Euro SIFMANet Valletta Report

In mid-March 2024, the Centre for Finance and Security (CFS) at RUSI convened one-to-one meetings with key representatives of the public and private sectors in Malta. CFS also held a sanctions-focused roundtable discussion involving 25 local stakeholders, as well as an evening event consisting of a panel discussion and networking with over 100 attendees from the public and private sector, and the University of Malta. These events were held under the Chatham House rule and as part of RUSI’s ongoing study of sanctions implementation and wider responses to illicit finance (Euro SIFMANet). This report represents the findings and views of the CFS team that participated in the visit. The visit was funded by the UK’s Serious Organised Crime Network (SOCNet).

Background

As with previous engagements under the Euro SIFMANet programme, the Financial Action Task Force’s (FATF) evaluation of the host country, this time Malta, underpins the discussions about illicit finance. This is especially relevant for Malta given it was placed on the FATF list of Jurisdictions under Increased Monitoring (the “grey list”) for strategic deficiencies in its regime to counter money laundering, terrorist financing and proliferation financing between June 2021 and June 2022. This was primarily due to the “detection of inaccurate company ownership information and sanctions on gatekeepers who fail to obtain accurate beneficial ownership information, as well as the pursuit of tax-based money laundering cases utilising financial intelligence”. Sanctions were not identified as a factor contributing to Malta’s placement on the grey list with technical compliance for Recommendation 6 and Recommendation 7 rated as Largely Compliant and Compliant respectively. For Immediate Outcome 10 concerning terrorist financing preventive measures and financial sanctions and Immediate Outcome 11 regarding proliferation financing financial sanctions, Malta received a Moderate and Substantial rating, respectively.

Roundtable participants and wider interviewees all agreed that Malta has a unique experience in Europe in implementing UN and EU sanctions given its historic and close economic exposure to Libya during the era of Muammar Qadhafi and following the Arab uprisings of 2011 when sanctions were imposed. This ensured that sanctions structures and frameworks were already in place for both the public sector – and elements of the private sector – prior to the sanctions related to Russia’s full-scale invasion of Ukraine in February 2022. For example, Malta had already established a sanctions public–private partnership (PPP) known as the Joint Economic Financial Sanctions Implementation Task Force (JEFSI). JEFSI facilitates outreach and engagement to share information and gather the financial sector’s views. Roundtable participants considered the Libya sanctions as having been more disruptive than Russia sanctions because Malta had greater prior exposure to Libya.

While Malta does not implement US sanctions, there was consideration of Libya-related sanctions issued by the US Office of Foreign Assets Control (OFAC) because of Malta’s reliance on US correspondent banking services. However, Maltese courts have delivered judgments that, in effect, invalidate OFAC sanctions since they conflict with EU, and therefore Maltese, laws.

More widely, interviewees also noted that while not explicitly related to sanctions, there is an ongoing issue with compliance-related fines levied by the Financial Intelligence Analysis Unit (FIAU) being appealed and substantially reduced on constitutional grounds. These rulings at the First Instance are being appealed and this issue awaits a ruling by the Constitutional Court. This has impacts on the FIAU’s bandwidth and credibility.

Overview of Legislative and Enforcement Framework

In Chapter 365 of the Laws of Malta, sanctions are implemented under the National Interest (Enabling Power) Act. The National Interest Act, Article 7 has established the Sanctions Monitoring Board (SMB) as the national competent authority responsible for monitoring the implementation and operation of sanctions legislation in Malta. The SMB was established within the Ministry of Foreign Affairs and European Affairs and Trade (MFET) and comprises 18 officials representing various government ministries and authorities. The SMB has the power to propose persons or entities for de-listing, to unfreeze their assets, or to propose entities to be designated by the UN Security Council or the Council of the European Union. The FIAU, Malta Financial Services Authority (MFSA) and the Malta Gaming Authority (MGA) collaborate with the SMB to ensure that subject persons comply with the Act.

UN sanctions are automatically applicable in Malta under the National Interest Act, and regulations and restrictive measures of the Council of the European Union and European Commission also apply due to Malta’s EU membership. Fines for sanctions violations are imposed by the National Interest Act. Individuals convicted of such violations face imprisonment ranging from 12 months to 12 years, and fines ranging from €25,000 to €5 million, while legal entities may be fined between €80,000 and €10 million. While OFAC sanctions are not directly enforceable under Maltese law, the SMB has issued several guidance notes drawing attention to decisions made by the OFAC, particularly concerning Maltese nationals and legal entities featured on the list.

