INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) [ S.L. 370.48. 1 SUBSIDIARY LEGISLATION 370.48 INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES A

2022, as amended by Legal Notice 156

2025. 1.

these regulations is the Investment Firms Directive (Administrative Penalties, Measures and Investigatory Powers) Regulations. Citation and scope.

these regulations is to transpose Articles 18, 19, 20, 21, 22, and 23

Directive (EU) 2019/2034

the European Parliament and

the Council

27 November 2019 on the prudential supervision

investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU. 2. requires -

the European Parliament and

the Council

26 June 2013 on access to the activity

credit institutions and the prudential supervision

credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, as amended from time to time, and includes any implementing measures that have been or may be issued thereunder; "CRR" means Regulation (EU) No 575/2013

the European Parliament and

the Council

26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012, as amended from time to time, and includes any implementing measures that have been or may be issued thereunder; "financial holding company" shall have the same meaning as that assigned to it in point

Article 4

the CRR; "the IFD" means Directive 2019/2034

the European Parliament and

the Council

27 November 2019 on the prudential supervision

investment firms and amending Directives 2002/87/EC, * See Legal Notice 60

1. Interpretation. Cap.
2. Cap.
3. 2 [ S.L. 370.48 INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU, as amended from time to time, and includes any implementing measures that have been or may be issued thereunder; "the IFR" means Regulation 2019/2033

the European Parliament and

the Council

27 November 2019 on the prudential requirements

investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/ 2014, as amended from time to time, and includes any implementing measures that have been or may be issued thereunder; "investment firm" means a person who holds an investment services licence issued by the competent authority under the Act and which is subject to the requirements

the IFR and the IFD; "mixed financial holding company" shall have the same meaning as that assigned to it in point

Article 3

the IFR.

the IFD and out

the IFR, either directly or in collaboration with European regulatory authorities and with overseas regulatory authorities, in terms

law and as warranted by the relevant circumstances. Administrative penalties and other administrative measures. 4.

the competent authority referred to in regulation 3 and the IFD, the competent authority shall impose administrative penalties and other administrative measures in respect

breaches

: (a) the provisions

the Act and, or

regulations and, or Investment Services Rules made thereunder transposing the provisions

the IFD; and, or (b) the provisions

the IFR, including where an investment firm: (i) fails to have in place internal governance arrangements as set out in Article 26

the IFD; (ii) fails to report information or provides incomplete or inaccurate information on compliance with the obligation to meet own funds requirements set out in Article 11

the IFR to the competent authority, in breach

point (b)

Article 54

the IFR; INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) [ S.L. 370.48. (iii) fails to report to the competent authority, in breach

point (e)

Article 54

the IFR, information about concentration risk or provides incomplete or inaccurate information; (iv) incurs a concentration risk in excess

the limits set out in Article 37

the IFR, without prejudice to Articles 38 and 39

the IFR; (v) repeatedly or persistently fails to hold liquid assets in breach

Article 43

the IFR, without prejudice to Article 44

the IFR; (vi) fails to disclose information, or provides incomplete or inaccurate information, in breach

the provisions set out in Part Six

the IFR; (vii) makes payments to holders

instruments included in the own funds

the investment firm where Article 28, 52 or 63

the CRR prohibit such payments to holders

instruments included in own funds; (viii) is found liable for a serious breach

national provisions adopted pursuant to Directive (EU) 2015/849

the European Parliament and

the Council

20 May 2015 on the prevention

the use

the financial system for the purposes

money laundering or terrorist financing, amending Regulation (EU) No 648/ 2012

the European Parliament and

the Council, and repealing Directive 2005/60/EC

the European Parliament and

the Council and Commission Directive 2006/70/EC; (ix) allows one or more persons who do not comply with Article 91

the CRD to become or remain a member

the management body.

the provisions

the Act and any regulations and Investment Services Rules issued thereunder transposing the requirements

the IFD, and

the IFR to the members

the management body

such companies and to other natural persons who under Maltese law are responsible for the breach. 3 4 [ S.L. 370.48 Investigatory and information gathering powers

the competent authority. Amended by: L.N. 156

1. INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS)
2. The competent authority shall have all the information gathering powers and investigatory powers which are necessary for the exercise

its functions. Without prejudice to other relevant provisions laid down in the Act, the IFD and in the IFR these powers shall include: (

1. a)the power to require information from the following natural or legal persons: (
2. i)(
3. ii)in Malta; investment firms established in Malta; investment holding companies established (iii) mixed established in Malta; financial (
4. iv)mixed-activity established in Malta; holding holding companies companies (
5. v)persons belonging to the entities referred to in sub-paragraphs (
6. i)to (iv); (
7. vi)third parties to whom the entities referred to in sub-paragraphs (
8. i)to (
9. iv)have outsourced operational functions or activities; (
10. b)the power to conduct all necessary investigations

any person referred in paragraph (a) established or located in Malta where necessary to carry out the tasks

the competent authority including: (i) the right to require the submission

documents by the persons referred to in paragraph (a); (ii) the right to examine the books and records

the persons referred to in paragraph (

1. a)and the right to take copies or extracts from such books and records; (iii) the right to obtain written or oral explanations from any person referred to in paragraph (
2. a)or their representatives or staff; and (
3. iv)the right to interview any other person who consents to be interviewed for the purpose

collecting information relating to the subject matter

an investigation; (c) the power to conduct all necessary inspections at the business premises

