Publication-Notice-25.06.2026.pdf

Administrative Measure Publication Notice This Notice is being published by the Financial Intelligence Analysis Unit (FIAU) in terms of Article 13C of the Prevention of Money Laundering Act (PMLA) and in accordance with the policies and procedures on the publication of AML/CFT administrative measures established by the Board of Governors of the FIAU. The Notice provides select information from the FIAU’s decision imposing the respective administrative measure and is not a reproduction of the actual decision. DATE OF IMPOSITION OF THE ADMINISTRATIVE MEASURE: 25 June 2026 RELEVANT ACTIVITY CARRIED OUT: Investment Services SUPERVISORY ACTION: Full scope compliance examination carried out in 2022 DETAILS OF THE ADMINISTRATIVE MEASURES IMPOSED: Remediation Directive in terms of Regulation 23(1)(c) of the Prevention of Money Laundering and Funding of Terrorism Regulations (the PMLFTR) LEGAL PROVISIONS BREACHED: - Regulation 5(1) of the PMLFTR and Sections 3.3 and 3.3.1 of the FIAU Implementing Procedures – Part I (the IPs), as amended on 18 October 2021 - Regulation 5(5)(a)(ii) of the PMLFTR and Sections 3.5.1, 3.5.2, and 3.5.3 of the IPs - Regulations 7(1)(a), 7(1) (b), 11(5) and 11(8) of the PMLFTR and Section 4.9.2.2(c) of the IPs - Regulation 7(1)(c) of the PMLFTR and Section 4.4.2 of the IPs - Regulation 7(2)(b) of the PMLFTR and Section 4.5.1 (b) of the IPs - Regulation 7(2)(a) of the PMLFTR and Sections 4.5.1(a) and 4.5.2 of the IPs - Regulations 13(1) and 13(2) of the PMLFTR and Sections 9.1, 9.2(c), and 9(5)(2) of the IPs REASONS LEADING TO THE IMPOSITION OF THE ADMINISTRATIVE MEASURE: Business Risk Assessment (BRA) – breach of Regulation 5(1) of the PMLFTR and Sections 3.3 and 3.3.1 of the IPs The compliance examination identified that the Company was not timely in obtaining formal Board approval of its BRA, with the Committee noting that a Board-approved BRA was not in place as from 1 January 2018. Page: 1 In addition, certain shortcomings were observed in the substance of the BRA, particularly in relation to the accuracy of figures and statistics reported under some of the four risk pillars, the level of data granularity, and the clarity with which the risks and corresponding controls were described. Some inconsistencies were also noted within the jurisdictional risk assessment (JRA). While the Committee noted the presence of a number of weaknesses in the Company’s BRA, it also took into account that certain discrepancies, including those relating to delivery channel risk and geographic risk, were relatively minor and did not have an impact on the overall residual risk result. In this regard, the Committee also noted positively the remedial actions undertaken by the Company, including the subsequent completion of the required JRAs for the previously unassessed jurisdictions. Customer Risk Assessment (CRA) – breach of Regulation 5(5)(a)(ii) of the PMLFTR and Sections 3.5.1, 3.5.2 and 3.5.3 of the IPs. The compliance examination identified a number of shortcomings in the Company’s previous CRAs and underlying CRA methodology. In particular, it was noted that such CRA methodology was not sufficiently comprehensive and overly subjective, with geographic risk and reputation/behavioural risk not being adequately taken into consideration in certain cases. Other issues noted at the time when the prior CRA framework was in place include the following: • In a limited number of instances, CRAs were not supported by a documented methodology or calculations to justify the assigned risk scores; • CRAs pertaining to certain customer files were not updated following a trigger event; • The Company did not distinguish between initial and subsequent CRAs, as prior assessments were, at times, overwritten without retaining adequate record thereof, thereby hindering its ability to carry out CRAs in a timely and documented manner. Further to the above, it was observed that there were instances where CRAs were not being carried out at onboarding, i.e., upon the establishment of the business relationship. In addition, a number of customers continued to be assessed with the previous inadequate methodology and therefore required updating. In this respect, the Committee confirmed that the previous CRA methodology was inadequate and lacked objectivity, notably in terms of its structure and level of detail, which reduced its effectiveness in supporting a consistent and sufficiently granular assessment of ML/FT risks. Particularly, the absence of clearly defined risk factors, objective scoring criteria, and sufficient granularity meant that the methodology could not reliably differentiate between varying levels of risk across the Company’s customer base. Notwithstanding the above, the Committee acknowledged that the Company had identified these deficiencies of its own accord through the independent audit conducted prior to the compliance examination, and had made efforts to remediate these deficiencies through an updated CRA methodology, as well as the completion of all JRAs as previously mentioned. Additionally, the Company sought to address the deficiency of documenting a proper audit trail through the set-up of the new CRA template. The Committee found that the Company was required to conduct CRAs based on a clear methodology, including documented calculations and all the relevant risk factors. The Committee did, however, positively acknowledge that a revised CRA methodology was subsequently implemented as evidenced through the Company’s representations for certain customer files. Customer Due Diligence (CDD) – breach of Regulations 7(1)(a), 7(1) (b), 11(5) and 11(8) of the PMLFTR and Section 4.9.2.2(c) of the IPs The compliance examination revealed that, in one isolated instance, there were certain issues in relation to the establishment and determination of the customer’s