A. Body corporate or body of persons

i. The beneficial owner is the natural person/s who ultimately own/owns or control/controls that body corporate or body of persons through the direct or indirect ownership of a sufficient percentage of shares, voting rights or ownership interest.

Direct ownership or control of the body corporate or body of persons means:

• direct ownership of 25% plus one (1) or more of the shares (including bearer shares);
• direct ownership of more than 25% of the voting rights; or
• a direct holding of an ownership interest of more than 25%.
• Indirect ownership or control of the body corporate or body of persons means:
  • indirect ownership of 25% plus one (1) or more of the shares (including bearer shares); 
  • or indirect ownership of more than 25% of the voting rights; or
• an indirect holding of an ownership interest of more than 25%.

ii. A natural person(s) who exercise(s) control via other means. Examples of such cases include:

a. persons who are granted rights through formal arrangements (such as shareholders’ agreements or through rights attached to shares) by means of which that person(s) can exert dominant influence or veto the decision-making of that legal person (e.g., having absolute discretion or veto rights over the entity’s business plan, borrowing options or business model);

b. individuals who, though not being owners of a sufficient percentage of shares or voting rights (i.e., less than the 25% threshold explained previously), collectively exceed the 25% threshold and are subject to an arrangement to exercise their rights collectively in the same way;

c. individuals who hold the right to directly or indirectly appoint or remove the majority of the board of directors (or administration) of an entity, or to appoint or remove the CEO of that entity; and

d. individuals who through family connections exert influence over the decision-making body of that entity (e.g., a family business in which a family member, even though not being formally involved in that entity, is routinely referred to for direction about company decisions).

iii. The natural person(s) holding the position of senior managing official(s) – if, after having exhausted all possible means, no beneficial owner as defined under paragraphs (i) and (ii) above is identified.

The definition of “senior managing official(s)” will depend on the type of body corporate or body of persons. However, it is to capture those individual(s):

i. who are responsible for taking strategic decisions that fundamentally affect the business operations or general direction of that entity; and

ii. who exercises executive control over the daily or regular affairs of the entity through a senior management position.

Paragraph (ii) above would typically include individuals who have executive functions or are otherwise responsible for the management of the entity such as executive directors, chief executive officers and chief financial officers. Directors who do not have any executive function would fall under paragraph (i) above.

B. Trusts

The following are considered to be beneficial owners:

i. Settlor;

ii. Trustee(s);

iii. Protector (where applicable);

iv. Beneficiaries, or where the individuals benefiting from the trust have yet to be determined, the class of persons in whose main interest the trust is set up or operates; and

v. any other natural person exercising ultimate control over the trust by means of direct or indirect ownership or by other means.

C. Other types of legal entities (such as foundation) or legal arrangements similar to a trust, which administers and distribute funds.

Natural person(s) holding equivalent or similar positions to those referred to in (b) above.

In the case of a foundation or an association, the following as beneficial owners:

a. the founder;
b. the administrator or administrators;
c. the guardian, protector or members of the supervisory council, where applicable;
d. the beneficiaries or the class of beneficiaries, as may be applicable; and
e. any other natural person exercising ultimate control over the foundation by means of direct or indirect ownership, or by any other means.

“Politically Exposed Persons” means natural persons who are or have been entrusted with prominent public functions in or outside Malta, other than middle ranking or more junior officials. For the purposes of this definition the term "natural persons who are or have been entrusted with prominent public functions" means:

a) Heads of State, Heads of Government, Ministers, Deputy or Assistant Ministers, and Parliamentary Secretaries

b) Members of Parliament or similar legislative bodies;

c) Members of the governing bodies of political parties;

d) Members of superior, supreme, and constitutional courts or of other high-level judicial bodies whose decisions are not subject to further appeal, except in exceptional circumstances;

e) Members of courts of auditors or of the boards of central banks;

f) Ambassadors, charges d’affaires and high-ranking officers in the armed forces; and

g) Members of the administrative, management or supervisory boards of State-owned enterprises.

Anyone exercising a function equivalent to those set out in paragraphs (a) to (f) within an institution of the European Union or any other international body.

The definition of PEP also extends to the PEP's family members or persons known to be close associates of the PEP.

With respect to the term ‘family members’ of PEPs, it includes:

a) the spouse, or any person considered to be the equivalent to a spouse.

b) the children and their spouses, or persons considered to be the equivalent to a spouse; and

c) the parents.

