The European Banking Authority (EBA) has found “general and systematic shortcomings” in the Financial Intelligence Analysis Unit’s (FIAU) application of anti-money laundering directives with regard to the infamous Pilatus Bank.

It also said that the FIAU breached anti-money laundering directives. 

The EBA said in June that it had started probing the FIAU’s handling of Pilatus Bank, which has been mired in controversy and named in several leaked FIAU reports. The bank was allegedly used to transfer kickbacks into PEP accounts. A former employee, Maria Efimova, had claimed that Panamanian company Egrant belonged to Michelle Muscat, the PM’s wife, a claim that the Muscats reject.

The bank was authorized by the Malta Financial Services Authority in 2014. Both the MFSA and the FIAU carried out on-site inspections, with the latter initially saying that there were serious breaches of AML/CFT requirements. After a follow-up visit, the FIAU had said that the issues raised previously had now been closed.

The EBA conducted a preliminary enquiry, including an on-site visit to the Maltese competent authorities. The enquiry focused on the extent to which the FIAU’s approach to AML/CFT supervision and enforcement in relation to Pilatus Bank has been effective and in line with EU law.

On 23 May 2018, the EBA opened a Breach of Union Law investigation pursuant, on the basis that the FIAU appeared to have failed to apply Union law or had applied it in a way which appeared to breach Union law.

The findings

In its findings, the EBA said that the FIAU does not have sufficient records of the specific files and documents examined during the first on-site visit, to make it possible to identify which customer files were examined and which due diligence documentation was available or not available at the time. This lack of records contributed to the FIAU’s inability to defend itself against the institution’s challenges.

Discussions in the Compliance Monitoring Committee Meetings, the FIAU’s decision-making body on supervisory matters (CMC), are not adequately reasoned or documented with the result that it is not possible to understand what led to the closure of the case without further supervisory measures or sanctions. It is not possible to establish whether the decision was well founded.

The EBA said that FIAU and its advisers sought to narrow down the scope of the investigation to focus primarily on the existence of customer due diligence documentation confirming the source of funds.

“The FIAU seems to have agreed to this narrowed scope unquestioningly. As a consequence, it appears that in the second on-site visit the FIAU only paid attention to the availability of source of funds documentation without a deeper analysis of it but it did not pay any attention to some of the more serious findings listed in the letter of 17 May 2016. The CMC also did not take into consideration these remaining deficiencies when deciding on next steps.”

“Notwithstanding the serious nature of its initial findings, the FIAU has not documented, or otherwise provided clear reasons and compelling arguments why it considered it appropriate not to impose any sanctions or other supervisory measures. This applies, in particular in relation to those initial findings that are not related exclusively to the institution’s failure to provide the required customer diligence documentation, including: i) the very high risks of ML/TF to which the institution is exposed not being mitigated adequately; and ii) the lack of sound AML/CFT policies established by the institution’s board of directors for customers classified as PEPs.”

“Notwithstanding it was a high-risk institution of a type which was new to the jurisdiction, the FIAU neither planned nor carried out an on-site inspection to the institution until asked to do so by the MFSA, two years after the institution started its activities and no risk-based justification has been given for this inaction.”

“After deciding to close the case, without imposing any sanction or considering any other supervisory measure, and despite the stated concerns of the FIAU as to how documentation became available in the second on-site visit although it was not available at the first inspection, the FIAU did not develop any other supervisory engagement plan with the institution. The documents provided by the FIAU to the EBA and interviews held with FIAU staff confirm that, after the 26 September 2016 communication to the institution closing the case, despite the documented concern regarding the documentation that was not available until after its first inspection, the FIAU considered the need for additional supervisory measures only in April 2017, when the allegations were made public against the institution.”

Conclusions

These findings point to general and systematic shortcomings in the FIAU’s application of AMLD3, the EBA said.

“Although the preliminary enquiry was initiated to address the concerns raised by the FIAU’s supervision of Pilatus Bank, the findings from the EBA’s investigation reveal a general practice of the FIAU at the time of the case at issue and not only, as argued by the FIAU, a failure in this particular case.”

“The information requested and provided to the EBA has not been limited to the procedures and policies applied to Pilatus Bank. The FIAU has also challenged the issuing of a Recommendation because an Action Plan had been already adopted by the FIAU to address the same concerns set out in the draft Recommendation.”

The EBA welcomed the actions that the FIAU has taken or is in the process of taking to strengthen its activities but, in the EBA’s view the need identified by the FIAU for such a wide-ranging nature Action Plan provides support for its findings that the procedures and policies applied at the time of the case at issue were not appropriate and effective.

The authority said the FIAU did not effectively monitor and take the necessary measures with a view to ensuring compliance with the requirements of the Directive by the institution. The FIAU failed to ensure that the bank put in place adequate and appropriate AML/CFT policies and procedures; and the FIAU neither imposed effective, proportionate and dissuasive sanctions nor any other supervisory measures to correct the shortcomings it had identified to ensure the bank’s compliance with AMLD3’s requirements.

The FIAU has informed the EBA of general actions that, as an Action Plan, it has undertaken, or which are in train, to strengthen its supervision. While a move in the right direction, these measures are not enough to be satisfied that the deficiencies that led to a breach of Union law.

Recommendations

The EBA has made a number of recommendations, advising the FIAU to ensure that it takes all necessary measures to fulfil its obligations under the 4th Anti-money laundering Directive, and to ensure that national law is in line with EU law.

It said the FIAU should enhance its assessment of Money Laundering/Financing of Terrorism risk associated with its financial sector to ensure it is comprehensive and relevant, and to enable it to (i) allow the identification of ML/TF risk factors both domestic and foreign affecting the Maltese financial sector.

It also urged the FIAU to establish and maintain a clear process to ensure this ML/TF risk assessment remains up to date, and can be amended without undue delay where necessary.

The FIAU should ensure that there are sufficient resources at its disposal in the light of its tasks, the size and complexity of its sector.

It should also implement robust internal procedures to conduct AML/CFT supervision, and robust record-keeping processes.

In her covering letter to MEPs, EBA chairperson Andrea Enria said the FIAU is required to inform the EBA within 10 working days of receipt of that recommendation of the steps it has taken or intends to take to ensure compliance with Union law.

She also said that a preliminary enquiry concerning the MFSA is still ongoing.

The full report, including the recommendations, can be viewed here.

The covering letter can be viewed here.

 

FIAU statement

The Financial Intelligence Analysis Unit said it is disappointed with today's European Banking Authority's conclusion that the FIAU is in breach of Union law in the case of Pilatus Bank.  

Furthermore, the FIAU has serious reservations on the process adopted by the EBA in the carrying out its preliminary enquiry and the subsequent breach of Union law investigation.  

Notwithstanding this, the FIAU will continue to cooperate with the EBA throughout the implementation of the FIAU's action plan, which has been set in action prior to the EBA's opening of a preliminary enquiry into the possible breach of Union law in November 2017. 

The FIAU said it will be responding to the EBA in due course.