ownership and control structure. Page: 2 After deliberations, the Committee found that the Company failed to establish persons behind the shareholder entities within the customer’s structure chart1, including those holding smaller percentages, which could collectively result in ownership or control meeting the threshold as defined in Regulation 2(1) of the PMLFTR. The Committee emphasised that beneficial ownership should be assessed holistically, and that individuals acting through multiple entities may ultimately meet the relevant threshold when considered in aggregate. Through the compliance report, the Committee noted that in one (1) instance, enhanced due diligence (EDD) measures were not undertaken by the Company despite the circumstances warranting such measures in line with Section 4.9 of the IPs. Customer Due Diligence (CDD) – Purpose and Intended Nature – Regulation 7(1)(c) of the PMLFTR and Section 4.4.2 of the IPs The compliance report noted that, for a few customer files, the Company did not ensure that sufficient information and documentation was collected to properly establish the customers’ business and risk profiles, including information on the Source of Wealth (SOW) and Source of Funds (SOF). By way of example, in the case of one high-risk file, the Company relied on an unverified SOW/SOF self- declaration, without obtaining independent evidence to substantiate the transactional amounts involved. Ongoing Monitoring – Updating of Documentation - Regulation 7(2)(b) of the PMLFTR and Section 4.5.1 (b) of the IPs The compliance examination identified a number of customer files for which periodic reviews were not being conducted in line with the Company’s own policies and procedures, which resulted in certain verification documentation being expired. On this point, the Committee emphasised that the timely updating of CDD documentation is fundamental to an effective AML/CFT framework, since it ensures that customer profiles remain accurate and up-to-date. Such updates should be conducted based on the risk-based approach, with the frequency and extent of reviews commensurate with the customer’s risk profile. Ongoing Monitoring – Scrutiny of Transactions – breach of Regulations 7(1)(d), 7(2)(a) and 11(9) of the PMLFTR and Sections 4.5.1(a) and 4.5.2.2 of the IPs The compliance report found that in relation to a few customer files, the Company did not retain sufficient information and supporting documentation to adequately substantiate the transactional activity taking place. In relation to these customer files, the Committee noted that the Company’s approach to ongoing transaction monitoring presented certain limitations, because it did not adequately assess whether transactions were consistent with the customer’s profile, nor was additional information or supporting documentation consistently requested where merited. Record Keeping - breach of Regulations 13(1) and 13(2) of the PMLFTR and Sections 9.1, 9.2(c) and 9(5)(2) of the IPs During the compliance examination, it was observed that extractions from the Company’s record keeping system were not always consolidated, resulting in certain omissions and inconsistencies in customer data. The Committee positively noted that, in its representations, the Company committed to enhancing its record keeping processes in order to ensure the maintenance of consolidated records, including 1 For the purposes of this publication, shareholders or shareholder entities shall refer to all shareholding entities in the structure chart, whether direct or indirect. Page: 3 comprehensive client and transaction lists. In the Committee’s view, such measures should assist the Company in retaining accurate, comprehensive, and readily retrievable records. ADMINISTRATIVE MEASURES TAKEN BY THE FIAU’S COMPLIANCE MONITORING COMMITTEE: As outlined above, the Committee determined that the Company had failed to comply with various AML/CFT obligations arising from the PMLFTR and the IPs. In view of the breaches identified, the Committee decided to exercise its powers under Regulation 23(1)(c) of the PMLFTR and to issue a Remediation Directive. In reaching its decision regarding the appropriate administrative measure, the Committee took into account all information made available during the compliance examination, together with the representations subsequently submitted. While emphasising the importance of the identified shortcomings and the importance of full and timely compliance with AML/CFT requirements, the Committee noted the presence of several mitigating factors which were considered relevant in determining the proportionality of the measure imposed. In particular, the Committee observed the breaches were either observed in a limited number of customer files reviewed during the compliance examination or else were not considered to be material enough to consider them as serious or systematic in nature. In view of this, the Committee considered the shortcomings to be of generally low materiality. Furthermore, the Committee acknowledged that following the examination, it was clear from the representations of the Company that many of these issues were historical in nature and, based on the Company's representations, had already been addressed through remediation efforts. This consideration was instrumental in the Committee’s decision, as it recognised the Company’s efforts to update and refine its policies and procedures following the earlier breaches. Against this background, the Committee concluded that the imposition of a Remediation Directive, was appropriate in the circumstances. The Directive is intended to ensure that the Company addresses the identified shortcomings, strengthens its AML/CFT control framework, and attains full and sustained compliance with its legal obligations under the PMLFTR and the IPs. By means of the Remediation Directive, the