Malta FIAU Settles Four AML Enforcement Cases for €356,714, Reducing Original Penalties by €225,120

Malta’s Financial Intelligence Analysis Unit (FIAU) has published details of four settlement agreements concluded in 2026, involving a combined final penalty of €356,714 compared with original administrative penalties totalling €581,834. The cases concern investment services provider MiFinity Malta Limited, electronic money institution Em@ney p.l.c., gaming operator European Lotto and Betting Limited, and an unnamed investment services provider.

The settlements demonstrate how Malta’s revised enforcement framework allows eligible institutions to obtain reductions in administrative penalties by admitting identified breaches and implementing corrective measures. However, the agreements do not remove the obligation to address the underlying deficiencies, and some include follow-up directives requiring further remediation.

The most recent notice, published on 2 November 2026, concerns an unnamed investment services provider. The institution agreed to a settlement on 26 October, reducing its original administrative penalty of €57,517 by 35% to €37,386. The underlying compliance examination took place in 2023 and identified deficiencies relating to customer risk assessments, customer profiling and ongoing monitoring.

The FIAU found that certain customer assessments had been completed only after the commencement of business relationships or transactions. It also identified weaknesses in the documentation supporting customer profiles, including information concerning business activities, source of funds, source of wealth and expected transaction behaviour. Monitoring alerts had, in some instances, been closed using generic explanations that did not sufficiently address the specific transactions or customer circumstances. A follow-up directive was also imposed.

The largest settlement involved MiFinity Malta Limited, which agreed to pay €160,099 following an original administrative penalty of €266,833. The 40% reduction was agreed on 27 August and published on 2 September 2026. The case followed a 2023 examination that identified weaknesses in the institution's customer risk assessment and monitoring arrangements.

According to the FIAU's findings, MiFinity introduced its customer risk assessment process only after commencing operations. As a result, a number of customers were assessed late, while others had not been assessed at all. Customer profiles also relied heavily on transaction thresholds rather than a sufficiently comprehensive assessment of individual risk factors.

The examination further identified transaction monitoring alerts that had been closed without adequate written justification. In some cases, the activity observed was inconsistent with the customers' known income or expected transaction behaviour, but the explanations recorded did not sufficiently demonstrate how the alerts had been assessed. MiFinity subsequently described remediation measures to the FIAU's Compliance Monitoring Committee, and the settlement included a follow-up directive.

Em@ney p.l.c. agreed to a settlement of €97,622, reduced from an original penalty of €162,704. The agreement was concluded on 31 August and published on 4 September 2026, also providing for a 40% reduction. Unlike the other cases, the deficiencies concerned the institution's reporting obligations under Malta's Centralised Bank Account Register (CBAR) framework rather than primarily customer due diligence and transaction monitoring.

The FIAU found that Em@ney had failed to submit the required information to the register within the prescribed timeframes for a period exceeding one year and three months. The institution attributed the difficulties partly to the departure of key personnel during 2024, which affected its access to the relevant data. Although partial valid submissions were subsequently made, full reporting was not restored immediately.

The Centralised Bank Account Register is intended to provide competent authorities with information concerning bank and payment accounts and related financial relationships. Reporting entities are required to submit the prescribed information at regular intervals. The Em@ney case therefore demonstrates that operational continuity, data accessibility and clearly assigned reporting responsibilities are important components of regulatory compliance. The FIAU also took account of subsequent improvements in management and governance, as well as the engagement of an external service provider to assess remediation.

The fourth case involved European Lotto and Betting Limited, which agreed to pay €61,607 following an original administrative penalty of €94,780. The settlement was concluded on 17 September and published on 25 September 2026, representing a 35% reduction.

The FIAU's examination identified weaknesses in the gaming operator's customer risk assessment methodologies, customer profiling, transaction monitoring and politically exposed person (PEP) screening. The assessment process involved both manual and automated methodologies, but these did not adequately capture all relevant risk factors. Some customers had been assigned low-risk classifications without sufficient supporting justification, while the automated methodology was affected by limitations in the historical gaming data available to it.

The regulator also identified deficiencies in customer profiles and monitoring arrangements, including reliance on transaction thresholds and insufficient investigation of indicators requiring enhanced scrutiny. PEP screening was another area of concern, with delays identified in screening customers after they reached the applicable €2,000 deposit threshold. European Lotto described measures introduced to improve its risk assessment framework, transaction monitoring and screening configurations.

Taken together, the four settlements resulted in a reduction of €225,120 from the original administrative penalties. The reductions were 35% in the cases involving European Lotto and the unnamed investment services provider, and 40% for MiFinity and Em@ney. The FIAU attributed these reductions to the timing of the institutions' admission of breaches and the remediation undertaken.

The settlement framework was introduced in April 2026 through amendments to Malta's anti-money laundering and Centralised Bank Account Register regulatory framework. It provides the FIAU with the ability to conclude settlement agreements with eligible subject persons in respect of identified breaches. The process is intended to facilitate earlier resolution of enforcement cases and accelerate corrective action.

Settlement is not an automatic entitlement. The FIAU retains discretion over whether to offer an agreement, taking account of the applicable policy requirements and public interest considerations. A subject person must accept the identified breaches unconditionally, undertake the agreed corrective measures and waive its rights to appeal, review or otherwise challenge the relevant determinations.

The reductions are also linked to the stage at which the institution admits the breaches and the timing of remediation. The published policy provides for reductions generally ranging from 10% to 50%, depending on the circumstances. Where a reduction is granted in connection with remediation, the benefit is conditional upon the institution completing the agreed corrective measures. Failure to comply can result in the recovery of the reduced portion of the penalty.

For regulated institutions, the four cases provide practical examples of the types of deficiencies that can result in significant administrative penalties. They highlight the importance of completing customer risk assessments before establishing business relationships, maintaining sufficiently detailed customer profiles, documenting the rationale for closing monitoring alerts and ensuring that PEP screening operates at the appropriate stages of the customer relationship.

The cases also demonstrate that compliance obligations extend beyond conventional customer due diligence and transaction monitoring. The Em@ney settlement illustrates the financial consequences of failing to maintain reliable regulatory reporting arrangements, particularly where responsibilities depend on specific employees or access to internal data.

For boards, senior management and compliance officers, the central issue is whether the institution can demonstrate that its controls operate effectively in practice. Policies and procedures must be supported by reliable records, appropriate systems, clear responsibilities and ongoing testing. Where weaknesses are identified, corrective measures should be documented, assigned to responsible individuals and monitored until their effective implementation has been verified.

The FIAU's first four published settlements indicate that the new framework is being used across different sectors and types of regulatory breaches. While the reduced penalties provide an incentive for early admission and remediation, the accompanying directives and continuing obligations make clear that settlement does not bring supervisory scrutiny to an end. The ultimate objective remains the correction of deficiencies and the establishment of sustainable AML/CFT compliance arrangements.

By fLEXI tEAM