Dear-CEO-Letter-Investment-Firms-Outcomes-Based-Su

MFSA-PUBLIC 08th June 2026 Conduct Supervision Tel: (+356) 21441155 Dear Chief Executive Officer, Dear Compliance Officer, INVESTMENT FIRMS: OUTCOMES BASED SUPERVISION 2025 You are receiving this letter as the Chief Executive Officer and Compliance Officer of an investment firm supervised by the Malta Financial Services Authority (referred to herein as the “MFSA” or the “Authority”). INTRODUCTION The MFSA endeavours to stimulate compliance with applicable rules governing investment services licensed entities (also hereinafter referred to as ‘‘licensed entities’’, or ‘‘investment firm/s’’, or “regulated persons”) for a fair, honest, and transparent financial market, which in turn strengthens confidence within same market, with the aim of protecting investors. To this end, the Authority’s supervisory activities are aimed at attaining high compliance standards within the supervised licensed entities using diversified tools encompassing mystery shopping exercises, thematic reviews, off-site work, supervisory meetings, and on-site inspections. Marketing communications play a crucial role in impacting consumer behaviour and influencing their investment decisions. An advertisement can significantly influence the prospective client who may not have the knowledge about certain products. Misleading advertisements may not adequately warn the client of risks that may arise from the investment product or may over emphasise benefits over risks. Accordingly, licensed entities are to ensure that all their marketing communications are fair, clear and not misleading, so that they are easily understood by retail clients. STRENGTHENING SUPERVISORY EFFECTIVENESS THROUGH COMPLIANCE OUTCOMES – BASED SUPERVISION A thematic review involves an in-depth assessment of identified risks and issues that may have broader implications for the financial services market. By examining specific matters in detail, such reviews enable meaningful comparisons to be drawn and analysed across locally licensed entities and support the identification of common trends and areas of concern. Throughout 2025, the Authority applied the Compliance Outcomes Based Supervision approach across its supervision of the entire financial services sector in Malta. This approach focuses on achieving the intended results of supervisory interactions in an efficient and effective manner, while upholding the three core objectives of financial regulation: consumer protection, financial stability, and market integrity. Its primary aim is to ensure a broader reach across the population by delivering tangible, measurable outcomes over a defined period. The selection of the compliance outcomes for 2025 was primarily guided by observations from past interactions carried out by the Authority along with trends identified through regulatory reporting. 1 MFSA-PUBLIC For the purpose of this approach, the Authority follows a three (3) year supervisory engagement cycle with the Licensed Entities. During the first year of this cycle, the Authority will engage with the sector via a thematic review or onsite inspections focusing on a particular area. During the second year, the Authority will communicate its findings and expectations with the industry and, expects that licensed entities conduct a compliance gap analysis and address any identified deficiencies. In the third year, the Authority will re-engage and re-assess the licensed entities to measure the achievement of the above-mentioned outcome. This re- assessment will serve to verify whether the licensed entities have effectively addressed the compliance gaps identified and implemented the necessary corrective measures to ensure full alignment with regulatory obligations. The purpose of this letter is to provide further guidance to licensed entities on how certain issues should be addressed in accordance with the applicable rules, regulations, and guidelines. This letter sets out the key findings arising from a thematic review conducted in 2025, which covered a range of supervisory areas, including marketing practices. It also sets out the observations identified during the review, highlighting both good and poor practices, and outlines the Authority’s expectations in this area. BACKGROUND AND METHODOLOGY During the year 2025, the Authority’s supervisory priorities partially focused on the importance of compliant marketing. The main scope of this priority is to ensure that adverts relating to financial products and services are fair, clear and not misleading, making sure that clients are not enticed to purchase products which do not meet their objectives. This includes verifying that all promotional content, advertisements, and disclosures accurately represent the nature, features, and risks of the services and products being offered. These requirements apply equally to business conducted on a cross-border basis. When issuing advertisements, regulated persons are expected to provide information in a comprehensible form, enabling clients to understand the key characteristics, risks, and potential benefits of the service or product, and to make decisions on an informed