Malta’s Wider Financial Landscape

Interviewees, more broadly, noted Malta’s effective tax rate of 5% for foreign companies has likely contributed to an industry for designated non-financial businesses and professionals (DNFBPs) and trust and company service providers (TCSPs). Like many international financial centres, the economy is heavily dependent on this sector with significant income from company formation and fiduciary services. However, there were historically significant issues with the quality of due diligence checks as evidenced by the FATF grey-listing. There have been improvements that resulted in Malta’s removal from the grey list and extensive documentation has been published by the FIAU. The move to a harmonised international taxation system could be a significant blow to Malta’s economy unless there is further diversification and new income streams.

Similarly, interviewees raised issues related to Malta’s citizenship by investment (CBI) or “golden passport” programme. Under this scheme, individuals can become Maltese citizens by investing between €600,000 and €750,000, residing in Malta between 12 and 36 months, and purchasing or renting property. Since 2014 there have been 2,300 applicants of which 735 were Russian or Belarussian nationals. Of these, 559 were successful and some applicants were very high-profile. In 2020, Russians were still the largest group of new Maltese citizens. Some of these applicants also held dual or multiple nationalities. Since 2022, the CBI programme has been suspended for Russian and Belarussian applicants due to the difficulties in obtaining information to conduct due diligence checks. While new citizens are published annually in theMalta Gazette, how they became citizens – for example, by marriage or the CBI process – and their original nationality are not stated. There is no requirement to retain a nexus or remain in Malta once citizenship is granted. There is also an unhelpful view locally that most Russian golden passport holders and their funds pose only a limited risk as they do not often remain in Malta.

Citizenship can be revoked through a deprivation process. However, this is rare. Once placed on the OFAC sanctions list, Russian golden passport holders have been stripped of their Maltese citizenship. Other procedures are ongoing against nationals who have appeared on EU and US sanctions lists. There is a right of appeal in the deprivation process that can add legal complexity.

The European Commission is currently taking legal action against Malta. It considers granting EU citizenship in return for pre-determined payments without a genuine link to a member state to be a breach of EU laws. There have been improvements in conducting CBI-related enhanced due diligence, policies and procedures, and collaboration with the FIAU following grey-listing. The final judgment by the European Court of Justice (ECJ) is expected by the end of 2024. This may lead to the closure of the CBI programme, significant amendments to it, or, least likely, the continuation of the programme without change.

As at the end of December 2022, there were 338 remote gaming or online gambling companies registered in Malta. These are a significant part of Malta’s economy, making up 9.6% of gross value added (GVA) of Malta and employing 5.5% of the country’s total workforce. Online gaming companies are regulated entities under the Malta Gaming Authority and have the usual obligations under the Prevention of Money Laundering Act (PMLA) and the National Interest Act. Wider discussions with interviewees noted that online gaming companies are focused on growth, revenue generation and technology development with compliance often a secondary consideration. This is reflected in the funding and resourcing of compliance departments. The low prioritisation of compliance is especially the case in the numerous smaller companies. Online gaming compliance has traditionally been focused on responsible gambling directives, fraud and, more recently, anti-money laundering (AML), countering terrorist financing (CTF) and counter-proliferation financing. The additional requirements and complexities for sanctions screening, especially the move from purely list-based screening, has challenged iGaming companies. Their ability to integrate cost-effective solutions with existing back-office systems is challenging and changes take months to implement. While there is exposure to markets in the Baltic states and Eastern Europe, there have been no reported sanctions breaches related to Russia or Belarus.

More widely, interviewees also touched on the virtual financial assets activities in Malta. Malta has expressed its desire to attract cryptocurrency exchanges or virtual asset service providers (VASPs) as “the blockchain island” although this has been less successful than anticipated. Malta, despite its relatively small size was previously an outsize market for cryptocurrencies. In 2018, Malta reportedly saw up to €60 billion in cryptocurrency transactions. According to the World Bank, this figure was around five times Malta’s 2018 GDP of €14 billion. The figure of €60 billion is challenged by the supervisory authorities in that it likely attributes this to Binance’s trading activity. However, Binance did not ultimately apply to be licensed in Malta and the MFSA issued warnings to this effect.

