B 203
Suppliment tal-Gazzetta tal-Gvern ta’ Malta Nru. 20,774, 27 ta’ Jannar , 2022
Taqsima  B
____________________________________________________________________B 203
L.N. 23 of 2022
INVESTMENT SERVICES ACT
(CAP. 370)
Investment Firms Directive (Administrative Penalties, Measures 
And Investigatory Powers) Regulations, 2022
IN EXERCISE of the powers conferred by article 12 of the
Investment Services Act, the Minister responsible for the regulation of
Financial Services, acting on the advice of the Malta Financial
Services Authority, has made the following regulations:
Citation, scope 
and 
commencement.1. (1) The title of these regulations is the Investment Firms
Directive (Administrative Penalties, Measures and Investigatory
Powers) Regulations, 2022.
(2) The scope of these regulations is to transpose Articles 18,
19, 20, 21, 22, and 23 of Directive (EU) 2019/2034 of the EuropeanParliament and of the Council of 27 November 2019 on the pruden tial
supervision of investment firms and amending Directives 2002/87 /EC,
2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU.
(3) These regulations shall come into force on such date as the
Minister may by notice in the Gazette establish.
Interpretation. 2. (1) In these regulations, unless the context otherwise
requires -
Cap. 370. "the Act" means the Investment Services Act;
Cap. 330. "competent authority" means the Malta Financial Services
Authority established by article 3 the Malta Financial ServicesAuthority Act;
"CRD" means Directive 2013/36/EU of the European Parliament
and of the Council of 26 June 2013 on access to the activity of  credit
institutions and the prudential supervision of credit institutions,
amending Directive 2002/87/EC and repealing Directives 2006/48/ EC
and 2006/49/EC, as amended from time to time, and includes any
implementing measures that have been or may be issued thereunde r;
"CRR" means Regulation (EU) No 575/2013 of the European
Parliament and of the Council of 26 June 2013 on prudentialrequirements for credit institutions and amending Regulation (E U) No
648/2012, as amended from time to time, and includes any
implementing measures that have been or may be issued thereunde r;
VERŻJONI ELETTRONIKA
B 204
B 204
"financial holding company" shal l have the same meaning as that
assigned to it in point (20) of Article 4(1) of the CRR;
"the IFD" means Directive 2019/2034 of the European
Parliament and of the Council of 27 November 2019 on the pruden tial
supervision of investment firms and amending Directives 2002/87 /EC,
2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU,
as amended from time to time, and includes any implementing
measures that have been or may be issued thereunder;
"the IFR" means Regulation 2019/2033 of the European
Parliament and of the Council of 27 November 2019 on the pruden tial
requirements of investment firms and amending Regulations (EU) No
1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014, as amended from time to time, and includes any implementing
measures that have been or may be issued thereunder;
"investment firm" means a person who holds an investment
services licence issued by the competent authority under the Ac t and
which is subject to the requirements of the IFR and the IFD;
"mixed financial holding company" shall have the same meaning
as that assigned to it in point (25) of Article 3(1) of the IFR .
(2) Words and expressions used in these regulations shall have
the same meaning as that assigned to them in the Act.
Supervisory 
powers and 
powers to impose 
penalties.3. The competent authority shall exercise its supervisory
powers and its powers to impose administrative penalties and
measures, in such a way as to ensure full and complete adherenc e to
the requirements and obligations arising out of the IFD and out of theIFR, either directly or in collaboration with European regulato ry
authorities and with overseas regulatory authorit ies, in terms of law
and as warranted by the relevant circumstances.
Administrative 
penalties and other 
administrative 
measures.4. (1) Without prejudice to the supervisory powers of the
competent authority referred to in regulation 3 and the IFD, th e
competent authority shall impose administrative penalties and o ther
administrative measures in respect of breaches of:
(a) the provisions of the Ac t and, or of regulations and,
or Investment Services Rules made thereunder transposing the
provisions of the IFD; and, or
(b) the provisions of the IFR,
including where an investment firm:
VERŻJONI ELETTRONIKA
B 205
B 205
(i) fails to have in place internal governance
arrangements as set out in Article 26 of the IFD;
(ii) fails to report information or provides incomplete
or inaccurate information on compliance with the
obligation to meet own funds requirements set out in
Article 11 of the IFR to the competent authority, in breachof point (b) of Article 54(1) of the IFR;
(iii) fails to report to the competent authority, in
breach of point (e) of Article 54(1) of the IFR, information
about concentration risk or provides incomplete or
inaccurate information;
(iv) incurs a concentration risk in excess of the
limits set out in Article 37 of the IFR, without prejudice toArticles 38 and 39 of the IFR;
(v) repeatedly or persistently fails to hold liquid
assets in breach of Article 43 of the IFR, without prejudiceto Article 44 of the IFR;
(vi) fails to disclose information, or provides
incomplete or inaccurate information, in breach of theprovisions set out in Part Six of the IFR;
(vii) makes payments to holders of instruments
included in the own funds of the investment firm whereArticle 28, 52 or 63 of the CRR  prohibit such payments to
holders of instruments included in own funds;
(viii) is found liable for a serious breach of national
provisions adopted pursuant to Directive (EU) 2015/849 ofthe European Parliament and of the Council of 20 May
2015 on the prevention of the use of the financial system
for the purposes of money laundering or t errorist financing,
amending Regulation (EU) No 648/2012 of the European
Parliament and of the Council, and repealing Directive
2005/60/EC of the European Parliament and of the Counciland Commission Directive 2006/70/EC;
(ix) allows one or more  persons whodo not comply
with Article 91 of the CRD to become or remain a memberof the management body.