basis. Disclosures must be made in good time prior to the provision of the service or the conclusion of any contract, ensuring that Clients have sufficient opportunity to process the information before making a purchasing decision. In turn, this outcome supports the Authority’s objective of promoting transparency, protecting consumers, and maintaining confidence in financial markets by ensuring that marketing and promotional practices align with regulatory expectations. The main areas assessed under this workstream were: 1. The Policies and Procedures for the Production and Approval of Marketing Communication; 2. Outsourcing; 3. Mediums of Disclosure; 4. Fair, Clear and Not Misleading Marketing Communication; and 5. Record Keeping of Marketing Communication A sample of eight (8) locally licensed investment firm, four (4) of which also offer services on a cross-border basis were selected based on the marketing materials distributed during 2024. These investment firms represent eleven percent (11%) of all investment firms servicing retail clients. To assess the level of adherence to the rules outlined within the Conduct of Business Rulebook (“COBR”), a self-assessment questionnaire was distributed to the sample, to be populated by the compliance officer of the respective Investment Firms. Additionally, a set of documents were also requested, including: (i) the policies and procedures for the production and approval of marketing communication (ii) an extract of the compliance monitoring programme outlining marketing checks carried out, (iii) the log outlining deficiencies pertaining 2 MFSA-PUBLIC to marketing materials, (iv) the checklist followed when selecting third-party service providers, (v) a sample of an e-mail sent to a specific segment of clients, (vi) an example of marketing material distributed on social media and (vi) the marketing material log, further assess the compliance and alignment with the marketing requirements The Authority has also issued one-to-one letters to the sampled investment firms, outlining the main findings identified during this review and setting out the Authority’s expectations for remediation. Overall, the Authority noted with concern that certain investment firms had not adequately addressed key elements relating to the review of marketing materials. Firms are expected to take prompt corrective action to address the regulatory shortcomings highlighted and to ensure full compliance with the areas assessed. In light of the shortcomings identified, the Authority is issuing this Dear CEO Letter to highlight the key findings and set clear expectations for remediation. This letter outlines the relevant regulatory requirements and provides guidance on how investment firms are expected to meet their obligations on an ongoing basis. KEY FINDINGS A. POLICY GOVERNING THE APPROVAL AND DISTRIBUTION OF MARKETING MATERIAL As per the COBR, licensed entities are required to have in place internal procedures for issuing or approving marketing material. Such policies and procedures shall outline the Company’s process of approving and issuing marketing material in line with the rules emanating from Chapter 1, Section 2 of the COBR. The following findings relate to such policies provided by the sample undertaken for this exercise. [i] Granularity of Policies and Procedures Regulatory Requirements and Guidelines In line with Rule R.1.2.10(b) of the COBR, when issuing or approving advertisements, Regulated Persons shall have in place internal procedures relating to the approval of advertisements to be issued by the Regulated Person. Key Findings The Authority noted that the policy submitted by one (1) investment firm was overly brief and was drawn up in a one (1) page document and thus, did not contain sufficient detail to evidence an adequate and comprehensive framework for the approval and ongoing oversight of marketing communications. On the other hand, the Authority noted that the other sampled investment firms had established a marketing policy governing the approval and production of marketing materials. However, the Authority also observed that certain policies did not always consistently reflect the processes implemented in practice. These discrepancies were identified when investment firms indicated in the self-assessment questionnaires that certain practices were being carried out, but the relevant policies did not include any corresponding reference to such practices. Set out below are examples of requirements that were not incorporated within the policies: i. Ensuring that comparisons of products are presented in a fair and balanced manner, that sources of information are specified and that key-facts and assumptions used to make comparisons are included when advertisements or information compares investments or ancillary services, as per R.1.2.61 of the COBR; ii. Ensuring that the name of the Authority or any other competent authority is not included in a way that suggested endorsement or approval of its products and services, as per R.1.2.15 of the COBR; 3 MFSA-PUBLIC iii. Ensuring that the target market for whom the advertisement is intended for and the method of