meta_id 3259763

On June 22, 2026, the Malta Financial Services Authority (MFSA) issued a Dear CEO Letter addressing risks of terrorist financing (TF), proliferation financing (PF) and targeted financial sanctions (TFS) evasion across Malta's credit institution sector. The letter, addressed to management bodies and money laundering reporting officers at all MFSA-licensed credit institutions, presents findings from a comprehensive thematic exercise and sets out supervisory expectations to strengthen financial crime compliance frameworks. The MFSA conducted the review across all locally incorporated banks and branches of foreign banks operating in Malta, and it was informed by Malta's national risk assessment (NRA), which identifies the banking sector as highly exposed to TF, PF and TFS evasion risks due to its central role in the movement of funds. The letter sets out the MFSA’s key findings across six key areas, as well as its expectations of credit institutions operating in Malta: Risk understanding and governance - the MFSA found that many credit institutions are aligning their entity-level assessments with Malta’s NRA and making substantive use of it within their frameworks. The MFSA expects entities to keep this link current by periodically refreshing NRA-derived assumptions and to ensure that any such assessment and associated risk rating are updated periodically. The MFSA expects entities to keep this link current by periodically refreshing NRA-derived assumptions and to ensure that any such assessment and associated risk rating are updated periodically. Identification and verification - the MFSA found that the implementation of dedicated systems to detect forged and fake identification documents was consistent with the fact that the majority of credit institutions in Malta onboard customers through face-to-face interactions. The MFSA expects entities to ensure that, when considering the procurement and deployment of identity-verification systems and tools, the solution’s capabilities and assurance level are appropriate for their intended use, and that the authentication checks are sufficiently reliable to detect forged or fake documents. The MFSA expects entities to ensure that, when considering the procurement and deployment of identity-verification systems and tools, the solution’s capabilities and assurance level are appropriate for their intended use, and that the authentication checks are sufficiently reliable to detect forged or fake documents. Transaction monitoring - the MFSA found that transaction monitoring controls are in place, with variations reflecting the differing sizes, complexities, and business models of Maltese-licensed credit institutions. The majority of entities indicated that they screen payment messages prior to settlement. The MFSA expects entities to determine, on a proportionate and risk-sensitive basis, whether transaction monitoring is to be performed through an automated tool or via a hybrid approach. When an automated solution is deployed, entities must demonstrate governance and transparency regarding the scenarios, typologies, and detection rules in use. The MFSA expects entities to determine, on a proportionate and risk-sensitive basis, whether transaction monitoring is to be performed through an automated tool or via a hybrid approach. When an automated solution is deployed, entities must demonstrate governance and transparency regarding the scenarios, typologies, and detection rules in use. Sanctions screening - the MFSA found that across credit institutions, sanctions screening is automated and predominantly third-party-enabled, and that screening tools are either updated in real time or within 24-48 hours of an update to the lists screened against. The MFSA expects entities to evidence robust outsourcing governance and, when in place, to carry out regular compliance checks by the service provider, assess the effectiveness of the services covered by the agreement, and take any necessary mitigating measures. The MFSA expects entities to evidence robust outsourcing governance and, when in place, to carry out regular compliance checks by the service provider, assess the effectiveness of the services covered by the agreement, and take any necessary mitigating measures. Artificial intelligence deployment: the MFSA found that AI adoption within TF, PF, and TFS compliance frameworks remains limited and in its early stages across credit institutions. The MFSA expects entities that have deployed or are planning to deploy AI to demonstrate a clear understanding of the system’s design, functionality, and limitations, including how the system maintains an audit trail of alerts raised. The MFSA expects entities that have deployed or are planning to deploy AI to demonstrate a clear understanding of the system’s design, functionality, and limitations, including how the system maintains an audit trail of alerts raised. Training and awareness - the MFSA found that credit institutions reported delivering a comprehensive suite of annual, induction, and ongoing training through a blended approach that combined e-learning modules with in-person, instructor-led sessions. The board of directors and senior management are also provided with training on regulatory developments and the evolving financial crime risk landscape. The MFSA expects entities to maintain a risk-sensitive and role-specific training framework that ensures all employees receive ongoing, substantive training proportionate to their exposure to money-laundering and terrorist-financing risks. The MFSA expects entities to maintain a risk-sensitive and role-specific training framework that ensures all employees receive ongoing, substantive training proportionate to their exposure to money-laundering and terrorist-financing risks. The observations highlighted in the letter indicate that while a number of sound practices are already embedded, there remain aspects of TF, PF and TFS’ compliance frameworks which would benefit from further strengthening to ensure full alignment with supervisory expectations. The MFSA encourages Authorised Entities and MLROs to review the letter alongside other relevant guidance, such as the MFSA’s Guidance for MLROs in the Financial Services Secto r and the Financial Intelligence Analysis Unit’s issued guidance.