Key Reporting Obligations For Financial Institutions In Malta

Annual FI Return

• Deadline: Submit within 1 month from the accounting reference date.
• Contents: Includes audited financial statements, signed representation sheet, and auditor's management letter.

Auditor's Management Letter Implementation Statement

• Deadline: Submit within 4 months from the accounting reference date.
• Purpose: Explains how recommendations from the auditor's letter were addressed or provides reasons for inaction.

Compliance Report

• Deadline: Submitted annually along with the audited financial statements.
• Contents: Must include the Compliance Officer's monitoring plan, status of regulatory breaches, and details on how breaches were mitigated.

Interim FI Returns ("IFR")

• Deadlines:
  • Q1 IFR: Within 1 month after the 3-month period.
  • Q2 IFR: Within 1 month after the 6-month period.
  • Q3 IFR: Within 1 month after the 9-month period.
• Contents: Each submission must include a signed Representation Sheet and any additional disclosures as required.

Risk Evaluation Questionnaire ("REQ")

• Deadline: Annually by 31 January.
• Submission: Must be submitted via the MFSA's License Holder ("LH") Portal and may require supporting documentation, including an updated Business Risk Assessment ("BRA") and Subject Person Profile.

Quarterly Statistical Reporting (BR/06)

• Deadline: Every quarter, in line with the statutory reporting schedule.
• Scope: Covers statutory financial information, including details of assets and liabilities.

Event-Driven Notifications

Material Changes

• Deadline: Notify immediately upon becoming aware of the following:
  • Changes in senior management or key function holders.
  • Fraud or breaches of internal controls.
  • Decisions to claim on Professional Indemnity Insurance.
  • Legal or judicial proceedings of material significance (e.g., financial crime or significant operational losses).

Safeguarding Arrangements

• Deadline: Notify in advance upon any changes.
• Scope: Includes changes to safeguarding methodologies or third-party involvement. Prior approval from the MFSA may be required.

Outsourcing Critical Functions

• Deadline: Notify prior to outsourcing critical or important functions.
• Submission Requirements: Provide risk analysis, exit strategies, service-level agreements ("SLAs"), data protection measures, and contingency plans.

Departure of Appointed Persons

• Deadline: Notify within 5 working days of their departure.
• Details: Include reasons for departure and any remedial measures taken.

Passporting Notifications

• Deadline: Notify before initiating activities such as:
  • Establishing branches in another EU member state.
  • Appointing agents or distributors locally or across borders.
  • Undertaking cross-border services under freedom of services.

Changes to Previously Notified Information

• Deadline: Notify immediately upon changes to prior passporting submissions or information provided.

Periodic Requirements

IT and Cybersecurity Infrastructure

• Requirement: Maintain systems ensuring the integrity, security, and availability of data stored locally or within the EEA. Align with the EU's Digital Operational Resilience Act ("DORA") if applicable.

Record Keeping

• Requirement: Retain records for at least 5 years in an accessible and secure format for MFSA review.

Reconciliations for Safeguarding Accounts

• Requirement: Perform periodic reconciliations and rectify discrepancies by the end of the business day.

Annual Safeguarding Audit

• Requirement: Audit safeguarding arrangements annually to confirm compliance with regulatory standards. Submit findings to the MFSA if required.

Reporting Obligations from Directive 5

BR/06 Return

• Deadline: As specified in the BR/06 (usually quarterly).
• Scope: Covers statutory financial information, including details of assets and liabilities.

BR/05 Return

• Deadline: As specified in the BR/05 (monthly or as required).
• Scope: Focuses on liquidity requirements for credit institutions.

COREP and FINREP Reporting

• Deadline: As per circulars issued by the competent authority.
• Scope: Financial institutions must submit data under the Common Reporting Framework ("COREP") and Financial Reporting Framework ("FINREP") according to Regulation EU No 575/2013.

Transmission Standards

• Requirement: All submissions must be sent through a secure electronic channel to the Central Bank of Malta ("CBM") using designated portals or transmission systems.

Ad Hoc Requests

• Requirement: The CBM may request additional statistical or regulatory information from financial institutions as needed. Examples include data on liquidity, exposure to specific sectors, or stress testing results.

Calendar of Reporting Obligations

Date 30th January, 2025

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.