The Malta Financial Services Authority (“MFSA“) has recently issued the findings of its 2025 Thematic Review on the oversight exercised by Company Service Providers (“CSPs“) when arranging for individuals to act as directors and company secretaries. Although the review was conducted on a selected sample of authorised CSPs, its findings and recommendations are intended to guide the industry as a whole and provide valuable insight into the Authority’s evolving supervisory expectations.
The overarching message is that arranging for another person to act as a director or company secretary is not merely an administrative exercise. The MFSA has reaffirmed that CSPs retain full responsibility for the governance, oversight and quality of these appointments and are expected to maintain effective controls throughout the duration of the engagement.
Given the pivotal role that directors and company secretaries play in ensuring sound corporate governance, regulatory compliance and the integrity of Malta’s financial services sector, the Authority makes it clear that responsibility does not transfer to the appointed individual. Rather, accountability remains firmly with the CSP arranging the appointment.
Against this backdrop, the MFSA identifies inadequate oversight as giving rise to significant regulatory and financial crime risks, including:
- the appointment of “rubber-stamping” directors who fail to exercise genuine independent judgement;
- ineffective corporate governance structures;
- inadequate documentation of board deliberations and decision-making;
- failures to identify or escalate suspicious activities; and
- heightened money laundering and financial crime exposure.
The Authority therefore expects CSPs to move beyond merely facilitating appointments and instead adopt a proactive and risk-based approach to the continuous supervision of individuals providing these services.
The Main Areas of Concern
Many CSPs Still Misunderstand “Arranging Services”
One of the most notable findings was that a significant proportion of CSPs were unable to correctly define what constitutes “arranging” under the Company Service Providers Rulebook.
The MFSA reiterates that arranging involves appointing a natural person who is an employee or officer of the CSP to act as director or company secretary on behalf of the CSP. It does not extend to appointing unrelated third parties or legal entities. Where group structures are involved, appropriate resource-sharing arrangements and regulatory notifications are expected.
This finding serves as an important reminder that internal policies and governance frameworks should accurately reflect the regulatory definition of arranging services and clearly distinguish them from the direct provision of company services.
Fitness and Properness Is Not a One-Time Exercise
The review also emphasises that fitness and properness assessments should not be regarded as a one-off compliance exercise undertaken solely at the point of appointment. While the vast majority of CSPs confirmed that they perform initial assessments, the MFSA expects these evaluations to continue throughout the duration of the engagement.
In particular, firms should continually assess an individual’s:
- competence, qualifications and professional experience;
- integrity and reputation;
- actual and potential conflicts of interest;
- independence of mind; and
- ability to dedicate sufficient time to the role.
Importantly, the Authority reminds CSPs that they cannot rely exclusively on the MFSA’s own approval of an individual. The obligation to ensure that an arranged person remains fit and proper at all times rests squarely with the CSP.
Active Oversight
Perhaps the most significant theme emerging from the review is the Authority’s expectation that oversight must be active, meaningful and ongoing. Although most CSPs indicated that they perform some degree of monitoring, the MFSA observed that many firms limit their oversight to due diligence reviews or verification of statutory filings. In the Authority’s view, such measures, while important, do not constitute adequate supervision.
Instead, the MFSA expects CSPs to receive regular reporting on matters including:
- governance practices and board effectiveness;
- operational developments;
- compliance with statutory and regulatory obligations;
- material financial transactions;
- risk management matters;
- conflicts of interest;
- solvency and financial position; and
- significant developments affecting the client’s business.
The Authority also encourages firms to implement event-driven reporting mechanisms, ensuring that material developments are escalated promptly rather than being deferred until scheduled reporting cycles.
Collectively, these expectations reinforce the principle that arranged directors and company secretaries must remain actively engaged in the affairs of the entities they serve and should never become passive or nominal office holders.
Time Commitment requires a Substance-over-form Assessment
Another significant focus of the review is the assessment of time commitment. The MFSA notes that many CSPs simply record the number of appointments held by an individual without assessing whether that person can realistically devote sufficient time to each mandate.
The review highlights an example where an individual held 151 directorships, a situation the Authority considers inconsistent with effective governance.
Instead, CSPs are expected to conduct both:
- quantitative assessments, considering the number of appointments; and
- qualitative assessments, taking into account factors such as:
- the complexity of each entity;
- whether it is regulated;
- geographical footprint;
- group structures; and
- overall risk profile.
The Authority is therefore signalling a clear shift towards a substance-over-form approach. Merely recording the number of appointments is no longer sufficient; firms must critically assess whether an individual can genuinely fulfil the responsibilities associated with each role.
Practical Takeaways for CSPs
Beyond highlighting regulatory shortcomings, the thematic review also provides valuable guidance on industry best practice. Accordingly, CSPs should consider whether their existing governance framework adequately addresses the Authority’s expectations by:
- reviewing and updating policies governing arranging services;
- strengthening documented fitness and properness procedures;
- enhancing ongoing monitoring and oversight mechanisms;
- implementing structured and periodic reporting by arranged individuals;
- carrying out robust qualitative and quantitative assessments of time commitment; and
- undertaking a documented gap analysis against the findings of the thematic review.
Importantly, the MFSA expressly encourages all CSPs, including those that did not participate in the review, to perform such a gap analysis and retain appropriate evidence for future supervisory engagements.
Final Thoughts
The 2025 Thematic Review marks another step in the MFSA’s transition towards an increasingly outcomes-based and governance-focused supervisory approach.
The Authority has made it abundantly clear that arranging for individuals to occupy key governance positions cannot be viewed as a passive administrative service. Rather, it is a regulated activity that demands continuous oversight, effective governance arrangements and demonstrable accountability.
For Company Service Providers, the review provides an opportunity not only to assess existing practices against the Authority’s expectations but also to strengthen governance frameworks before supervisory scrutiny intensifies. Firms that adopt a proactive approach to oversight, maintain robust documentation and embed effective monitoring mechanisms will be significantly better positioned to demonstrate regulatory compliance and sound governance during future supervisory interactions.
How We Can Assist
At Zerafa Advocates, we regularly advise companies throughout their corporate lifecycle on governance and company secretarial matters, including the provision of company secretarial services, corporate governance support and ongoing regulatory compliance. Our team also has extensive experience assisting start-ups, financial institutions and other regulated entities in identifying, assessing and appointing suitable individuals to key governance and control functions, including directors, company secretaries and other key function holders.
From conducting fitness and properness assessments and evaluating time commitment, to preparing governance documentation, drafting service agreements and supporting regulatory submissions, we assist clients in building governance frameworks that are aligned with the MFSA’s expectations from the outset. As regulatory scrutiny continues to increase, adopting a proactive and well-documented approach to governance not only mitigates regulatory risk but also strengthens the long-term resilience and credibility of an organisation.
