - avoid where possible, if necessary write them into the text or add links. G GGR - “gross gaming revenues” Government - does not need a capital g. Governor - should be written out in full, NOT Gov. Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines) H Headlines - all words should begin with a capital Horseracing NOT horse racing Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money - DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper I Impact - should be used as a noun - i.e. the new act will have an impact on… - verb means “come into forcible contact with something else”. - using “affect” as a verb is more accurate. J Judgment - legal decision Judgement - one’s own opinion Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters. Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive. OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur DON’T need capitals unless a figure of importance (i.e., Prime Minister, President) Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be. Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team). K KYC - know your customer L Legislature - does not need a capital l. Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables. Licence - noun (UK), i.e. a driver’s licence License - verb/noun (US) Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent). M MONEYVAL NOT Moneyval More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players. N Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive. Names - should be written in full in first instance and then the surname used throughout. Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences. Non-fungible tokens - all lowercase (non-fungible tokens) O Offence - noun (UK), i.e. commit an offence Offense - noun (US) Organisations/companies - singular entities (it NOT they) should be followed by “which/that” rather than “who” Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears). Over - should not be used as a replacement for “more than”. P Parliament - does not need a capital p. Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”. - passed is the past tense of “to pass” - “the law was passed in government”. Prepaid, not pre-paid Percentages - numbers should always be written as figures percent NOT per cent or % Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent) Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to” Principal - main, most important Principle - a fundamental source or basis of something Programme (UK) Program (US, UK - for computer program, Australian English) Q Quotes - speaker should be referenced in the past tense (said NOT says) Quote marks - double quote marks should be used for speech - single quote marks should only be used for titles and within quotes. (See Quote reference sheet for more information on how to use quotes.) R regtech NOT RegTech Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines) Racetracks not race tracks S Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018. Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act. Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.) Sports betting NOT sportsbetting Sports team names Storey (pl. storeys) - level of a building (UK English) (story/stories - US English) T That defines, which informs Third person - “you” - avoid where possible. Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a) Tenses - content should generally be written in past tense - present tense should be used for something that has just happened and will be continuing into the future. U United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”) U.S. Department of Justice - Justice Department (with capitals as requested) V Vixio GamblingCompliance / Vixio PaymentsCompliance Vixio (to be used on its own after first instance) W Which informs, that defines While/among NOT Whilst/amongst While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”. X Y Year quarters - Q1, Q2, H1, H2, etc. Z Acronyms AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT API - application programming interface DLT - distributed ledger technology --- Now, given the above instructions and style guide, please generate a horizon scanning update based on the following webpage content. Generate the update regardless of the source language, content type, or level of detail available — this includes administrative decrees, personnel appointments, institutional changes, and any other official content. Use whatever information is present. Administrative Measure Publication Notice This Notice is being published by the Financial Intelligence Analysis Unit (the FIAU) in terms of Article 13C of the Prevention of Money Laundering Act (the PMLA) and in accordance with the policies and procedures on the publication of AML/CFT administrative measures established by the Board of Governors of the FIAU. The Notice provides select information from the FIAU’s decision imposing the respective administrative measures and is not a reproduction of the actual decision. DATE OF IMPOSITION OF THE ADMINISTRATIVE MEASURE: 23 March 2026 SUBJECT PERSON: Stanleybet Malta Limited RELEVANT ACTIVITY CARRIED OUT: Remote Gaming Operator SUPERVISORY ACTION: Targeted review initiated in 2025 DETAILS OF THE ADMINISTRATIVE MEASURES IMPOSED: - An administrative penalty of €225,730 in terms of Regulation 21(1) of the Prevention of Money Laundering and Financing of Terrorism Regulations (PMLFTR) - A periodic penalty payment of €2,000 per day in terms of Regulation 21(5) of the PMLFTR - A Follow-up Directive in terms of Regulation 21(4) of the PMLFTR LEGAL PROVISIONS BREACHED: - Regulations 9(1), 7(1)(d), 7(2)(a), 7(1)(c) and 5(5)(a)(ii) of the PMLFTR, Sections 3.5 and 4.4.2 of the FIAU Implementing Procedures – Part I (the IPs – Part I), and Sections 3.2, 3.3 and 2.1 of the FIAU Implementing Procedures – Part II: Remote Gaming Sector (the IPs – Part II) REASONS LEADING TO THE IMPOSITION OF THE ADMINISTRATIVE MEASURE: Customer Due Diligence (CDD), Customer Risk Assessment (CRA) and Monitoring Obligations – breach of Regulations 9(1), 7(1)(d), 7(2)(a), 7(1)(c) and 5(5)(a)(ii) of the PMLFTR, Sections 3.5 and 4.4.2 of the IPs – Part I, and Sections 3.2, 3.3 and 2.1 of the IPs – Part II By way of background, Stanleybet Malta Limited (the Company) is a remote gaming operator holding a Business-to-Consumer (B2C) Gaming Service Licence issued by the Malta Gaming Authority (MGA), whereby it is authorised to provide both