CENTRALISED BANK 
ACCOUNT REGISTER [S.L. 373.03 1
SUBSIDIARY LEGISLATION 373.03
CENTRALISED BANK ACCOUNT 
REGISTER REGULATIONS
20th October, 2020
LEGAL NOTICE 401 of 2020.
Citation and scope 1. (1) The title of these regulations is the Centralised
Bank Account Register Regulations.
(2) The scope of these regulations is to implement the
provisions of Directive (EU) 2018/843 of the European Parliamen t
and of the Council of 30 May 2018 and of Directive (EU) 2019/11 53
of the European Parliament and of the Council of 20 June 2019relative to centralised automated mechanisms allowing for theidentification, in a timely manner, of any natural or legal per sons
holding or controlling payment accounts and bank accounts ident ified
by IBAN, or making use of safe custody services provided by cre dit
institutions.
Interpretation. 2. (1) In these regulations, unless the context otherwise
requires:
Cap. 373. "Act" means the Preventi on of Money Laundering Act;
S.L. 373. 01."beneficial owner" shall have t he same meaning as assigned to
it under the Prevention of Money Laundering and Funding ofTerrorism Regulations;
"credit institution" means  any one of the following:
Cap. 371.(a) a person or institution who is for the time being
licensed under the provisions of the Banking Act;
(b) a branch in Malta of any person or institution
who has been granted an equiva lent licence or authorisation
under the laws of any other jurisdiction; and
(c) the Central Bank of Malta;
S.L. 373.01"customer" shall have the same meaning as assigned to it under
the Prevention of Money Laundering and Funding of TerrorismRegulations;
"financial institution" means any one of the following:
Cap. 376.(a) a person or institution who is for the time being
licensed under the provisions of the Financial Institutions Act ;
and 
(b) a branch in Malta of any person or institution
2[S.L. 373.03CENTRALISED BANK 
ACCOUNT REGISTER
who has been granted an equivalent licence or authorization
under the laws of any other jurisdiction;
"IBAN" means an internatio nal payment account number
identifier, which unambiguously identifies an individual paymen t
account, the elements of which are specified by the Internation al
Organisation for Standardisation;
"register" means the centralised automated mechanism referred
to in article 16(1)(n) of the Act;
"safe custody" means the holding of tangible assets on behalf o f
customers;
Cap. 365."serious criminal offences" m eans tax evasion, an offence
under the National Interest (Enabling Powers) Act and any otheroffence listed in Annex I to  Regulation (EU) 2016/794.
(2) Words and expressions used in these regulations which
are also used in the Act shall have the same meaning as assigne d to
them in the Act.
Obligations of 
credit and financial 
institutions.3. (1) Where a credit or financial institution provides an
account identified by IBAN, or where a credit institution provi des safe
custody services, the credit or financial institution shall, fo r the
purposes of these regulations, ma intain an electronic record of  such
data and information as may be prescribed by the Unit in relati on to
the following:
(a) the customer and,  where applicable,
(i) any agent thereof authorized to act on the
customer’s behalf; and
(ii) the beneficial owner of the customer;
(b) the IBAN associated with any such account or the
alphanumeric code used to iden tify safe deposit boxes or any
items entrusted to a credit institution when providing any safecustody services as are referred to hereabove;
(c) the length of time for which any account or safe
custody services are provided as set out hereabove; and
(d) any other data or information on bank or payment
accounts or safe custody services provided by creditinstitutions as the Unit may set out from time to time inprocedures issued under regulation 5.
(2) Credit and financial institutions shall ensure that any data
that they may be required to hold in terms of sub-regulation (1 ) is at
CENTRALISED BANK 
ACCOUNT REGISTER [S.L. 373.03 3
all times adequate, accurate and up to date, and the electronic  record
thereof shall be updated immediately upon the credit or financi al
institution being informed or otherwise becoming aware that any  of
the data or information requi red to be held has changed.
S.L. 373. 01. (3) Regulation 13 of the Prevention of Money Laundering
and Funding of Terrorism Regula tions shall be equally applicabl e to
the retention of the data and information that credit and finan cial
institutions may be required to hold in terms of sub-regulation  (1).
Establishment, 
management and 
administration of register.4. (1) The Unit shall establish, manage and administer
the register wherein there shall be retained data and informati on on
accounts identified by IBAN held by credit and financial instit utions
and on safe custody services pr ovided by credit institutions, w hich
data and information is to allow for the timely identification of any
person or persons holding or controlling any such accounts or a ssets
held under safe custody, or who may have held or controlled any  such
accounts or assets.
(2) The register shall contain an electronic record of the data
and information that credit and financial institutions are requ ired to
hold in terms of regulation 3(1), which data and information is  to be
made available by credit and fi nancial institutions in such for mat and
with such frequency as may be prescribed by the Unit, with cred it and
financial institutions to retain s uch records as may be necessa ry to
show that they have fulfilled a ny such obligations for a period  of five
(5) years from the date on which data and information was submi tted
or was required to be submi tted, whichever is the earlier.
