Entities classified as 'subject persons' under the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR) must implement customer due diligence (CDD), ongoing monitoring, and suspicious transaction reporting procedures supervised by the Financial Intelligence Analysis Unit (FIAU). Obligations scale with the entity's assessed money laundering and terrorist financing risk.
Key Legal Takeaways
- Subject persons include credit and financial institutions, corporate service providers, gaming operators, and other designated non-financial businesses.
- Customer Due Diligence must identify and verify the customer, beneficial owners, and the purpose and nature of the business relationship.
- Entities must produce a Business Risk Assessment (BRA) and apply Customer Risk Assessments (CRA) on a risk-sensitive basis.
- Suspicious transactions must be reported to the FIAU without delay through the appointed Money Laundering Reporting Officer (MLRO).
Who Qualifies as a Subject Person?
The PMLFTR designates specific categories of persons as 'subject persons' bound by statutory AML/CFT obligations, including banks, financial institutions, corporate and trust service providers, gaming licensees, and certain other non-financial businesses such as dealers in high-value goods.
Each subject person must appoint a Money Laundering Reporting Officer (MLRO) responsible for internal reporting, and where thresholds require, a designated compliance officer overseeing the entity's AML/CFT framework.
Customer Due Diligence and Ongoing Monitoring
Subject persons must apply Customer Due Diligence measures before establishing a business relationship or executing an occasional transaction above the prescribed threshold, verifying customer identity, beneficial ownership, and the intended purpose of the relationship using reliable, independent source documentation.
Enhanced Due Diligence applies to higher-risk scenarios, including politically exposed persons (PEPs), complex or unusually large transactions, and customers from jurisdictions identified as high-risk by the Financial Action Task Force (FATF).
Risk Assessment and Reporting Obligations
Subject persons must maintain a documented Business Risk Assessment evaluating exposure across customer, product, delivery channel, and geographic risk factors, supplemented by individual Customer Risk Assessments applied on a risk-sensitive basis.
Where knowledge or suspicion of money laundering or terrorist financing arises, the MLRO must submit a report to the FIAU without delay, and the underlying transaction must not be executed until clearance is obtained, save where doing so would prejudice the investigation.
Official Maltese Statutory References & Sources
- Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta)
- Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01)
- FIAU Implementing Procedures (Part I and sector-specific Part II)