circulating the advertisement is appropriate for that target market, as per R.1.2.10(c) of the COBR; iv. Ensuring that any advertisements containing acronyms or initials also state what the acronyms or initials stand for, as per R.1.2.19 of the COBR; and v. Ensuring that marketing material is kept up to date with the information in investment firms provides to its clients in the course of delivering its services, as per R.1.2.21 and R.1.4.9(g) of the COBR. Expectations Investment firms are expected to establish detailed policies and procedures governing the issuance and approval of marketing materials to ensure that such communications are fair, clear and not misleading. Furthermore, these policies and procedures should reflect the practices applied in practice when reviewing, approving and distributing marketing materials, to ensure consistency between documented frameworks and operational implementation. [ii] Review of Policies and Procedures Regulatory Requirements and Guidelines Reference is made R3-3.2.1 and R3-3.2.2(i) of the Investment Services Rules for Investment Services Providers which establishes that the Licence Holder shall establish and maintain an effective compliance function, who in turn, should monitor on a regular basis, the adequacy and effectiveness of the measures, policies and procedures put in place. Key Findings The Authority noted that two (2) investment firms indicated that reviews of their policies and procedures are conducted on an as-needed basis. Furthermore, one (1) of these firms included references to Part BI: Standard Licence Conditions applicable to investment services licence holders qualifying as MiFID firms within its policy, suggesting that the policy may not have been reviewed regularly, as it did not reflect the current applicable regulatory framework. The Authority also noted that one investment firm stated in its self-assessment that its policies are reviewed on an annual basis. Notwithstanding this assertion, a review of the policy submitted as part of this thematic exercise indicated that, although the policy had been reviewed annually during the past two years, such frequency had not been consistently maintained in earlier years. In fact, it was observed that a period of four years had elapsed before the first documented review was carried out. In addition, the Authority observed that five (5) investment firms did not incorporate a review of their marketing policy within the Compliance Monitoring Programme (CMP), per the extracts of the respective CMPs. While the Authority cannot confirm whether such policy reviews were addressed elsewhere within the CMP, it emphasises that the review of the marketing policy should be explicitly incorporated to ensure proper oversight and compliance. Furthermore, the Authority observed that two investment firms did not maintain a document control log detailing version history, records of amendments introduced during each review, the dates on which such reviews were conducted, and the individuals responsible for drafting and approving the relevant policies and procedures. 4 MFSA-PUBLIC Expectations Although the Rules do not specifically prescribe a version control log, it is deemed to be a best practice that policies and procedures show a record of the exact date of the last amendment thereto and the respective version of the policy along with the updates performed, so that a proper audit trail is kept. Such log shall also include the officials responsible for the drafting and approval of said policies and procedures The Authority expects that investment firms include a provision within their policies and procedures specifying the frequency for review. In turn, reviews are to be carried out in accordance with the cycles set out in the policies and procedures and shall be reflected, where appropriate, within the investment firm’s CMP. The Authority further emphasises that policies and procedures are expected to be fully aligned with the latest applicable regulatory framework. B. COMPLIANCE MONITORING PROGRAMME (CMP) The CMP is a compliance tool utilised primarily by the compliance function to ensure that the regulated entity is operating in line with applicable legislative and regulatory requirements. On this basis, the CMP should also incorporate specific checks relating to marketing activities, including the review of marketing materials, marketing policies and procedures, and related controls, to ensure that all communications are consistent with regulatory obligations and appropriately targeted to the defined audience. [i] Marketing Reviews as Part of the Compliance Monitoring Programme Regulatory Requirements and Guidelines Reference is made to Section 5.1 Responsibilities of the Compliance Function, specifically paragraphs 14 to 18 of ESMA’s Guidelines on certain aspects of the MiFID II Compliance Function Requirements which outline that the compliance function must conduct a risk assessment covering all services, clients, products, and operations to identify compliance risks and establish a risk-based monitoring programme. This programme should guide monitoring, advisory, and resource allocation, while being