The Sanctions Monitoring Board (SMB) has issued on August 2026 a Guidance Note titled Implementing Article 32 Sanctions Compliance Requirements under the National Interest (Enabling Powers) Act, Chapter 653 of the Laws of Malta (the "NIA").

The Guidance Note explains in practical terms what operators are expected to put in place in order to comply with Article 32. It is important to note that this is not just simple commentary but procedures issued by the SMB are legally enforceable under Article 15(5)(c) of the NIA, and the Guidance Note states plainly clearly that it gives practical effect to the Act by setting out what the regulator expects.

Article 32 applies to Subject Persons listed in Schedule I to the NIA. Operators with branches or majority owned subsidiaries in third countries must apply the Act there so far as local law allows. Where local law does not allow it, they must adopt other measures to manage the risk and must be able to show the SMB what they have done.

At the centre of the Guidance Note is what the SMB calls the "Sanctions Framework". Operators are expected to build and maintain the following components:

• An enterprise wide sanctions risk assessment, supported by a documented risk appetite statement approved at senior level.
• Sanctions due diligence on clients, extending to the ownership and control structure behind them.
• Screening of relevant parties against the applicable sanctions lists.
• Ongoing monitoring, including repeat screening whenever lists are updated or circumstances change.
• Freezing of funds and economic resources where restrictive measures require it.
• Reporting of confirmed matches and suspected breaches to the SMB without delay.
• Controls to prevent tipping off.
• Written policies and procedures, with records kept for 5 years.
• Oversight of any reliance on third parties or outsourcing.
• Training for staff and adequate screening systems.
• Governance arrangements, including a designated Sanctions Compliance Officer with genuine authority and independence.

The SMB notes that the above controls should not be conducted in isolation but should be designed to operate as a continuum where the output of one component feeds into the operation of the others, creating an ongoing feedback loop.

The SMB has also included a chapter addressing the interaction between sanctions controls and AML/CFT frameworks. While acknowledging that operators will often utilise the same systems, processes and controls to satisfy both sets of obligations, the SMB emphasises that the underlying legal tests are distinct and should not be treated as interchangeable. The guidance specifically highlights this distinction in the context of beneficial ownership assessments and jurisdictional considerations.

The enforcement position is firm. Article 35 establishes administrative penalties that may be imposed on Subject Persons that fail to comply with obligations under Article 32 of the NIA. Liability can extend to directors, managers and other officers where the breach occurred with their knowledge or followed a failure to supervise. Any penalty above €1,500 is published on the SMB's website. Administrative penalties imposed under this Article are intended to ensure compliance by Subject Persons with their sanctions obligations and may be applied in addition to other supervisory or enforcement measures available under the NIA. The Guidance Note also warns that weak controls may be used as evidence in criminal proceedings, and that a decision not to follow the guidance may count against a Subject Persons in enforcement.

Why Does This Matter?

Sanctions compliance has often been treated as a small extension of the AML/CFT framework. This Guidance Note signals a decisive shift away from that approach reflecting the growing prominence of sanctions compliance at EU level. Against this backdrop the Guidance Note established a common baseline that applies to sole practitioners and large institutions alike, with tailored guidance for individual sectors to follow. Subject Persons should read the Guidance Note together with its annexes, particularly the 11 worked examples addressing the identification and screening of parties within layered ownership and control structures.