(3) In carrying out the functions referred to in sub-
regulation (1), the Unit shall have regard to the highest techn ological
standards and shall ensure that any of its officers or employee s
responsible for its management and administration are of highintegrity and receive proper and regular training as to theconfidentiality and data protection obligations applicable to t he
register.
(4) Any data or information contained in the register shall
be so held for five (5) years following the closure of the acco unt or
the termination of the safe custody service as may be applicabl e,
upon the expiry of which the data and information so held shall  be
deleted:
Provided that the period of five (5) years may be further
extended, up to a maximum retention period of ten (10) years, w here
such extension would be considered  necessary for the purposes o f the
prevention, detection, analysis,  investigation or prosecution o f money
laundering, associated predicate offences, funding of terrorism  or any
other serious criminal offence.
4[S.L. 373.03CENTRALISED BANK 
ACCOUNT REGISTER
S.L. 586. 09.(5) The rights of the data subject referred to in regulation 4
of the Restriction of the Data Protection (Obligations and Righ ts)
Regulations, in particular the r ight of access, shall be restri cted,
partially or completely, where su ch a restriction is necessary and
proportionate for the Unit to ensure the proper functioning of the
register and avoid causing prejudice to any action being undert aken by
any of the authorities that are to be allowed access thereof in  terms of
regulation 6 in the course  of its functions at law.
Issue of procedures 
and guidance.5. The Unit may issue procedures and guidance as may be
necessary for the purpose of prescribing anything required unde r these
regulations and to ensure the proper functioning of the registe r, with
any such procedures being binding on credit and financial insti tutions.
Access to register. 6. (1) The data and information held in the register
shall be directly accessible, in line with procedures set out b y the Unit,
by the following authorities:
(a) the Unit;
(b) national authorities conducting criminal
investigations into or prosecutions of money laundering,associated predicate offences, funding of terrorism or any othe r
serious criminal offence, including when supportinginvestigations concerning an y of the said offences;
(c) the Asset Recovery Bureau;
(d) the Commissioner for Revenue; 
(e) the Sanctions Mon itoring Board; and
(f) the Security Service.
(2) Each of the authorities listed in sub-regulation (1) shall
access and make use of the data a nd information contained in th e
register on a case-by-case basis and to the extent that this ma y be
necessary for the prevention, d etection, investigation or prose cution
of money laundering, associated predicate offences funding of
terrorism or any other serious criminal offence, and for the av oidance
of any doubt this shall include supporting investigations conce rning
any such offence, including the identification, tracing and fre ezing of
the assets related to such investigation:
Provided that the above shall be without prejudice to any
access to data and information he ld in the register that the Un it may
require for the proper carrying out of its functions under regu lation
4(1).
(3) In addition to the access re ferred to in sub-regulation (2),
the data and information contained in the register may also be used to
CENTRALISED BANK 
ACCOUNT REGISTER [S.L. 373.03 5
produce such aggregate or statistical data as may be required b y the
authorities referred to hereabove for the same purposes as arereferred to in sub-regulation (2).
(4) The authorities listed in sub-regulation (1) may also
access and make use of the data a nd information contained in th e
register to reply to justified requests for information receive d from
foreign or supranational bodies having similar functions uponascertaining that the reques ting body applies confidentiality a nd data
protection requirements equivalent  to those applicable to them:
Provided that such authorities shall be required to
disclose on behalf of which aut hority the disclosure is being e ffected.
(5) Each of the authorities listed in sub-regulation (1) shall
designate one or more of their officers or employees that are t o have
access to and carry out searches in the register, with each des ignated
officer or employee being granted the said rights only uponundergoing such registration or accreditation process as may beestablished by the Unit.
(6) The authorities listed in sub-regulation (1) shall
implement the necessary safeguards to ensure that data andinformation held in the register  is accessed and made use of on ly
when this is strictly required for the purposes set out in thisregulation.
(7) In meeting their obligati on under sub-regulation (6), and
having due regard to the sensitivity of the data and informatio n
involved, the authorities listed in sub-regulation (1) shall, a s a
minimum:
(a) ensure that they maintain high professional
standards of confidentiality and adherence with the applicabledata protection requirements, including through monitoringcompliance with the said standards, and that all of theirofficers and employees a re of high integrity;
(b) provide any officer or employee designated in
terms of sub-regulation (5), or any officer or employee able torequest any such employee to carry out searches in the register ,
with the necessary training on how to handle data andinformation accessible through the register in line with dataprotection requirements;
(c) establish internal policies and procedures setting
out the conditions and circumstances in which data andinformation is to be obtained from the register, includingsafeguards to avoid unauthorized o r unjustified access thereto,
and monitoring the application of the same;
6[S.L. 373.03CENTRALISED BANK 
ACCOUNT REGISTER
(d) apply technical and organisational measures to
ensure the security of the data to high technological standards ;
and
(e) ensure that the Unit is promptly informed
whenever an officer or employee is no longer to be consideredas a designated em ployee in terms of sub-regulation (5).