regularly reviewed and updated to address emerging risks, and consider prior monitoring results and audit findings. Furthermore, whilst the COBR does not expressly provide for post-publication checks, the Authority considers the implementation of such checks as best practice. This position derives from the obligation set out in Rule R.1.2.6 of the COBR, pursuant to which all advertisement and information must be fair, clear and not misleading. In addition, the following COBR provisions set out the requirement for investment firms to ensure that disseminated information remains current: R.1.2.21 of the COBR, which states that “A Regulated person shall ensure that any information contained in a marketing communication is consistent with any Information the Regulated Person provides to a client in the course of carrying on Services and Ancillary Services.”; and R.1.4.9(g) of the COBR which states that “A Regulated Person shall ensure that the information referred to in R.1.4.8 complies with the following conditions: (g) the Information is up to date and relevant to the means of communication used.” 5 MFSA-PUBLIC Key Findings The Authority observed that most of the sampled investment firms incorporated marketing communication checks within their CMP. With this said, the Authority noted that one (1) investment firm only included checks for marketing materials distributed via social media platforms, whereas the firm confirmed that marketing content is also disseminated through other channels, including television, radio, and billboards, among others in the self- assessment. In addition to the above, in terms of post-publishing checks, it was observed that four (4) investment firms conduct post-publication checks of marketing communications on a sample basis; however, the review frequency is inadequate, ranging from semi-annual to annual, upon request and, in some cases, not defined at all. Such extended or unspecified frequency substantially reduces the real effectiveness of this control and increase the risk that inaccurate or potentially misleading materials remain accessible to clients or prospective clients for a prolonged period. Furthermore, one (1) investment firm confirmed that it is not currently conducting any post-publishing checks and that any reviews carried out are random and do not form part of an established procedure. Expectations The Authority expects investment firms to conduct post-publishing checks on marketing materials that are commensurate with the size, nature, and complexity of the firm’s activities. While the Authority acknowledges that the risk of non-compliant communications may be mitigated where marketing materials are subject to prior approval by the Compliance Officer, it remains essential for firms to perform post-publishing reviews to verify that the materials ultimately disseminated correspond to those that were formally approved and to ensure that the content remains accurate and up to date with respect to the investment firms’ services. The Authority further expects that such post-publishing checks are incorporated within the CMP. In addition, any findings arising from these reviews should be appropriately documented and reported to the Board of Directors. C. DISCLOSURES Disclosures play a critical role in the provision of information and advertisements to individuals, as they enable clients or potential clients to understand the nature of the products and services offered by investment firms. On this basis, all advertisements should be fair, clear, and not misleading, with disclosures that are both readily available and prominently presented. [i] Indicators of risks when referring to benefits Regulatory Requirements and Guidelines In line with Rule R.1.2.7(i) of the COBR, “…a Regulated Person shall ensure that any advertisement and Information is not misleading in relation to (i) any relevant risks and, in particular, shall not emphasise any potential benefits of a Product or Service without also giving a fair and prominent indication of relevant risks.” Key Findings The Authority observed that, notwithstanding one (1) investment firm’s confirmation that its marketing communications include a clear and prominent disclosure of risks when referencing potential benefits, a review of the firm’s website identified language that appears inconsistent with such representation, as it placed undue emphasis on the potential benefits of investing without ensuring a fair and clear presentation of the associated risks. 