The MFSA has on the 12th July 2018 issued a consultation paper on the Virtual Financial Assets rules for VFA agents. The closing date for submission was 31st July 2018 and now the MFSA is expected to issue the official chapter after taking into account the submissions which it has received as well as other consultations with relevant stake holders which it has carried out.
This paper is intended to form part of a rule book which will be entitled the ‘Virtual Financial Assets Rulebook’ and which will be divided into three chapters. This chapter applies to VFA agents appointed in terms of the VFA Act and to applicants seeking registration in terms of the said Act.
The first title of this chapter outlines the high-level principles which should guide VFA agents in the provision of their VFA activity in or from within Malta, while title 2 outlines the registration requirements and the registration process for VFA agents.
Title 3 outlines the ongoing obligations which VFA agents must adhere to, while title 4 provides for enforcement and sanctions in the event of misconduct by VFA agents.
This article will deal with title 3, i.e. the on-going obligations for VFA agents.
Title 3 – On-going obligations for VFA agents
A VFA agent shall have at all times adequate business organization, systems, experience and expertise to act as a VFA agent. He must take reasonable steps to ensure continuity and regularity in the performance of his services.
The business shall be directly and managed by at least 2 individuals, who have sufficient good repute, possess sufficient knowledge and experience and commit sufficient time to perform their functions.
The VFA agent shall:
- establish and maintain decision making procedures and an organizational structure with clear reporting lines and functions and responsibilities
- ensure that relevant persons are aware of the procedures which must be followed
- establish and maintain adequate internal control mechanisms designed to secure compliance with decisions and procedures
- employ personnel with the necessary skill and knowledge
- maintain adequate records of its business
- ensure that performance of multiple functions by its relevant persons will not prevent such persons from performing them in a professional manner
The VFA agent shall also establish and maintain:
- systems and procedures to safeguard the security and confidentiality of the information
- an adequate business continuity process to ensure the preservation and recoverability of essential data in case of interruption to its systems
- accounting policies and procedures to be able to deliver in a timely manner to the MFSA any financial reports which reflect a true and fair view of its financial position
- due diligence systems and controls to ensure that a proper assessment is made on the clients’ fitness and properness.
The professional indemnity insurance shall cover
- Any legal liability in consequence of negligence, error or omission
- Legal defense costs
- The whole territory of the EU and other territories where services are being provided
- Dishonest, fraudulent or criminal acts carried out by any person employed by the VFA agent as well as its consultants
- Libel, slander and defamation
- Loss and damage to documents and records including cost of restoring such documents and records
- Any liability resulting from any beach of a provision of the Act or rules or regulations
- Claims made after the expiry of the policy
The policy shall be governed by Maltese law.
The VFA agent shall within 2 working days from the date it becomes aware of the following, inform the MFSA in writing where:
- The VFA agent has notified insurers of an incident which may give rise to a claim
- The insurer has cancelled the policy or has notified its intention of doing so
- The policy has not been renewed and a similar policy has not been taken out
- The terms and conditions of the policy have been changed
- The insurer intends to decline to indemnify the insured in respect of a claim
Other insurance coverage – VFA agents shall also be required to take and maintain an insurance policy that covers loss of money or loss or damage to asset of property belonging to the VFA agent.
When relying on a third party for the performance of its operational functions, a VFA agent must take reasonable steps to avoid undue additional operational risks for the provision of satisfactory services to its clients. The outsourcing must not materially impair the quality of its internal control and the ability of the MFSA to monitor the firm’s compliance with its obligations.
The VFA gent shall remain fully responsible for discharging its obligations and shall at all times adequately manage all risks. It shall also carry out an ongoing assessment of the operational risks and notify the MFSA of any material developments. The ultimate responsibility lies with the VFA agent. The outsourcing arrangements shall not result in the delegation of responsibility. The VFA agent must inform the MFSA of any material outsourcing arrangements.
The VFA agent must have an outsourcing policy on its approach to outsourcing including contingency plans and exit strategies. Furthermore, any outsourcing arrangement must be based on a clear, written contract which establishes the rights and obligations of both the VFA agent as well as the service provider.
Procedures for reporting of breaches
The VFA agent shall develop and maintain appropriate procedures for employees to report breaches internally. The Protection of the Whistleblower Act shall be complied with.