Type 1 and Type 2 Gaming Services. In terms of its business model, the Company offers such gaming services through a network of physical betting shops located within Page: 1 a European Union (EU) jurisdiction. These betting shops are operated by independent traders, referred to as betting shop operators, who act as service providers and payment facilitators on behalf of the Company. The potential breaches letter issued following the targeted review conducted by the FIAU noted that, in practice, the Company does not have systems or adequate measures in place to track cumulative deposits by the betting shops’ end customers and link such clients’ activity across all betting shops in order to identify when the €2,000 deposit threshold is reached, whether in the context of an occasional transaction or a business relationship. During the targeted review, it was observed that the Company only applies CDD measures when a customer makes a deposit of €2,000 or more at one go, or where certain other criteria and risk parameters are met. One such criterion is where, within the same day, the same customer carries out several transactions amounting to a total equal to or greater than €2,000 with a betting shop. Nevertheless, the Committee considered that the measure implemented to monitor this criterion is insufficient, as its application relies on betting shop employees recognising clients by sight, which presents inherent weaknesses. Notably, customers may visit a specific betting shop at different times of the day, and may also frequent multiple betting shops within the Company’s network, even within the same town or city, which may lead to the possible circumvention of the €2,000 deposit threshold. Moreover, the aforementioned criterion is also not aligned with the legal requirement to calculate and monitor the €2,000 threshold either on the basis of the customer’s lifetime deposits or over a 180-day rolling period. In view of its inability to associate transactions to each respective customer, the Company does not currently have a complete list of its end customers, which in turns prevents it from assessing their money laundering/funding of terrorism (ML/FT) risks, establishing their business and risk profiles, and carrying out the necessary CDD checks, where such requirements are applicable in terms of law. The Company is also not in a position to monitor transactions executed throughout any of the business relationships established with the clients it services. It further transpired that the Company considers business relationships to be established with the betting shop operators (point one). However, all interactions with end customers placing wagers are automatically treated as occasional transactions, or as a series of linked occasional transactions, with no possibility for such interactions to eventually be classified as a business relationship (point two). The Committee addressed the two points in question as follows: • Point One: The Committee emphasised that, in line with Section 3.3.1 of the IPs – Part II, where the customer makes use of an account held by the operator of the physical establishment, in this case, the betting shop, to carry out transactions with the licensee, the licensee has to ensure that the physical establishment applies the licensee’s own AML/CFT policies and procedures once the relative threshold is reached. Moreover, here the physical establishment would be considered as an extension or an agent of the licensee and would therefore have to apply the licensee’s own AML/CFT policies and procedures on its behalf. Given that, in this context, it is clear that the Company’s customer is the end client making use of the betting shop operator’s services, and not the betting shop operator itself, the three important cumulative elements indicative of a business relationship1, as outlined in the PMLFTR and the IPs, do not apply. Consequently, although the relationships between the Company and the betting shop operators are undoubtedly 1 These three cumulative elements consist of the following: a.) The relationship must be of a business, professional or commercial nature between two or more persons; b.) At least one of the persons involved in the relationship must be a subject person, whether undertaking a relevant financial business or a relevant activity; and c.) The relationship has, or is expected to have at the time when the contact is established, an element of duration. Page: 2 business or commercially driven, they cannot be construed as a ‘business relationship’ as defined in terms of Maltese law. • Point Two: The Committee highlighted that, the Company, as a Maltese licensed remote gaming operator, is required to ensure full compliance with all applicable AML/CFT obligations, including those specifically pertaining to remote gaming operators under the IPs – Part II. For this reason, while the interaction with a customer may initially be classified as an occasional transaction, measures must be in place both to link connected transactions, such as multiple bets linked to the same game, as well as to identify clients who should eventually be classified as having a business relationship. In the latter circumstance, a business relationship is deemed to arise when three factors cumulatively apply. Of crucial importance is the fact that, if an element of duration or ongoing engagement exists, the interaction with the customer should no longer be considered as an occasional transaction or a series of linked occasional transactions. Rather, the interaction would now fall within the definition of a business relationship as set out in the PMLFTR and the IPs, triggering the application of more onerous AML/CFT obligations on the part of the Company. Taking all of this into account, the Committee emphasised that it is pertinent for the Company to be able to identify the specific point in time at which a customer’s activity becomes habitual, whereby an interaction based on the concept of an occasional transaction transitions into one based on the concept of a business relationship. Although it was acknowledged that, under its current framework, the Company was able to produce a list of customers, this was limited to those customers whose deposits exceeded €2,000 in a single transaction. Additionally, matters were compounded by the fact that, even when information was collected to establish the customer’s