The Sanctions Monitoring Board (SMB) has published new guidance on the implementation of Article 32 of the National Interest (Enabling Powers) Act (Chapter 653 of the Laws of Malta), providing operators with detailed expectations on how sanctions compliance frameworks should be designed, implemented and maintained.
The guidance is intended to support entities falling within Schedule I of the Act in establishing effective sanctions compliance measures capable of identifying, managing and mitigating sanctions risks. It addresses the full lifecycle of sanctions compliance, from risk assessments and customer due diligence to governance, reporting, record-keeping and internal controls.
A risk-based Sanctions Framework
A central theme of the guidance is that sanctions compliance is not a “one-size-fits-all” exercise. The SMB emphasises that compliance measures should be proportionate to the nature, size and risk profile of each organisation. Operators are expected to conduct a dedicated Sanctions Risk Assessment (SRA) to identify and assess sanctions exposure arising from their customers, products, services, geographical footprint, delivery channels and transactional activity.
The guidance further requires operators to establish a documented sanctions risk appetite and ensure that sanctions controls are tailored to the risks identified. Higher-risk activities, particularly those involving international transactions, complex ownership structures or exposure to sanctions-sensitive sectors, may require enhanced controls and monitoring arrangements.
Expanded expectations for Sanctions Due Diligence
A substantial part of the guidance focuses on sanctions customer due diligence (CDD). While many operators will already be familiar with AML/CFT CDD requirements, the SMB highlights that sanctions compliance serves a different objective and requires a broader examination of ownership, control and transactional relationships.
Operators are expected to look beyond the immediate customer relationship and consider other parties that may create sanctions exposure, including beneficial owners, controllers, intermediaries, counterparties and persons acting on behalf of customers. The guidance places particular emphasis on identifying circumstances where sanctioned persons may hold ownership interests or exercise control indirectly through layered corporate structures, trusts, foundations or other arrangements.
The SMB also clarifies that sanctions exposure can arise through both ownership and control tests, requiring operators to assess not only formal shareholding positions but also governance rights, veto powers, financing arrangements and other mechanisms that may confer dominant influence.
Ongoing Screening and Transaction Monitoring
The guidance reinforces the importance of ongoing sanctions monitoring rather than treating sanctions screening as a one-time onboarding exercise. Operators are expected to re-screen relevant parties whenever sanctions lists are updated and whenever material changes occur within a customer relationship.
In addition, operators should implement transaction monitoring arrangements capable of identifying potential sanctions breaches, sanctions evasion techniques and suspicious transactional behaviour. Examples highlighted by the SMB include transactions involving sanctioned jurisdictions, unusual payment routes, complex intermediary structures, dual-use goods, restricted sectors, vessels or aircraft subject to sanctions measures, and transactions designed to obscure the ultimate beneficiary.
The guidance also encourages the use of adverse media screening and network analysis techniques to identify indirect links between customers, counterparties and sanctioned persons.
Enhanced governance and accountability
The SMB places considerable emphasis on governance arrangements, making clear that sanctions compliance extends beyond compliance functions and should be embedded throughout an organisation. Operators are expected to establish clear responsibilities across the three lines of defence, maintain effective escalation procedures and ensure appropriate oversight by senior management.
The guidance also introduces expectations around the appointment of a dedicated Sanctions Compliance Officer and requires senior management to actively oversee the effectiveness of sanctions controls. Importantly, the document reminds operators that liability may extend to directors and senior management where offences occur and appropriate oversight cannot be demonstrated.
Freezing, Reporting and Tipping-Off Controls
The guidance provides detailed instructions on how operators should respond when potential sanctions matches are identified. Once a sanctions hit is confirmed, operators must freeze the relevant funds or economic resources without delay and report the matter to the SMB using the prescribed reporting procedures.
Further guidance is provided on the reporting of suspected sanctions breaches and circumvention attempts, including situations where no designated person has yet been identified but the available facts indicate potential sanctions evasion.
The guidance also introduces specific expectations relating to tipping-off controls, requiring operators to ensure that clients and third parties are not informed in advance of pending freezing measures or sanctions-related reporting actions.
Looking Ahead
The publication marks a significant development in Malta’s sanctions compliance framework and provides the first comprehensive roadmap for operators seeking to meet their obligations under Article 32 of the National Interest (Enabling Powers) Act. By setting out detailed and legally binding expectations concerning risk assessments, due diligence, monitoring, governance and reporting, the guidance is expected to play a key role in shaping sanctions compliance programmes across Malta’s regulated sectors.
Operators should review the guidance carefully and assess whether their existing sanctions frameworks, policies, procedures and systems remain aligned with the SMB’s expectations and the evolving sanctions risk landscape.
The full guidance document can be found on the SMB website here.