MFSA consults on a revised Chapter 2 of the Financial Institutions Rulebook

The Malta Financial Services Authority (“MFSA”) has issued a consultation document proposing a revised Chapter 2 of the Financial Institutions Rulebook (“FIR/02”), applicable to financial institutions carrying out activities under the First Schedule to the Financial Institutions Act, excluding activities 4 (payment services) and 10 (issuing of electronic money).

The proposal represents a significant restructuring of the existing framework. Rather than making a series of largely high-level supervisory statements and relying extensively on the application of Banking Rules, the draft introduces a considerably more detailed, self-contained set of ongoing requirements for licence holders.

From a principles-based framework to a more prescriptive Rulebook

The existing FIR/02 operates, in important respects, by reference to the prudential framework applicable to credit institutions. The current Rule contemplates, for example, the application of the Large Exposures Rule (BR/02), Own Funds Rule (BR/03), Liquidity Rule (BR/05), Solvency Ratio Directive (BD/04), Credit and Country Risk Provisioning Rule (BR/09) and consolidated supervision principles under BR/10.

The draft sets out standalone requirements within FIR/02 itself, covering matters which were previously dealt with through cross-reference or, in some cases, through licence conditions agreed with the MFSA.

Importantly, however, the draft does not abandon proportionality. The MFSA continues to distinguish between institutions according to their nature, scale and complexity and retains discretion in a number of areas. This is particularly evident in the capital framework.

A new own funds framework

For financial institutions carrying out activities 1, 2, 3 and 6 of the First Schedule, own funds would be required to equal the higher of the initial capital requirement and 5% of total adjusted assets. For institutions carrying out activities 5, 7, 8 and 9, the corresponding test would be the higher of the initial capital requirement and 25% of adjusted total expenditure. Initial capital would continue to be determined by the MFSA on a case-by-case basis, having regard to the activities proposed and the risks arising from the relevant business model.

The draft also preserves a degree of supervisory flexibility by allowing the MFSA to require an institution to hold up to 20% more or less than the amount produced by the prescribed calculation, based on its assessment of the firm’s risk management processes, loss data and internal controls.

Under the current FIR/02, own funds requirements for non-payment/e-money financial institutions are principally linked to the Own Funds Rule applicable to credit institutions, with the MFSA retaining the ability to determine the initial own funds requirement on a case-by-case basis.

Governance moves to the centre of the framework

The draft would require the business of a licence holder to be effectively directed from Malta by at least two individuals acting as executive directors and/or senior management. The board would generally need to comprise at least three members, include at least one independent non-executive director, maintain a balance between executive and non-executive directors and include at least one Malta-resident member. The board would also have to meet at least quarterly.

The role of the chairperson is also addressed expressly. The chairperson is expected to be an independent non-executive director, although the MFSA may grant a temporary derogation following a justified request. The chairperson may not simultaneously act as CEO unless the arrangement is justified by the institution and authorised by the MFSA. Where board committees are established, these must comprise at least three individuals, including an independent non-executive director.

There is also a stronger emphasis on the substance of board oversight. Directors are expressly expected to challenge management proposals and information, while board minutes should be sufficiently detailed to record the rationale for decisions and any concerns raised by directors.

Policies, control functions and business continuity

Licence holders would be expected to maintain an internal governance and control framework with independent compliance and internal audit functions, appropriate reporting lines and processes for identifying and managing risk. A formal code of conduct or ethics framework is also contemplated.

The proposed conflicts framework is notably detailed. It would require institutions to identify and manage actual and potential conflicts and to maintain a dedicated conflicts policy. The circumstances to be considered include economic interests, relationships with shareholders and staff, outside and recent previous employment, external stakeholder relationships and political relationships.

The draft also formalises compliance reporting. The Compliance Officer would be required to prepare an annual Compliance Report, covering the compliance monitoring plan and identified regulatory breaches, to be submitted with the annual audited financial information and signed by at least one director. An MLRO must be maintained at all times, while internal audit is required to operate separately and independently, subject to the possibility of a temporary MFSA derogation. Where internal audit is outsourced, a director must remain responsible for overseeing the function.

Business continuity is similarly elevated from a broad prudential expectation into a defined framework. The draft requires a Business Impact Analysis, Business Continuity Plan and Disaster Recovery Plan, with the latter two tested annually and updated in light of testing results, threat intelligence and lessons learned.

Greater supervisory engagement

Immediate notification through the LH Portal would be required for matters including changes in senior managers and key function holders, significant fraud or dishonesty, material legal proceedings, material information affecting the institution or its business, regulatory breaches and certain outsourcing changes. Other matters would require prior MFSA consent, including material changes to the business or organisational structure, certain corporate transactions, appointments falling within the approved persons regime, changes of name or address and changes to the applicable own funds requirement.

Outsourcing also receives a significant overhaul

The draft requires an outsourcing policy, risk assessments, due diligence, monitoring, board oversight, audit rights and appropriate exit arrangements. For important or critical functions, the institution must be capable of transferring the function to an alternative provider, bringing it back in-house or discontinuing the dependent activity within an appropriate timeframe. The framework also expressly addresses intra-group outsourcing and third-country providers.

Other prudential requirements are brought into sharper focus

The draft introduces, among other things, a 40% cap on exposures to an individual third-party client or connected group of third-party clients for relevant activities, calculated by reference to the institution’s own funds.

The arm’s length framework is also expanded. In addition to the related parties already contemplated by the Act, the draft expressly brings a wider range of shareholders, auditors, directors, employees, their relevant interests and corresponding persons in affiliated companies within the framework.

There are further requirements concerning record keeping, continuous liquidity, ICT infrastructure and credit risk management. The latter would require a formal credit risk appetite, documented credit risk policies, defined responsibilities, a designated credit risk function, appropriate management information and an independent review process.

What should licence holders be considering?

The proposed FIR/02 would make the regulatory expectations applicable to financial institutions significantly more explicit and, in a number of areas, more prescriptive.

Existing licence holders would be well advised to assess their current position against the draft rather than waiting for the final Rulebook. In particular, board composition and independence, Malta substance, own funds, approval and notification procedures, control functions, conflicts management, business continuity and outsourcing arrangements are all areas where the gap between an institution’s existing arrangements and the proposed requirements could become relevant.

The consultation closes on 6 November 2026.

This article is based on the MFSA’s draft Chapter 2 and Consultation Document published on 6 October 2026. The proposed requirements remain subject to the outcome of the consultation process.