Malta businesses urged to prepare for EU anti-money laundering overhaul ahead of 2027 deadline

Malta-based businesses and regulated entities must prepare for significant changes to their anti-money laundering obligations as the European Union moves towards implementing a harmonised regulatory framework from July 2027.

The implications of the EU's Anti-Money Laundering (AML) Package were outlined by Jonathan Phyall, Head of Legal Affairs at the Financial Intelligence Analysis Unit (FIAU), during an executive briefing organised by Diligex on Wednesday.

Speaking at Ahead of the Curve, an event held with the participation of the FIAU, Dr Phyall discussed the forthcoming legislative changes, Malta's preparedness and the expectations facing obliged entities.

The reforms will introduce more consistent anti-money laundering requirements across EU Member States, affecting banks, financial institutions, accountants, auditors, notaries, legal professionals and gaming operators, among others.

Malta's economic realities must be considered

During his presentation, Dr Phyall highlighted the importance of ensuring that Malta's economic circumstances are adequately represented in European regulatory discussions.

He observed that the size of Malta's economy is not always fully appreciated at EU level, making it important for local practitioners to contribute their perspectives during consultation processes.

The new framework involves numerous technical standards and guidelines being developed through committees operating under the EU's new Anti-Money Laundering Authority (AMLA).

Dr Phyall explained that Malta's participation in these discussions extends beyond the FIAU, with other authorities, including the Malta Financial Services Authority (MFSA), also involved.

He also acknowledged the complexity of certain proposed technical requirements, expressing hope that feedback received during consultations would contribute to their simplification.

Beneficial ownership and customer due diligence

Among the key changes highlighted were provisions concerning beneficial ownership, governance, customer due diligence and the identification of individuals exercising control over companies.

Under the new AML Regulation, obliged entities must identify individuals who ultimately own or control legal entities, including through complex corporate structures.

The legislation clarifies how indirect ownership and control should be assessed, including situations where individuals exercise control through intermediary companies.

Dr Phyall drew attention to these provisions, noting their relevance when reviewing customer records and fulfilling ongoing monitoring obligations.

His presentation also examined forthcoming regulatory technical standards (RTS) on customer due diligence.

These address identification requirements, identity verification in non-face-to-face situations, complex ownership and control structures, and establishing the purpose and intended nature of business relationships or occasional transactions.

The treatment of pooled accounts was also identified as an area requiring further clarification.

For businesses, the changes could necessitate reviewing existing know-your-customer procedures, particularly when dealing with complex corporate clients or conducting remote customer onboarding.

What constitutes a business relationship?

Another area addressed was the distinction between an ongoing business relationship and an occasional transaction.

Dr Phyall outlined proposed technical standards intended to clarify how these arrangements should be classified.

Under the proposals discussed, determining whether a business relationship exists would involve considering factors such as duration and repetition.

This includes whether providing a service requires multiple actions over a substantial period, whether services are delivered at different intervals, and whether different services are provided to the same customer.

The distinction is important because the classification of a customer relationship affects the application of customer due diligence and ongoing monitoring requirements.

The changes are particularly relevant to professional service providers, including notaries, whose engagements may involve several activities without necessarily constituting conventional ongoing commercial relationships.

Technical standards remain under development

Dr Phyall also outlined the extensive regulatory work being undertaken ahead of implementation.

His presentation identified several measures progressing through consultation and review, including technical standards concerning customer due diligence, business relationships, occasional transactions, group-wide policies and risk assessments.

Other workstreams address internal policies, outsourcing, ongoing monitoring, information-sharing and cooperation between supervisory authorities.

The development of a central European AML/CFT database was also highlighted.

Dr Phyall explained that some reporting requirements for financial sector supervisors have implementation timelines extending beyond July 2027, reflecting the preparatory work required.

The new European authority, AMLA, headquartered in Frankfurt, will coordinate supervisory efforts across Member States and directly supervise selected high-risk financial institutions from 2028.