MFSA's Q3 round-up finds weak oversight and board reporting across seven reviews

The Malta Financial Services Authority (MFSA) has published its Dear CEO Letter Q3 round-up, setting out the key findings and supervisory expectations from seven reviews. They cover:

- company service providers (CSPs) that arrange for others to act as directors or company secretaries;
- capital and stress testing at less significant banks;
- tied insurance intermediaries selling investment and pension products;
- retirement scheme statements;
- insurers' regulatory returns;
- MiFIR transaction reporting;
- outsourcing by fund managers.

The round-up sets out the MFSA’s supervisory expectations. Most are framed as what firms "should" do or are "expected" to do. Two are put as obligations: retirement scheme communications "must be clear, accurate, concise, transparent and member-focused", and fund managers "must have proper and effective due diligence process in place", including documented ongoing reviews. The MFSA says the MiFIR findings "will continue to inform the MFSA's risk-based supervisory activities". The round-up adds to the Dear CEO letters the MFSA has issued this year, including one on AI governance on 4 June. Atlas reads the seven reviews as one message: the MFSA is testing whether firms supervise the people and providers they depend on, and whether boards see enough to do so.

Banks and investment firms

The ICAAP review, set out in a full letter, sampled less significant institutions against the Capital Requirements Regulation (EU) No 575/2013, MFSA Banking Rules BR/24 and BR/26, the EBA Guidelines on institutions' stress testing and the ECB Guide to the ICAAP. Its central finding is "a recurring divergence between institutions' self-assessments and the MFSA's supervisory assessment". Weak points were stress test coverage, scenario design and calibration, reverse stress testing, and the use of outputs in governance, capital planning and strategy. Stress testing as a forward-looking management tool remains "at varying stages of maturity", particularly in challenging assumptions.

Banks should have robust challenge processes and board oversight, scenarios that capture all material risks and institution-specific vulnerabilities, and stress testing outputs that feed risk appetite, capital planning, strategic decisions and recovery preparedness. On proportionality, the MFSA says: "proportionality should not result in the omission of material risks". The review complements the MFSA's ILAAP letter of 17 June.

A questionnaire to investment firms and credit institutions subject to Article 26 of MiFIR found generally positive awareness and core reporting frameworks at most respondents. A number of firms reported weaknesses in trading obligation assessments, transparency waivers and deferrals, algorithm governance, staff training and internal assurance. Approaches to reconciliations, outsourcing oversight and documentation of compliance decisions varied. Firms should reassess their frameworks periodically and stay prepared for the MiFIR Review and related Level 2 measures.

Fund managers and company service providers

The outsourcing review covered fund managers, including self-managed AIFs, UCITS and professional investor funds, that outsource portfolio management, risk management, valuation, compliance, AML or internal audit. The MFSA found:

- weak verification of providers before appointment;
- an unclear line between in-house functions and outsourced services;
- conflict of interest management out of line with the MFSA Corporate Governance Code;
- governing bodies receiving only high-level information on outsourcing;
- no effective contingency planning.

Fund managers should set pre-defined selection criteria with substance requirements in mind, so as not to become "letter box" entities. Their boards should get frequent reporting on providers, backed by a contingency plan that keeps service uninterrupted if a provider fails.

For CSPs that arrange for others to act as director, company secretary or partner, the review found gaps in how services and agreements are defined, and deficiencies in fitness and properness assessments of the persons arranged for and in oversight of them. CSPs are expected to make those persons report regularly on their activities, and to assess their time commitment qualitatively and quantitatively.

Insurance and pensions

A 2026 mystery shopping exercise on tied insurance intermediaries selling insurance-based investment products and pension products found deficient demands and needs and appropriateness assessments, weak pre-contractual information, poor explanations of costs, risks and features, incomplete product comparisons and communications "that could be perceived as investment advice".

Member Statements for personal retirement schemes lacked a section on underlying investments and did not name the investment manager or adviser. Pension Benefit Statements for occupational schemes omitted the term itself and a full breakdown of costs deducted by the retirement scheme administrator, and in some cases not all charges, commissions and fees were disclosed. Administrators are expected to run a process robust enough to include everything the Pension Rules prescribe.

The Insurance and Pensions Supervision function's data quality letter, published on 3 September, follows 2025 onsite inspections of how (re)insurers prepare Quarterly Management Accounts, National Specific Templates and Quantitative Reporting Templates. The MFSA made data quality a 2025 priority in line with EIOPA's emphasis and expects submissions to be "timely, accurate, complete and reliable".

The MFSA's recent enforcement has also turned on filings and notifications. On 30 September it settled a Banking Act Article 13(5) notification failure with ECCM Bank for €99,945, and on 8 October it imposed a €5,700 penalty on an alternative investment fund for late regulatory filings.