L.S. 476.04 Regolamenti dwar Reporting of Infringements

(1)The title of these regulations is the Reporting of Infringements Regulations. Citation and scope.

(2)The purpose of these regulations is to implement Article 32

(1)of the Market Abuse Regulation and the Commission Implementing Directive on the reporting to competent authorities of actual or potential infringements, and they shall be interpreted and applied accordingly.

(3)These regulations specify the procedures set out in Article 32

(1)of the Market Abuse Regulation, including arrangements for reporting and for following-up reports, and measures for the protection of persons working under a contract of employment and measures for the protection of personal data. 2.

(1)In these regulations unless the context otherwise requires: "the Act" means the Prevention of Financial Markets Abuse Act; "Commission Implementing Directive " means Commission Implementing Directive (EU) 2015/2392 of 17 December 2015 on Regulation (EU) No 596/2014 of the European Parliament and of the Council as regards reporting to competent authorities of actual or potential infringements of that Regulation; "Market Abuse Regulation" means Regulation (EU) No 596/2014 of the European Parliament and of the Council of the 16 April 2014 on market abuse (market abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/ EC; "report of infringement " means a report submitted by the reporting person to the competent authority regarding an actual or potential infringement of the Market Abuse Regulation; "reported person" means a person who is accused of having committed, or intending to commit, an infringement of the Market Abuse Regulation by the reporting person; "reporting person " means a person reporting an actual or potential infringement of the Market Abuse Regulation to the competent authority.

(2)Words and expressions used in these regulations shall have the same meaning as is assigned to them in the Market Abuse Regulation and the Commission Implementing Directive unless otherwise defined herein. Interpretation. Cap.

1. 2 [ S.L.476.04 REPORTING OF INFRINGEMENTS Competent authority. Cap.
3. The Malta Financial Services Authority established by the Malta Financial Services Authority Act shall be the designated competent authority in Malta for the purposes of implementing Article 32

(1)of the Market Abuse Regulation and the relevant provisions of the Commission Implementing Directive, and any reference therein to the competent authority shall be deemed and construed accordingly. Applicability of the EU Directive to the competent authority.

1. The competent authority shall exercise all the functions, obligations and powers that are established in the Commission Implementing Directive and shall satisfy all the requirements imposed on competent authorities by the Commission Implementing Directive. Prevention of Financial Markets Abuse Rules.
2. For the better carrying out of Article 32

(1)of the Market Abuse Regulation and the provisions of the Commission Implementing Directive or these regulations, the competent authority may, from time to time, issue and publish Prevention of Financial Markets Abuse Rules which shall be binding on all persons that may be specified therein and as the competent authority may consider appropriate. Appointment and functions of dedicated staff members. 6.

(1)The competent authority shall ensure that dedicated staff members are appointed who can handle reports of infringements. Dedicated staff members shall be trained for the purposes of handling reports of infringements.

(2)Dedicated staff members shall exercise the following functions: (

1. a)providing any interested person with information on the procedures for reporting infringements; (
2. b)receiving and following-up reports of infringements; (
3. c)maintaining contact with the reporting person where the latter has identified itself. Information regarding the receipt of reports of infringements and their followup. 7.

(1)The competent authority shall publish on its website in a separate, easily identifiable and accessible section the information regarding the receipt of reports of infringements set out in sub-regulation

(2).

(2)The information referred to in sub-regulation

(1)shall include all of the following: (a) the communication channels for receiving and following-up the reporting of infringements and for contacting the dedicated staff members in accordance with regulation 9

(1), including: (

1. i)the phone numbers, indicating whether conversations are recorded or unrecorded when using those phone lines; (
2. ii)dedicated electronic and postal addresses, which are secure and ensure confidentiality, to contact the dedicated staff members; (
3. b)the procedures applicable to reports of infringements REPORTING OF INFRINGEMENTS [ S.L.476.04 referred to in regulation 8; (
4. c)the confidentiality regime applicable to reports of infringements in accordance with the procedures applicable to reports of infringements referred to in regulation 8; (
5. d)the procedures for the protection of persons working under a contract of employment; (
6. e)a statement clearly explaining that persons making information available to the competent authority in accordance with the Market Abuse Regulation are not considered to be infringing any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, and are not to be involved in liability of any kind related to such disclosure.

(3)The competent authority may publish on its website more information regarding the receipt and the follow-up of infringements set out in sub-regulation

(2). 8.

(1)The procedures applicable to reports of infringements referred to in regulation 7

(2)(

1. b)shall clearly indicate all of the following information: Procedures applicable to reports of infringements. (
2. a)that reports of infringements can also be submitted anonymously; (
3. b)the manner in which the competent authority may require the reporting person to clarify the information reported or to provide additional information that is available to the reporting person; (
4. c)the type, content and time-frame of the feed-back about the outcome of the report of infringement that the reporting person can expect after the reporting; (
5. d)the confidentiality regime applicable to reports of infringements, including a detailed description of the circumstances under which the confidential data of a reporting person may be disclosed in accordance with Articles 27, 28 and 29 of the Market Abuse Regulation.

(2)The detailed description referred to in sub-regulation

(1)(d) shall ensure awareness of the reporting person concerning the exceptional cases in which confidentiality of data may not be ensured, including where the disclosure of data is a necessary and proportionate obligation required under European Union law or Maltese law in the context of investigations or subsequent judicial proceedings or to safeguard the freedoms of others including the right of defence of the reported person, and in each case subject to appropriate safeguards under such laws. 9.

