Malta-based fintech firm whose former director was sanctioned by the US slapped with FIAU fine

The Financial Intelligence Analysis Unit (FIAU) has fined Papaya Ltd €279,756 due to irregularities found during a compliance review carried out in 2020, which found the credit institution in breach of anti-money laundering rules. The FIAU also gave the firm a reprimand and imposed a follow-up directive, so that it may assess the implementation of the bank’s action plan to solve the issues identified.

Papaya Ltd is a financial institution founded in 2012 and is regulated by the Malta Financial Services Authority (MFSA).

One of its former directors, Frederic Villa, was sanctioned by the US in February due to his connection with Walter Moretti, an individual alleged to have been involved in sanctions evasion in relation to the Russian invasion of Ukraine.

According to the Times of Malta he resigned from the firm’s board the same month.

The firm does not have any sanctions imposed on it.

The FIAU noted that the customer risk assessment (CRA) risk score attributed to five of the firm’s customer files which were reviewed, were not in line with the risks posed by the business relationships at the time of the examination.

One of the examples was a customer involved in the oil and gas industry. While the file included all the information in the CRA it did not include a risk score, and therefore was recognised as medium risk. However, the FIAU took into consideration the volume of value of transactions taking place, and noted that in less than two years, a total of €516,481.19 was withdrawn in cash from three of the firm’s accounts.

The company was registered in Hong Kong and its principal place of business was Italy. It received funds from a company in the UK and cash was withdrawn in France and Italy.

In light of this information, the FIAU noted that the medium-risk classification was not justified, considering the volume of funds channelled across multiple jurisdictions and the sum withdrawn.

Another point of concern was that two of the files reviewed held generic information on the customers’ purpose and intended nature of the business relationship. The only information the firm had was that they were ‘manual workers’ or ‘self-employed.’

The firm informed the FIAU that it will update its systems to a more robust application process.

The FIAU also noted a lack of information on a file related to a number of wealthy individuals, such as their source of wealth, and the intended purpose of the business relationship with the firm.

There was also inadequate documentation in relation to transactions taking place.

In one example, a ‘Customer A’ received over €6 million from ‘Customer B’ in a period of two years. While the firm provided loan agreements to support these transactions, it could not be determined that they were for legitimate purposes.

It was also noted how one of the loan agreements which was worth €700,000 was changed to €7 million. It transpired that in less than a month, ‘Customer A’ lent ‘Customer B’ €8 million. The loan agreement shed little light on the purpose of the loan, and the FIAU determined that the firm failed to scrutinise the documentation it collected as part of its monitoring obligations.

The firm is expected to create an action plan indicating the remedial actions that it has carried out and implemented since the compliance exam.

The administrative penalty is not yet final and may still be appealed by the firm. It shall only become final upon the lapse of the appeal period or upon final determination by the Court of Appeal.