Legal & Regulatory Updates - September 2026

We are pleased to share the third edition of our Legal & Regulatory Updates for 2026, bringing together practical legal insight on key developments shaping Malta’s legal and business landscape.

This edition covers:

• When AI Meets Children: Italy’s Garante Fines Character.AI Over Transparency and Safeguarding Failures
• Do You Need to Whitewash? The Financial Assistance Prohibition under Maltese Law Explained
• Usufruct over Company Shares: A Maltese Perspective
• The Right to be Forgotten: New Protection for Persons Recovered from Oncological Diseases

Whether you are a business owner, legal professional, or corporate decision-maker, staying informed is staying ahead.

Legal & Compliance Bulletin

This issue brings together notable legal, regulatory, and compliance developments across a range of sectors, focusing on changes that may have practical implications for your organisation. Our aim is to keep you informed and well-prepared in an evolving regulatory landscape.

Outlined below is an overview of the key updates from this quarter:

MGA

• 22 September: The MGA, in collaboration with the Malta Digital Innovation Authority (MDIA), launched the AI Gaming Charter, a sector-specific framework promoting the ethical and responsible use of artificial intelligence across gaming operations. It is voluntary and principles-based.

The MGA also published its usual notice of URLs identified during September 2026 that it has no connection with. This is routine and probably not bulletin material.

• 29 July 2026: The MGA published the findings of its Thematic Review on Governance Assurance – Key Functions. The review assessed governance arrangements across a sample of B2B and B2C authorised persons, focusing on the effectiveness of the Chief Executive Officer, Compliance, Internal Audit and Prevention of AML/CFT functions. While generally identifying mature governance frameworks, the MGA also identified areas for further enhancement in governance, compliance, internal audit and AML/CFT oversight.

MFSA

• 30 September: The MFSA published a page called “Cyber Reporting Updates” today, but the search result didn’t show what it says.
• 23 September: The MFSA and FinanceMalta jointly launched Malta Finance Week 2027, taking place from 13–15 October 2027.
• 18 September: The MFSA’s Outcomes-Based Review identifies shortcomings in Fund Managers’ outsourcing arrangements.
• 16 September: The MFSA and the Malta Stock Exchange will jointly host the 2027 Governance, Risk, Compliance and ESG Conference.
• 3 September (settlement): The MFSA agreed to settle pending matters with a Financial Institution after demonstration of goodwill. The failings related to late submission of its 2022 audited financial statements and auditor’s management letter.
• 5 August 2026: The MFSA published its Financial Crime Compliance Strategy 2026, setting out its approach to financial crime supervision and its priorities for addressing emerging risks, enhancing supervisory effectiveness and supporting alignment with the evolving EU AML/CFT framework and the establishment of AMLA.
• 3 August 2026: The MFSA published a new Guidance Note setting out the methodology it will apply when determining administrative penalties for credit institutions. The methodology introduces a structured framework which considers, among other factors, the severity of the breach, the size and financial strength of the institution, aggravating and mitigating circumstances and any financial benefit arising from the infringement.
• 31 July 2026: The MFSA launched a consultation on proposed Rules for Notified Aircraft Financial Leasing Companies and Related Due Diligence Service Providers. The proposed framework covers governance, eligibility and substance requirements, ongoing due diligence, AML/CFT systems and controls, and regulatory reporting obligations. The consultation period closed on 31 August 2026.
• 20 July 2026: The MFSA announced amendments to subsidiary legislation for the partial transposition and implementation of Directive (EU) 2024/927, introducing changes to Malta’s legislative framework concerning Alternative Investment Fund Managers and UCITS.
• 14 July 2026: The MFSA, together with the Financial Intelligence Analysis Unit, introduced the Harmonised Regulatory Reporting Framework (HRRF), aimed at harmonising regulatory reporting requirements across various sectors supervised by the Authority and standardising the manner in which regulatory data is submitted to the MFSA.

