Introduction
This article originates from a Meet the Regulator session organised by the Malta Institute of Accountants together with the FIAU on 1 October 2026.
Whilst the session was specifically organised for members of the accountancy sector, many of the regulatory developments, supervisory insights and anticipated changes discussed are relevant across the AML/CFT landscape and are therefore applicable to all types of Subject Persons.
The session provided valuable updates on the future direction of AMLA, preparations for Malta’s next MONEYVAL evaluation, forthcoming FIAU guidance, and a number of practical compliance developments that are expected to shape AML/CFT obligations over the coming years.
AML compliance is entering a new phase
The anti-money laundering and counter-terrorist financing (AML/CFT) landscape continues to evolve at both European and local level. Recent discussions involving regulatory developments, supervisory priorities and forthcoming guidance provide valuable insight into what Subject Persons can expect over the coming years.
While a number of the initiatives discussed remain subject to further development, the direction of travel is increasingly clear. Subject Persons should use the coming years not merely to react to regulatory change, but to proactively assess the impact that these developments may have on their governance frameworks, customer onboarding processes, risk assessments and reporting obligations.
Looking ahead to the 2028 MONEYVAL evaluation
If current plans proceed as anticipated, Malta’s next MONEYVAL evaluation is expected to take place in April 2028, with information requests and preparatory submissions likely commencing by the end of 2027.
One of the most notable changes is that assessments will be conducted under the revised methodology, which separates the evaluation of the financial services sector from that of Designated Non-Financial Businesses and Professions (DNFBPs).
For DNFBPs, this places even greater emphasis on demonstrating a mature understanding of sector-specific risks and the effectiveness of AML/CFT controls in practice.
AMLA continues to shape the future regulatory framework
At European level, the Anti-Money Laundering Authority (AMLA) is continuing its work on the extensive package of Level 2 and Level 3 measures that will support implementation of the EU AML Framework.
Various AMLA working groups and committees are currently developing:
- Regulatory Technical Standards (RTSs)
- Implementing Technical Standards (ITSs)
- Guidelines
- Factsheets
- Other supervisory and implementation materials
Several RTSs have reportedly already been transmitted to the European Commission for adoption. Among the most advanced measures are the RTS on Customer Due Diligence, the RTS on Business Relationships, Occasional Transactions and Linked Transactions, and the RTS on Group-Wide Policies and Third Countries. In parallel, AMLA continues to develop a number of additional guidelines covering areas such as business-wide risk assessments, ongoing monitoring, outsourcing and reliance, internal policies, risk factors, targeted financial sanctions, de-risking and partnerships for information sharing. These measures will ultimately form part of a wider Single AML/CFT Rulebook intended to harmonise expectations across the European Union.
A more risk-based approach to regulatory data collection
Current indications suggest that regulatory data collection exercises, including REQ submissions, may move towards a more risk-based model rather than requiring annual submissions from all Subject Persons irrespective of risk profile.
At the same time, local supervisory authorities are expected to retain flexibility to introduce country-specific questions where necessary. These additional data points may support domestic priorities, including information gathering for future National Risk Assessments (NRA) and other national supervisory initiatives.
Customer Due Diligence requirements continue to evolve
The developing RTS on Customer Due Diligence is also expected to provide further clarity on identification details, the treatment of complex ownership and control structures, and practical considerations surrounding the establishment of the purpose and intended nature of business relationships. These areas continue to present operational challenges for many Subject Persons and are therefore likely to attract significant attention once the final standards are adopted.
- Beneficial Owners of listed entities: Future requirements may require Subject Persons to identify and verify beneficial owners even where listed entities are involved.
- Purpose and intended nature: A more flexible and practical approach is expected in relation to establishing the purpose and intended nature of a business relationship.
- Non-Face-to-Face identification and verification: The anticipated direction is towards reliance on eIDAS-compliant electronic identification solutions and Video conferencing-based verification processes.
Governance expectations are expanding
Future governance frameworks are expected to formally recognise:
- The Compliance Officer (currently often referred to as the MLRO)
- The Compliance Manager
Holding companies are brought within scope of the new EU AML framework
The AML Regulation classifies non-financial mixed activity holding companies as obliged entities. While the practical focus of these obligations is expected to centre primarily on group-wide AML/CFT governance, oversight and policy implementation, affected groups should begin assessing the impact of these requirements well ahead of the Regulation’s application date in July 2027.
FIAU guidance and other local developments
The FIAU is expected to issue guidance clarifying that Subject Persons would generally not be required to enquire whether shareholders hold their shareholding jointly with their spouses under the Community of Acquests regime. However, enhanced consideration may still be warranted where specific risk indicators are present, such as known criminal connections or sanctions-related concerns involving a spouse.
Further guidance is also anticipated in relation to certifications and the treatment of complex ownership and control structures. In parallel, discussions remain ongoing regarding the scope of tax advice, with authorities continuing to work towards a practical and proportionate definition for regulatory purposes.
National Risk Assessment expected in the coming months
The next National Risk Assessment (NRA) is reportedly expected towards the end of this year or the beginning of next year.
Continued focus on Transaction Monitoring and Reporting
Supervisory findings continue to highlight the importance of effective scrutiny of transactions and reporting obligations.
Conclusion
The coming years are expected to bring substantial changes to the AML/CFT framework applicable to Maltese Subject Persons. While implementation timelines for many European initiatives remain uncertain, the underlying direction is becoming increasingly clear.
Whether through new AMLA standards, evolving CDD requirements, enhanced governance expectations or preparation for the next MONEYVAL evaluation, subject persons should begin assessing the impact of these developments now.