Thematic Review: Adequate Oversight when Arranging for Other Persons to act as Directors and/or Company Secretaries

This review assessed the adequacy of the oversight carried out by Company Service Providers (CSPs) authorised to provide arranging for another person to act as company director, company secretary, a partner in a partnership or hold a similar position in relation to other legal entities.

• Key Findings: the review highlighted gaps in the manner that CSPs define such services, including the agreements entered into, in line with legal and regulatory requirements. Deficiencies were also noted in relation to the fitness and properness assessment of the persons arranged for and the oversight carried out on such persons.
• Supervisory Expectations:
• Adequate Oversight: CSPs are expected implement mechanisms to ensure that persons arranged for provide regular reports on activities undertaken to ensure they are adequately performing their role.
• Time Commitment & Availability: CSPs are expected to carry out qualitative and quantitative assessments of time commitment of persons arranged for to ensure they perform their functions efficiently and effectively.

Compliance Outcomes-Based Supervision: The Internal Capital Adequacy Assessment Process (ICAAP) and Stress Testing Capabilities

The review assessed how a sample of Less Significant Institutions (LSIs) have translated ICAAP and stress testing regulatory requirements and supervisory expectations into practice. Particular focus was placed on the adequacy and effectiveness of institutions’ governance arrangements, capital planning processes, stress testing frameworks, and the extent of their alignment with applicable regulatory requirements and supervisory expectations, including Regulation (EU) No 575/2013, MFSA Banking Rules BR/24 and BR/26, the EBA Guidelines on Institutions’ Stress Testing, and the ECB Guide to the ICAAP.

The exercise forms part of the MFSA's Compliance Outcomes-Based Supervision approach and provides important supervisory insight into institutions' capital resilience under adverse conditions. It also complements the MFSA's recent targeted review of the Internal Liquidity Adequacy Assessment Process (ILAAP), contributing to a broader assessment of institutions' overall financial resilience from both a capital and liquidity perspective.

Key Findings

While institutions have generally established foundational ICAAP and stress testing frameworks, the review identified a recurring divergence between institutions’ self-assessments and the MFSA’s supervisory assessment. Opportunities for enhancement were identified in relation to stress test coverage, scenario design and calibration practices, reverse stress testing, and the practical application of stress testing outputs within governance, risk management, capital planning, and strategic decision-making processes.

The review also highlighted that, although stress testing is generally performed across institutions, its use as a forward-looking management tool remains at varying stages of maturity, particularly in relation to challenging assumptions, informing management actions, and supporting strategic decision-making.

Supervisory Expectations

• Governance and Oversight

Institutions should ensure that ICAAP and stress testing frameworks are supported by effective governance arrangements, clearly defined responsibilities, robust challenge processes, and appropriate Board oversight.

• Risk Coverage and Scenario Design

Institutions should ensure that stress testing frameworks capture all material risks and institution-specific vulnerabilities, supported by credible, forward-looking, and appropriately calibrated scenarios.

• Application and Decision-Making

Institutions should use stress testing outputs as a meaningful risk management tool to support risk appetite setting, capital planning, strategic decision-making, recovery preparedness, and the assessment of resilience under adverse conditions.

Proportionality  

The MFSA recognises that ICAAP and stress testing frameworks should be proportionate to the nature, scale, and complexity of an institution’s activities. However, proportionality should not result in the omission of material risks or limit the effectiveness of governance, challenge, capital planning, and stress testing processes. All institutions are expected to maintain frameworks that provide a meaningful assessment of resilience and support effective decision-making.

Thematic Review of the Distribution of Insurance-Based Investment Products – Key Findings from the 2026 Mystery Shopping Exercise

The MFSA conducted a mystery shopping exercise to assess the distribution of Insurance-Based Investment Products (''IBIPs'') and pension products by Tied Insurance Intermediaries (''TIIs'') in Malta. The exercise forms part of the Authority’s ongoing supervisory efforts to strengthen consumer protection, promote fair and transparent sales practices, and identify areas for improvement in customer interactions. The review highlighted a number of recurring conduct related shortcomings, including deficiencies in demands and needs and appropriateness assessments, weaknesses in the provision of pre-contractual information, inadequate explanations of costs, risks and product features, product comparisons which were not exhaustive or incomplete and communications that could be perceived as investment advice. The findings are being shared to encourage improved industry practices and enhance compliance with regulatory requirements.

Thematic Review on Member Statements and Pension Benefit Statements

The Authority’s expectations in respect of the issuance of the Member Statements and Pension Benefit Statements for Personal Retirement Schemes and Occupational Retirement Schemes, respectively.

• Key Findings: From the Member Statements reviewed, it was observed that the statements did not include a dedicated section outlining member’s underlying investments and did not identify the investment manager and/or the investment advisor. In addition, from the Pension Benefit Statements reviewed, it was observed that the statements did not include the term ‘Pension Benefit Statements’ and a full breakdown of costs deducted by the Retirement Scheme Administrator during the reporting period. Furthermore, in certain instances, not all charges, commissions and fees incurred by the member were disclosed.
• Supervisory Expectations:
• • Retirement Scheme Administrators are expected to ensure that the process leading to preparation and issuance of Member Statements and Pension Benefit Statements is sufficiently robust to ensure that such documents contain all information prescribed by the Pension Rules.
  • All communications issued to members and/or beneficiaries must be clear, accurate, concise, transparent and member-focused, enabling members and beneficiaries to understand their retirement savings and make informed decisions.

