FIAU Compliance Review Checklist Malta
An FIAU compliance review checklist Malta businesses can rely on is not a generic AML document pulled from a policy folder. It is a working assessment of whether your procedures, records, governance and day-to-day controls would stand up to scrutiny if the Financial Intelligence Analysis Unit were to review your business tomorrow.
For subject persons in Malta, that distinction matters. Many firms have policies in place, but the real test is whether those policies are current, properly implemented and reflected in evidence. A compliance review usually exposes the gap between what a business says it does and what it can actually demonstrate.
What an FIAU compliance review is really testing
An FIAU review is not limited to whether you have adopted AML/CFT paperwork. It looks at whether your business has identified its risks correctly, applied proportionate controls and kept sufficient records to prove compliance. In practice, the review often moves between governance, customer files, transaction monitoring, internal reporting and staff awareness.
That means the checklist should do more than confirm the existence of documents. It should test effectiveness. A beautifully drafted business risk assessment will carry limited value if customer files show inconsistent source of funds checks, outdated identification records or weak ongoing monitoring.
For some sectors, particularly gaming, financial services, virtual financial assets and corporate services, the expectation is naturally higher. Higher-risk businesses are expected to show greater depth, stronger escalation procedures and more frequent review cycles. For lower-risk operators, the standard is still serious, but proportionality may affect how controls are documented and applied.
FIAU compliance review checklist Malta businesses should use
The strongest starting point is governance. An FIAU reviewer will usually want to understand who is responsible for compliance, whether reporting lines are clear and whether AML/CFT oversight reaches senior management level. If the MLRO, compliance officer and directors are not aligned on responsibilities, weaknesses often appear elsewhere.
Governance and responsibility
Check whether the board or management body has formally approved your AML/CFT framework and whether that approval is recorded. Confirm that the MLRO appointment is properly documented, that the role is supported by adequate authority and resources, and that deputies or backup arrangements exist where appropriate. It is also worth reviewing whether management information on AML issues is actually being reported upwards in a useful format, rather than as a routine exercise.
Where firms struggle is not always in naming a responsible person, but in proving effective oversight. Minutes, reporting packs, escalation logs and remediation tracking often tell the real story.
Business risk assessment
Your business risk assessment should reflect the actual nature of your operations in Malta. It should account for customer types, services, delivery channels, jurisdictions, transaction patterns and any sector-specific exposure. A generic template with minimal tailoring is rarely enough.
Review whether the assessment is current, whether it reflects changes in products or client base and whether the conclusions feed into your customer due diligence measures. If your risk assessment identifies elevated exposure to non-face-to-face onboarding or complex structures, your procedures should clearly show how those risks are mitigated.
This is one of the most common pressure points in a compliance review. The FIAU will look for consistency between the business-wide risk view and what actually happens at file level.
Policies, controls and procedures
Your internal policies should cover customer acceptance, risk classification, due diligence, enhanced due diligence, ongoing monitoring, suspicious transaction reporting, record keeping, sanctions screening, staff training and reliance or outsourcing arrangements where relevant. The issue is not volume. It is clarity, accuracy and usability.
A practical review asks whether staff can follow the procedure in real situations. If the policy says senior management approval is required for higher-risk customers, can you show where that happened? If the policy requires periodic reviews by risk rating, are those reviews being completed on time?
Controls should also be aligned with Malta-specific requirements and current FIAU expectations. Businesses operating across borders often have group policies, but local adaptation is critical.
Customer due diligence under an FIAU compliance review checklist Malta firms cannot ignore
Customer due diligence remains central because it reveals how compliance operates in practice. A reviewer will usually sample files and test whether the customer profile, risk rating and supporting evidence make sense together.
Identification and verification
Check whether identification records are complete, legible and valid. For legal entities, confirm that registration documents, ownership details, constitutional records and evidence of authorised signatories are properly retained. For natural persons, ensure identification documents are current and verification is clearly evidenced.
