S.L. 371.5 Art. 10Reporting of breaches.

(1) The competent authority shall establish effective and reliable mechanisms to encourage reporting of potential or actual breaches of the provisions of the Act, regulations made and

Banking Rules issued thereunder, of any binding legal instrument issued thereunder and of the provisions of the CRR.

(2) The mechanisms referred to in sub-regulation (1) shall include at least:

(a) specific procedures for the receipt of reports on breaches and their follow-up;

(b) appropriate protection for employees of credit institutions who report breaches committed within the credit institution against retaliation, discrimination or other types of unfair treatment at a minimum;

(c) protection of personal data concerning both the person who reports the breaches and the natural person who is allegedly responsible for a breach, in accordance with the Data Protection Act and any regulations made thereunder;

(d) clear rules that ensure that confidentiality is guaranteed in all cases in relation to the person who reports the breaches committed within the credit institution, unless disclosure is required by Maltese law in the context of further investigations or subsequent judicial proceedings.

(3) Credit institutions shall have in place appropriate procedures for their employees to report breaches internally through a specific, independent and autonomous channel. Such a channel may also be provided through arrangements provided for by social partners. The same protection as referred to in sub-regulation (2)(b), (c) and (d) shall apply.

Part II - Right of Appeal