What Malta's New Sanctions Compliance Requirements Mean for Businesses

Who is affected?

The requirements apply to entities categorised as "operators" under Schedule I of the Act. This extends beyond financial institutions and captures a wide range of businesses and professions, including:

• Credit and financial institutions
• Company service providers
• Trustees and trust service providers
• Virtual Financial Asset (VFA) service providers
• Investment firms and fund administrators
• Insurance undertakings and intermediaries
• Gaming operators
• Real estate agents
• Auditors, accountants and tax advisers
• Legal professionals undertaking specified activities
• Other subject persons falling within Malta's AML/CFT framework

Organisations should first assess whether they fall within scope and determine the extent of their sanctions exposure.

A risk-based approach is at the heart of Article 32

A central requirement under the guidance is the implementation of a Sanctions Risk Assessment (SRA).

The SRA should enable organisations to identify, assess and understand how sanctions risks may arise across their business activities. Factors such as customer profiles, products and services, delivery channels, geographical exposure, transaction types and business counterparties should all be considered.

Importantly, the risk assessment should not be treated as a one-time exercise. The SMB expects operators to review and update their SRA whenever significant changes occur, such as entering new markets, launching new products or being exposed to evolving sanctions regimes.

For many organisations, this may require a reassessment of whether existing AML and compliance frameworks adequately capture sanctions-specific risks.

Customer due diligence and screening expectations

The guidance reinforces that sanctions compliance extends well beyond checking customer names against sanctions lists.

Organisations are expected to perform appropriate due diligence before establishing business relationships or carrying out transactions. This includes identifying and verifying customers, beneficial owners and individuals exercising ownership or control over legal entities.

The SMB also places emphasis on:

• Screening customers and beneficial owners against applicable sanctions lists
• Understanding ownership and control structures
• Applying enhanced measures where higher sanctions risks are identified
• Conducting ongoing monitoring and periodic re-screening

In practice, organisations may need to review whether their current screening tools, procedures and escalation processes sufficiently address these expectations.

Immediate action is required when a sanctions match is confirmed

One of the most significant aspects of the guidance relates to asset freezing and reporting obligations.

Where a designated person or entity is identified, operators must act immediately. This includes freezing funds and economic resources, preventing assets from being made available to designated persons and notifying the SMB without delay.

The guidance also highlights the importance of maintaining evidence of decisions taken, documenting assessments and monitoring frozen assets on an ongoing basis.

Given the speed with which action may be required, businesses should ensure that escalation procedures are clearly documented and regularly tested.

Governance is now a key area of regulatory focus

Article 32 places considerable emphasis on governance and accountability.

The SMB expects organisations to implement a clear governance framework, supported by appropriate oversight and defined responsibilities. This includes adopting a three-lines model where operational teams, compliance functions and independent assurance each play a distinct role.

The guidance also introduces expectations regarding the appointment of a suitably qualified Sanctions Compliance Officer with sufficient authority, independence and resources to effectively discharge their responsibilities.

As a result, boards and senior management should ensure that sanctions compliance receives adequate attention at governance level rather than being viewed solely as an operational compliance exercise.

Training, record-keeping and outsourcing remain critical

The effectiveness of any sanctions compliance framework ultimately depends on how well it operates in practice.

The SMB therefore expects organisations to maintain documented policies and procedures covering areas such as:

• Risk assessments
• Screening processes
• Escalation procedures
• Asset-freezing controls
• Reporting obligations
• Staff training
• Record retention

Where sanctions-related activities are outsourced, responsibility remains with the operator. Businesses should therefore ensure they maintain adequate oversight of outsourced providers and obtain assurance that appropriate sanctions controls remain in place.

What should organisations do now?

Although the guidance establishes clear expectations, implementation may present practical challenges for many organisations.

Businesses should consider:

• Assessing whether they fall within the scope of Article 32
• Reviewing existing sanctions frameworks and policies
• Conducting or updating a sanctions risk assessment
• Evaluating governance and accountability arrangements
• Testing screening, escalation and reporting procedures
• Reviewing outsourced sanctions controls
• Providing targeted staff training and awareness programmes

Taking proactive steps now can help organisations identify potential gaps and strengthen their sanctions compliance framework before issues arise.

Looking ahead

The message from the SMB is clear: sanctions compliance can no longer be viewed solely as a screening exercise.

Article 32 requires organisations to demonstrate a comprehensive and risk-based programme encompassing governance, risk assessment, customer due diligence, screening, reporting, training, record-keeping and ongoing oversight.

For many operators, the guidance presents an opportunity not only to meet regulatory expectations but also to strengthen compliance resilience and reduce exposure to financial crime and sanctions-related risks.

How Grant Thornton Malta can help

As organisations assess their obligations under Article 32, independent reviews of sanctions governance, risk assessments and control frameworks can help identify potential gaps and enhance compliance readiness.

Our Regulatory, Risk and Compliance specialists support organisations with sanctions risk assessments, framework reviews, governance design, independent assurance, internal audit and compliance training to help organisations meet evolving regulatory expectations.