Where the obligation to recognise and escalate sits inside a Maltese subject person, and where it stops. Written for people outside the compliance function.
An employee who suspects something raises an internal report with the MLRO. It does not go to the FIAU. It is the MLRO who considers the internal report and decides whether it becomes a suspicious transaction report to the FIAU.
That decision belongs to the MLRO, not to the person who raised it. The common misunderstanding runs the other way — that suspecting something means filing with the regulator yourself — and it is worth stating plainly that it does not.
Two details of the procedure are worth knowing because they bear on everyone, not only on compliance. Reporting lines are to be kept as short as possible, ideally allowing an employee to report directly to the MLRO. And the timing runs from the employee: once an employee becomes aware of the information, the matter is to be treated with the utmost urgency and reported to the MLRO without delay, with the FIAU expecting the internal report by no later than the next working day.
Where a decision is taken not to forward a report to the MLRO, the internal procedures are expected to deal with that too, so a disagreement about escalation has a route rather than an ending.
Worked through in the case study The company whose shares he sold was struck off two years earlier.
Source: PMLFTR (S.L. 373.01) (Reporting obligations) · FIAU Implementing Procedures, Part I (§5.4 internal reporting procedures, pp. 232–233; decision not to forward, p. 235, last amended 27 April 2026)
The trigger for an internal report is suspicion. It is not proof, not a conclusion that money laundering has occurred, and not a case that would stand up somewhere. The threshold also extends to reasonable grounds to suspect.
That second limb is an objective test: it asks what a competent person in the same role, holding the same information, would have suspected. “I did not personally suspect anything” is not a defence where a competent person would have.
Source: PMLFTR (S.L. 373.01) (Suspicion and reasonable grounds to suspect) · PMLA (Cap. 373) (The reporting framework)
The duty on someone outside compliance is bounded. It is to recognise something that does not fit and to pass it on. It is not to work out whether it amounts to money laundering, not to investigate, and not to decide what happens to the relationship.
Someone outside compliance who starts investigating on their own initiative is doing the wrong thing, however well intentioned. Further enquiry may well be needed, but it is directed by the MLRO and the compliance function rather than undertaken unilaterally by whoever noticed first.
Source: FIAU Implementing Procedures, Part I (Internal reporting procedures and the role of the MLRO, last amended 27 April 2026)
Disclosing to the client, or to a third party, that a report has been made or that an investigation is under way or contemplated is a criminal offence. It does not stop being one because the disclosure was casual, well meant, or phrased as an explanation for a decision.
Worked through in the case study A pattern of round-sum consultancy invoices.
Source: PMLA (Cap. 373) (The offence of tipping off) · PMLFTR (S.L. 373.01) (Tipping off and non-disclosure)
The obligations sit on the subject person, but they do not stop there. Individual staff — in particular directors and similar officers responsible for management, and employees in certain instances — may face administrative sanctions for the firm’s contraventions.
Separately, individuals may face criminal penalties for involvement in money laundering or terrorist financing, or for breaching non-disclosure obligations.
Source: FIAU Implementing Procedures, Part I (§7.1, p. 267, last amended 27 April 2026)
These are study notes, written while teaching myself Maltese AML/CFT. They are a revision aid and nothing more.
This is not legal or compliance advice, and no accuracy is guaranteed. Nothing here has been reviewed by a qualified practitioner. Reading this page is not training, and it does not discharge any obligation owed by you or by a subject person. Definitions are summaries and will lose nuance; the law changes, and pages here may lag behind it.
Where something matters, go to the source: the PMLFTR (S.L. 373.01), the PMLA (Cap. 373), the FIAU Implementing Procedures, or a professional who is paid to be right about it.