(8) Where any of the authorities becomes aware that the data
or information held in the regist er is not correct or is otherw ise not up
to date, the authority concerne d shall immediately inform the U nit.
(9) Each authority listed in sub-regulation (1) shall hold
statistical data on the number of searches carried out through the
register and shall make the same available to the Unit or to th e
European Commission upon request or in line with such procedure s as
may be established.
Keeping and 
access to logs.7. (1) The Unit shall establish such procedures as it
may deem proper to monitor and regulate the access and the carr ying
out of searches for data and information contained in the regis ter,
which procedures shall include the retention of the followinginformation with respect to each search:
(a) the case refe rence number;
(b) the date and time of the query or search;
(c) the type of data used to launch the query or
search;
(d) the unique identif ier of the results;
(e) the name of the authority consulting the registry;
(f) the unique user identifier of the designated
officer or employee referred to in regulation 6(5) and, whereapplicable, of the official who ordered the query or search and ,
as far as possible, the unique user identifier of the recipient  of
the results of the query or search.
(2) The information referred to i n sub-regulation (1)(a) to (f)
shall be:
(a) held only to monitor confidentiality and data
protection requirements, including checking the admissibilityo f  a  r e q u e s t  a n d  t h e  l a w f u l n e s s  o f  d a t a  p r o c e s s i n g ,  a n d  f o rensuring data security; 
(b) accessible only to the data protection officer of
the Unit, who shall check the same on a regular basis, and,
CENTRALISED BANK 
ACCOUNT REGISTER [S.L. 373.03 7
upon request, to the Information and Data Protection
Commissioner; and
(c) protected by appropriate measures against
unauthorised access and shall be  erased five (5) years after it s
creation, unless it is required for monitoring procedures thatare ongoing.
(3) Any data or information obtained through the register
shall be kept confidential by the authorities and by their offi cers,
employees or agents, past and pr esent, and any use thereof othe r than
for the purposes set out in regulation 6 shall be considered to  be an
unauthorised disclosure of the same.
(4) In the event that the authorities listed in regulation 6(1)
become aware of any unauthorised or unjustified access to, or u se of,
the register, they shall promptly inform the Unit and provide i t with
any information in relation to any such unauthorised or unjusti fied
access or use as may be  requested by the Unit.
(5) The Unit may, where it considers that any of the
authorities are not implementing the necessary safeguards to pr event
unauthorised or unjustified access to, or use of, the register and of the
data and information contained therein, or are otherwise failin g to
comply with any of their obligations under these regulations, r estrict,
suspend or terminate the authority’s access and only reinstate the
same again once the authority h as implemented the necessary
measures to prevent the same from occurring again.
Supervision and 
enforcement.8. (1) The Unit shall be responsible to monitor that
credit and financial institutions meet their obligations under these
regulations and any procedures a nd guidance issued under regula tion
5.
(2) For the purposes of carrying out its functions under sub-
regulation (1), the Unit may exercise any of the powers granted  to it
under article 26 of the Act as we ll as carry out data quality c hecks on
the data and information provided by credit and financial insti tutions
for inclusion in the register as it may deem fit and give suchdirections as may be necessary t o redress any issues identified  with
respect to such data and information.
(3) In accordance with article 13 of the Act, any credit or
financial institution who contravenes any provision of theseregulations or of any procedure or guidance issued in terms of
regulation 5, as well as any direction given by the Unit, shall  be liable
to an administrative penalty of not less than two hundred fifty  euro
(€250) and not more than forty-six thousand five hundred euro(€46,500) in respect of every separate breach.
(4) Notwithstanding the provisions of sub-regulation (3),
8[S.L. 373.03CENTRALISED BANK 
ACCOUNT REGISTER
the Unit may:
(a) with respect to minor contraventions and where
the circumstances so warrant, imp ose an administrative penalty
below the minimum established by these regulations but notless than two hundred and fifty euro (€250) or issue areprimand in writing instead of  an administrative penalty;
(b) with respect to serious, repeated or systematic
contraventions, impose administr ative sanctions that in total a re
not to exceed one million euro (€1,000,000);
(c) instead of or in conjunction with the imposition
of any administrative penalty as envisaged under thisregulation, require the credit or financial institution to take  any
action or measure to remedy such contravention or to ensurecompliance with the provisions of these regulations or anyprocedures issued by the Unit.
(5) Administrative measures under these regulations shall be
imposed by the Unit without recourse to a court hearing and inaccordance with policies and procedures established by the Boar d of
Governors referred to in the Act, with the Unit being able to i mpose
penalties either as a one-time fixed penalty or as a daily cumu lative
penalty or both:
Provided that an administrative penalty imposed on a
daily cumulative basis shall not be less than two hundred and f ifty
euro (€250) and the accumulated penalty shall not exceed themaximum set out under sub-regulations (3) and (4)(b), as may beapplicable.
(6) Articles 13A to 13C, both in clusive, of the Act shall be
equally applicable in relation to any administrative measure im posed
on a credit or financial institution for any contravention of t hese
regulations or of any procedures o r guidance issued in terms of
regulation 5.