Cap. 653 Art. 32Obligations of persons, entities or bodies. Cap. 527.

(1) The persons, entities or bodies listed in Schedule I

shall:

(a) identify the identity of a customer and, where applicable, identify and verify the ownership and control structure of the said customer prior to engaging to service the same customer, and ensure on an on-going basis that the information so obtained is still current and up-to-date;

(b) regularly check the list of designated persons, entities or bodies in accordance with European Union restrictive measures, restrictive measures by the United Nations Security Council Resolutions and domestic restrictive measures and to screen their client databases against those lists prior to engaging with a client, on a regular basis and immediately after a change to any of these lists occurs and upon awareness that the relevant circumstances surrounding the client and its operations have changed;

(c) have in place and effectively implement internal controls, policies and procedures to ensure compliance with the obligations arising from this Act and European Union restrictive measures, restrictive measures by the United Nations Security Council Resolutions and domestic restrictive measures, with the said internal controls, policies and procedures having to be in compliance with Chapter IV of Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 when being implemented by a payment service provider or a crypto-asset service provider when performing transfers of funds and crypto-assets respectively;

(d) immediately notify the Board in case targeted funds and economic resources are identified, and of the actions taken in relation to such funds and economic resources in compliance with the requirements of this Act, including in relation to any attempted transactions; and

(e) upon awareness, immediately notify the Board of any suspected violations of European Union restrictive measures, restrictive measures by the United Nations Security Council Resolutions and domestic restrictive measures.

(2) The Minister may, from time to time, by regulations amend Schedule I as necessary.

(3) All persons, entities or bodies listed in Schedule I may rely on a third-party to comply with their obligations in accordance with sub-article (1), with the person, entity or body relying on third parties remaining ultimately responsible for compliance with the said obligations.

(4) All persons, entities or bodies listed in Schedule I relying on other third parties to comply with their obligations in accordance with sub-article (1) shall take adequate steps to ensure that, upon request, such third-party shall immediately provide any relevant data, information and documentation required in terms of sub-article (1).

(5) All persons, entities or bodies listed in Schedule I operating in Malta shall take appropriate steps, proportionate to the nature and size of their business, to identify and assess the risks of violations of restrictive measures and proliferation financing and circumvention thereof that arise out of its activities or business. These steps shall take into account risk factors, including those relating to clients, geographical areas, products, services, transactions and delivery channels:

Provided that crypto-asset service providers shall in particular consider the risks associated with transfers of crypto-assets directed to or originating from a self-hosted address measure to mitigate and manage the risk of non-implementation and evasion of targeted financial restrictive measures and proliferation financing-related targeted financial restrictive measures.

(6) All persons, entities or bodies listed in Schedule I referred to in sub-article (5) shall properly document the risk assessment referred to in that sub-article and shall make such documentation available to the Board or any other relevant supervisory authority acting on the Board’s behalf, upon demand by the said Board or supervisory authority.

(7) All persons, entities or bodies listed in Schedule I shall ensure that the risk assessment carried out in terms of sub-article (5) is regularly reviewed and kept up-to-date.

(8) Any person, entity or body listed in Schedule I referred to in sub-article (1) shall be prohibited from informing the client or any third party in advance that a freezing order pursuant to this Act is to be applied.

(9) Any person, entity or body listed in Schedule I referred to in sub-article (1) shall retain records to demonstrate its compliance with the obligations referred to in accordance with this article for a period of five (5) years from the end of the business relationship with the clients which shall start to run as follows:

(a) in relation to the records retained to demonstrate compliance with the obligations referred to in accordance with sub-article (1)(a), from the date when the person, entity or body no longer services the client;

(b) in relation to the records to be retained to demonstrate compliance with the obligations referred to in accordance sub-article (1)(b), from the date when the verification takes place;

(c) in relation to the records to be retained to demonstrate compliance with any other obligation, from the date when the person, entity or body referred to no longer falls within any of the categories listed in Schedule I:

Provided that the Board may extend the five (5) year retention period in so far as that period is limited to what is strictly necessary in relation to the purpose for which the information is processed.

(10) In accordance with the provisions of the Protection of the Whistleblower Act, the Board, in any investigating, prosecuting, judicial or administrative authority shall protect and keep confidential the identity of any person, entity or body who reports, either internally within a person, entity or body or to the Board, awareness or suspicions that economic resources are the proceeds of violations of restrictive measures or the circumvention of the restrictive measures.

(11) Detrimental action shall be not taken against any person, entity or body, including employees or officials of the person, entities or bodies who reports, either internally within the person, entity or body or to the Board, awareness or suspicions of sanctions violation or sanctions circumvention or awareness or suspicions that funds are the proceeds of violations of restrictive measures or the circumvention of restrictive measures.