(1)The competent authority shall establish independent and autonomous communication channels, hereinafter referred to as "dedicated communication channels", which are both secure and ensure confidentiality, for receiving and following-up the reporting Dedicated communication channels. 3 4 [ S.L.476.04 REPORTING OF INFRINGEMENTS of infringements.

(2)Dedicated communication channels shall be considered independent and autonomous, provided that they meet all of the following criteria: (

1. a)they are separated from general communication channels of the competent authority, including those through which the competent authority communicates internally and with third parties in its ordinary course of business; (
2. b)they are designed, set up and operated in a manner that ensures the completeness, integrity and confidentiality of the information and prevents access to nonauthorised staff members of the competent authority; (
3. c)they enable the storage of durable information in accordance with regulation 10 to allow for further investigations.

(3)The dedicated communication channels shall allow for reporting of actual or potential infringements in at least all of the following ways: (

1. a)written report of infringements in electronic or paper format; (
2. b)oral report of infringements through telephone lines, whether recorded or unrecorded; (
3. c)physical meeting with dedicated staff members of the competent authority.

(4)The competent authority shall provide the information referred to in regulation 7

(2)to the reporting person before receiving the report of infringement, or at the moment of receiving it at the latest.

(5)The competent authority shall ensure that a report of infringement received by means other than dedicated communication channels referred to in this regulation is promptly forwarded without modification to the dedicated staff members of the competent authority by using dedicated communication channels. Record-keeping of reports received. 10.

(1)The competent authority shall keep records of every report of infringement received.

(2)The competent authority shall promptly acknowledge the receip t of writt en reports of i nfringement s t o the po st al or electronic address indicated by the reporting person, unless the reporting person explicitly requested otherwise or the competent authority reasonably believes that acknowledging receipt of a written report would jeopardise the protection of the reporting person’s identity.

(3)Where a recorded telephone line is used for reporting of infringements, the competent authority shall have the right to document the oral reporting in the form of: (

1. a)an audio recording of the conversation in a durable and REPORTING OF INFRINGEMENTS [ S.L.476.04 5 retrievable form; or (
2. b)a complete and accurate transcript of the conversation prepared by the dedicated staff members of the competent authority. In cases where the reporting person has disclosed its identity, the competent authority shall offer the possibility to the reporting person to check, rectify and agree with the transcript of the call by signing it.

(4)Where an unrecorded telephone line is used for reporting of infringements, the competent authority shall have the right to document the oral reporting in the form of accurate minutes of the conversation prepared by the dedicated staff members of the competent authority. In cases where the reporting person has disclosed its identity, the competent authority shall offer the possibility to the reporting person to check, rectify and agree with the minutes of the call by signing them.

(5)Where a person requests a physical meeting with the dedicated staff members of the competent authority for reporting an infringement according to regulation 9

(3)(c), the competent authority shall ensure that complete and accurate records of the meeting are kept in a durable and retrievable form. The competent authority shall have the right to document the records of the physical meeting in the form of: (

1. a)an audio recording of the conversation in a durable and retrievable form; or (
2. b)accurate minutes of the meeting prepared by the dedicated staff members of the competent authority. In cases where the reporting person has disclosed its identity, the competent authority shall offer the possibility to the reporting person to check, rectify and agree with the minutes of the meeting by signing them. 11.

(1)The competent authority shall put in place procedures ensuring effective exchange of information and cooperation with other European regulatory authorities and any other relevant authority involved in the protection of persons working under a contract of employment who report infringements of the Market Abuse Regulation to the competent authority or are accused of such infringements, against retaliation, discrimination or other types of unfair treatment, arising due to or in connection with reporting of infringements of the Market Abuse Regulation.

(2)The competent authority shall ensure that: (

1. a)reporting persons have access to comprehensive information and advice on the remedies and procedures available under Maltese law to protect them against unfair treatment, including on the procedures for claiming pecuniary compensation; (
2. b)reporting persons have access to effective assistance from the competent authority before any relevant authority involved in their protection against unfair treatment, including by certifying the condition of Protection of persons working under a contract of employment. 6 [ S.L.476.04 REPORTING OF INFRINGEMENTS whistle-blower of the reporting person in employment disputes. Protection procedures for personal data and reports received. 12.

(1)The competent authority shall ensure that the records of every report of infringement received are stored in a confidential and secure system and access to the data stored in such system shall be available only to staff members of the competent authority for whom access to that data is necessary to perform their professional duties.

(2)The competent authority shall not disclose to any person, either directly or indirectly, the identity of the reporting person or reported person or any other references to circumstances that would allow the identity of the reporting person or reported person to be deduced, unless such transmission is in accordance with the confidentiality regime referred to in regulation 8

(1)(d).

(3)The competent authority shall put in place adequate procedures for the transmission of data of the reporting person and reported person inside and outside of the competent authority. Protection of identity of reported persons not known to the public. 13.

(1)Where the identity of reported persons is not known to the public, the competent authority shall ensure that their identity is protected at least in the same manner as for persons that are under investigation by the competent authority.

(2)The procedures set out in regulation 12

(1)shall also apply for the protection of the identity of the reported persons. Review of the procedure as set out in these regulations. 14. The competent authority shall review the procedure for receiving reports of infringements as established in these regulations and their follow-up once every two years. In reviewing such procedures the competent authority shall take account of its experience and that of other European regulatory authorities and adapt its procedures accordingly and in line with market and technological developments.