MFSA puts AI governance on the regulatory radar for financial services firms

The Malta Financial Services Authority has placed AI governance firmly on the supervisory agenda, issuing a Dear CEO Letter that sets out binding expectations for how financial services firms manage artificial intelligence risks.

The directive applies to all MFSA-supervised licence holders and signals a regulatory shift as the EU Artificial Intelligence Act takes shape.

The MFSA acknowledged that AI adoption among Maltese firms is still at an early stage, but warned that the scale and complexity of AI use is expected to increase significantly in the coming years.

The Authority made clear that the use of AI does not change the fundamental objectives of financial regulation: consumer protection, financial stability and market integrity.

The expectations cover several critical areas. Boards and senior management are now explicitly accountable for AI systems. Firms must establish governance and oversight arrangements, manage third-party dependencies and concentration risk, and ensure model validation, monitoring and reliability.

Data governance and regulatory compliance, as well as operational resilience and systemic risk, are also in scope.

Alan Decelis, Head of Supervisory ICT Risk and Cybersecurity at the MFSA, said: "The MFSA expects firms to adopt a forward-looking approach to AI governance, risk management and operational resilience."

To help firms comply, the MFSA has developed a structured self-assessment framework covering current and anticipated AI use cases, governance arrangements, third-party dependencies and control environments.

Firms are not required to submit the results yet, but must demonstrate that the assessment was performed, that outcomes were considered at board and senior management level, and that any identified gaps are being addressed.

The Authority confirmed that AI-related considerations will feature in ongoing supervisory activities, including thematic reviews and onsite inspections.

Particular focus will be placed on governance frameworks, outsourcing arrangements, the use of AI in customer-impacting processes, and alignment between AI adoption and firms’ risk appetite.

The MFSA also announced targeted AI training and capacity-building initiatives through the Financial Supervisors Academy to help firms strengthen internal expertise and oversight capabilities.

For Malta's financial services sector, the letter represents a clear regulatory marker. Firms that are already experimenting with AI or planning to do so must now embed AI risk into their existing governance and risk management frameworks.

The self-assessment exercise, while voluntary for now, is likely to become a baseline for supervisory scrutiny. Boards that treat AI governance as a tick-box exercise risk falling foul of the MFSA's expectations.