profile, specifically regarding the client’s source of wealth (SOW), expected source of funds (SOF), and anticipated level of activity, such information was deemed insufficient and inadequate. In fact, it emerged that the onboarding forms provided by the Company during the targeted review contained only generic information about the customers’ employment status and origin of funds, with responses limited to broad classifications such as “employed”, “unemployed”, and “student” for employment status, and “savings”, “wages”, and “dividends” for the expected SOF. In some instances, some data fields within the forms were even left blank. The Committee expressed its serious concerns regarding these material deficiencies when it comes to the collection of CDD information and stressed that this issue directly impacts the Company’s obligations to carry out a CRA, formulate a business and risk profile, and carry out transaction monitoring where applicable. This failure also rendered the Company unable to assess whether the information obtained from its clients warranted corroboration through supporting documentation, in alignment with the risk-based approach. ADMINISTRATIVE MEASURES TAKEN BY THE FIAU’S COMPLIANCE MONITORING COMMITTEE: After taking into consideration the above-mentioned findings, the Committee proceeded to impose the following administrative penalties, as explained below: - A combined penalty of €225,730 for the serious and systematic failure on the part of the Company: a.) To establish and know its customers, due to its inability to associate transactional activity with individual customers as well as to cumulatively link transactions to determine when the €2,000 deposit threshold was reached, whether in the context of a business relationship or an occasional transaction; b.) As a result of failure (a.), to carry out a CRA in order to understand the risks posed by the customers it was servicing and apply the necessary CDD measures; and Page: 3 c.) To collect adequate information to develop a comprehensive customer profile when clients exceeded the said threshold in the context of a business relationship as well as apply adequate monitoring measures. This in terms of Regulations 9(1), 7(1)(d), 7(2)(a), 7(1)(c) and 5(5)(a)(ii) of the PMLFTR, Sections 3.5 and 4.4.2 of the IPs – Part I, and Sections 3.2, 3.3 and 2.1 of the IPs – Part II. - A periodic penalty payment of €2,000 per day in respect of the specific failure detailed under point (a.) above. This measure reflects the Committee’s serious concern regarding the Company’s urgent need to ensure that it is capable of identifying and associating the transactions executed by each customer, so as to establish when the €2,000 threshold has been met, whether within a single betting shop or across the Company’s network of betting shops, and whether the activity occurs in the context of a business relationship or multiple linked occasional transactions. To note that such periodic penalty payment will remain in effect until such time as the FIAU is fully satisfied that the failure detailed under point (a.) above has been duly remediated. In arriving at the final amount of the administrative penalties to impose, the Committee took into consideration a range of aggravating and mitigating factors. The Committee could not but stress the importance of the AML/CFT obligations that the Company has breached, together with the overall seriousness of the findings identified and their material impact. Specifically, the Committee noted that, given that the Company was providing services to customers without adequate controls in place, its failures in relation to the CRA, CDD, and monitoring obligations could have led to the unintentional facilitation of ML/FT. Moreover, it was noted that the lax approach adopted by the Company with respect to the fundamental legal requirement to know who it is servicing, which is a cornerstone of the entire AML/CFT framework, could not only have adversely impacted its own operations, but also exposed the Maltese jurisdiction to certain unmanaged ML/FT risks. Further to this, the Committee also took into account the nature, size and operations of the Company’s activities. More positively, when reaching its final decision, the Committee gave weight to overall good level of cooperation exhibited by the Company throughout the process, particularly its willingness to engage with the FIAU in order to explain its position, as well as its provision of all requested information and documentation in a timely manner. Furthermore, the Committee considered the Company’s openness towards revising its internal processes and controls to meet the FIAU’s expectations as well as ensure full compliance with its obligations, including through enhanced AML/CFT training and auditing processes. Notwithstanding, the Committee remains of the view that further tangible and measurable progress is required, this since the changes implemented to date, while indicative of a willingness to improve, primarily focus on increased training for betting shop operators and therefore fall short of fully addressing the serious and systemic failures identified. Indeed, the revision of internal processes and controls, without implementing the fundamental legal requirement for the Company to identify and recognise who the vast majority of its customers are, is inherently ineffective and will ultimately not achieve the intended outcomes of the revisions undertaken. For this reason, the Committee also proceeded to serve the Company with a Follow-Up Directive by virtue of the FIAU’s powers under Regulation 21(4) of the PMLFTR, this to ensure that the Company takes immediate, concrete, and verifiable steps to ensure complete alignment with its AML/CFT obligations. Through this Directive, the Company is expected to make available an Action Plan containing an overall status play of the current remediation measures being implemented from its end, which shall include: - The implementation of a system, or other adequate measures, to enable the cumulative linking of transactions to a specific customer, in order to determine when such client reaches the €2,000 Page: 4 deposit threshold, whether through a single transaction or through multiple transactions which cumulatively meet or exceed the said threshold, regardless of whether this occurs within the context of an occasional transaction (which includes a