Malta SMB Issues Binding Sanctions Guidance Under the NIA
Malta's Sanctions Monitoring Board (SMB) published a Guidance Note in August 2026 under the National Interest (Enabling Powers) Act, Chapter 653 of the Laws of Malta (the "NIA"), giving practical effect to Article 32. The document is not soft guidance: procedures issued by the SMB are legally enforceable under Article 15(5)(c) of the NIA, and the SMB states plainly that declining to follow the Guidance Note can count against a Subject Person in enforcement proceedings. For accounting firms, auditors, and CFOs supporting regulated Maltese entities, including those in the digital asset sector, this publication demands immediate attention.
What the NIA Framework Requires and Who It Covers
Article 32 of the NIA sits at the heart of Malta's domestic sanctions architecture. It applies to all Subject Persons listed in Schedule I to the NIA, a category that spans financial institutions, payment service providers, virtual financial asset service providers, and a range of other regulated operators.
Territorial reach beyond Malta
The Guidance Note extends the compliance obligation beyond Maltese shores. Operators with branches or majority-owned subsidiaries in third countries must apply the NIA's requirements in those jurisdictions to the extent local law permits. Where local law blocks full application, the operator is expected to adopt alternative risk-reduction measures and be able to demonstrate those measures to the SMB on request. This extraterritorial dimension is significant for any group structure with international operations and will require documented governance decisions at parent level.
The Sanctions Framework: prescribed components
Central to the Guidance Note is what the SMB calls the "Sanctions Framework," a set of interconnected controls that every Subject Person is expected to build and maintain. The SMB is explicit that these components are not siloed compliance exercises. They are designed to operate as a continuum, where the output of one feeds directly into the next, creating an ongoing feedback loop across the organisation. An enterprise-wide sanctions risk assessment, supported by a documented risk appetite statement approved at senior level, anchors the entire framework. Each component that sits downstream of that assessment draws on it and feeds results back into it.
For firms that already deploy crypto accounting software or digital asset accounting software to manage transaction-level data, the SMB's feedback-loop model has a practical read-across: sanctions screening outputs, beneficial ownership determinations, and risk appetite decisions need to be reconcilable with one another at the record level. Systems that hold data in separate silos will struggle to demonstrate the continuum the SMB describes.
Sanctions Controls vs. AML/CFT: A Legally Distinct Test
One of the most operationally consequential parts of the Guidance Note is its treatment of the relationship between sanctions compliance and AML/CFT frameworks. The SMB acknowledges that operators routinely use the same systems, processes, and staff to satisfy both sets of obligations. It does not object to that. What it rejects is the assumption that the two regimes are legally interchangeable.
Beneficial ownership and jurisdictional assessments
The SMB specifically highlights beneficial ownership assessments and jurisdictional considerations as areas where the distinction matters most. Under AML/CFT, a beneficial ownership determination feeds a risk rating that drives enhanced due diligence or ongoing monitoring. Under sanctions law, the same determination may trigger an outright prohibition regardless of the customer's apparent risk profile. The legal threshold, the consequence, and the decision tree are different in each case.
For accounting firms advising clients on how AML/KYC obligations interact with crypto reporting frameworks, this distinction has an immediate practical consequence: compliance documentation must show separately that each test was applied on its own terms, not that one framework was satisfied and the other assumed to follow.
Implications for crypto firm compliance programmes
Virtual financial asset service providers licensed in Malta already operate under the MFSA's existing VFA framework and are Subject Persons under the NIA. The Guidance Note means their compliance programmes now need a sanctions layer that is architecturally separate from, though operationally connected to, their AML/CFT controls. In practice, this likely requires policy documents, workflow configurations, and audit trails that distinguish sanctions determinations from AML decisions at the transaction or counterparty level. Crypto bookkeeping software used by these firms must be able to produce records that support both sets of documentation independently.
Enforcement: Penalties, Personal Liability, and Publication
The SMB's enforcement position leaves little room for ambiguity. Article 35 of the NIA establishes administrative penalties for Subject Persons that fail to meet their Article 32 obligations. Those penalties are not limited to the entity itself.
Personal liability for senior individuals
Liability under Article 35 can extend to directors, managers, and other officers where the breach occurred with their knowledge or resulted from a failure to supervise. For CFOs and compliance officers at Malta-licensed firms, this creates direct personal exposure, not just corporate risk. Governance structures need to reflect this: board-level approval of the risk appetite statement is prescribed, and the audit trail supporting that approval will matter if the SMB investigates.
Publication threshold and the criminal proceedings warning
Any administrative penalty above €1,500 is published on the SMB's website. Given that even routine control deficiencies could generate penalties at that level, public disclosure is a realistic outcome for firms that fall short. The Guidance Note goes further: it warns that weak controls may be used as evidence in criminal proceedings. A documented decision not to follow the Guidance Note's procedures can, in the SMB's own words, count against a Subject Person in enforcement. That is an unusually direct statement from a Maltese regulatory body and signals that the SMB intends to treat the Guidance Note as a compliance benchmark in any future action.