The introduction of the Virtual Financial Assets Acts (the Digital Acts) in June 2018, which are similar to the incoming EU Markets in Crypto-Assets (MiCA) Regulations, saw a drop in the use of cryptocurrency to under €4 billion by 2020. In effect, the requirement to meet the same standards in traditional financial products meant that cryptocurrency companies did not want to operate in Malta. While this could be considered a red flag, it is just as likely that VASPs moved to find the least demanding regulatory environments that offered similarly low corporation tax benefits.

Initially, around 180 companies had applied but 85% did not continue their activities in Malta, with 23 eventually applying for licences. As of 30 June 2023, there were 15 licensed VASPs, with 11 actively operating, one which had not started operating and three had surrendered their licences voluntarily. In 2023, Chainalysis rated Malta as 123rd in the world for cryptocurrency usage. There are no reports of Russian sanctions-related breaches.

As part of this innovative and dynamic ecosystem of finance- and technology-focused companies in Malta, there is a prevalence of payment service providers (PSPs) – that is, payment gateways rather than money remitters. This presents a vulnerability since PSPs can process large volumes of transactions, mix payment flows and generally complicate the payment landscape. Like many of the remote-gaming companies and VASPs that they support, PSPs are often “start-up” companies with a greater focus on growth and revenue generation and lack the size and sophistication of compliance resources and technology commensurate with the volume and value of payments they facilitate.

Private sector actors at the roundtable pointed out that the EU’s introduction of conflicting legislation was especially challenging. On 26 February 2024, the Council of the European Union adopted a regulation to make instant payments fully available in euros to consumers and businesses in the EU and EEA countries. This new regulation will mean that all banks and PSPs will be required to make credit transfers within 10 seconds of payment being ordered. Aside from the great boon to fraudsters using authorised push payment fraud schemes, this will make sanction screening even more burdensome and risky. The regulation will also change screening requirements so it is not just limited to parties; requirements will extend to consider the purpose of the transaction, the IBAN, blocked banks and countries. There is the potential for a huge number of false positives. These would then have to be investigated, requiring extensive resources as well as re-calibration of the screening tools. This requirement puts the banks and PSPs in an awkward position. They would have to satisfy competing requirements. Resolving this tension would best be addressed at an EU level to ensure the private sector can effectively implement sanctions and not expend resources and effort on false positives.

Changes since February 2022

Since February 2022, various Maltese authorities have issued guidelines on sanctions. On 22 February 2022, the MFSA published a public notice regarding the situation in Ukraine reminding its licence holders of their obligation to effectively screen sanctions. In March 2022, in response to Russia’s full-scale invasion of Ukraine, Malta’s FIAU issued a guidance note reminding all subject persons of their obligations on sanctions and AML and CTF regulations. In June and July 2022, the SMB issued several guidance notes on the interpretation of some of the restrictive measures. Article 5n prohibited the provision of a range of services including accounting, auditing, tax and public relations. Article 5m focused on the administration of trust funds and foundations involving Russian nationals as settlors, beneficiaries or trustees, and Article 5b of the EU regulation related to SWIFT and SEPA channels and the restrictions on deposits over €100,000. In October 2022, it published a guidance on Russia and Belarus sanctions (including the eighth package) which included new designations, wider geographic scope, and visa restrictions, financial restrictions, trade restrictions and broadcasting restrictions. In January 2024, the SMB published further guidance on the EU prohibition on the sale or transfer of ownership of oil tankers to Russia-based individuals or entities as part of the 12th EU sanctions package. Associations and commercial legal and consultancy firms have amplified these guidance notes.

Public Sector Challenges and Responses

Engagement with the public sector mainly took place during the roundtable session although there was also further engagement and discussion during the networking event. The SMB under the MFET is the lead entity for outreach, training and guidance. While relatively well-established, the SMB is under-resourced and lacks the breadth of skills necessary to drive full implementation. It therefore must use the resources of the MFSA and FIAU to conduct inspections. This does have benefits as the SMB understands sanctions. However, it does not necessarily understand the complexities and breadth of financial services. Other agencies can provide this expertise.

