S.L. 370.40 Art. 6Publication of decisions. 6 [ 7

(1) The competent authority shall publish any decision imposing an administrative penalty or measure which it shall take under these regulations on its official website, without undue delay after the person on whom the penalty or measure was imposed has been informed of that decision. The publication shall include at least information on the type and nature of the infringement and the identity of the persons responsible:

Provided that this obligation shall not apply to decisions imposing measures that are of an investigatory nature. S.L.370.40 MEASURES AND INVESTIGATORY POWERS)

(2) Notwithstanding sub-regulation (1), where the publication of the identity of the legal persons or of the personal data of the natural persons is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where publication jeopardises the stability of financial markets or an on-going investigation, the competent authority shall either:

(a) defer the publication of the decision to impose the administrative penalty or measure until the moment where the reasons for non- publication cease to exist;

(b) publish the decision to impose the administrative penalty or measure on an anonymous basis in a manner which complies with Maltese law, if such anonymous publication ensures an effective protection of the personal data concerned; or

(c) not publish the decision to impose an administrative penalty or measure at all in the event that the options set out in points (a) and (b) are considered to be insufficient to ensure:

(i) that the stability of financial markets would not be put in jeopardy;

(ii) the proportionality of the publication of such decisions with regard to administrative penalties or measures which are deemed to be of a minor nature.

(3) In the case of a decision to publish an administrative penalty or measure on an anonymous basis in accordance with sub-regulation (2), the publication of the relevant data may be postponed for a reasonable period of time if it is envisaged that within that period the reasons for anonymous publication shall cease to exist.

(4) Where the decision to impose an administrative penalty or measure is subject to appeal in terms of regulation 8, the competent authority shall also publish, immediately, on its official website such information and any subsequent information on the outcome of such appeal. Moreover, any decision annulling a previous decision to impose an administrative penalty or a measure shall also be published.

(5) The competent authority shall ensure that any publication in accordance with this regulation shall remain on its official website for a period of at least five years after its publication:

Provided that personal data contained in the publication shall only be kept on the official website of the competent authority for the period which is necessary in accordance with the applicable data S.L.370.40 MEASURES AND INVESTIGATORY POWERS) [ protection laws.

(6) This regulation shall be without prejudice to article 16(8) of the Malta Financial Services Authority Act.

(7) The competent authority shall inform ESMA of all administrative penalties imposed but not published in accordance with point (c) of sub-regulation (2) including any appeal in relation thereto and the outcome thereof.

(8) The competent authority shall provide ESMA annually with aggregated information regarding all sanctions and measures imposed in accordance with sub-regulations (1) to (4):

Provided that this obligation does not apply to measures of an investigatory nature.

(9) Where the competent authority has disclosed an administrative measure, penalty or criminal sanction to the public, it shall, at the same time, report that fact to ESMA.