the legal persons referred to in paragraph (a) and any other undertakings included in the INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) [ S.L. 370.48. 5 supervision

compliance with the group capital test, where the competent authority is the group supervisor, subject to the prior notification

other competent authorities concerned. 6. Where an investment firm is found by the competent authority to have committed any

the breaches referred to in regulation 5, the administrative penalties and other administrative measures which the competent authority may impose shall include at least the following: (a) a public statement which identifies the natural or legal person, investment firm, financial holding company or mixed financial holding company and the nature

the breach; (

1. b)an order requiring the natural or legal person responsible to cease the conduct and to desist from repeating that conduct; (
2. c)the withdrawal

the investment firm’s investment services licence, in accordance with article 7

the Act; (d) subject to the provisions

regulation 4

the investment firm’s management body or any other natural person, who is held responsible, from exercising functions within investment firms; (e) in the case

a legal person, administrative penalties

up to 10%

the total annual net turnover including the gross income consisting

interest receivable and similar income, income from shares and other variable or fixed-yield securities, and commissions or fees

that legal person in the preceding business year: Provided that, where the investment firm subject to the administrative penalty is a subsidiary

a parent undertaking, the relevant gross income shall be the gross income resulting from the consolidated account

the ultimate parent undertaking in the preceding business year; (f) in the case

a legal person, administrative penalties

up to twice the amount

the profits gained or losses avoided due to the breach where those profits or losses can be determined; and (g) in the case

a natural person, administrative penalties

up to EUR 5,000,000. Penalties. Amended by: L.N. 156

2025. 6 [ S.L. 370.48 Publication

administrative penalties and measures. INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) 7.

ficial website and, or on any other media, as deemed appropriate, any administrative penalties and measures which are imposed for breaches

the Act, regulations and Investment Services Rules issued thereunder transposing the requirements

the IFD, and

the IFR. Such publication shall include information on the type and nature

the breach and the identity

the natural or legal person on whom the penalty or measure is imposed. The information shall only be published by the competent authority after that person has been informed

those administrative penalties or measures and to the extent that the publication is necessary and proportionate: Provided that, in cases where an appeal has been filed by the person on whom such administrative penalties or measures have been imposed, the competent authority shall, without undue delay, also publish on its

ficial website information on the status

the appeal and the outcome thereof.

these regulations, on an anonymous basis, in any

the following circumstances: (a) where the penalty or measure is imposed on a natural person and, following an obligatory prior assessment, the publication

personal data is found to be disproportionate; (b) where publication would jeopardise the stability

financial markets or an ongoing criminal investigation; or (

1. c)where publication would cause, insofar as it can be determined, disproportionate damage to the investment firms, or natural persons involved: Provided that, where the circumstances referred to in paragraph (
2. a)are likely to cease within a reasonable period

time, publication in terms

sub-regulation

time.

this regulation shall remain on the

ficial website

the competent authority for a period

not less than five years. Personal data shall be retained on the

ficial website

the competent authority only for the period necessary, in accordance with the provisions

Maltese legislation on data protection. Exchange

information on penalties. 8. The competent authority shall inform the EBA

all administrative penalties and measures it imposes under these regulations. It shall also provide information regarding any appeal in relation thereto and the outcome therefrom for the purpose

publication on the EBA database

sanctions which the competent INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) [ S.L. 370.48. 7 authority shall consult where appropriate in the carrying out

its functions and duties. 9. When determining the type

administrative penalties or other administrative measures and the level

administrative penalties to be imposed in terms

these regulations, the competent authority shall take into account all relevant circumstances including, where appropriate: (a) Effective application

penalties and exercise

powers to impose penalties by the competent authority. the gravity and the duration

the breach; (b) the degree

responsibility

the natural or legal person responsible for the breach; (c) the financial strength

the natural or legal person responsible for the breach, including the total turnover

a legal person or the annual income

a natural person; (d) the importance

profits gained or losses avoided by the natural or legal person responsible for the breach; (

1. e)breach; the damages for third parties caused by the (
2. f)the level

co-operation

the natural or legal person responsible for the breach with the competent authority; (

1. g)previous breaches by the natural or legal person responsible for the breach; and (
2. h)any potential systemic consequence

the breach. 10.

potential or actual breaches

the provisions

the Act, regulations and Investment Services Rules issued thereunder transposing the requirements

the IFD, and

the provisions

the IFR.

such reports, including the establishment

secure communication channels; (b) appropriate protection against retaliation, discrimination or other types

unfair treatment by the investment firm for employees

investment firms who report breaches committed within the investment firm; Reporting

breaches. 8 [ S.L. 370.48 INVESTMENT FIRMS DIRECTIVE (ADMINISTRATIVE PENALTIES, MEASURES AND INVESTIGATORY POWERS) (c) protection

personal data concerning both the person who reports the breaches and the natural person who is allegedly responsible for a breach, in accordance with the Maltese legislation on data protection and Regulation (EU) 2016/679

the European Parliament and

the Council

27 April 2016 on the protection

natural persons with regard to the processing

personal data and on the free movement

such data, and repealing Directive 95/46/EC (General Data Protection Regulation); (d) clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the investment firm, unless disclosure is required by national law in the context

further investigations or subsequent judicial proceedings.

fer the same protection as the protection referred to in paragraphs (b), (c) and (d)

sub-regulation

appeal.    Cap.

2. Subject to the provisions

the Act, any person in respect

whom a decision is taken by the competent authority under these regulations may appeal to the Financial Services Tribunal in terms

article 19

the Investment Services Act.