L.S. 373.03 Regolamenti dwar Reġistru Ċentrali tal-Kontijiet Bankarji

(1)The title of these regulations is the Centralised Bank Account Register Regulations. Citation and scope

(2)The scope of these regulations is to implement the provisions of Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 and of Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 relative to centralised automated mechanisms allowing for the identification, in a timely manner, of any natural or legal persons holding or controlling payment accounts and bank accounts identified by IBAN, or making use of safe custody services provided by credit institutions. 2. requires:

(1)In these regulations, unless the context otherwise Interpretation. Amended by: L.N. 83 of 2026. "Act" means the Prevention of Money Laundering Act; Cap. 373. "beneficial owner" shall have the same meaning as assigned to it under the Prevention of Money Laundering and Funding of Terrorism Regulations;   S.L. 373. 01. "competent authority" shall have the same meaning as assigned to it under the Prevention of Money Laundering and Funding of Terrorism Regulations;   S.L. 373.01. "credit institution" means any one of the following: (

1. a)a person or institution who is for the time being licensed under the provisions of the Banking Act;   Cap. 371. (
2. b)a branch in Malta of any person or institution who has been granted an equivalent licence or authorisation under the laws of any other jurisdiction; and (
3. c)the Central Bank of Malta; "customer" shall have the same meaning as assigned to it under the Prevention of Money Laundering and Funding of Terrorism Regulations; *Vide Regulation 5 of Legal Notice 83 of 2026.   S.L. 373.01 2 CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 "financial institution" means any one of the following:   Cap. 376. (
4. a)a person or institution who is for the time being licensed under the provisions of the Financial Institutions Act; and (
5. b)a branch in Malta of any person or institution who has been granted an equivalent licence or authorization under the laws of any other jurisdiction; "IBAN" means an international payment account number identifier, which unambiguously identifies an individual payment account, the elements of which are specified by the International Organisation for Standardisation; "register" means the centralised automated mechanism referred to in article 16

(1)(n) of the Act; "safe custody" means the holding of tangible assets on behalf of customers;   Cap. 365. "serious criminal offences" means tax evasion, an offence under the National Interest (Enabling Powers) Act and any other offence listed in Annex I to Regulation (EU) 2016/794.

(2)Words and expressions used in these regulations which are also used in the Act shall have the same meaning as assigned to them in the Act. Obligations of credit and financial institutions. 3.

(1)Where a credit or financial institution provides an account identified by IBAN, or where a credit institution provides safe custody services, the credit or financial institution shall, for the purposes of these regulations, maintain an electronic record of such data and information as may be prescribed by the Unit in relation to the following: (

1. a)the customer and, where applicable, (
2. i)any agent thereof authorized to act on the customer’s behalf; and (
3. ii)the beneficial owner of the customer; (
4. b)the IBAN associated with any such account or the alphanumeric code used to identify safe deposit boxes or any items entrusted to a credit institution when providing any safe custody services as are referred to hereabove; (
5. c)the length of time for which any account or safe custody services are provided as set out hereabove; and CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 (
6. d)any other data or information on bank or payment accounts or safe custody services provided by credit institutions as the Unit may set out from time to time in procedures issued under regulation 5.

(2)Credit and financial institutions shall ensure that any data that they may be required to hold in terms of sub-regulation

(1)is at all times adequate, accurate and up to date, and the electronic record thereof shall be updated immediately upon the credit or financial institution being informed or otherwise becoming aware that any of the data or information required to be held has changed.

(3)Regulation 13 of the Prevention of Money Laundering and Funding of Terrorism Regulations shall be equally applicable to the retention of the data and information that credit and financial institutions may be required to hold in terms of sub-regulation

(1). S.L. 373.01. 4.

(1)The Unit shall establish, manage and administer the register wherein there shall be retained data and information on accounts identified by IBAN held by credit and financial institutions and on safe custody services provided by credit institutions, which data and information is to allow for the timely identification of any person or persons holding or controlling any such accounts or assets held under safe custody, or who may have held or controlled any such accounts or assets. Establishment, management and administration of register.

