Banking Act (Cap. 371), article 34

34. (1) Nothing in this Act shall authorise the Central Bank or the competent authority to enquire or cause an enquiry to be ma de in a credit institution into the affairs of any individual cust omer of a credit institution except - (a) for the purpose of ensuring compliance with any of the provisions of this or any other Act, or Cap. 204. (b) for the purpose of enabling the Central Bank to satisfy its responsibilities under the Central Bank of Malta Act, or (c) for the purpose of enabling the Central Bank or the competent authority, as the case may be, to satisfy their respective obligations arising under Malta’s international commitments. (2) No person, including past and present officers or agents of a bank, financial holding company or mixed financial holding comp any, shall disclose any information relating to the affairs of a ban k or of a customer of a bank, or relating to the affairs of a financial holding company or a mixed financial holding company, which he has acqu ired in the performance of his duties or the exercise of his functio ns under this Act or any regulations made or Banking Rules or Cond uct of Business Rules issu ed thereunder except - (a) when authorised to do so under any of the provisions of this Act or any regulations made or Banking Rules or Conduct of Business Rules issued thereunder; or BANKING [CAP. 371. 77 (b) for the purpose of the performance of his duties or the exercise of hi s functions; (c) when lawfully required to do so by any court or tribunal or under a provision of any law; (d) for the purpose of enabling the Central Bank or the competent authority, as the case may be, to satisfy their respective obligations arising under Malta’s international commitments; or (e) when the customer expressly consents, in writing, to the disclosure of information relating to his affairs, to the extent authorised by the customer. Cap. 373. (3) Where an officer of a credit institution has reason to belie ve that a transaction or a proposed transaction could involve mone y laundering or the funding of terrorism, he shall act in complia nce with the reporting and other obligations set out in the regulat ions made under article 12 of the Prevention of Money Laundering Act , and any procedures and guidan ce issued thereunder, and such disclosure shall not constitute a breach o f confidentiality. Cap. 9. (4) Officers of the competent authority and of the Central Bank, including past and present officers, as well as auditors or experts acting on behalf of the competent authority or the Cent ral Bank, shall be governed by the obligation of professional secre cy and shall not disclose information obtained in the course of ca rrying out supervisory and other duties unless such disclosure of information be done in summary or collective form, such that individual credit institutions cannot be identified, without pr ejudice to the provisions of the Criminal Code : Provided that the said officers, auditors or experts may divulg e such information for the purpose of the performance of their du ties, or the exercise of their functions, only in summary and collective form as specified in sub-article (4), or when lawfully required to do s o, by any court or under a provision of any law: Provided further that where a credit institution has been declared bankrupt or is being compulsorily wound up, confidenti al information which does not concern third parties involved in attempts to rescue that credit institution may be disclosed in civil or commercial proceedings. (5) The provisions of sub-article (4) shall not prevent the competent authority from exchanging information with overseas regulatory authorities in other Member States and authorities in other Member States responsible for the supervision of credit institu tions and investment firms or trans mitting information to the ESRB, t he EBA or the European Securities and Markets Authority establishe d by Regulation (EU) No. 1095/2010, i n accordance with the Act and a ny regulations made and Banking Rules issued thereunder transposin g the CRD, with any binding legal instruments issued under the CRD, with the CRR , with Regulation (EU) 2019/2033 , with Article 15 of Regulation (EU) No. 1092/2010 , with Articles 31, 35 and 36 of Regulation (EU) No. 1093/2010 and with Articles 31 and 36 of 78 CAP. 371.] BANKING Regulation (EU) No.1095/2010 , with Directive (EU) 2019/2034 and with other Directives applicable to credit institutions. Such information shall be subject to the provisions of sub-article ( 4): S.L. 371.16. Provided that the provisions of sub-article (4) shall not preve nt the competent authority from publishing the outcome of stress t ests carried out in accordance with the Banking Act (Supervisory Review) Regulations or Article 32 of Regulation (EU) No. 1093/ 2010 or from transmitting the outcome of the stress tests to the EB A for the purpose of publication by the EBA of the results of Uni on-wide stress tests. S.L. 