Quality of Data in Regulatory Financial Returns

Following the Outcome-Based Supervisory Onsite Inspections carried out during 2025, the MFSA’s Insurance and Pensions Supervision Function (“IPS”) has issued a Dear CEO Letter outlining its key observations and supervisory expectations regarding the quality of financial regulatory reporting within the insurance sector.

As part of its 2025 supervisory programme, the MFSA identified Data Quality in Financial Regulatory Returns as a strategic supervisory priority, reflecting EIOPA’s ongoing emphasis on the importance of high-quality regulatory data. Given the reliance placed on regulatory returns for supervisory, analytical and reporting purposes at both national and European levels, (re)insurance undertakings are expected to ensure that all submissions are timely, accurate, complete and reliable.

The inspections were designed to provide the Authority with greater insight into the processes and controls underpinning the preparation of regulatory returns, including Quarterly Management Accounts, National Specific Templates (NSTs), and Quantitative Reporting Templates (QRTs) submitted on both a quarterly and annual basis.

Through the Dear CEO Letter, the MFSA seeks to share the key findings arising from its supervisory engagements and to reinforce its expectations regarding the governance, oversight and control frameworks necessary to support robust regulatory reporting. The letter highlights areas where improvements may be required and promotes greater awareness of the standards expected across the insurance sector.

The Authority emphasises that the quality and reliability of regulatory data remain essential to effective supervision. Accordingly, (re)insurance undertakings are expected to carefully consider the findings and expectations set out in the letter and, where necessary, take appropriate measures to strengthen their reporting processes, governance arrangements and internal control frameworks.

Outcome-Based Supervision: Questionnaire issued by the Authority to firms which fall within the scope of Transaction Reporting Obligation Article 26 of Markets in Financial Instruments Regulation (EU) No 600/2014 (‘MiFIR’) and the accompanying Markets in Financial Instruments Directive 2014/65/EU (‘MiFID II’)

The MFSA has published a Dear CEO Letter summarising the findings of a thematic review conducted on a sample of investment firms and credit institutions subject to the transaction reporting requirements under Article 26 of the Markets in Financial Instruments Regulation (MiFIR). The review assessed firms' governance arrangements, transaction reporting frameworks, transparency obligations, outsourcing oversight, algorithm governance, staff training, and data protection controls.

Key Findings: The review identified generally positive levels of awareness of MiFIR obligations and the existence of core transaction reporting frameworks across most respondents. Nevertheless, a number of firms reported weaknesses in areas such as trading obligation assessments, application of transparency waivers and deferrals, algorithm governance arrangements, staff training, and the consistency of internal control and assurance frameworks. Variations were also observed in firms' approaches to transaction reporting reconciliations, outsourcing oversight, and documentation supporting compliance decisions.

Supervisory Expectations: The Authority expects firms to maintain robust governance and control arrangements supporting the completeness, accuracy, and timeliness of regulatory reporting. Firms should periodically reassess their compliance frameworks, strengthen oversight mechanisms, ensure adequate staff training, and remain prepared for ongoing regulatory developments arising from the MiFIR Review and related Level 2 measures. The findings will continue to inform the MFSA's risk-based supervisory activities.

Outcomes-Based Review: Outsourcing by Fund Managers (including self-managed schemes authorised as AIFs, UCITS and PIFs) with respect to the critical functions of portfolio management, risk management, valuation, compliance, AML and internal audit

The review assessed the extent Fund Managers comply with the requirements of the Directives 2011/61/EU and 2009/65/EC as amended, and as transposed in the applicable investment services rules, in terms of outsourcing, and the level of adherence with internal processes in the outsourcing process life-cycle.

Key Findings:

• Verification of critical elements of the outsourced service provider at pre-appointment stage was found to be lacking;
• Distinction between ‘in-house’ function and an ‘outsourced service’ was not always clear; conflict of interest identification and management was not in line with the MFSA Corporate Governance Code;
• Reporting to the governing body of the Fund Manager on outsourcing is limited to high-level information;
• Outsourced arrangements shall be applied in line with the nature, scale and complexity of operations of the Fund Manager and, in any event, the Fund Manager shall not become a ‘letter box’ entity; and
• Lack of effective contingency planning and evaluation was observed.

Supervisory Expectations:

• Fund Managers should focus on having clear pre-defined criteria in their approach in the selection of outsourced service providers and taking into consideration the substance requirements to avoid letter-box entity situations;
• Conflict of interest that arises from outsourcing relationships should be managed appropriately;
• Fund Managers must have proper and effective due diligence process in place (including properly documenting the ongoing reviews conducted); and
• The governing body should be provided with frequent reporting that enhances its visibility on the outsourced service providers and a contingency plan should be in place that ensures uninterrupted service to clients in case the outsourced service provider fails to deliver the contracted service.