6 MFSA-PUBLIC Expectations The Authority requires investment firms to conduct a detailed review of all marketing materials to ensure a fair and balanced presentation of both risks and potential returns. This is intended to enable users to make informed decisions with a clear understanding of the risks involved. [ii] Statements relating to external sites Regulatory Requirements and Guidelines In line with Rule R.1.111(e) and G.1.2.8 of the COBR, Regulated Persons are to include appropriate statements that the Client or prospective Client is leaving the internet site and accessing another in cases where the internet site of the Regulated Person is hyperlinked to other sites. Key Findings The Authority observed that three (3) investment firms failed to include an appropriate statement informing users that they are leaving the investment firm’s website and being redirected to a third-party website, following a confirmation in self-assessment. Conversely, the Authority noted that one (1) investment firm indicated that it does not provide such disclosures, although the requirement was reflected within its marketing policy. In two (2) instances, although not strictly related to marketing materials but rather to informational content provided to users, the Authority noted the absence of such statement when directing users to the website of the Office of the Arbiter for Financial Services in the context of complaints handling, as well as when providing a link to the website of the Malta Tax and Customs Administration for tax-related purposes. In another case, the Authority observed that no such statement was provided when a user selected a service within the investment firm’s website, resulting in a redirection to a subsidiary within the same group as the investment firm. In this regard, the Authority emphasises that, notwithstanding group affiliation, where entities operate under separate licences, an appropriate disclosure must be included. Additionally, the Authority noted an instance where no statement was provided when users clicked on social media icons on the investment firm’s website, which redirected them to the firm’s social media platforms. Expectations Appropriate and prominent statements shall be implemented consistently across all hyperlinks directing users to external content, including but not limited to links to social media platforms Users accessing external links from an investment firm’s website must be clearly informed that they are leaving the firm’s website. In the absence of such statement, clients may be unaware that they are no longer accessing the firm’s website, which in turn may may cause confusion relating to the nature of the products and services are being offered, and who the service provider is. [iii] Mention of the MFSA to suggest approval of a service Regulatory Requirements and Guidelines In line with Rule R.1.2.15 of the COBR, “a Regulated Person shall ensure that information shall not use the name of the MFSA or any other competent authority in such a way that would indicate or suggest endorsement or approval by the MFSA or any other competent authority of the Products or Services of the Regulated Person.” 7 MFSA-PUBLIC Key Findings An investment firm indicated in its self-assessment that it does not reference the Authority or any other competent authority in a manner that could imply endorsement or approval of its products or services. Notwithstanding this, a review of the firm’s website revealed that certain statements suggested that specific investment products are supported by a regulated investment experience, thereby potentially implying regulatory backing. Expectations The Authority expects investment firms to review and amend all marketing material and information that could refer to the Authority to ensure that such references are limited to statements of regulatory status. In particular, investment firms should remove or rephrase any language that may imply endorsement, approval, or a guarantee by the Authority of the security of services or the financial well-being of clients. Investment firms should further ensure that all references to regulatory supervision are presented in a neutral manner and are subject to appropriate compliance review prior to publication. [iv] Lack of Regulatory Disclosures Regulatory Requirements and Guidelines In line with R.1.2.14 of the COBR, advertisements are required to include a regulatory disclosure statement which is to indicate that the “Regulated Person is regulated by the MFSA or by a European regulatory Authority, as applicable, as well as a reference to the legislation under which such regulation is afforded”, unless exempted under G.1.2.2 of the Conduct of Business Rulebook. Key Findings It was noted that one (1) investment firm affirmed that it does not include a regulatory disclosure in all its advertisements it issues, indicating that the firm is regulated by the MFSA or a European Regulatory Authority, along with a reference to the relevant legislation. Such disclosure is essential to ensure that clients are provided with transparent and accurate information regarding the firm’s regulatory status, to mitigate the risk of misleading communications, and to enable clients to identify the appropriate authority responsible for the firm’s supervision. Further to a website review, the Authority also noted, that were this particular investment firm included a regulatory disclosure outlining that it is regulated by the MFSA, there was no reference to the legislation under which such regulation is afforded. Expectations The Authority expects all investment firms to ensure that licensing statements are included in advertisements and information issued, where applicable, as per G.1.2.2 of the Conduct of Business Rulebook and that such statements contain a reference to the relevant legislative framework, in accordance with the obligations outlined in the Conduct of Business Rulebook. D. MEDIA USED FOR MARKETING The Authority maintains oversight of the media through which marketing materials are disseminated, as information on such media is collected via the MiFID Firm Quarterly Report. Given the wide range of channels available (including newspapers, social media platforms such as Facebook, Twitter, Instagram, TikTok, YouTube, and LinkedIn, as well as emails, client newsletters, billboards, and other communication methods) investment firms must ensure that the selected media are appropriate and proportionate to the intended audience of the information or advertisement. 