S.L. 370.25 Art. 10Reporting of breaches.

(1) The competent authority shall establish effective and reliable mechanisms to encourage the reporting to it of potential or actual breaches of the provisions of the Act, regulations and Investment Services Rules issued thereunder transposing the requirements of the CRD, and of the provisions of the CRR.

(2) The mechanisms referred to in sub-regulation (1) shall include at least:

(a) specific procedures for the receipt of reports on breaches and their follow-up;

(b) appropriate protection for employees of an investment firm who report breaches committed within the investment firm itself against retaliation, discrimination or other types of unfair treatment at a minimum;

(c) protection of personal data concerning both the person who reports the breaches and the natural person who is allegedly responsible for a breach, in accordance with the Maltese legislation on data protection;

(d) clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the investment firm, unless disclosure is required by national law in the context of further investigations or subsequent judicial proceedings.