During the roundtable, representatives from the SMB noted that sanctions have increased sevenfold over the past two years, with queries becoming much more technical and complex. The demands this generates have been offset by better collaboration within government and also with the private sector. There has been an increase in the amount and types of outreach with consultancies, VASPs and the commercial sector. This outreach includes logistics and import/export companies now encountering sanctions restrictions on goods and services with which they are not familiar.

The SMB is well connected including with the European Commission, and the SMB reported that it was visited by DG FISMA (the lead Directorate for sanctions implementation) in November 2023. It is also aware of and involved in the DG REFORM-sponsored Technical Support Instrument (TSI). This is a capacity-building programme for member states – and its use must be requested by the member state itself rather than being imposed on it.

To supplement the capacity of the SMB, the MFSA and FIAU act as agents of the SMB via memoranda of understanding. They too face challenges of resourcing and the dynamic nature of the sanctions regimes. The MFSA and the SMB require regulated (“subject”) persons – including accountants, lawyers and auditors – to screen their clients against the sanctioned individuals list. As defined under the Prevention of Money Laundering Act (PMLA), subject persons must monitor their business relationships and check the list of designations from the EU, the UN and the SMB. Failure to comply may result in administrative penalties ranging from €100 to €800. Interviewees who are local financial crime experts did not consider these penalties to be a proportionate, dissuasive and effective sanction. The MFSA and FIAU conduct inspections following an agreed methodology with each inspection having a separate focus on sanctions. The report is submitted to the SMB which deals with the sanctions-related elements of the inspection as required. Small entities usually used only basic and manual processes to comply with these requirements but also had requisite smaller and less complex issues. It was noted that even larger banks have struggled to deal with the increased number of sanctions-related screening hits which include false positives, as they often lack the automation or resources to deal with the higher volume.

The Malta Business Registry (MBR) is considered a key element of the national sanctions architecture. It has benefited from the scrutiny placed on it following the FATF Mutual Evaluation and requirement to reach an agreed international operational standard. The SMB has unrestricted access to the Register of Beneficial Owners. However, following the European Court of Justice’s November 2022 ruling – that found that access to beneficial ownership interfered with privacy rights – the MBR restricted access to the registry, limiting it to subject persons and competent authorities. This matter is currently under revision in Brussels.

The MBR has a multi-pronged approach (the registry approach, the company approach and the existing information approach) to ensure information on the beneficial ownership of a company is accurate and up to date. It conducts its own know your customer (KYC) checks and has subsequently implemented a second KYC screening system for sanctions from which positive hits are sent to the SMB. A problem raised at the roundtable is that the process companies undergo to notify of changes to information held by the registry is retrospective and lengthy: they must communicate these changes through their banks rather than directly to the MBR. While this ultimately closes the loop, it is not an efficient or timely process.

The Malta Ship Registry is the largest in the EU and one of the largest in the world, contributing about 14% of Malta GDP. The Shipping Directorate sits within Transport Malta (TM) and has processes in place for checking databases for positive hits of ships, entities and people when new sanctions are published. There is extensive guidance published by TM Maritime on the various EU restrictive measures. Vessels are put under review on a case-by-case basis to understand their exposure to sanctions.

The Russian Maritime Register of Shipping has been removed and, for the oil price cap, registered owners are required to give appropriate information and attest that they are abiding by the requirements. The current assessment is that no Maltese-registered vessels were facilitating operations above the price cap and no breaches have been detected. However, one participant at the roundtable commented that because of these actions, tankers that were previously registered in Malta are being sold or re-flagged; this is impacting Malta’s revenue. Others at the roundtable agreed with this view.

Given the centrality of maritime business to Malta, Malta Customs plays a key role in sanctions implementation. Customs staff are clearly knowledgeable and have a good understanding of specific technical issues but – consistent with all government agencies in the country – lack resources and are unsurprisingly losing experience to the private sector even as their workload increases. The roundtable discussions identified a notable gap: while the customs authority has a good understanding of strategic trade controls, trade documentation and red flags, it cannot legally investigate any breaches. Should a sanctions infringement be suspected, Malta Customs refers the matter to the SMB Chair who would consider whether there is a case for referral to the police for further investigation. As a result, this documentation is sent to the SMB, along with the trade-related documents, for its consideration. However, as noted earlier, the SMB has neither the expertise nor resources to investigate these cases itself.

