Malta AML for Accountants: FIAU Implementing Procedures Explained

In Malta, accountants and auditors are "subject persons" under the country's anti-money laundering (AML) framework, supervised by the Financial Intelligence Analysis Unit (FIAU). The FIAU's Implementing Procedures are legally binding, and a separate sector part is written for accountants and auditors. This guide explains who counts as a subject person, what activities are covered, what the FIAU expects on risk assessment, customer due diligence and reporting, and what changed in the 2026 edition of the general procedures. It draws on the FIAU's Implementing Procedures Part I (2026 edition) and its Part II for accountants and auditors, whose cover shows dates of November 2021 and December 2022. Because the sector part may have been updated since, check the FIAU website for the current version before you rely on any detail. This is general information, not legal advice.

Legal status of the Implementing Procedures

The FIAU issues the Implementing Procedures under Regulation 17 of the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR). According to the Procedures themselves, they are legally binding on all subject persons and are not merely consultative, and failure to comply may lead to administrative sanctions. Part I applies to all sectors. Part II contains sector-specific guidance and must be read together with Part I. They do not replace the PMLFTR or the Prevention of Money Laundering Act, and they are not designed as an internal procedures manual or a checklist.

Who is a subject person?

Part II explains that auditors, external accountants and tax advisors carry out "relevant activity" under the PMLFTR. Several clarifications matter in practice:

• "External" means independent. It covers someone acting on their own behalf and in their own name. Employees working for an employer are not subject persons.
• The firm is the subject person. Accountancy firms registered with the Accountancy Board are subject persons, and individual partners or staff are generally not subject persons in their own name.
• Liquidators. Liquidators acting in a personal capacity are subject persons, while those acting through the firm generally are not.

Which activities are covered?

Part II refers to audit services, liquidation under the Companies Act, operating, managing or administering companies (such as controller or administrator roles), and other services such as dealings in real property or company formation. Company services and tax advice are covered by separate guidance for company service providers and tax advisers. The Procedures apply only to subject persons carrying out a relevant activity, and only when doing so.

Risk assessment

Under Part II, the business risk assessment must be documented, approved by the board and reviewed at least annually, and the customer risk assessment must be completed before the relationship starts and updated on trigger events. Part I describes the business risk assessment as identifying threats and vulnerabilities, assessing likelihood and impact to determine inherent risk, weighing mitigating measures and deriving residual risk, and it must be available to the FIAU on request. Our guide to the firm-wide AML risk assessment shows how to build one, though Maltese firms should follow the FIAU's method.

Part II lists sector-specific risk factors:

• complex corporate structures, customers in the virtual financial assets sector, cash-intensive businesses and high-volume trading businesses;
• misuse of client accounts, which should not operate as shadow banking;
• use of intermediaries and non-face-to-face interaction; and
• at a national level, the 2018 National Risk Assessment identified tax evasion as a major domestic driver.

Customer due diligence points specific to accountants

Part II includes these requirements:

• Agents. Identify and verify persons who bind the customer, and confirm written authority.
• Intermediaries. Senior management approval is needed, except for sole practitioners, and checks must be repeated at least annually.
• Acting for others. Possible straw-man indicators call for considering a suspicious transaction report and ceasing the service.
• Purpose and source of funds. Understand the rationale for the services and obtain source of funds information when activity is unusual.
• Audit. Compare opening and closing balances across audit cycles and review changes in the risk profile.
• Liquidation. The company is the customer, and distributions of assets should be scrutinised.

Part I also covers beneficial owners, source of wealth and funds, simplified and enhanced due diligence, reliance on third parties and sanctions screening. Our guide to ultimate beneficial ownership for accountants explains the general approach to tracing owners.

Reporting suspicious transactions

According to Part II, a suspicious transaction report (STR) must be filed with the FIAU under Regulation 15(3) of the PMLFTR. Reporting must be prompt, and the same day where suspicion persists. The reporting obligation applies even to transactions that occurred long before your review, and adverse media that raises a money laundering suspicion must be considered for reporting. Regulation 16 prohibits tipping off, and Part II says communications when resigning must avoid wording that could tip off the client. Part I describes the role of the money laundering reporting officer (MLRO), including appointment, qualifications and functions, so read it carefully.

What changed in the 2026 edition

The FIAU's Part I shows it was last amended on 27 April 2026. The changes it lists are a deletion of an exception to the definition of trusts in a footnote to Section 4.2.2, a comprehensive redraft of Section 7.5 including changes to the employee screening obligation, and consequential changes to record-keeping in Sections 9.2 and 9.3.6. If your onboarding or staff vetting procedures predate April 2026, check them against the revised text.

A starting checklist for a Maltese firm

1. Confirm whether each service you provide is a relevant activity.
2. Check that the business risk assessment is documented, board-approved and reviewed annually.
3. Complete a customer risk assessment before each new relationship.
4. Confirm who files STRs and that the process works the same day.
5. Review employee screening against the 2026 changes.
6. Record training and keep records as Part I requires.

See our CPD courses for AML training, and use our AML and KYC guides hub to compare approaches across jurisdictions.

Frequently asked questions

Who supervises accountants in Malta for AML?

The FIAU issues the binding Implementing Procedures for subject persons, including auditors, external accountants and tax advisors.

Are the Implementing Procedures binding?

Yes. They state that they are legally binding on all subject persons and that non-compliance may lead to administrative sanctions.

Are employed accountants subject persons?

Not if they work for an employer. Part II says "external" means acting on your own behalf and in your own name.

How quickly must I file an STR?

Promptly, and the same day where suspicion persists, according to Part II.