An appointment may be completed on a particular day. The responsibility to oversee an arranged appointment, where the relevant regulatory requirements apply, continues well beyond it.
Why the MFSA’s October update matters
On 21 October 2026, the Malta Financial Services Authority (MFSA) published its Q3 Dear CEO Letter round-up. One section addressed a thematic review of company service providers (CSPs) authorised to arrange for other persons to act as directors, company secretaries or in comparable positions.
The Authority reported weaknesses in how some providers defined these services and documented their contractual arrangements. It also identified shortcomings in assessments of the fitness and properness of individuals being arranged for, and in ongoing oversight.
Two expectations were particularly clear: providers should have mechanisms for receiving regular activity reports from arranged persons, and should assess those individuals’ available time using both qualitative and quantitative measures.
The message is relevant beyond the affected firms. Good governance is not established simply because an appointment has been documented. It is demonstrated through continuing visibility, appropriate challenge and evidence of decisions.
This article addresses the specific arranging-for-another-person service considered in the review. Acting personally as a director or secretary, arranging for another person to act, and providing company-secretarial administration are not automatically the same regulated activity. Applicable duties depend on the provider’s authorisation, service model and current rules.
1. Define the service before defining the controls
A recurring risk arises when an engagement letter describes a broad corporate-services package without distinguishing who is appointed, who arranges the appointment, who monitors performance and who is accountable for particular decisions.
A clearer engagement record should identify the actual service, its regulatory basis, the parties’ responsibilities, reporting arrangements and escalation points.
For an arranging service, a practical control record might identify the appointed person, the relevant client entity, the date and nature of the appointment, the scope of the arrangement and the person responsible for oversight within the CSP.
This does not transfer a director’s statutory duties to the CSP. Nor does it eliminate the CSP’s own obligations where it is authorised to arrange the appointment. Each responsibility needs to be identified on its own terms.
2. Assess fitness and properness with supporting evidence
The MFSA’s Company Service Providers Rulebook addresses fitness and properness assessments for persons arranged to act in relevant roles. Its Title 4 rules include due diligence, ongoing monitoring and time-commitment considerations.
A defensible assessment should be more than a tick-box declaration. Depending on the applicable requirements and circumstances, it may consider the individual’s experience, competence, reputation, conflicts, other appointments and ability to discharge the proposed responsibilities.
A practical file should make clear what information was obtained, who assessed it, any concerns identified, how those concerns were resolved and when reassessment may be needed.
The objective is not to generate the largest possible file. It is to retain enough reliable evidence to explain why the person was considered suitable for that particular role.
3. Test time commitment in two dimensions
The MFSA’s October round-up expressly refers to qualitative and quantitative assessments of the time available to arranged persons.
A quantitative assessment considers the number of appointments, expected meeting and preparation hours, recurring obligations and foreseeable peaks in workload.
A qualitative assessment asks a different question: does the individual have the experience, access to information, operational support and capacity to respond when the role becomes demanding?
For example, two appointments may require very different levels of attention if one entity is dormant while the other is active, regulated or undergoing a significant transaction.
A sensible process records the assumptions behind the assessment and revisits them when circumstances change. An initial estimate should not become a permanent substitute for evidence of actual availability.
4. Make regular reporting useful
Under the applicable arranging provisions of the MFSA CSP Rulebook, arranged persons must be requested to provide regular activity reports; the rulebook specifies that the reporting frequency should reflect the client’s activities and that reports should be prepared at least annually.
The minimum frequency should not be mistaken for a universal best-practice frequency. Material events, higher-risk activities or emerging concerns may warrant more frequent updates.
Useful reporting could cover decisions and meetings attended, material corporate developments, emerging conflicts, governance concerns, overdue actions and matters requiring escalation.
The CSP’s oversight process should then show that reports were actually considered. Merely collecting a document is weaker evidence than reviewing it, following up on exceptions and recording the outcome.
5. Separate oversight from the officer’s own judgement
An arranged director must still exercise the duties of the office, including independent judgement where required. The CSP’s oversight role should not become an informal instruction channel that undermines those responsibilities.
A sound model preserves a clear boundary:
- the officer carries out the duties of the appointment and reports relevant activities;
- the CSP oversees the arrangement to the extent required by its authorisation and the applicable rules;
- the client entity maintains its own governance, decision-making and statutory records; and
- material concerns are escalated through defined channels.
The precise responsibilities and reporting lines should be established in the engagement and governance documents, not inferred from an organisational chart.
6. Build an evidence trail that survives personnel changes
A proportionate oversight register can bring together the appointment record, due diligence and suitability assessment, time-commitment review, agreed reporting cycle, activity reports, exceptions, follow-up actions and periodic reassessment.
For each material exception, the record should show what was identified, who owned the action, when it was due and how it was resolved.
This matters when a client changes personnel, when an officer resigns or when a supervisor asks how the arrangement was monitored. A process that depends on one individual’s memory is difficult to evidence and difficult to transfer.
It also helps distinguish an actual oversight process from a collection of forms.
7. Apply the right rules to the right provider
Malta’s CSP framework was refined in 2025, including separate arrangements for Limited Company Service Providers and Restricted Company Service Providers.
The MFSA’s October 2026 thematic-review findings should not be interpreted as making every CSP category subject to identical arranging-service obligations. A provider must first establish its own authorisation or registration category, the services it may lawfully perform and the rules applicable to those services.
Where a business provides personal directorship or company-secretarial services rather than arranging for another person, the relevant personal and regulatory duties must be assessed separately.
The correct starting point is always the current MFSA framework and the actual engagement, supported by professional advice where appropriate.
A practical board and CSP review
Boards and service providers can use the MFSA’s findings to test the quality of their arrangements. Can the organisation explain who was appointed and why, whether sufficient time is available, what reports are expected, how exceptions are challenged and where the resulting evidence is retained?
If the answer depends mainly on an appointment letter or an annual declaration, the oversight model may deserve closer examination.
Benjamin Franklin’s observation, “Well done is better than well said,” is a useful reminder. In corporate governance, the difference between a policy and an effective control is what can be demonstrated in practice.
For Malta-based businesses, the October 2026 MFSA message is therefore not simply about more documentation. It is about clear roles, proportionate monitoring and evidence that oversight is genuinely taking place.
Geren Corporate supports clients with corporate governance, board support, company-secretarial coordination and regulated corporate services within the applicable authorisation scope. The aim is to keep responsibilities, records and follow-up clear and workable.
This article is for general information only and does not constitute legal, regulatory, accounting or other professional advice. Requirements differ according to the entity, CSP category, authorisation, service and applicable rules. The current regulatory instruments and individual circumstances should be reviewed before action is taken.
Primary references