371.16 Provided that the provisions of sub-article (4) shall not prevent the competent authority from publishing the outcome of stress tests carried out in accordance with the Banking Act (Supervisory Review) Regulations or Article 32 of Regulation (EU) No. 1093/2010 or from transmitting the outcome of the stress tests to the EBA for the purpose of the publication by the EBA of the results of Union-wide stress tests. Substituted by: XXXI. 2017.72. Cap. 377. Cap. 9. (6) Notwithstanding the provisions of the Professional Secrecy Act and of article 257 of the Criminal Code , a credit institution may, where necessary for the pro per carrying out of its activit ies or for the fulfilment of its obligations, communicate any informat ion which is in its possession and which is related to the affairs of a customer or of a con nected person to: Cap. 331. Cap. 370. Cap. 376. Cap. 403. (a) other members of the group of companies of which that credit institution forms part, which carry out any activities licensed or authorised by the competent authority under this Act, the Trusts and Trustees Act , the Investment Services Act , the Financial Institutions Act or the Insurance Business Act , or which otherwise carry out activities equivalent to those activities mentioned in this paragraph, and which are authorised by an overseas authority in a recognised jurisdiction, as well as the credit institution’s holding company or financial holding company or mixed financial holding company or mixed activity holding company, where this is necessary for the proper ca rrying out of its activities or for the fulfilment of its obliga tions or for the carrying out of risk management , audit or compliance processes of the credit institution or of the group of companies of which it forms part; or (b) any auditor or expert engaged by the credit institution to carry out a compliance assessment, monitoring, auditing or a similar review in relation to any of the activities or risk management, audit or compliance processes of the credit institution or of the group of companies of which it forms part or in order to assess the credit institution’s compliance with any statutory obligations relating to the prevention of money laundering and the funding of terrorism; (c) an outsourcing service provider in whose favour a credit institution has outsourced any of its activities. BANKING [CAP. 371. 79 This shall be without pre judice to article 19A: Provided that, for the purposes of this sub-article, any such communication of information shall be made subject to all proper controls and safeguards, so that it shall be the responsibility of the credit institution to ensure that the group company member, the auditor or expert, or the outsourcing service provider, as the case may be, is subject to equivalent obligations of data protection, confidentiality and care as required under Maltese law and any European Union law, including the GDPR: Provided further that for the purpose of this article, advertising, marketing or promotion, shall not, under any circumstances, be considered as necessary for the proper carrying out of the activities of a credit institution or for the fulfilment of its obligations: S.L. 373.01. Provided further that communication of information made in terms of paragraphs ( a) to ( c) shall be without prejudice to any provision of the Prevention of Money Laundering and Funding o f Terrorism Regulations . (7) Where the competent aut hority receives confidential information under sub-articles (4) and (5), it shall use such information only in the course of its duties and only for any of the following purposes - (a) to check that the conditi ons governing access to the activity of credit institutions are met and to facilitate monitoring, on a non-consolidated or consolidated basis, of the conduct of such activity, especially with regard to the monitoring of liquidity, solvency, large exposures and administrative and accounting procedures and internal control mechanisms; (b) to impose penalties; Cap. 330. (c) in an appeal against a decision of the competent authority pursuant to article 10 and in any court proceedings before the Court of Appeal in terms of article 21(14) of the Malta Financial Services Authority Act; (d) in court proceedings ini tiated pursuant to special provisions provided for in European Union law adopted in the field of credit institutions. (8) The competent authority, when processing personal data for the purposes of this Act and any regulations and, or Banking Ru les and, or Conduct of Business Rules issued thereunder, shall do s o in accordance with any applicable l egislation on data protection. (9) The provisions of article 25( 2) and sub-articles (4), (5) an d (7) of this article shall be without prejudice to the powers of investigation conferred on the European Parliament pursuant to Article 226 of the Treaty on the Functioning of the European Union. 80 CAP. 371.] BANKING Data protection. Added by: XXVI.2019.17.