Company is required to implement targeted remedial measures aimed primarily at strengthening its BRA, CRA framework, CDD arrangements for both identification and verification as well as for purpose and intended nature, ongoing monitoring and updating of documents, and ongoing transaction monitoring and scrutiny processes as well as record-keeping arrangements, including but not limited to: - Reviewing and enhancing the BRA to ensure that it functions as a comprehensive, accurate, and dynamic tool for identifying, assessing, and mitigating all inherent ML/FT risks arising from its business model, products and services, customer base, delivery channels, geographical exposure. - Applying a consistent and well-defined risk assessment methodology across all customers, ensuring that risk scores are determined in a uniform manner across its customer base. - Ensuring all customers are properly identified and verified prior to onboarding and ensuring EDD measures are consistently applied to PEPs, their family members and close associates. - Enhancing the customer profiling framework to ensure that customer information is sufficient to support effective risk assessment and ongoing monitoring. - Maintaining appropriate systems and controls to monitor the validity of CDD on an ongoing basis, such that expired or outdated documents are promptly identified and updated. - Strengthening its transaction monitoring framework to ensure timely detection and assessment of unusual or potentially suspicious activity. - Maintaining a complete, accurate, and consolidated client list and list on occasional transactions and ensuring that data is orderly and stored in a retrievable manner. Page: 4 The Directive served on the Company shall ensure that sufficient and tangible progress is achieved on the adoption and implementation of all the procedures and measures referred to above. In the event that the requested information and/or supporting documentation are not made available within the stipulated timeframes, or the Company falls short of its obligations in terms of this Directive, the Company’s default will be communicated to the Committee for its eventual actions, including the possibility of the imposition of an administrative penalty in terms of the FIAU’s powers under Regulation 21(1) of the PMLFTR. Key Takeaways - In line with Regulation 5(1) of the PMLFTR and Sections 3.3 and 3.3.1 of the IPs, subject persons shall ensure that it has a formal BRA in place which is documented, dated, and approved. The BRA should comprehensively cover all four risk pillars, based on accurate and granular data, and tailored to the subject person's specific business model. Subject persons should ensure that risks are properly identified, supported by reliable statistics, and list the risk scenarios and controls implemented by the Company in sufficient detail. Similarly, subject persons should also ensure that the JRA is accurate and complete. - In accordance with subject person’s obligations stipulated in Regulation 5(5)(a)(ii) of the PMLFTR and Sections 3.5.1, 3.5.2 and 3.5.3 of the IPs, a CRA methodology is to be robust, objective and consistently applied. Subject persons should ensure that CRAs are conducted and documented at onboarding. Equally important is maintaining a clear audit trail, preserving historical assessments, and updating CRAs on both a periodic and trigger-event basis, particularly when there are material changes in a customer's risk profile. - For establishing the purpose and intended nature of a business relationship, subject persons should ensure adherence to Regulation 7(1)(c) of the PMLFTR and Section 4.4.2 of the IPs. Specifically, subject persons should ensure that sufficient information, and when applicable, independently verified information is also obtained in order to understand a customer's overall risk profile. Moreover, subject persons should not rely solely on self-declarations for customers rated as higher-risk. Adding to this, information such as share capital alone is not sufficient to corroborate a client’s SOW and SOF, and that more reliable documentation, such as audited financial statements (where applicable), should be obtained to ensure an informed and risk-based understanding of the customer relationship. - With respect to the requirements in Regulation 7(2)(b) of the PMLFTR and Section 4.5.1 (b) of the IPs, subject persons are reminded that ongoing monitoring is not a one-time exercise since CDD is be kept up to date throughout the business relationship. Subject persons should ensure that periodic reviews are conducted in accordance with their own policies and procedures, with the frequency and scope of reviews determined by the customer's risk profile. - Regulations 7(1)(d), 7(2)(a) and 11(9) of the PMLFTR and Sections 4.5.1(a) and 4.5.2.2 of the IPs require the implementation of effective ongoing transaction monitoring with the aim of identifying unusual, suspicious, and complex transactions, as well as ensuring that customer activity is continuously assessed against the customer's known profile. Subject persons should not rely solely on customer declarations or unverified explanations in higher-risk scenarios or when the customer activity does not match the information in the customer profile. In such cases, sufficient, independent, and verifiable documentation to support the SOW and SOF is required. Page: 5 - With respect to Regulations 13(1) and 13(2) of the PMLFTR and Sections 9.1, 9.2(c) and 9(5)(2) of the IPs on record-keeping obligations, subject persons are to remain vigilant in ensuring the accurate, complete, and readily retrievable records of their client and transaction data. Having such records in a consolidated and standardised manner enables subject persons in other obligations including effective monitoring, reviewing and regulatory reporting. 25 June 2026 Page: 6