8 MFSA-PUBLIC [i] Defining the Target Market and Ensuring Appropriate Distribution Methods Regulatory Requirements and Guidelines In line with R.1.2.10(c) of the COBR, “when issuing or approving such Advertisements , Regulated Persons, other than Tied or Ancillary Insurance Intermediaries shall (c) identify the target market of the Client for whom the Advertisement is intended and ensures that the method of circulating the Advertisement is appropriate for the Identified target market.” Key Findings In one (1) instance, an investment firm confirmed that it uses a corporate partner for the distribution of marketing communications and that clients are acquired through the corporate partner’s client base. Furthermore, the investment firm established that e-mails relating to the investment firm’s services, distributed by the corporate partner, were sent to all clients of the corporate partner, without differentiation between clients who were already clients of the investment firm and those who were not. The Authority observed that the absence of segmentation by relevant client groups may indicate that the firm has not taken reasonable steps to ensure that its marketing communications are directed to, and capable of being understood by, the identified target market. Additionally, the distribution of such communications to recipients who do not utilise the Authorised Person’s services may result in information that is potentially misleading or confusing. Another investment firm confirmed in the self-assessment, that generic e-mail communications were sent to all clients and that communications that were specific in nature were targeted to relevant client groups based on the services provided, given that the firm provides a number of services, including but not limited to: execution only, advice and discretionary portfolio management. In this context, the investment firm provided two (2) examples of e-mails containing information relating to a newly issued complex secured bond, each including contact details of the investment firm’s team and an attachment relating to the bond issue. One e-mail was sent to advisory clients and included an investment recommendation within the attachment, whereas the e-mail sent to execution-only clients contained the same attachment without the recommendation. The Authority notes with concern that the e-mail communication was addressed personally to the recipients and the reference to the recommendation contained therein may therefore be perceived as a personal recommendation - provided without the attendant suitability assessment. Expectations Licence holders are expected to ensure that investment-related communications directed personally to recipients are carefully assessed to determine whether such communications may constitute a personal recommendation, as per Appendix 1 of Chapter 4 the Conduct of Business Rulebook and the Supervisory Briefing published by ESMA on the Definition of Advice under MiFID II. In instances where communications may be deemed to amount to a personal recommendation, licence holders should ensure compliance with all applicable suitability assessment requirements, as outlined above. Furthermore, the Authority expects investment firms to implement and maintain a robust segmentation process for all marketing communications, regardless of the distribution channel, including electronic and non-electronic means, to ensure that communications are specifically directed to the defined target market and are not misleading or inappropriate for recipients outside that market. 9 MFSA-PUBLIC E. THIRD-PARTY SERVICE PROVIDERS Investment firms may, in certain circumstances, engage third-party service providers to distribute marketing materials on their behalf. Notwithstanding such delegation, the responsibility to ensure the quality, compliance, and integrity of all marketing communications remains firmly with the investment firm. Firms must ensure that third-party providers are of an appropriate standard, governed by formal agreements, and subject to ongoing monitoring, review, and approval processes for any marketing materials they distribute. [i] Adequate Training for Third-Party Service Providers Regulatory Requirements and Guidelines Although the COBR does not include a direct requirement for regulated entities to provide training to third-party service providers, the Authority considers such training to be essential. This is particularly relevant in