(2) The administrative penalties and other administrative
measures taken pursuant to sub-regulation (1) shall be effectiv e,
VERŻJONI ELETTRONIKA
B 206
B 206
proportionate and dissuasive.
(3) The competent authority may impose administrative
penalties and other administrative measures relating to breache s of the
provisions of the Act and any regulations and Investment Servic es
Rules issued thereunder transposing the requirements of the IFD, and
of the IFR to the members of the  management body of such compan ies
and to other natural persons who under Maltese law are responsi ble for
the breach. 
Investigatory 
and information gathering 
powers of the 
competent authority.5. The competent authority shall have all the information
gathering powers and investigatory powers which are necessary f or the
exercise of its functions. Without prejudice to other relevant provisions
laid down in the Act, the IFD and in the IFR these powers shall
include:
(a) the power to require information from the following
natural or legal persons:
(i) investment firms established in Malta;
(ii) investment holding companies established in
Malta;
(iii) mixed financial holding companies established
in Malta;
(iv) mixed-activity holding companies established
in Malta;
(v) persons belonging to the  entities referred to in
sub-paragraphs (i) to (iv);
(vi) third parties to whom the entities referred to in
sub-paragraphs (i) to (iv) have outsourced operationalfunctions or activities;
(b) the power to conduct all necessary investigations of
any person referred in paragraphs (a)(i) to (iv) established orlocated in Malta where necessary to carry out the tasks of the
competent authority including:
(i) the right to require the submission of
documents by the persons referred to in paragraph (a);
(ii) the right to examine the books and records of
the persons referred to in paragraphs (a)(i) to (iv) and the
right to take copies or extracts from such books and
VERŻJONI ELETTRONIKA
B 207
B 207
records;
(iii) the right to obtain written or oral explanations
from any person referred to in paragraphs (a)(i) to (iv) or
their representatives or staff; and
(iv) the right to interview any other person who
consents to be interviewed for the purpose of collectinginformation relating to the subject matter of an
investigation;
(c) the power to conduct all necessary inspections at the
business premises of the legal persons referred to in paragraph s
(a)(i) to (iv) and any other undertakings included in the
supervision of compliance with the group capital test, where th e
competent authority is the group supervisor, subject to the priornotification of other competent authorities concerned.
Penalties. 6. Where an investment firm is found by the competent
authority to have committed any of the breaches referred to inregulation 5, the administrative penalties and other administrativemeasures which the competent a uthority may impose shall include at
least the following:
(a) a public statement which identifies the natural person,
investment firm, financial holding company or mixed financial
holding company and the nature of the breach;
(b) an order requiring the natural or legal person
responsible to cease the conduct and to desist from repeating t hat
conduct;
(c) the withdrawal of the investment firm’s investment
services licence, in accordance with article 7 of the Act; 
(d) subject to the provisions of regulation 4(3), a
temporary ban against a member of the investment firm’smanagement body or any other natural person, who is held
responsible, from exercising functions within investment firms;
(e) in the case of a legal person, administrative penalties
of up to 10% of the total annual net turnover including the gro ss
income consisting of interest receivable and similar income,income from shares and other variable or fixed-yield securities ,
and commissions or fees of that legal person in the precedingbusiness year:
Provided that, where the inve stment firm subject to the
VERŻJONI ELETTRONIKA
B 208
B 208
administrative penalty is a subsidiary of a parent undertaking, the
relevant gross income shall be the gross income resulting from the
consolidated account of the ultimate parent undertaking in the
preceding business year;
(f) in the case of a legal person, administrative penalties
of up to twice the amount of the profits gained or losses avoid ed
due to the breach where those profits or losses can be
determined; and
(g) in the case of a natural person, administrative
penalties of up to EUR 5,000,000.
