Today, the Malta Financial Services Authority (MFSA) issued a Dear CEO Letter to all licence holders outlining its supervisory expectations on Artificial Intelligence (AI) governance, risk management and prudential oversight.
📋 MFSA Observations
In its 2025 cross-sectoral review, the MFSA observed that AI adoption across Malta’s financial services sector is increasing, particularly through the use of third-party generative AI solutions. However, many licence holders are still developing the governance frameworks, risk management practices and internal expertise necessary to oversee AI effectively.
⚠️ Five key areas highlighted by the MFSA
1️⃣ Governance & Oversight
The MFSA expects AI adoption to be supported by clear governance arrangements. Boards and senior management must retain effective oversight of AI systems and remain accountable for their use, including where such systems are provided by third parties.
2️⃣ Third-Party & Concentration Risk
AI-related outsourcing should be managed in line with existing outsourcing and third-party risk management frameworks. Licence holders are expected to retain sufficient control, oversight and understanding of externally provided AI solutions.
3️⃣ Model Risk & Reliability
AI systems should be subject to appropriate validation, testing and ongoing monitoring to ensure outputs remain reliable, explainable and fit for purpose.
4️⃣ Data Governance
Robust data governance frameworks are essential to support AI use, including controls around data quality, integrity, security and regulatory compliance.
5️⃣ Systemic & Operational Risk
Licence holders are expected to adopt a forward-looking approach to AI risk, considering not only firm-level impacts but also potential system-wide implications arising from widespread AI adoption.
📌 Accountability remains with the licence holder
Importantly, the MFSA reiterates that responsibility for AI-related decisions and outcomes remains with the licence holder, even where AI capabilities are provided by third-party vendors.
📝 The Self-Assessment Questionnaire
Annex 1 of the Dear CEO Letter includes a detailed self-assessment questionnaire covering 16 areas, including AI strategy, governance, process inventory, vendor mapping, financial crime controls, data governance and board oversight.
While submission to the MFSA is not currently required, licence holders are encouraged to use the questionnaire as a gap-analysis tool and should be prepared to discuss and evidence their AI governance arrangements during supervisory engagements.
The MFSA also emphasises that AI governance arrangements should be proportionate to the nature, scale and complexity of a firm’s activities and AI use cases.
How can Fexserv help?
At Fexserv Fund Services Limited, we work closely with licensed entities and understand the challenge of translating regulatory expectations into practical action. Whether you are conducting an AI gap assessment, completing the self-assessment questionnaire, developing an AI governance framework, or embedding AI-related risks into your compliance and operational risk programmes, we can help.
Feel free to reach out to us at queries@fexservfunds.com, anabel@fexservfunds.com, naomi@fexservfunds.com to discuss how we can assist.
