CSPs

Ensuring that all regulatory compliance emanating from the respective laws and rules are adhered to. This implies having an adequate compliance structure based on the nature and size of the business which includes having all the required policies and procedures documented and in place – but that they are also monitored in practice and the setup is following up what is going on, ensuring maintenance of and reporting on compliance matters.

This is a relatively new function that has been structured into a requirement. Risk management includes having systems in place whereby the setup looks at all the inherent risks, internal and external, to the business and sets out plans and management structures to monitor, mitigate and plan for the likelihood of such risks.

Anti-Money Laundering and Countering Financing of Terrorism remain core functions of the CSP sector and through the new framework are brought further into light. CSPs must ensure they have the necessary structure in place to ensure they are not only carrying out their AML/CFT requirements but are actively risk assessing and monitoring to avoid that they may be putting themselves into use by abusers of the system. The MFSA here refers heavily to the obligations set out in the respective AML/CFT legislation (referred to as the PMLA and PMLFTR) and FIAU requirements. The FIAU has also recently published its Implementing Procedures Part II specifically for the CSP sector issuing clearer guidance as to what is required of them.