Accounting and Audit Implications for Firms
For accounting firms and auditors servicing Malta-regulated clients, the Guidance Note introduces several considerations that go beyond standard AML compliance reviews.
Documentation and record-keeping standards
The SMB's emphasis on a feedback loop across the Sanctions Framework implies that records must show not just that controls exist, but that they are operating as a system. Auditors reviewing compliance programmes will need to trace how the risk assessment informs screening configurations, how screening outputs update the risk assessment, and how senior-level approvals are documented at each stage. Firms using digital asset accounting software should assess whether their existing record architecture can produce that chain of evidence in a format an SMB examiner can follow.
Group-level consolidation considerations
For groups with third-country branches or subsidiaries, the requirement to either apply the NIA or adopt documented alternative measures creates a consolidation-level compliance obligation. Accounting firms preparing group compliance reports will need to capture each jurisdiction's status, the legal basis for any deviation from full NIA application, and the compensating controls adopted. This is new territory for many Maltese-headquartered crypto groups and will likely require input from local legal counsel in each relevant jurisdiction alongside the accounting function.
Understanding what regulators expect from digital asset compliance programmes is becoming increasingly relevant as jurisdictions across the EU and beyond tighten their frameworks in parallel with Malta's approach.
The 11 Worked Examples and What They Signal
The Guidance Note includes 11 worked examples in its annexes, specifically addressing the identification and screening of parties within layered ownership and control structures. The SMB's decision to include these examples is itself a signal: regulators typically add worked examples when they have seen repeated failures in a specific area in practice.
Layered structures in the crypto context
Layered ownership is a well-known feature of the digital asset space, where tokens may be held through chains of wallets, holding entities, and beneficial owners spread across multiple jurisdictions. The SMB's examples are not crypto-specific, but the challenge they address, tracing control and beneficial ownership through multiple layers to identify a sanctioned party, maps directly onto the screening problems that crypto firms face. Subject Persons in the VFA sector should work through all 11 examples and assess whether their current screening logic would reach the same conclusions the SMB illustrates.
A Broader Shift in the Regulatory Baseline
The SMB frames this Guidance Note as part of a deliberate shift away from treating sanctions compliance as a minor extension of AML/CFT work. It reflects, in the SMB's view, the growing prominence of sanctions compliance at EU level, a trend visible across member states as autonomous EU sanctions regimes have expanded in scope and complexity since 2022.
The Guidance Note establishes a common baseline that applies equally to sole practitioners and large institutions. Sector-specific tailored guidance is expected to follow, so firms should treat the current document as the floor, not the ceiling, of what will eventually be required in their particular sector.
For firms already managing the compliance burden of MiCA authorisation, DORA obligations, and AML/CFT requirements, adding a structurally separate sanctions framework is a material operational change. The practical answer for most firms will involve a combination of updated policies, reconfigured screening workflows, and crypto accounting software capable of maintaining the audit trails the SMB's feedback-loop model demands. Firms that have not yet mapped their current controls against the prescribed Sanctions Framework components should treat that gap analysis as a near-term priority.
Frequently Asked Questions
Who is a Subject Person under Malta's NIA?
Subject Persons are the categories of operator listed in Schedule I to the National Interest (Enabling Powers) Act, Chapter 653 of the Laws of Malta. The list includes financial institutions, payment service providers, and virtual financial asset service providers, among others. If your firm holds a VFA licence from the MFSA, it is almost certainly a Subject Person and subject to Article 32 obligations.
Is the SMB Guidance Note legally binding or just advisory?
It is legally binding. Procedures issued by the SMB carry force under Article 15(5)(c) of the NIA. The Guidance Note itself states that a decision not to follow its procedures can count against a Subject Person in enforcement proceedings, including criminal proceedings where weak controls are used as evidence.
How does sanctions compliance differ from AML/CFT compliance under the Guidance Note?
The SMB acknowledges that firms often use the same systems for both, but it insists the legal tests are distinct. An AML risk rating and a sanctions determination are governed by different rules, thresholds, and consequences. Beneficial ownership assessments and jurisdictional considerations must be evaluated separately under each regime, and compliance records must reflect that separation.
What are the penalties for non-compliance with Article 32?
Article 35 of the NIA sets out administrative penalties for Subject Persons that fail to meet their Article 32 obligations. Penalties above €1,500 are published on the SMB's website. Liability can extend to individual directors, managers, and officers where a breach occurred with their knowledge or resulted from inadequate supervision.
What should a firm do first in response to the Guidance Note?
The immediate priority is a gap analysis: map your current sanctions controls against the Sanctions Framework components described in the Guidance Note, assess whether your records can demonstrate the feedback loop the SMB requires, and work through all 11 annexe examples to test your screening logic against layered ownership structures. Any gaps identified should be escalated to senior management and addressed in a documented remediation plan before the next supervisory interaction.