Cap. 371 чл. 34Confidentiality.

(1) Nothing in this Act shall authorise the Central Bank or the competent authority to enquire or cause an enquiry to be made in a credit institution into the affairs of any individual customer of a credit institution except -

(a) for the purpose of ensuring compliance with any of the provisions of this or any other Act, or

(b) for the purpose of enabling the Central Bank to satisfy its responsibilities under the Central Bank of Malta Act, or

(c) for the purpose of enabling the Central Bank or the competent authority, as the case may be, to satisfy their respective obligations arising under Malta’s international commitments.

(2) No person, including past and present officers or agents of a bank, financial holding company or mixed financial holding company, shall disclose any information relating to the affairs of a bank or of a customer of a bank, or relating to the affairs of a financial holding company or a mixed financial holding company, which he has acquired in the performance of his duties or the exercise of his functions under this Act or any regulations made or Banking Rules or Conduct of Business Rules issued thereunder except -

(a) when authorised to do so under any of the provisions of this Act or any regulations made or Banking Rules or Conduct of Business Rules issued thereunder; or

(b) for the purpose of the performance of his duties or the exercise of his functions;

(c) when lawfully required to do so by any court or tribunal or under a provision of any law;

(d) for the purpose of enabling the Central Bank or the competent authority, as the case may be, to satisfy their respective obligations arising under Malta’s international commitments; or

(e) when the customer expressly consents, in writing, to the disclosure of information relating to his affairs, to the extent authorised by the customer.

(3) Where an officer of a credit institution has reason to believe that a transaction or a proposed transaction could involve money laundering or the funding of terrorism, he shall act in compliance with the reporting and other obligations set out in the regulations made under article 12 of the Prevention of Money Laundering Act, and any procedures and guidance issued thereunder, and such disclosure shall not constitute a breach of confidentiality.

(4) Officers of the competent authority and of the Central Bank, including past and present officers, as well as auditors or experts acting on behalf of the competent authority or the Central Bank, shall be governed by the obligation of professional secrecy and shall not disclose information obtained in the course of carrying out supervisory and other duties unless such disclosure of information be done in summary or collective form, such that individual credit institutions cannot be identified, without prejudice to the provisions of the Criminal Code:

Provided that the said officers, auditors or experts may divulge such information for the purpose of the performance of their duties, or the exercise of their functions, only in summary and collective form as specified in sub-article (4), or when lawfully required to do so, by any court or under a provision of any law: Provided further that where a credit institution has been declared bankrupt or is being compulsorily wound up, confidential information which does not concern third parties involved in attempts to rescue that credit institution may be disclosed in civil or commercial proceedings.

(5) The provisions of sub-article (4) shall not prevent the competent authority from exchanging information with overseas regulatory authorities in other Member States and authorities in other Member States responsible for the supervision of credit institutions and investment firms or transmitting information to the ESRB, the EBA or the European Securities and Markets Authority established by Regulation (EU) No. 1095/2010, in accordance with the Act and any regulations made and Banking Rules issued thereunder transposing the CRD, with any binding legal instruments issued under the CRD, with the CRR, with Regulation (EU) 2019/2033, with Article 15 of Regulation (EU) No. 1092/2010, with Articles 31, 35 and 36 of Regulation (EU) No. 1093/2010 and with Articles 31 and 36 of Regulation (EU) No.1095/2010, with Directive (EU) 2019/2034 and with other Directives applicable to credit institutions. Such information shall be subject to the provisions of sub-article (4):

Provided that the provisions of sub-article (4) shall not prevent the competent authority from publishing the outcome of stress tests carried out in accordance with the Banking Act (Supervisory

Review) Regulations or Article 32 of Regulation (EU) No. 1093/ 2010 or from transmitting the outcome of the stress tests to the EBA for the purpose of publication by the EBA of the results of Union-wide stress tests. Provided that the provisions of sub-article (4) shall not prevent the competent authority from publishing the outcome of stress tests carried out in accordance with the Banking Act

(Supervisory Review) Regulations or Article 32 of Regulation (EU) No. 1093/2010 or from transmitting the outcome of the stress tests to the EBA for the purpose of the publication by the EBA of the results of Union-wide stress tests.

(6) Notwithstanding the provisions of the Professional Secrecy

Act and of article 257 of the Criminal Code, a credit institution may, where necessary for the proper carrying out of its activities or for the fulfilment of its obligations, communicate any information which is in its possession and which is related to the affairs of a customer or of a connected person to:

(a) other members of the group of companies of which that credit institution forms part, which carry out any activities licensed or authorised by the competent authority under this Act, the Trusts and Trustees Act, the Investment Services Act, the Financial Institutions

Act or the Insurance Business Act, or which otherwise carry out activities equivalent to those activities mentioned in this paragraph, and which are authorised by an overseas authority in a recognised jurisdiction, as well as the credit institution’s holding company or financial holding company or mixed financial holding company or mixed activity holding company, where this is necessary for the proper carrying out of its activities or for the fulfilment of its obligations or for the carrying out of risk management, audit or compliance processes of the credit institution or of the group of companies of which it forms part; or

(b) any auditor or expert engaged by the credit institution to carry out a compliance assessment, monitoring, auditing or a similar review in relation to any of the activities or risk management, audit or compliance processes of the credit institution or of the group of companies of which it forms part or in order to assess the credit institution’s compliance with any statutory obligations relating to the prevention of money laundering and the funding of terrorism;

(c) an outsourcing service provider in whose favour a credit institution has outsourced any of its activities. This shall be without prejudice to article 19A: Provided that, for the purposes of this sub-article, any such communication of information shall be made subject to all proper controls and safeguards, so that it shall be the responsibility of the credit institution to ensure that the group company member, the auditor or expert, or the outsourcing service provider, as the case may be, is subject to equivalent obligations of data protection, confidentiality and care as required under Maltese law and any European Union law, including the GDPR: Provided further that for the purpose of this article, advertising, marketing or promotion, shall not, under any circumstances, be considered as necessary for the proper carrying out of the activities of a credit institution or for the fulfilment of its obligations: Provided further that communication of information made in terms of paragraphs (a) to (c) shall be without prejudice to any provision of the Prevention of Money

Laundering and Funding of Terrorism Regulations.

(7) Where the competent authority receives confidential information under sub-articles (4) and (5), it shall use such information only in the course of its duties and only for any of the following purposes -

(a) to check that the conditions governing access to the activity of credit institutions are met and to facilitate monitoring, on a non-consolidated or consolidated basis, of the conduct of such activity, especially with regard to the monitoring of liquidity, solvency, large exposures and administrative and accounting procedures and internal control mechanisms;

(b) to impose penalties;

(c) in an appeal against a decision of the competent authority pursuant to article 10 and in any court proceedings before the Court of Appeal in terms of article 21(14) of the Malta Financial Services Authority Act;

(d) in court proceedings initiated pursuant to special provisions provided for in European Union law adopted in the field of credit institutions.

(8) The competent authority, when processing personal data for the purposes of this Act and any regulations and, or Banking Rules and, or Conduct of Business Rules issued thereunder, shall do so in accordance with any applicable legislation on data protection.

(9) The provisions of article 25(2) and sub-articles (4), (5) and

(7) of this article shall be without prejudice to the powers of investigation conferred on the European Parliament pursuant to Article 226 of the Treaty on the Functioning of the European Union.