Against a backdrop of increasing financial crime threats, rapid regulatory change, and the implementation of the EU Anti-Money Laundering Package and operationalisation of the Anti-Money Laundering Authority (AMLA), the MFSA is positioning both itself and the industry for a more mature, risk-focused and outcomes-driven supervisory environment.
A New Supervisory Philosophy
At the core of the FCC Strategy 2026 is an increased emphasis on demonstrable effectiveness rather than documentary compliance alone. MFSA-authorised entities are expected to show that their financial crime controls are not only designed appropriately but also operating effectively and delivering tangible risk mitigation outcomes.
The Strategy reinforces the MFSA's move towards supervision that looks beyond the existence of policies and procedures and considers whether regulatory measures and internal controls are achieving their intended outcomes.
This means that authorised entities will increasingly need to be able to demonstrate whether their customer due diligence processes, transaction monitoring systems, sanctions screening controls, governance frameworks and investigative functions deliver meaningful outcomes. Having documentation in place may not, in itself, demonstrate effective compliance where an entity cannot show that its controls are operating as intended and addressing identified risks in practice.
The Six Strategic Pillars
The Strategy is built around six interconnected pillars designed to strengthen Malta's overall financial crime framework. These include:• Risk-based supervision;
• Outcomes-based supervision;
• Lifecycle oversight of authorised entities;
• Streamlined regulatory coordination and oversight;
• Stronger coordination and collaboration; and
• Enhanced industry outreach and engagement.
Collectively, these pillars signal an increasingly sophisticated supervisory model in which higher-risk sectors, products and activities will receive greater regulatory scrutiny, while regulatory resources are allocated proportionately to areas presenting the greatest financial crime exposure.
Governance Moves to Centre Stage
One of the most important themes emerging from the Strategy is the importance of governance, senior management oversight, and a strong financial crime compliance culture.Financial crime compliance is increasingly expected to be treated as a broader governance issue rather than solely as an operational responsibility of the Money Laundering Reporting Officer (MLRO) or the compliance function. The Strategy places particular importance on the role of senior management in establishing and maintaining an effective financial crime compliance culture.
For boards and senior management, the practical implication is that they should be capable of demonstrating appropriate oversight of the entity’s financial crime risks, control environment and remediation activity. This includes ensuring that appropriate resources, governance arrangements and escalation mechanisms are in place. Firms that continue to treat AML/CFT compliance as a technical exercise may find themselves increasingly exposed during supervisory engagements.
Data, Evidence and Measurable Outcomes
Another notable feature of the Strategy is its emphasis on outcomes and the ongoing assessment of supervisory effectiveness. The MFSA's approach will increasingly consider whether interventions and control frameworks are achieving their intended regulatory outcomes, rather than relying solely on documentary evidence.
In practical terms, an outcome-based approach is likely to require firms to demonstrate effectiveness across areas such as:
• Transaction monitoring effectiveness;
• Quality of sanctions screening controls;
• Risk assessment methodologies;
• Governance decision-making;
• Quality of internal investigations;
• Management information and reporting;
• Remediation effectiveness and continuous improvement.
This reflects a broader regulatory expectation that firms should be capable of producing objective evidence demonstrating that financial crime risks are being effectively managed.
Preparing for the Future Regulatory Environment
The FCC Strategy 2026 also aligns Malta's supervisory framework with major developments at European level, including the implementation of the EU AML legislative package and the operationalisation of AMLA. The MFSA has confirmed its intention to strengthen cooperation with domestic and international authorities, law enforcement bodies and industry participants to support a coordinated response to financial crime threats.
For regulated entities, the message is clear: preparation cannot wait. Firms should already be assessing whether their governance arrangements, risk frameworks, control environments and reporting mechanisms can withstand an outcomes-based supervisory review.
The Strategy does not introduce a standalone new compliance framework, but it provides a clear indication of the direction of supervisory scrutiny. Authorised entities should therefore consider whether they can demonstrate the effectiveness of their FCC arrangements, rather than simply demonstrate that they exist.
This may include reviewing whether financial crime risk assessments remain aligned with the actual business model and customer base; testing the effectiveness of transaction monitoring and screening arrangements; ensuring that management information enables senior management to identify emerging weaknesses; documenting the rationale behind material financial crime decisions; assessing whether remediation measures have produced the intended result; and ensuring that governance arrangements provide effective challenge and oversight.
The direction of travel is clear. As the MFSA develops its risk-based and outcomes-driven supervisory model, authorised entities will increasingly need to demonstrate not only that appropriate FCC frameworks have been established, but that those frameworks operate effectively, respond to evolving risks and produce identifiable risk-management outcomes.
How BDO Can Help
As regulatory expectations move towards demonstrable effectiveness, BDO can help organisations assess whether their AML/CFT and sanctions frameworks deliver the outcomes expected by the MFSA. Our specialists support firms through independent effectiveness reviews, governance and board assessments, AML risk assessments, internal audit engagements, remediation programmes, and targeted training to help strengthen financial crime controls and prepare for an increasingly outcomes-focused supervisory environment.