(2)The register shall contain an electronic record of the data and information that credit and financial institutions are required to hold in terms of regulation 3

(1), which data and information is to be made available by credit and financial institutions in such format and with such frequency as may be prescribed by the Unit, with credit and financial institutions to retain such records as may be necessary to show that they have fulfilled any such obligations for a period of five

(5)years from the date on which data and information was submitted or was required to be submitted, whichever is the earlier.

(3)In carrying out the functions referred to in subregulation

(1), the Unit shall have regard to the highest technological standards and shall ensure that any of its officers or employees responsible for its management and administration are of high integrity and receive proper and regular training as to the confidentiality and data protection obligations applicable to the register.

(4)Any data or information contained in the register shall be so held for five

(5)years following the closure of the account or the termination of the safe custody service as may be applicable, upon the expiry of which the data and information so held shall be deleted: Provided that the period of five

(5)years may be further 3 4 CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 extended, up to a maximum retention period of ten

(10)years, where such extension would be considered necessary for the purposes of the prevention, detection, analysis, investigation or prosecution of money laundering, associated predicate offences, funding of terrorism or any other serious criminal offence.   S.L. 586. 09.

(5)The rights of the data subject referred to in regulation 4 of the Restriction of the Data Protection (Obligations and Rights) Regulations, in particular the right of access, shall be restricted, partially or completely, where such a restriction is necessary and proportionate for the Unit to ensure the proper functioning of the register and avoid causing prejudice to any action being undertaken by any of the authorities that are to be allowed access thereof in terms of regulation 6 in the course of its functions at law. Issue of procedures and guidance. 5. The Unit may issue procedures and guidance as may be necessary for the purpose of prescribing anything required under these regulations and to ensure the proper functioning of the register, with any such procedures being binding on credit and financial institutions. Access to register. Amended by: L.N. 83 of 2026. 6.

(1)The data and information held in the register shall be directly accessible, in line with procedures set out by the Unit, by the following authorities: (

1. a)the Unit; (
2. b)national authorities conducting criminal investigations into or prosecutions of money laundering, associated predicate offences, funding of terrorism or any other serious criminal offence, including when supporting investigations concerning any of the said offences; (
3. c)the Asset Recovery Bureau; (
4. d)the Commissioner for Revenue; (
5. e)the Sanctions Monitoring Board; and (
6. f)the Security Service.

(2)Each of the authorities listed in sub-regulation

(1)shall access and make use of the data and information contained in the register on a case-by-case basis and to the extent that this may be necessary for the prevention, detection, investigation or prosecution of money laundering, associated predicate offences funding of terrorism or any other serious criminal offence, and for the avoidance of any doubt this shall include supporting investigations concerning any such offence, including the identification, tracing and freezing of the assets related to such investigation: Provided that the above shall be without prejudice to any CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 access to data and information held in the register that the Unit may require for the proper carrying out of its functions under regulation 4

(1).

(3)In addition to the access referred to in sub-regulation

(2), the data and information contained in the register may also be used to produce such aggregate or statistical data as may be required by the authorities referred to hereabove for the same purposes as are referred to in sub-regulation

(2).

(4)The data and information contained in the register may also be accessed and made use of: (a) by the Financial Intelligence Analysis Unit to reply to justified requests for information received from a competent authority not listed in sub-regulation

(1); and (b) by any of the authorities listed in sub-regulation

(1)to reply to justified requests for information received from foreign or supranational bodies having similar functions after they have ascertained that the requesting body applies confidentiality and data protection requirements equivalent to those applicable to them: Provided that the authorities referred to in paragraphs (

1. a)and (
2. b)shall disclose to the register the requesting body to which any such data and information shall be disclosed: Provided further that the authorities referred to in (
3. a)and (
4. b)may provide for specific procedures for the receipt of any request of information and may impose such conditions and restrictions as they may consider necessary when replying to any such request for information.

(5)Each of the authorities listed in sub-regulation

(1)shall designate one or more of their officers or employees that are to have access to and carry out searches in the register, with each designated officer or employee being granted the said rights only upon undergoing such registration or accreditation process as may be established by the Unit.

