Introduction
The Malta Financial Services Authority (MFSA) Capital Markets Supervision (CMS) Function intends to launch a thematic review to assess whether supervised entities have implemented robust arrangements, governance structures and controls that ensure the accuracy, reliability and timeliness of regulatory reporting.
Overview
The review shall cover data reported across the MiFIR, EMIR, SFTR, and MAR frameworks.1 The assessment shall be undertaken at a principle-based level, focusing on core governance, controls, and oversight practices, regardless of the specific regime or datasets.
The seven aspects are:
1. Organisation & governance of data reporting;
2. Compliance and internal control systems;
3. Risk management;
4. Policies and procedures;
5. Outsourcing (incl. third and relevant sub-service providers);
6. Production and transmission of data;
7. Internal and External communication.
The MFSA might also ask for visibility or information regarding the tools and platforms
supporting reporting processes (such as AI-enabled tools).
Population & Approach
Naturally, entities shall be selected using a risk-sensitive and proportionate approach for all those falling with the scope of MiFIR, EMIR, SFTR and MAR. The selection process will consider several factors including the size of the firm, its activity profile and supervisory insights gathered over years of oversight.
What will be expected from Selected Entities?
Selected entities will receive a notification letter outlining the documents and information required in support of the thematic review, with submissions to be made through secure MFSA channels. Valid examples of the requested documentation include: governance artefacts; policies and procedures; control documentation; risk and oversight materials; outsourcing arrangements; BCP/DR documentation; and management information supporting timeliness and quality.
Entities may also be asked to include the role of AI-enabled components.
What is the Indicative Timetable?
● Industry circular issued: by Mid March 2026
● Notification letters to selected entities: by end of March 2026
● Document submission window: 20–30 working days from notification (target return by
end of April 2026 for letters issued by end of March)
● Clarification Q&A period (targeted): 1–2 weeks following submission
● On-site supervisory meetings (where scheduled): between Q2 and Q3 of 2026, with
specific dates agreed bilaterally per entity
● Individual feedback communications: within 6 weeks of the entity’s supervisory
interaction
● Industry communication of cross-firm observations and expectations (if any): end of
2026
Next Steps
No immediate action is required from market participants at this stage. The Authority encourages firms within the scope of MiFIR, EMIR, SFTR and MAR to ensure that their documentation and governance artefacts remain up-to-date
Contacts
Authors
Kane Sammut Kenwood
Senior Legal Associate
Share this article