series of linked transactions) or a business relationship. - The implementation of a system, or other adequate measures, to allow the Company to determine the point in time at which one or a series of linked occasional transactions transitions into a business relationship. - Providing evidence that, once a customer meets the €2,000 deposit threshold, the following AML/CFT obligations are consistently and effectively carried out: (a.) application of CDD measures; (b.) completion of a robust CRA; and (c.) formulation of a comprehensive customer profile, all in accordance with the risk based approach. - Undertaking updates and further enhancements to the processes and procedures currently adopted for the collection of information on the purpose and intended nature, which is utilised for customer profiling purposes, as well as to framework in place in relation to ongoing monitoring, with a particular emphasis on the scrutiny of customer transactions. The administrative penalty hereby imposed is not yet final and may be appealed before the Court of Appeal (Inferior Jurisdiction) within the period prescribed by the applicable law. It shall become final upon the lapse of the appeal period or upon final determination by the Court. Key Take-aways - For all subject persons licensed as remote gaming operators, including those operating within a retail environment via physical establishments such as betting shops, it is of utmost importance that such subject persons have systems or adequate measures in place to cumulatively link transactions executed by their customers in order to determine when the €2,000 deposit threshold is reached, both in the context of multiple linked occasional transactions and within a business relationship. Adopting these mechanisms not only ensures that the subject person is able to fully comply with its AML/CFT requirements once the €2,000 threshold is met, such as those related to CDD, CRA and monitoring (where applicable), but also helps to minimise the risk that such threshold is circumvented and abused. - While there is no automatic requirement for each and every customer transaction to fall under the concept of a business relationship, the subject person must nonetheless have the ability to monitor the aggregate transactional activity of each client and have a holistic view thereof. This would allow the subject person to establish, where applicable, the point in time at which the interaction with the customer ceases to constitute an occasional transaction or a series of linked occasional transactions, but has instead evolved into a business relationship. A key factor underpinning this determination is the frequency of the customer’s activity – once it becomes evident that there exists an element of duration and that such activity is habitual, the interaction cannot be regarded as falling under the concept of an occasional transaction. The above position is supported by Section 4.2.1 of the IPs – Part I, which stipulates that where services or transactions are carried out on a regular basis on behalf of the same customer, such activity cannot fall within the concept of an occasional transaction, notwithstanding the fact that there may have been no intention to set-up a relationship at the outset. Even though there is no prescribed criteria or metrics that automatically trigger the transition from an occasional transaction to a business relationship, this is a determination that the subject person needs to make itself in line with the risk-based approach, taking into account relevant customer and transactional data. Page: 5 - In accordance with Section 4.4.2 of the IPs – Part I, when formulating a customer’s business and risk profile, subject persons are required to obtain information on, and where necessary, supporting documentation in relation to the following: a.) The customer’s business/occupation/employment; b.) Any other activity in addition to a.) above from which the customer derives his/her wealth (e.g. inheritance); c.) The expected source and origin of the funds to be used throughout the relationship; and d.) The anticipated level and nature (including expected value and frequency of transactions) that is to be undertaken throughout the relationship. With specific reference to the remote gaming sector, and as per Section 3.2 of the IPs – Part II for the Remote Gaming Sector, where the ML/FT risk is not high, obtaining a customer declaration including details such as the nature of employment or business and typical annual salary amount may be sufficient for customer profiling purposes. However, where the risk is higher, or where there are any doubts regarding the veracity of the information provided, it must be corroborated by means of independent and reliable additional information and documentation. In the case of non-high risk customers, subject persons may also consider utilising statistical data to develop behavioural models against which customer activity can be assessed over time rather than collecting source of wealth information. Such models may be based on official economic indicators or on data gathered internally by the subject person over a period of time. - In addition, Section 4.4.2 of the IPs – Part I also stipulates that subject persons should not restrict the collection of information for customer profiling purposes to vague and generic terms such as “business”, “employment”, or “inheritance”, as such descriptions would never be deemed sufficient to meet this obligation, independently of the risk presented. Indeed, it important that the information acquired tangibly assists in understanding the customer’s background and financial standing. Thus, by way of example, it is not sufficient for the client to merely state that he or she is “employed”, as this does not identify the nature of his/her job, his/her employer, the sector in which he/she works, or the position he/she holds, all of which are relevant in assessing whether his or her financial activity is consistent with his or her declared profile. Similarly, the term “savings”, without further context, and particularly without sufficient details regarding the customer’s employment, fails to explain how those funds were accumulated and from what underlying source. 23 March 2026 Page: 6

Publication-Notice-23032026-2.pdf

Classification

Pipeline Progress

🔄 Pipeline Journey

🤖 How this summary was made

Full AI Instructions