The MFSA has on the 16th February 2024 issued its 2024 Supervisory Priorities document, outlining its key objectives and focus for supervisory engagement in 2024.
There are a number of key developments in this year’s publication including an over-arching theme relating to a shift towards an ‘outcomes-based’ approach to supervision. This seems to imply a higher demand for immediate action from licence holders to meet supervisory expectations.
The most fundamental development in our view relates to the enhanced focus on FinTechs (payment and e-money institutions and VFSAs) through their inclusion in the so-called pilot project for outcomes-based supervision.
The dedication of a sizeable part of the MFSA Supervisory Priorities document to FinTechs is unprecedented and underscores the increasing relevance of the Fintech sector in Malta. It further increases the expectation of more intrusive supervisory interactions with FinTechs during this year.
The four key supervisory outcomes applicable to FinTechs are:
- Adequate arrangements relating to Safeguarding/Safekeeping of Assets;
- Adequate Governance arrangements and compliance with Passporting Rules (new area of emphasis)
- Strong Business Resilience
- Sufficient MiCA Preparedness (applicable to VFAs only).
While the afore-mentioned four key supervisory outcomes are generally speaking recurring objectives, the MFSA’s distinct approach is already being felt. In this respect, the MFSA commenced on the 23rd February 2024 its first 2024 thematic through the issuance of a Survey on Safeguarding to all VFASPs. VFASPs have been given two weeks to respond.
An additional four supervisory outcomes related to ICT Risk and Cybersecurity are fully applicable to FinTechs:
- Sufficient DORA Preparedness
- Implementation of Strong Risk Management and Compliance Functions
- Adequate Incident Management Processes; and
- Satisfactory Status of Third Party Providers.
Be prepared
The timeless Scout Motto “Be Prepared” couldn’t be more accurate. The MFSA’s 2024 Outcomes Based supervisory approach is a call to action for all licence holders, and in particular Fintechs, which are at the heart of the so-called pilot project.
Drawing from indications obtained through the first thematic review on Safeguarding of Assets, Fintechs are required to provide the MFSA with prompt and detailed information on their internal set-ups and control frameworks. Institutions need to up their game in managing compliance risk and build capacity and technical knowledge to meet the MFSA’s expectations.
Embark can help manage your compliance risk through our diverse regulatory advisory services. Please visit our Regulatory Compliance brochure for further info.
This article was authored by Pierre-Paul Gauci (Senior Advisor – Regulatory and Business)
