MFSA warns financial institutions to improve their methods for protecting clients’ funds

Financial Institutions, such as Payment Institutions and Electronic Money Institutions, are legally obliged to protect the funds entrusted to them by their clients. These entities are expected to safeguard their clients’ funds by establishing the appropriate mechanisms as outlined in the applicable regulations, particularly the recently updated Rulebook published by the MFSA.

The primary aim of the Rulebook is to ensure that these institutions operate safely, soundly, and in compliance with both national and European Union regulations. The latest updates to the Rulebook provide a comprehensive guide for financial institutions on the methods that should be applied for safeguarding clients’ funds, as well as for outsourcing arrangements.

These areas were the focus of two thematic reviews carried out by the MFSA to assess how Financial Institutions are meeting the respective regulatory obligations, which also include the EBA Guidelines on Outsourcing Arrangements, the Digital Operations Resilience Act and the Financial Institutions Act (Safeguarding of Funds) Regulations. The findings were subsequently communicated in a Dear CEO Letter sent to the Financial Institutions, which also outlined the Authority’s findings and expectations on the various regulatory requirements.

The safeguarding mechanisms applied by Financial Institutions are important since they ensure that client funds are used exclusively for their intended purposes, and that, in the event of any issues encountered by the institution, the client would be able to get his funds back. This is why service providers are expected to have the Safeguarding Policy and Procedure in place, as well as a Reconciliation Process. Similarly, an Outsourcing Policy and Register are a must to ensure the quality and accessibility of documents, such as contractual agreements. The Authority noted that this practice was not being adopted across the board, and that documentation, such as policies and procedures, were drafted solely for the purpose of the MFSA’s thematic reviews. Additionally, reviews were not being properly conducted, and some documentation was not aligned with the relevant framework,

The Authority has also come across instances where the assessment with the relevant framework was not conducted properly – one example being, classifying internal control functions as not critical. The MFSA insists that any pre-contractual assessments are conducted diligently and carefully, ensuring that these align with relevant framework

provisions. This also forms the basis for subsequent actions, making it a crucial first step for both outsourcing and safeguarding arrangements.

Moreover, the Authority has identified instances of conflicts of interest in outsourcing arrangements and emphasises the need for enhanced oversight by the licensed entities’ Board of Directors to ensure the effectiveness of safeguarding measures. In this regard, Financial Institutions must prioritise governance and appoint individuals within the entity to monitor and evaluate the degree of their adequacy in adhering to the relevant regulatory framework.

Camille Pepos, Head of FinTech Supervision at the MFSA said: “The latest updates to the Financial Institutions Rulebook aim to guide local operators in this sector to adhere to established standards, promoting a stable and trustworthy financial environment. Financial Institutions need to up their game and comply with the regulatory obligations related to the areas covered in the latest MFSA thematic reviews. Through our ongoing supervisory framework, we will sustain our engagement with the institutions through further meetings and onsite inspections, with a view to increasing regulatory compliance.”

The revised Rulebook now obliges Financial Institutions to include Safeguarding of Clients Funds within their yearly audit plan. It also details the inclusion of audit reviews on outsourcing arrangements.