The Protection of the Whistleblower Act (CAP. 527) (the “Act”) aims to provide a framework for the protection of persons who expose improper practices such as misconduct and, or dishonest or illegal activity in an organisation. These persons are considered as “Whistleblowers”. Whistleblowing is therefore the disclosure by a person of information regarding improper practices in an organisation. The Act also provides for protection of the whistleblower against detrimental action that he/she might otherwise suffer as a result of his/her whistleblowing.

The Act applies to the MFSA in two ways. Firstly, as an employer, the MFSA appoints a Whistleblowing Reporting Officer to receive and deal with internal disclosures made by MFSA employees under the Act and to facilitate such disclosures, the MFSA maintains Internal Whistleblowing Procedures. Secondly, being a designated authority under the First Schedule to the Act, the MFSA is designated to receive external disclosures from whistleblowers in relation to matters, activities or services falling under the regulatory and supervisory competence of the MFSA and for this purpose it has set up a Whistleblowing Reports Unit.


All disclosures that are made in good faith and not for personal gain, and where the whistleblower reasonably believes the information to be true, qualify to be treated as protected disclosures in terms of the Act. A protected disclosure affords the whistleblower protection against detrimental action and against revealing the identity of the said whistleblower, which can only be revealed with the written consent of the whistleblower. An anonymous disclosure is not a protected disclosure, but it may still be received and processed and taken into account in determining whether an improper practice has occurred.


As a designated authority the MFSA under the Act, is authorised to receive external disclosures in matters related to the business of credit and financial institutions, the business of insurance and the activities of insurance intermediaries, the provision of investment services and collective investment schemes, pensions and retirement funds, regulated markets, central securities depositories, the carrying out of trustee business either in a professional or personal capacity, company service providers, and generally such other areas as may be placed from time to time under the regulatory and supervisory competence of the MFSA.

External disclosures to the MFSA in regard to an improper practice as above will only qualify as protected disclosures if an internal disclosure has already been made or attempted to be made within the relevant organisation.

An external disclosure may also be made if the whistleblower has reasonable grounds to believe one or more of the following:

  • that although an internal disclosure has previously been made, the whistleblower has not been informed on the status of the matter disclosed, or it is reasonably evident to the whistleblower that there has been no action or recommended action on the matter to which the disclosure relates within a reasonable time from the making of the disclosure; or

  • that the head of the organisation is or may be involved in the improper practice alleged in the disclosure; or

  • that immediate reference to the MFSA, is justified by the urgency of the matter to which the disclosure relates, or some other exceptional circumstances; or

  • that as an employee the whistleblower will be subjected to an occupational detriment by his employer if he/she makes an internal disclosure; or

  • that it is likely that evidence relating to the improper practice will be concealed or destroyed if he/she makes an internal disclosure.


The Whistleblowing Reports Unit is set-up in accordance with article 17(1) of the Protection of the Whistleblower Act for the purposes of receiving external disclosures on matters falling under the regulatory and supervisory competence of the MFSA.

The Whistleblowing Reports Unit is bound to consider and decide on the appropriateness of an external disclosure within 45 days of having received such disclosure and inform the whistleblower accordingly. The Unit is also required to determine whether the said disclosure should be referred to another designated authority in terms of the Act, or to the police. Such referral has to be made within 30 days of having received an external disclosure.

The Whistleblowing Reports Unit is set up within the Enforcement Unit of the MFSA.


External disclosures should be made in writing by downloading and completing the Whistleblowing External Disclosure Form available here.