(6)The authorities listed in sub-regulation

(1)shall implement the necessary safeguards to ensure that data and information held in the register is accessed and made use of only when this is strictly required for the purposes set out in this regulation. 5 6 CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03

(7)In meeting their obligation under sub-regulation

(6), and having due regard to the sensitivity of the data and information involved, the authorities listed in sub-regulation

(1)shall, as a minimum: (

1. a)ensure that they maintain high professional standards of confidentiality and adherence with the applicable data protection requirements, including through monitoring compliance with the said standards, and that all of their officers and employees are of high integrity; (
2. b)provide any officer or employee designated in terms of sub-regulation

(5), or any officer or employee able to request any such employee to carry out searches in the register, with the necessary training on how to handle data and information accessible through the register in line with data protection requirements; (

1. c)establish internal policies and procedures setting out the conditions and circumstances in which data and information is to be obtained from the register, including safeguards to avoid unauthorized or unjustified access thereto, and monitoring the application of the same; (
2. d)apply technical and organisational measures to ensure the security of the data to high technological standards; and (
3. e)ensure that the Unit is promptly informed whenever an officer or employee is no longer to be considered as a designated employee in terms of sub-regulation

(5).

(8)Where any of the authorities becomes aware that the data or information held in the register is not correct or is otherwise not up to date, the authority concerned shall immediately inform the Unit.

(9)Each authority listed in sub-regulation

(1)shall hold statistical data on the number of searches carried out through the register and shall make the same available to the Unit or to the European Commission upon request or in line with such procedures as may be established. Keeping and access to logs. 7.

(1)The Unit shall establish such procedures as it may deem proper to monitor and regulate the access and the carrying out of searches for data and information contained in the register, which procedures shall include the retention of the following information with respect to each search: (

1. a)the case reference number; (
2. b)the date and time of the query or search; CENTRALISED BANK ACCOUNT REGISTER (
3. c)search; [ S.L. 373.03 the type of data used to launch the query or (
4. d)the unique identifier of the results; (
5. e)the name of the authority consulting the registry; (
6. f)the unique user identifier of the designated officer or employee referred to in regulation 6

(5)and, where applicable, of the official who ordered the query or search and, as far as possible, the unique user identifier of the recipient of the results of the query or search.

(2)The information referred to in sub-regulation

(1)(

1. a)to (
2. f)shall be: (
3. a)held only to monitor confidentiality and data protection requirements, including checking the admissibility of a request and the lawfulness of data processing, and for ensuring data security; (
4. b)accessible only to the data protection officer of the Unit, who shall check the same on a regular basis, and, upon request, to the Information and Data Protection Commissioner; and (
5. c)protected by appropriate measures against unauthorised access and shall be erased five

(5)years after its creation, unless it is required for monitoring procedures that are ongoing.

(3)Any data or information obtained through the register shall be kept confidential by the authorities and by their officers, employees or agents, past and present, and any use thereof other than for the purposes set out in regulation 6 shall be considered to be an unauthorised disclosure of the same.

(4)In the event that the authorities listed in regulation 6

(1)become aware of any unauthorised or unjustified access to, or use of, the register, they shall promptly inform the Unit and provide it with any information in relation to any such unauthorised or unjustified access or use as may be requested by the Unit.

(5)The Unit may, where it considers that any of the authorities are not implementing the necessary safeguards to prevent unauthorised or unjustified access to, or use of, the register and of the data and information contained therein, or are otherwise failing to comply with any of their obligations under these regulations, restrict, suspend or terminate the authority’s access and only reinstate the same again once the authority has implemented the necessary measures to prevent the same from occurring again. 7 8 CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 Supervision and enforcement. 8.

(1)The Unit shall be responsible to monitor that credit and financial institutions meet their obligations under these regulations and any procedures and guidance issued under regulation 5.

(2)For the purposes of carrying out its functions under subregulation

(1), the Unit may exercise any of the powers granted to it under article 26 of the Act as well as carry out data quality checks on the data and information provided by credit and financial institutions for inclusion in the register as it may deem fit and give such directions as may be necessary to redress any issues identified with respect to such data and information.