The file should also show why the customer relationship was accepted. That includes understanding the purpose and intended nature of the business relationship, not merely collecting IDs.
Beneficial ownership and control
For companies, trusts and more complex structures, beneficial ownership analysis should go beyond box-ticking. Review whether the beneficial owners have been identified correctly, whether control has been analysed where ownership is not straightforward and whether discrepancies or unusual structures have been escalated.
In Malta, this area deserves close attention, particularly for businesses serving international clients or layered structures. Where ownership chains are complex, the supporting rationale should be easy to follow from the file.
Source of wealth and source of funds
These are often confused and often under-evidenced. Your review should test whether the business is collecting source of wealth and source of funds information when required, whether the evidence is proportionate to the risk and whether staff are documenting their assessment rather than simply filing documents.
For higher-risk clients, enhanced due diligence should be visible and reasoned. A brief note stating that funds appear legitimate is unlikely to be persuasive if the underlying evidence is thin.
Ongoing monitoring and file reviews
A customer file is not compliant just because onboarding was completed properly. Review whether periodic reviews are conducted in line with the assigned risk rating, whether trigger events are identified and whether transaction activity is assessed against the customer profile.
If a client’s activity has changed materially, the file should show how and when the business responded. Delayed refreshes, static risk ratings and weak review notes can create avoidable exposure.
Transaction monitoring, reporting and record keeping
Transaction monitoring should reflect the nature of the business. Some firms need automated systems; others may apply manual controls, but the method must be credible and proportionate. The key question is whether unusual activity would actually be identified and escalated.
Review alert handling, internal reporting channels and decision-making around suspicious transaction reports. Even where no external report was filed, the rationale for that decision should be documented if concerns were considered internally. Inadequate internal records can make defensible decisions look careless.
Record keeping is equally important. Customer due diligence records, transaction data, internal reports, training logs and compliance review evidence should be retained in an organised and accessible way. If records cannot be produced promptly, that alone can become a problem.
Training, testing and remediation
Training should be role-specific, current and recorded. General annual training may not be enough for higher-risk functions such as onboarding, payments, customer relationship management or compliance decision-making. Staff should understand not only the rules, but the warning signs relevant to your business model.
Independent testing or internal quality assurance is often where firms gain the clearest picture of their real exposure. A proper review does not stop at identifying gaps. It should assign remedial actions, owners and deadlines, with evidence that issues have been followed through.
This is where a compliance review becomes commercially useful. The aim is not only to prepare for potential regulatory engagement, but to reduce operational risk before it turns into enforcement risk.
Common weaknesses that turn up in Malta
Across sectors, certain themes appear repeatedly. Policies are sometimes too generic, customer risk ratings are inconsistent, beneficial ownership analysis is superficial, and ongoing monitoring is treated as an administrative cycle rather than a risk exercise. Firms may also have training records without enough evidence that staff can apply what they were taught.
Another recurring issue is overreliance on onboarding. Businesses invest time in accepting clients, then allow files to go stale. That creates a mismatch between historical records and present-day risk.
For international groups operating in Malta, local governance can also be overlooked. Group standards may be sound, but if local reporting, documentation and decision-making are unclear, the business may still fall short of expectations.
When a checklist is not enough
A checklist is valuable because it creates structure, but it does not replace judgement. The right level of review depends on your sector, customer base, geographic exposure and transaction profile. A small firm with limited domestic exposure will not be reviewed in the same way as a cross-border operator handling higher-risk structures or regulated activity.
That is why an effective compliance review combines document testing, file sampling and challenge. It asks not just whether a process exists, but whether it works under pressure. For many businesses, that outside challenge is where the real value lies.
At Cuschieri Advocates, we often see that the businesses best placed for regulatory scrutiny are not necessarily those with the thickest manuals. They are the ones that can explain their risk, evidence their decisions and correct weaknesses early.
A good compliance review should leave you with more than comfort. It should leave you with a clearer view of where your AML/CFT framework is sound, where it needs attention and what should be fixed first while the issue is still manageable.
