MFSA sets September deadline for ESMA recommendations

The European Securities and Markets Authority (ESMA) published in July its fast-track peer review on the Malta Financial Services Authority’s (MFSA) authorisation and supervision of a crypto asset service providers (CASPs) under the EU’s new Markets in Crypto-Assets Regulation (MiCA).

The review concluded that Malta is fully meeting expectations in supervisory settings and resources, largely meeting expectations in supervisory review and use of adequate powers, but only partially meeting expectations in its authorisation process.

While ESMA praised the MFSA’s expertise, staffing, and proactive industry engagement, the Peer Review Committee (PRC) noted that several “material issues” remained unresolved at the time of the authorisation. These included aspects of the business plan, potential conflicts of interest, governance arrangements, ICT-related risks, and anti-money laundering (AML) and counter-terrorist financing (CFT) controls.

The report also questioned the timing of the authorisation, suggesting that the process should have been “more thorough” and allowed more time to ensure all key deficiencies were remedied before approval.

However, ESMA found MFSA’s supervisory response following certain events to be “largely appropriate and proportionate” and noted a number of good practices, including targeted recruitment of crypto-specialist supervisors, strong cooperation with other authorities, and proactive outreach to prepare the industry for MiCA’s transition.

Christopher Buttigieg: ‘We took this as an opportunity to identify any areas for improvement’

Speaking to BusinessNow.mt following the report’s publication, Christopher Buttigieg, Chief Officer – Supervision at the MFSA, stresses that Malta’s approach to regulating crypto assets was shaped by early recognition of the sector’s risks.

“In 2017, the Government had decided that it wanted another pillar of the economy: DLT (Distributed Ledger Technology and we started to see many crypto companies coming in. At that time, there were concerns at both international and European levels that crypto was leading to fraud, money laundering, and also cybersecurity and hacking risks. So, the MFSA Board told the Government that it’s better if Malta has a regulatory framework that regulates this area and provides supervision.’

Within a year, Malta introduced legislation based on existing EU laws – including MiFID, the Prospectus Regulation, the Transparency Directive, and the Market Abuse Regulation – treating crypto assets as an investment asset class. By November 2018, the MFSA had also introduced a cyber-resilience framework and an AML regime specific to crypto.

When licensing began in 2020, the MFSA simultaneously carried out a “clean-up” of the sector. “Initially, there were over 180 registered companies in Malta, but by the end of the process, only 13 obtained a licence,” Dr Buttigieg says. “Those who remained were companies that gave us comfort that they were in a position to comply with the regulatory requirements.”

Building supervisory capacity

The MFSA used the crypto regulatory push to overhaul its internal governance and expand its specialist departments, including Fintech Supervision, Due Diligence, Cybersecurity, and Financial Crime Compliance. Staff numbers rose from 230 in 2018 to 550 today.

Finding qualified personnel was a challenge, so the MFSA established its own Financial Supervisors Academy to train recruits. The Authority has also been working on an academic journal on financial supervision, set to launch in September.

Dr Buttigieg highlights the critical role of supervisory convergence in fostering a cohesive and trustworthy single market within the EU. He notes, “When a regulator in another country receives a notification from us stating, ‘This company will be providing services in your jurisdiction,’ it underscores the importance of mutual recognition and coordinated oversight. To strengthen this delicate trust between supervisors and ensure the integrity of cross-border operations, Europe actively pursues supervisory convergence. The MFSA fully supports these efforts, recognizing that convergence is a vital tool for enhancing mutual trust, facilitating effective supervision, and strengthening the resilience of our financial ecosystem.”

Responding to ESMA’s findings

Peer reviews, he explains, are “an opportunity to have an assessment from people who are competent in the field, telling you where you’re strong and where you could strengthen.”

On ESMA’s conclusions, Dr Buttigieg says: “What came out of this peer review was that, in terms of knowledge and experience, we are strong – we know the subject and our companies. In terms of supervision, we came out largely compliant. In terms of authorisation, we came out partially compliant, and there they gave us several recommendations for improvement.”

The MFSA has set an internal deadline of the end of September to implement all the recommendations. “Once these recommendations are in place, Malta will be stronger in this sector, both in attracting companies and in carrying out day-to-day supervision,” he says, adding that the Internal Audit function has been engaged to confirm completion and identify any further improvements needed.

Dialogue with European counterparts

Addressing past criticism from regulators such as France’s AMF, Dr Buttigieg highlighted the importance of direct communication: “We have a good relationship with every regulator in Europe. Many times, concerns are addressed simply by speaking to the relevant party, explaining what you’re doing, and how you’re dealing with certain issues.”

In line with ESMA’s recommendations, Malta’s focus will remain on enhancing its authorisation assessments – particularly around governance, ICT systems, conflicts of interest, and AML/CFT measures – to ensure a robust framework as MiCA takes full effect across the EU.