Publication of 
administrative 
penalties and 
measures.7. (1) The competent authority, without undue delay, shall
publish on its official website and, or on any other media, as deemed
appropriate, any administrative penalties and measures which ar e
imposed for breaches of the Act, regulations and Investment Services
Rules issued thereunder transposing the requirements of the IFD, and
of the IFR. Such publication shall include information on the t ype and
nature of the breach and the identity of the natural or legal person on
whom the penalty or measure is imposed. The information shall o nly
be published by the competent authority after that person has b een
informed of those administrative  penalties or measures and to t he
extent that the publication is necessary and proportionate:
Provided that, in cases where an appeal has been filed by
the person on whom such administrative penalties or measures havebeen imposed, the competent authority shall, without undue dela y, also
publish on its official website information on the status of the appealand the outcome thereof.
(2) The competent authority shall publish the penalties or
measures imposed in terms of these regulations, on an anonymousbasis, in any of the following circumstances:
(a) where the penalty or measure is imposed on a natural
person and, following an obligatory prior assessment, thepublication of personal data is found to be disproportionate;
(b) where publication would jeopardise the stability of
financial markets or an ongoing criminal investigation; or
(c) where publication would cause, insofar as it can be
determined, disproportionate damage to the investment firms, ornatural persons involved:
Provided that, where the circumstances referred to in
paragraph (a) are likely to cease within a reasonable period of time,
VERŻJONI ELETTRONIKA
B 209
B 209
publication in terms of sub-regulation (1) may be postponed for  such
period of time.
(3) Information published in terms of this regulation shall
remain on the official website of the competent authority for a period
of not less than five years. Personal data shall be retained on the
official website of the competen t authority only for the period
necessary, in accordance with the provisions of Maltese legislation on
data protection.
Exchange of 
information on penalties.8. The competent authority shall inform the EBA of all
administrative penalties and measures it imposes under these
regulations. It shall also provide information regarding any appeal inrelation thereto and the outcome therefrom for the purpose of
publication on the EBA database of sanctions which the competent
authority shall consult where appropriate in the carrying out o f its
functions and duties.
Effective 
application of 
penalties and exercise of 
powers to 
impose penalties by the competent 
authority. 9. When determining the type of administrative penalties or
other administrative measures and the level of administrative p enalties
to be imposed in terms of these regulations, the competent authority
shall take into account all relevant circumstances including, where
appropriate:
(a) the gravity and the duration of the breach;
(b) the degree of responsibilit y of the natural or legal
person responsible for the breach;
(c) the financial strength of the natural or legal person
responsible for the breach, including the total turnover of a l egal
person or the annual income of a natural person;
(d) the importance of profits gained or losses avoided by
the natural or legal person responsible for the breach;
(e) the damages for third parties caused by the breach;
(f) the level of co-operation of the natural or legal person
responsible for the breach with the competent authority;
(g) previous breaches by the natural or legal person
responsible for the breach; and
(h) any potential systemic consequence of the breach.
Reporting of 
breaches.10. (1) The competent authority shall establish effective and
reliable mechanisms to encourage the reporting to it of potenti al or
VERŻJONI ELETTRONIKA
B 210
________________________________________________________________________________________________________________________
Ippubblikat mid-Dipartiment tal-Informazzjoni (doi.gov.mt) — Valletta — Published by the Department of Information (doi.gov.mt) — Valletta
Mitbugħ fl-Istamperija tal-Gvern fuq karta FSC — Printed at the Government Printing Press on FSC certified paper
Prezz /Price
€0.36B 210
actual breaches of the provisions of the Act, regulations and
Investment Services Rules issued thereunder transposing the
requirements of the IFD, and of the provisions of the IFR. 
(2) The mechanisms referred to in sub-regulation (1) shall
include at least:
(a) specific procedures for the reception, treatment and
following up of such reports, including the establishment of
secure communication channels;
(b) appropriate protection against retaliation,
discrimination or other types of unfair treatment by the
investment firm for employees o f investment firms who report
breaches committed within the investment firm;
(c) protection of personal data concerning both the
person who reports the breaches and the natural person who is
allegedly responsible for a breach, in accordance with the
Maltese legislation on data protection and Regulation (EU)
2016/679 of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the
processing of personal data a nd on the free movement of such
data, and repealing Directive 95/46/EC (General Data ProtectionRegulation);
(d) clear rules that ensure that confidentiality is
guaranteed in all cases in relation to the person who reports thebreaches committed within the investment firm, unless
disclosure is required by national law in the context of furthe r
investigations or subsequent judicial proceedings.
(3) Investment firms shall have in place appropriate procedures
for their employees to report breaches internally through a spe cific
independent channel. Those procedures may be provided for by th e
social partners provided that those procedures offer the sameprotection as the protection referred to in paragraphs (b), (c) and (d) of
sub-regulation (2).
Right of appeal.
Cap. 370.11. Subject to the provisions of the Act, any person in respect
of whom a decision is taken by the competent authority under th ese
regulations may appeal to the Financial Services Tribunal in te rms of
article 19 of the Investment Services Act.
VERŻJONI ELETTRONIKA