light of R.1.2.6 of the COBR, which places ultimate responsibility on the investment firm to ensure that all advertisements are fair, clear, and not misleading. Key Findings The majority of the sampled investment firms confirmed that they do not use any third-party service providers for the distribution of material. With this said, two (2) investment firms confirmed that they use such parties, in both cases for the distribution of marketing communications. Both investment firms outlined that no formal training is provided to such third parties. One (1) of the investment firms ascertained that no training is provided on the basis that the appointed third-party service provided is not involved in the creation or drafting of the marketing materials, but the role is limited strictly to distribution of marketing materials that have been reviewed and approved by the said investment firm. On the other hand, the other investment firm outlined that no formal training has been provided, however feedback and insight was provided when needed. Expectations The Authority expects investment firms to ensure that all third-party service providers engaged in the marketing communications process are duly informed of the applicable arrangements and their respective responsibilities, irrespective of their role, whether in the creation, development, or solely the distribution of such communications. Furthermore, any training should be formally documented in an appropriate register and delivered on an ongoing basis to ensure continued compliance and understanding. E. RECORD-KEEPING Through the outcomes-based supervision, record-keeping was considered in two key areas, i.e. the marketing log and the recording of breaches. Proper record-keeping is essential, as it allows investment firms to review past actions, demonstrate adherence to internal policies, and provide evidence of compliance with regulatory requirements and identify any gaps or deficiencies in processes. [i] Recording of Marketing Material Regulatory Requirements and Guidelines In line with Rule R.1.2.10(d) of the COBR, “when issuing or approving such Advertisements, Regulated Persons, other than i Tied Agents or Ancillary Insurance Intermediaries shall (d) keep records of all Advertisements issued and approved, including: 10 MFSA-PUBLIC i. An approved certification in electronic format by the Compliance or the designated officer in terms of (a) above, that each Advertisement complies with the requirements of these Rules; ii.The name of the individual who approved the Advertisements; iii.The date of approval of the advertisements; iv.The publications in which the Advertisements was included; and v.Documentary evidence in support of any statement made in the advertisement” Furthermore, Rule R.1.2.12 of the COBR states that Regulated Persons are “required to keep a copy of each, different kind of Advertisement issued or approved by it, for a period of not less than 5 years”. Key Findings Following a review of the marketing registers submitted, the Authority observed that one (1) investment firm failed to include the name of the individual responsible for approving the marketing material within the register. In addition, the register maintained by the same firm contained ambiguous date fields, rendering it unclear what the recorded dates refer to. Similarly, the Authority noted that another investment firm’s marketing policies outline that specific information should be recorded in relation to marketing materials, including the approval of the Compliance Officer, the name of the individual granting approval, the date of approval, the medium used for publication, the target market, and supporting documentary evidence. Nonetheless, although such information is referenced within the policy, a review of the marketing register indicated that not all these fields were reflected in the register itself. The Authority also noted that another investment firm confirmed in its self-assessment that records are maintained for all marketing communications issued and approved, including those published online for a limited period. However, while the firm maintained a marketing register, the Authority observed that the firm’s marketing policies and procedures did not include any reference to the record-keeping process, including the applicable retention period. Furthermore, the Authority observed that another investment firm, although outlining record- keeping arrangements within its policy, did not include any reference to the requirement to retain records of marketing materials for a minimum period of five (5) years. Expectations The Authority expects investment firms to maintain marketing registers that clearly record the name of the individual responsible for approving the marketing material. The register should also record the date of approval and include appropriate certification confirming that the marketing material complies with the applicable regulatory framework. Furthermore, the Authority reminds investment firms to formalise the record-keeping process within their relevant policies and procedures. Such policies and procedures should clearly specify that records