Malta Customs uses the Common Customs Risk Management System (CRMS) – provided by the EU’s DG Tax and Customs Union. This system allows Malta Customs to securely share information with customs authorities of other EU member states. The upload of information is manual and time-consuming. CRMS is not available to other government entities in Malta although there are both formal and informal cross-government information sharing mechanisms. Malta Customs submits relevant reports to the World Customs Organization Customs Enforcement Network. However, sensitive sanctions information is not always shared as it is a global system and thus a wide range of actors have access to it.

Malta Customs is aware that there has been significant downturn in transactions to Russia. However, there are more red flags related to companies potentially acting as proxies. These may include, for example, obviously newly formed companies with no justification, rationale or purpose, or changes in activity where the end user is declared as being in a new third country where previously there was little or no trading relationship. Customs is aware of the need to look at the wider connections of these suspicious entities, but there is little evidence or proof on which to take enforcement action.

The Malta Police Force’s (MPF) Financial Crimes Investigations Department (FCID) does not have experience of investigating sanctions – the bulk of its experience relates to money laundering and terrorist financing. It is fully aware of the challenges posed by the transnational element of sanctions evasion and resulting investigations. Therefore, there is use of established cross-border information exchange mechanisms such as requests for information (RFIs) to the FIAU and SMB. The FIAU can then leverage FIUNet and the SMB can send RFIs on to the EU, for example. However, these are not always standard actions and are, of course, time consuming. The FCID has undergone extensive restructuring and now has more resources. However, it has also seen a significant churn in senior leadership. Wider discussions with interviewees noted the significant improvements in supervision but that the forthcoming, albeit currently not scheduled, Moneyval Mutual Evaluation will likely focus on the FCID’s effectiveness in investigating all forms of financial crime, including sanctions. It was also considered that despite efforts to improve the FCID, it still does not have the necessary capacity and capability to conduct complex investigations.

Private Sector Challenges and Responses

Implementation of the EU’s packages of restrictive measures on Russia has been challenging due to the volume and speed with which the packages have come forward and the lack of resources and capability in the market from a compliance perspective. Participants at the roundtable noted that these have roughly doubled the workload of the banking sectors’ compliance staff without a commensurate increase in resourcing. The larger banks already had some capacity and capability. However, the smaller banks, the non-bank financial institutions and the designated non-financial businesses and professions struggled in terms of their lack of capacity and expertise. Smaller banks have no specialist sanctions resources and rely on generalist financial crime compliance staff or the money laundering reporting officer (MLRO) or deputy MLRO to cover sanctions-related issues.

An industry-wide issue identified by roundtable private sector participants – and consistently raised across the EU – is the need to supplement name screening against sanctions lists with the new requirement to implement activity-based sanctions (for example, the provision by clients of certain services prohibited by sanctions). This has been particularly challenging as these restrictions are unrelated to the capabilities of traditional sanctions screening or transaction monitoring systems. This is especially the case for smaller banks that are already struggling with this issue from an AML/CTF perspective. Private sector participants also noted the challenge posed by the observed shift in transactions to third countries.

Although there are a range of potentially systemic issues facing Maltese financial institutions in effectively implementing sanctions, the risks are somewhat offset. The heightened focus of the industry on risk management in recent years means that even the larger banks now have less geographic risk. They are more focused on domestic retail banking and servicing local corporates. As Russia is not a core market for the industry, where exposure is identified, it is an easy decision to de-risk by offboarding a client. However, 48% of the companies registered in Malta do not have bank accounts in Malta itself. This is a potential vulnerability in a system where there is a reliance on controls on banks but only 52% of the companies have accounts that can be monitored.

For the bigger banks, the issue now is passing on the information from compliance departments – that are focused on and understand the regulatory aspects – to the lines of business which are focused on revenue generation or customer service. While they aim to provide the lines of business with clear policies, procedures and training, it is also necessary to change the mindset from AML/CTF to sanctions. As an example of improvements in this area, customer risk assessments now specifically include sanctions and affect risk ratings. Even then, there are difficulties of interpretation when faced with pressure to onboard or retain customers when there is an element of risk, but no clear sanctions breach.

The Malta Bankers’ Association reported that it has formed a sanctions sub-working group which ensures its members are kept abreast of sanctions issues, have a forum to discuss and develop best practice and also reach out to the SMB and other government agencies to make queries or give feedback.