(3)In accordance with article 13 of the Act, any credit or financial institution who contravenes any provision of these regulations or of any procedure or guidance issued in terms of regulation 5, as well as any direction given by the Unit, shall be liable to an administrative penalty of not less than two hundred fifty euro (€250) and not more than forty-six thousand five hundred euro (€46,500) in respect of every separate breach.

(4)Unit may: Notwithstanding the provisions of sub-regulation

(3), the (

1. a)with respect to minor contraventions and where the circumstances so warrant, impose an administrative penalty below the minimum established by these regulations but not less than two hundred and fifty euro (€250) or issue a reprimand in writing instead of an administrative penalty; (
2. b)with respect to serious, repeated or systematic contraventions, impose administrative sanctions that in total are not to exceed one million euro (€1,000,000); (
3. c)instead of or in conjunction with the imposition of any administrative penalty as envisaged under this regulation, require the credit or financial institution to take any action or measure to remedy such contravention or to ensure compliance with the provisions of these regulations or any procedures issued by the Unit.

(5)Administrative measures under these regulations shall be imposed by the Unit without recourse to a court hearing and in accordance with policies and procedures established by the Board of Governors referred to in the Act, with the Unit being able to impose penalties either as a one-time fixed penalty or as a daily cumulative penalty or both: Provided that an administrative penalty imposed on a daily cumulative basis shall not be less than two hundred and fifty CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 euro (€250) and the accumulated penalty shall not exceed the maximum set out under sub-regulations

(3)and

(4)(b), as may be applicable.

(6)Articles 13A to 13C, both inclusive, of the Act shall be equally applicable in relation to any administrative measure imposed on a credit or financial institution for any contravention of these regulations or of any procedures or guidance issued in terms of regulation 5. 9.

(1)In the course of determining the imposition of an administrative penalty on a credit or financial institution, the Financial Intelligence Analysis Unit may, in its own discretion but in accordance with the policies and procedures referred to in article 13

(2)of the Act, propose or agree to a request, to enter into a settlement agreement with the subject person or individual concerned.

(2)The Financial Intelligence Analysis Unit shall not enter into a settlement agreement where: (

1. a)the Financial Intelligence Analysis Unit believes that doing so would not be in the public interest in accordance with any policies and procedures as may be established by the Board of Governors; or (
2. b)two

(2)years have not yet lapsed from the conclusion of any corrective or remedial actions undertaken by the credit or financial institution concerned as part of a prior settlement agreement: Provided that the Financial Intelligence Analysis Unit may apply this restriction either in general or in relation to the different categories of actions that may be undertaken in accordance with article 26 of the Act but in any case it shall not enter into more than two

(2)settlement agreements with the same subject person within a period of two

(2)years: Provided further that where the credit or financial institution forms part of a group, the said limitation shall take into account any settlement agreement entered into with any other subject person within the group.

(3)A settlement agreement shall be in writing, signed, and shall be binding on the Financial Intelligence Analysis Unit and the credit or financial institution concerned. The said settlement agreement shall establish the terms and conditions of the agreement and shall include: Settlement agreements. Added by: L.N. 83 of 2026. 9 10 CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 (

1. a)a description of the contraventions identified by the Financial Intelligence Analysis Unit and the unconditional agreement therewith by the credit or financial institution concerned; (
2. b)a description of any corrective or remedial actions which the Financial Intelligence Analysis Unit may deem necessary to restore compliance, where applicable; (
3. c)an undertaking by the credit or financial institution concerned to implement the corrective or remedial actions required by the Financial Intelligence Analysis Unit, within such time-frames and subject to such conditions as may be set by or otherwise agreed with the Financial Intelligence Analysis Unit; (
4. d)the administrative penalty which the Financial Intelligence Analysis Unit was intent on imposing on the credit or financial institution concerned, and the amount by which the said administrative penalty is reduced on condition that the credit or financial institution concerned complies with the terms and conditions of the settlement agreement; (
5. e)an undertaking by the credit or financial institution concerned to pay the reduced administrative penalty in accordance with the terms established in the settlement agreement; (
6. f)a waiver by the credit or financial institution concerned of any right to appeal, review or to otherwise challenge the determination and conclusions of the Financial Intelligence Analysis Unit; and (
7. g)a declaration by the credit or financial institution concerned that the amount by which the administrative penalty is reduced shall become due and payable to the Financial Intelligence Analysis Unit, upon the Financial Intelligence Analysis Unit’s determination that any corrective or remedial actions as are referred to in paragraph (
8. c)have not been completed as envisaged by the settlement agreement.