relating to marketing materials are to be retained for a minimum period of five (5) years. In addition, where record-keeping processes are established within the policies and procedures, these should be adhered to in practice. Investment firms should ensure appropriate oversight of these processes and promptly address any deficiencies identified. [i] Recording of breaches relating to Marketing Material Regulatory Requirements and Guidelines Reference is made to R3-3.2.1 and R3-3.2.2(i) of the Investment Services Rules for Investment Services Providers which establishes that the Licence Holder shall establish and maintain an effective compliance function, who in turn, should monitor on a regular basis the adequacy and effectiveness of the policies and procedures and the actions takes to address any deficiencies accordingly. 11 MFSA-PUBLIC Key Findings The Authority observed that although one (1) investment firm confirmed that deficiencies relating to marketing material, specifically when material changes are identified following publication, are recorded and remedial actions are documented, a review of the marketing policies and procedures, revealed that there was no reference made to how such breaches should be identified and managed. Another investment firm highlighted that breaches relating to marketing material are outlined within the marketing register. Following a review of the marketing register, the Authority observed that the deficiencies recorded lacked sufficient detail as there was no reference to the root cause of the deficiency, the remedial actions undertaken, or the dates on which the deficiency was identified and subsequently rectified. Moreover, another investment firm indicated that a breach register is not maintained, citing the low number of isolated incidents, and noted that any deficiencies identified after marketing materials were issued were promptly addressed and the non-compliant materials removed. Expectations The Authority expects investment firms to document deficiencies through the maintenance of deficiency registers, capturing root causes, remediation actions, and relevant timelines. The Compliance Officer is responsible for reporting these deficiencies to the Board of Directors and ensuring that appropriate corrective actions are taken to address any identified gaps. GOOD MARKET PRACTICES • Two (2) regulated entities reviewed their policies and procedures in 2025, thus keeping their marketing policies updated and aligned to any amendments or additions to the applicable rules; • A particular regulated entity carried a gap analysis in line with the ESMA Final Report on the 2023 Common Supervisory Action and Mystery Shopping Exercise on Marketing. Furthermore, the same regulated entity conducted post-publication checks on marketing materials, although not on a periodic basis, including on-site visits to branches to review hard copy materials, such as brochures and leaflets, distributed to clients and prospective clients; • Two (2) regulated entities have set out a template of regulatory disclosures to be included on advertising material to be utilised by its marketing team when creating marketing material. Moreover, warning statements applicable for each product are also outlined within the policy to ensure that the right warnings are listed when issuing marketing content on specific products. Another entity included guidance on the appropriate warnings to be used for certain product, although not as detailed when compared to the other two (2) entities; and • Two (2) regulated entities implemented a marketing and advertising checklist to be completed for each advertisement or communication issued. The checklist incorporated the marketing rules set out in the COBR, ensuring that all marketing materials comply with the relevant regulatory requirements; 12 MFSA-PUBLIC WAY FORWARD As outlined throughout the contents of this letter, the Authority’s expectations are that licensed entities implement appropriate internal procedures to ensure that marketing material is fair, clear and not misleading to its ultimate target audience. It is therefore expected that licensed entities are, at all times, aligned with the requirements set out in Chapter 1 Section 2 of the COBR relating to Marketing Communications. The Authority will continue engaging with licensed entities as this three-year supervisory cycle progresses, through a follow-up to determine whether the findings outlined within this letter have been addressed. Should you require any clarification on the above, please do not hesitate to contact the Authority’s Conduct Supervision Function on csuinvestments@mfsa.mt. Yours faithfully, Malta Financial Services Authority Christopher P. Buttigieg Sarah Pulis Chief Officer Supervision Head – Conduct Supervision The MFSA ensures that any processing of personal data is conducted in accordance with Regulation (EU) 20161679 (General Data Protection Regulation), the Data Protection Act (Chapter 586 of the laws at Malta) and any other relevant European Union and national law. For further details, you may refer to the MFSA Privacy Notice available on the MFSA webpage www.mfsa.mt. 13