GVZH Legal & Regulatory Updates - September Issue

Welcome to the third edition of our 2025 Legal & Regulatory Updates, where we bring you the latest developments designed to keep you informed and ahead in a fast-evolving landscape. In this issue, we cover:

• The EU Pay Transparency Directive and Its Implementation in Malta
• Securing a Security – Latest Amendments to the Companies Act on Share Pledges
• The Need for a Disciplinary Policy "in Black and White"
• The Role of FRIA in Responsible AI

We strive to provide content that is both relevant and practical, offering legal insight that supports sound decision-making. Your feedback is always welcome as we continue to refine and improve our publications. We hope you find this edition informative and engaging.

Yours sincerely,

GVZH Advocates

Welcome to this quarter's issue of our Legal & Compliance Bulletin, where we highlight important updates on recent legal, regulatory, and compliance matters impacting various industries. In this edition, we cover key developments that could affect your business, ensuring you remain up to date and ready to navigate changes in the legal environment.

Below is a summary of the quarter's most significant updates:

Regulatory

Malta Gaming Authority (MGA)

1. On July 1st 2025, the MGA and MFSA signed a bilateral Memorandum of Understanding (MoU) to strengthen regulatory cooperation, information sharing, and joint training, enhancing oversight across Malta's financial and gaming sectors.
2. On July 2nd 2025, the MGA publishes its Capital Requirements Policy mandating licensees to maintain a Positive Equity Position to strengthen financial stability and sustainability in the gaming sector.
3. The MGA repealed the requirement for B2C licensees to reference the EU's Online Dispute Resolution Platform in their terms and conditions as from 20 July, following its discontinuation under new EU regulations.
4. On August 29th 2025, the MGA reminds consumers to only use services from licensed operators, warning that unregulated entities lack safeguards and pose risks to players.

Malta Financial Services Authority (MFSA)

1. On July 8th 2025, the MFSA highlights procedural requirements under the Credit Servicers and Credit Purchasers Act, which transposes the EU NPL Directive to regulate NPL transfers, credit servicers, and credit purchasers while safeguarding borrowers' rights.
2. On July 21st 2025, the MFSA informs institutions of the European Banking Authority's latest update on the transition to the new XBRL-CSV supervisory reporting format.
3. The MFSA repealed Banking Rule BR/05 on the liquidity requirements of credit institutions, and Banking Rule BR/29 Annex I on exposures associated with high risk, as from 5 August 2025.
4. On August 7th 2025, the Authority issues amendments to the Investment Services Rulebooks in relation to the Money Market Funds Regulations.
5. On August 13th 2025, the Authority issued a Circular reminding market participants, especially benchmark users, of their obligations under the EU Benchmarks Regulation (BMR).
6. On September 1st 2025, MFSA issued a Circular to Investment Firms, announcing amendments to the Investment Services Act, Banking Act various Subsidiary Legislation and Investment Firms' Rules.

Office of the Information and Data Protection Commissioner (IDPC)

1. On July 7th 2025, the IDPC is currently participating in the European Blockchain Sandbox's third cohort taking place between June and November 2025, engaging in regulatory dialogues on innovative blockchain uses cases.
2. On September 12th 2025, the European Data Protection Board (EDPB) has issued its first guidelines on the interplay between the Digital Services Act and General Data Protection Regulations, clarifying how intermediary service providers should handle personal data to ensure consistent application of both laws.

Malta Communications Authority (MCA)

1. On September 1st 2025, MCA issued a report on its monitoring and findings in accordance with Article 5 of the Open Internet Regulation, concluding that all Maltese internet providers complied with EU Open Internet Regulation requirements between May 2024 and April 2025.
2. On September 23rd 2025, the MCA and MCCAA sign MoU to strengthen consumer protection in the communication sector.

Malta Medicines Authority

1. On July 21st 2025, the Malta Medicines Authority published a consensus statement from EU medical device regulators to the European Commission, outlining common priorities and challenges in implementing the EU Medical Device and In Vitro Diagnostics Regulations.
2. On August 8th 2025, the Malta Medicines Authority has initiated a precautionary Class I recall of Ozempic batch PP5N682::RN287 due to suspicions of falsification, urging users to stop use, consult their pharmacy and return affected packs.

Food Safety & Security Authority (FSSA)

1. On July 9th 2025, the Food Safety & Security Authority Act (Cap. 649) comes into force by virtue of Legal Notice 128 of 2025, providing for the establishment of the Food Safety & Security Authority responsible for overseeing food safety and supply chain security across the Maltese Islands.

Financial Intelligence Analysis Unit (FIAU)

1. On July 25th 2025, the FIAU announces the EU's 18th sanctions package against Russia – naming new individuals and entities, expanding trade and financial restrictions (including in energy and dual-use goods), and urging compliance.
2. On August 21st 2025, the FIAU released its AML/CFT Supervisory Plan for 2025 – 2026.
3. On August 27th 2025, in an article entitled 'Beyond the Fine: How AML/CFT Enforcement Is Reshaping the Financial Sector' the FIAU argues that AML/CFT enforcement is evolving beyond just fines. Through corrective directives and structured compliance oversight, it is reshaping institutions' behaviour, control frameworks, and risk cultures to promote long-term integrity.

The EU Pay Transparency Directive and Its Implementation in Malta

Read the entire article

Directive 2023/970 (the "Pay Transparency Directive"), adopted on 10 May 2023, aims to strengthen the principle of equal pay between men and women through pay transparency and enforcement measures.

Securing a Security – Latest Amendments to the Companies Act on Share Pledges

Read the entire article

Act No. XVIII of 2025 (the Companies (Amendment) Act) introduced changes to the Companies Act (Chapter 386). Some amendments are already in force under Legal Notice 174 of 2025, while others are still pending.

The Need for a Disciplinary Policy "in Black and White"

Read the entire article

Under article 75(1) of the Employment and Industrial Relations Act (CAP 452), the Industrial Tribunal has exclusive jurisdiction over unfair dismissal cases. In recent years, it has stressed the importance of workplaces having a clear, written, and consistently applied disciplinary policy accessible to all employees.

The Role of FRIA in Responsible AI

Read the entire article

From 2 August 2026, Article 27 of the EU AI Act will require a Fundamental Rights Impact Assessment (FRIA) before deploying certain high-risk AI systems.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.