Beyond the banking sector, elements of the private sector such as DNFBPs and TCSPs lack sophisticated knowledge of sanctions issues. Importantly, these entities service key high-risk elements of the Russia sanctions regime, notably the maritime sector and high net worth Russians in other countries. There is an obstacle to convincing them of the necessity of these measures, especially since there has been no Russia-sanctions-evasion “smoking gun” in Malta, unlike Cyprus, and far less exposure to Russian investments, for example in the real estate sector.

For the private sector in Malta, the lack of relevant data may suggest an absence of evidence – rather than evidence of absence – of sanctions evasion activity. However, without more detailed data and analysis, it is hard to corral effort and resources in pursuit of activity that may simply endorse the limited sanctions risk exposure Malta faces.

Key Insights and Recommendations

Malta’s experience of having to deal with UN, US and EU sanctions related to Libya and the rigours of FATF grey-listing gave it a head start in setting up the structures and processes to deal with the Russia sanctions regimes. For example, PPPs involving banks and other regulated entities are well-established. However, the lack of laws to enable prosecutions, the lack of investigative skills and resources, and weak enforcement resulting in a failure of proportionate, effective and dissuasive sanctions are key shortfalls that will need to be addressed if Malta is to prove fully effective in implementing restrictive measures on Russia.

The following observations for consideration emerged from the roundtable and wider discussions with interviewees:

• Provide guidance on implementing laws to facilitate prosecution of sanctions evasion. Maltese law criminalises sanctions evasion but there is a need for some key amendments to facilitate and expedite prosecutions (as with AML breaches). This requires improving the quality of private sector reporting, sanctions investigations to develop intelligence and evidence, and education of prosecutors and judges. Furthermore, there needs to be the appetite and capacity to prosecute sanctions evasion, but this can only happen with an appropriate legal framework. The use of deferred prosecution agreements for sanctions breaches should be implemented.

• Design and deliver training programmes to upskill private sector resources. There is a need to upskill and increase resources in certain sectors. This is not necessarily the case in larger banks, but rather the smaller trade finance banks and the sectors that are more exposed but lack experience of compliance and screening activities such as DNFBPs, TCSPs, import/export and logistics companies. Relying on the major banks to police their clients for sanctions implementation leaves significant gaps and exposes Malta to risks from those entities that do not draw on banking services in Malta. Better private sector investigations and reporting will assist government entities in their investigation and enforcement efforts.

• Design and deliver training programmes to upskill government sector resources. There is a need to upskill and increase the number of resources in key government agencies, specific to sanctions. This is a cross-government need, including the SMB, MFSA, FIAU, Malta Customs and the FCID, to ensure they can support the compliance aspects of the sanctions regimes (for example intelligence-led activity, pro-actively communicating guidance to the private sector and answering implementation queries), but more importantly identifying and ensuring successful enforcement against breaches through specialised sanctions investigations.

What emerged from the roundtable discussion and wider interviews is that as a result of its experience of being closely linked to the Libyan economy at the time it was sanctioned in 2011, Malta clearly has a strong understanding of what is needed in terms of policies and government architecture to implement sanctions effectively. Yet it remains to be seen whether this clear understanding of policies can be effectively put into practice. There are silos of excellence but the comparatively well-developed architecture and partnerships do not mitigate the risks from the lack of resources and technical capabilities, such as investigations and intelligence analysis and dissemination. The lack of proportionate, effective and dissuasive enforcement action is also a key shortcoming. Given Malta’s position as home to international company registration, an active citizenship by investment scheme, an important maritime industry and an innovative FinTech scene made up of iGaming, PSPs and VASPs, it may well face considerable headwinds as the EU’s focus on restrictive measures moves from adding designations, to more closely monitoring the effectiveness of member state implementation.

Andrew Mackay was the Head of Financial Crime Investigations for a major bank in Malta and is co-Chair of the Malta ACAMS Chapter. He is an Associate Fellow at the Centre for Finance and Security (CFS) at RUSI, an Illicit Finance expert with the Foreign, Commonwealth and Development Office and a PhD candidate in Illicit Trade at the United Nations University for Peace (UPEACE).

Tom Keatinge is the Director of the Centre for Finance and Security at RUSI.