MFSA Fines CSP €2,400 for Late Annual Compliance Return
On 2 July 2026, the Malta Financial Services Authority imposed a €2,400 administrative penalty on a company service provider for failing to submit its Annual Compliance Return for the financial year ending 2022 within the prescribed deadline. The breach centred on Rule R3-13.2 of the CSP Rulebook, and the MFSA published the action under Article 16(8) of the Malta Financial Services Authority Act. Small as the figure may look, the enforcement notice is a pointed reminder that filing deadlines are not discretionary.
What the MFSA Found
The specific rule breached
Rule R3-13.2 of the CSP Rulebook requires authorised company service providers to file an Annual Compliance Return by a fixed regulatory deadline. The return is a structured self-assessment that covers the firm's compliance posture across its regulated activities. The MFSA determined that the unnamed CSP failed to meet that deadline for the financial year ending 2022, triggering the penalty provisions of the MFSA Act.
How the penalty was formalised
The authority cited Article 16(8) of the Malta Financial Services Authority Act as the basis for publishing the decision. That provision requires the MFSA to disclose enforcement outcomes publicly unless specific exemptions apply. Publication serves a dual purpose: it satisfies transparency obligations and acts as a deterrent to others who might treat a filing deadline as flexible.
Why a €2,400 Penalty Deserves Attention
It is not about the amount
For most regulated entities, €2,400 is not a material financial hit. That is not the point. What matters is the public record. A published enforcement notice sits on the MFSA's website, is searchable by counterparties and due diligence teams, and can surface in fit-and-proper assessments of directors and senior managers. The reputational cost routinely outweighs the monetary penalty, particularly for CSPs whose business model depends on the trust of corporate clients.
Escalation risk for repeated failures
The CSP Rulebook and the MFSA Act both allow for escalating responses. A first missed return may attract a fixed penalty. Continued non-compliance, or patterns of regulatory disregard, can lead to licence conditions, suspension, or revocation. Accounting firms and compliance officers advising Maltese CSPs should treat this notice as a calibration point, not an isolated curiosity.
Operational Lessons for Compliance Teams
Map every periodic filing obligation
The Annual Compliance Return is one item in a broader calendar of regulatory submissions that Malta-authorised entities must manage. Firms that have not mapped every obligation by entity, deadline, and responsible owner are exposed. A structured filing register, whether maintained inside capable crypto accounting software or a dedicated compliance tool, is the baseline requirement here. For firms managing multiple licensed entities, the risk multiplies without systematic oversight.
This case also connects to the broader pattern of regulators across the EU tightening periodic reporting requirements. Our earlier coverage of periodic AML reporting requirements expanding across the EU shows how Sweden's Finansinspektionen moved in the same direction for AML/CFT submissions. Malta's enforcement here reinforces that trend at the entity level.
Assign clear accountability
Late filings almost always trace back to one of two causes: no one was explicitly responsible, or the handoff between compliance and finance teams broke down. Assigning a named individual to each regulatory submission, with a documented escalation path if that person is unavailable, removes ambiguity. For CSPs specifically, the compliance officer is the natural owner, but the filing calendar should also be visible to the board.
Build in lead time
Filing on the deadline day is filing late if anything goes wrong. Systems outages, data gaps, staff absence, and last-minute sign-off delays are predictable risks. A submission window that opens two to three weeks before the regulatory deadline gives teams space to resolve those issues without breaching the rule.
The Broader MFSA Enforcement Context
This penalty does not sit in isolation. The MFSA has been deepening its supervisory scrutiny across multiple regulated sectors. Earlier this year, the authority completed a thematic review covering counter-financing of terrorism, counter-proliferation financing, and targeted financial sanctions obligations across credit institutions. That review set clear expectations and signalled that the MFSA is in active examination mode. Firms operating under any Maltese licence should read these enforcement signals as a connected pattern, not isolated incidents. Our analysis of MFSA CFT/CPF/TFS thematic review obligations for Malta-regulated firms sets out what those expectations mean in practice.
For firm-level compliance programmes, the takeaway is consistency. The MFSA's willingness to publish a penalty for a filing that is years old shows that the authority will close outstanding matters and do so on the public record. Firms that assume delayed enforcement means no enforcement are taking a risk that is not supported by the evidence.
Key Questions for Accounting Firms Advising CSPs
Checklist items to raise with CSP clients now
Accounting practices and auditors providing compliance support to Maltese company service providers should consider raising the following with their clients:
- Is there a complete register of all regulatory filing deadlines across every licence held?
- Has the Annual Compliance Return been submitted for every financial year up to and including the most recently closed period?
- Is there documentary evidence of submission, including any MFSA acknowledgement?
- If any past submission was delayed, has the firm proactively engaged with the MFSA to document the circumstances?
- Does the firm's crypto bookkeeping software or compliance system generate automated deadline alerts, and are those alerts routed to the right people?
These are not hypothetical questions. This enforcement notice confirms the MFSA is reviewing historical filings and acting on gaps it finds.
FAQs
What is the Annual Compliance Return under Malta's CSP Rulebook?
It is a periodic regulatory submission that company service providers authorised by the MFSA must file by a set deadline each year. The return covers the firm's compliance arrangements and is required under Rule R3-13.2 of the CSP Rulebook.
Why did the MFSA publish this penalty notice?
Publication is required under Article 16(8) of the Malta Financial Services Authority Act. The MFSA's Publication Policy sets out the circumstances in which enforcement decisions are disclosed publicly, and this case met those criteria.
Can a firm avoid publication of a penalty?
The MFSA Act provides limited grounds for non-publication, including situations where disclosure could cause disproportionate damage or jeopardise an ongoing investigation. A straightforward filing breach is unlikely to qualify for any exemption.
Does this enforcement action affect the CSP's licence?
The published notice records a financial penalty only. However, continued non-compliance or a pattern of regulatory breaches can lead to licence conditions, suspension, or revocation under the MFSA's broader supervisory powers.
How should firms use digital asset accounting software to manage filing deadlines?
A well-configured system should maintain a filing calendar tied to each regulated entity, generate alerts ahead of each deadline, and retain evidence of submission. For multi-entity groups or CSPs managing several client structures, automated tracking reduces the dependency on individual memory and reduces the risk of the kind of oversight this case illustrates.