FIAU

• 14 September: FATF warns of emerging risks in gaming and gambling and publishes new risk indicators
• 10 September: The FIAU posted an item on terrorist financing (“Twenty-Five Years After…”), and on 17 Sep it posted upcoming training dates.
• 31 August 2026: The FIAU published its AML/CFT Supervisory Plan for 2026–2027, setting out the supervisory priorities and interventions that will guide its compliance monitoring activities. The priorities are informed by national and sectoral risk assessments, European and international risk assessments and risk data collected through CASPAR.
• 21 July 2026: The FIAU announced the launch of AMLA’s data-collection exercise to identify obliged entities potentially eligible for direct supervision by AMLA from 2028. The FIAU is coordinating the exercise at national level for relevant credit institutions, financial institutions and groups operating across multiple EU Member States.
• 15 July 2026: The FIAU drew attention to AMLA’s public consultation on draft Regulatory Technical Standards concerning the methodology for assessing the inherent and residual ML/TF risk profiles of obliged entities in the non-financial sector under Article 40(2) of Directive (EU) 2024/1640.
• 6 July 2026: The FIAU highlighted an AMLA consultation on draft Implementing Technical Standards establishing the proposed format for reporting suspicious transactions and activities and for providing transaction records under the EU Anti-Money Laundering Regulation.

MCCAA

• 22 July 2026: The MCCAA , through the Office for Competition, issued a decision concerning the acquisition of VION Food Service Holding GmbH by Meat Acquico Germany II GmbH under the simplified concentration procedure.
• 21 July 2026: The MCCAA, through the Office for Competition, issued a decision concerning the acquisition of sole control of RH Aero Systems by Acme BidCo, Inc. and Acme Germany BidCo GmbH, resulting in indirect sole control by fund vehicles managed or advised by affiliates of Capitol Meridian Partners LP. The concentration was assessed under the simplified procedure.

FSSA

• 3 July 2026: The FSSA extended the validity of Plant Protection Product professional-user and distributor certificates which had expired or were due to expire on or before 30 September 2026. Eligible certificates are deemed to remain valid until 1 June 2027, while holders remain subject to all applicable obligations, conditions, restrictions and safe-use requirements under the Pesticides Control Act and relevant subsidiary legislation.

IDPC

• 22 September: The EDPB adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR and the final version of its guidelines on the interplay between the Digital Services Act and the GDPR.
• 9 September: The IDPC highlighted an Advocate General opinion on retention of electronic communications data. On 3 September 2026, the CJEU issued an important opinion of the Advocate General at the Court, Maciej Szpunar.
• 4 September 2026: The IDCP highlighted a judgment of the Court of Justice of the European Union of 3 September 2026 (Case C-798/24, Jautiva) clarifying that EU law does not require information relating to all shareholders of public limited liability companies, including minority shareholders, to be made publicly available. The Court further held that EU law precludes unrestricted online disclosure of personal data relating to such shareholders where access is not subject to conditions such as demonstrating a legitimate interest.
• 27 July 2026: The IDCP drew attention to revised implementation timelines for certain provisions of the EU AI Act following Council approval. High-risk AI-system requirements originally due to apply from 2 August 2026 will now apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for high-risk AI systems embedded in products. The deadline for the establishment of AI regulatory sandboxes by competent authorities has also been postponed by one year, to 2 August 2027. Other obligations, including transparency requirements relating to AI-generated or manipulated content, remain scheduled to apply from 2 August 2026.
• 20 July 2026: The IDCP highlighted the European Data Protection Board’s call for a clear legal basis enabling information sharing between regulators with different competences, including the exchange of confidential information relevant to enforcement.
• 13 July 2026: The Office of the Information and Data Protection Commissioner highlighted a Court of Justice of the European Union ruling of 9 July 2026 (Case C-199/24, ND v Legal Newsdesk Sweden AB) clarifying that merely placing decisions concerning criminal convictions online in return for payment does not, in principle, constitute processing of personal data for “journalistic purposes” under the GDPR.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.