(4)The amount of the administrative penalty conditionally r e d u c e d i n a c c o r da nc e wi t h su b- r e g u la t io n

(3)( d ) sh a l l b e extinguished upon determination by the Financial Intelligence CENTRALISED BANK ACCOUNT REGISTER [ S.L. 373.03 Analysis Unit that any corrective or remedial actions required by the settlement agreement have been carried out.

(5)In the event that a settlement agreement is not entered into due to lack of interest or lack of cooperation by the credit or financial institution concerned or within such time as may be set out by the Financial Intelligence Analysis Unit, the Financial Intelligence Analysis Unit shall proceed with the imposition of the administrative penalty in the full amount that it was intent on imposing and the imposition of such other measures as it is empowered by law to impose and as it may deem necessary.

(6)A settlement agreement shall be considered to be completed when the said agreement is signed by both parties and the credit or financial institution concerned has paid the full amount of the reduced administrative penalty in accordance with the terms and conditions established in the agreement, failing which, the Financial Intelligence Analysis Unit shall proceed with the imposition of the administrative penalty in the full amount it was intent on imposing and the imposition of such other measures as it is empowered by law to impose and as it may deem necessary.

(7)In the event that, following the conclusion of a settlement agreement, the Financial Intelligence Analysis Unit determines that the credit or financial institution concerned failed, without reasonable justification, to comply with the terms of the settlement agreement or with any corrective or remedial action as required by the agreement: (

1. a)the credit or financial institution concerned shall, following a notice in writing from the Financial Intelligence Analysis Unit, forfeit any concession or other benefit arising from the agreement, and the amount by which the administrative penalty had been reduced shall become due and payable to the Financial Intelligence Analysis Unit; (
2. b)the Financial Intelligence Analysis Unit may by notice in writing take such other measures as the Financial Intelligence Analysis Unit is empowered by law to take, and as may be deemed necessary in the circumstances, including issuing directives in writing requiring the credit or financial institution concerned to do or to refrain from doing any act, including such prohibitions, restrictions and limitations under such conditions as may be specified in the directives; and (
3. c)the Financial Intelligence Analysis Unit may institute an action before the Civil Court, First Hall, 11 12 [ S.L. 373.03 CENTRALISED BANK ACCOUNT REGISTER to recover from the credit or financial institution concerned the amount by which the administrative penalty had been reduced in terms of the settlement agreement, and to enforce the completion of the corrective or remedial actions that the Financial Intelligence Analysis Unit had imposed through the settlement agreement.  Cap. 12.

(8)Any such action shall follow the procedure established in articles 167 to 170 of the Code of Organization and Civil Procedure: Provided that where leave to defend the action is granted in accordance with article 170 of the Code of Organization and Civil Procedure or an appeal is otherwise filed from any decision of the Civil Court, First Hall, the time-frames established in article 13A

(3)to

(5)of the Act shall apply mutatis mutandis: Provided further that articles 13A

(6)and 13C of the Act shall also apply mutatis mutandis to any action referred to under this sub-regulation or an appeal therefrom.

(9)Where the Financial Intelligence Analysis Unit files an action as referred to in sub-regulation

(7)(d), it may also request the court to impose on the credit or financial institution concerned additional penalties which shall not exceed one thousand euro (€1,000) for every day until the corrective or remedial actions are completed. Communication of administrative penalties and measures to supervisory authorities. Added by: L.N. 83 of 2026. 10.* When the Financial Intelligence Analysis Unit exercises its powers under regulations 8 and 9, it shall inform in a timely manner the relevant supervisory authority or any other authority, body or committee responsible for the authorisation, approval, licensing, registration or regulation of, or the granting of a warrant to, the subject person or individual concerned and shall provide all relevant information on the contraventions committed as it deems necessary. *Vide Regulation 5

(3)of Legal Notice 83 of 2026.