MFSA outlines supervisory expectations regarding AI use in financial services

The Malta Financial Services Authority has issued a ‘Dear CEO Letter’ outlining supervisory expectations regarding the adoption and use of Artificial Intelligence across Malta’s financial services sector.

The scope of the letter, the authority said, “is to ensure that the adoption of artificial intelligence within the financial sector develops in a manner that is consistent with sound prudential principles, effective governance, and the overarching objectives of financial regulation.”

The MFSA said that the letter reflects the regulatory landscape of the EU, which is evolving, following the introduction of the EU Artificial Intelligence Act. It also forms part of the authority’s supervisory work to ensure that the adoption of AI develops in a way that “supports financial stability, consumer protection and market integrity.”

It said that the expectations apply to MFSA-supervised licence holders across the financial services sector. The letter outlines the authority’s supervisory expectations in key areas, including: Board and senior management accountability for AI systems; Governance and oversight arrangements; Third-party dependencies and concentration risk; Model validation, monitoring and reliability; Data governance and regulatory compliance; and Operational resilience and systemic risk considerations.

The MFSA expects licence holders to recognise AI as a prudentially relevant risk area. It also expects them to ensure that AI-related risks are embedded within existing governance, risk management and internal control frameworks.

“The MFSA expects firms to adopt a forward-looking approach to AI governance, risk management and operational resilience,” Alan Decelis, Head, Supervisory ICT Risk and Cybersecurity, said in the Dear CEO Letter.

“While AI adoption among Maltese licence holders remains at an early stage, the authority expects the scale and complexity of AI use to increase significantly over the coming years.”

Self-Assessment Framework and Ongoing Supervisory Engagement

The MFSA said that it has developed a structured self-assessment framework, which aims to assist firms in “evaluating current and anticipated AI use cases, governance arrangements, third-party dependencies and control environments.”

Firms are currently not required to submit the assessment results to the authority currently, but the MFSA said that licence holders are expected to demonstrate that the assessment was performed, that the outcomes have been considered at Board and senior management level, and that identified gaps are being addressed through remedial action.

The MFSA confirmed that AI-related considerations will continue to form part of its supervisory activities, including thematic reviews and onsite inspections.

Commenting on the news, Deloitte Malta Director Sandro Psaila said that AI governance just became a supervisory expectation in Malta.

“For Malta’s financial institutions, AI is now a matter of governance, risk and prudential oversight, and the related risks cannot be ignored. The Board owns it. Firms must be ready to show, on request, that AI use cases are mapped, risks assessed, the Board engaged, and gaps closed,” he said.

He said that institutions that treat governance as the enabler of confident adoption – not the brake on it – will be the ones scaling AI with their regulator’s trust intact.