The above list of “family members” is not an exhaustive list and thus other family relationships in specific circumstances may be considered to be similar to those under the indicative list above.

With respect to the term ‘persons known to be close associates’; this means:

a) a natural person known to have:

i. joint beneficial ownership of a body corporate or any other form of legal arrangement; or

ii. (ii) any other close business relations with that PEP.

b) a natural person who has sole beneficial ownership of a body corporate or any other form of legal arrangement that is known to have been established for the benefit of that PEP.

A. Verification and certification by Deloitte representatives

In situations where the beneficial owner is met face to face by a representative of Deloitte, then verification and certification must be carried out by such Deloitte representative.

B. Verification and certification by a third party

In the event that the beneficial owner is not met face to face by a Deloitte representative, then verification and certification must be carried out by one of the following:

• a legal professional
• an accountancy professional
• a notary
• a person undertaking Relevant Financial Business (please refer to Appendix D for definition), or a person undertaking an activity equivalent to Relevant Financial Business carried out in another jurisdiction.

All identification documentation is to be certified as a true copy of the original document, and the certification MUST state the following:

• That the document is a true copy of the original document
• That the document has been seen and verified by the certifier
• That the photo is a true likeness of the individual

In addition, the certifier must:

• sign and date the document,
• indicate their name and surname clearly beneath their signature.
• indicate their profession, designation or capacity, and
• provide their contact details including their full address.

“Relevant Financial Business” means:

a. any business of banking carried on by a person or institution who is for the time being licensed, or required to be licensed, under the provisions of the Banking Act;

b. any activity of a financial institution carried on by a person or institution who is for the time being licensed, or required to be licensed, under the provisions of the Financial Institutions Act;

c. any long-term insurance business other than business of reinsurance carried on by a person or institution who is for the time being authorised, or required to be authorised, under the provisions of the Insurance Business Act;

d. any insurance intermediary activities carried out by an insurance intermediary or by a tied insurance intermediary related to long-term insurance business which person or institution is enrolled or required to be enrolled under the provisions of the Insurance Distribution Act, other than a natural person who is registered or enrolled and acts on behalf of a tied insurance intermediary or a person or institution enrolled as a tied insurance intermediary that does not collect premiums, or other amounts intended for the policyholder or the beneficiary;

e. any long term insurance business other than business of reinsurance carried on by a person in accordance with the Insurance Business (Captive Insurance Undertakings and Captive Reinsurance Undertakings) Regulations, by a cell company in accordance with the provisions of the Companies Act (Cell Companies Carrying on Business of Insurance) Regulations or by an incorporated cell company and an incorporated cell in accordance with the provisions of the Companies Act (Incorporated Cell Companies Carrying on Business of Insurance) Regulations;

f. investment services carried on by a person or institution licensed or required to be licensed under the provisions of the Investment Services Act;

g. administration services to collective investment schemes provided by a person or institution recognised or required to be recognised under the provisions of the Investment Services Act other than administration services provided by recognised incorporated cell companies in accordance with the Companies Act (Recognised Incorporated Cell Companies) Regulations;

h. a collective investment scheme marketing its units or shares, licensed, recognised or notified, or required to be licensed, recognised or notified, under the provisions of the Investment Services Act;

i. any activity other than that of a retirement scheme or a retirement fund, carried on in relation to a retirement scheme, by a person or institution licensed or required to be licensed under the provisions of the Retirement Pensions Act and for the purpose of this paragraph, ''retirement scheme'' and ''retirement fund'' shall have the same meaning as is assigned to them in the Retirement Pension Act;

j. any activity of a regulated market and that of a central securities depository authorised or required to be authorised under the provisions of the Financial Markets Act;

k. safe custody services provided by any person or institution not already covered under the above;

l. any activity of a VFA agent carried out by a person or institution registered or required to be registered under the provisions of the Virtual Financial Assets Act;

m. VFA services carried out by a person or institution licensed or required to be licensed under the provisions of the Virtual Financial Assets Act;

n. the issue of virtual financial assets for offer to the public in or from Malta in terms of the Virtual Financial Assets Act; and

o. any activity under paragraphs (a) to (n) carried out by branches established in Malta and whose head offices are situated outside Malta.

This privacy statement applies to Deloitte Malta and its related entities, being members of Deloitte Central Mediterranean S.r.l., and having their registered office address at Deloitte Place, Triq L-Intornjatur, Central Business District, CBD 3050 Malta (“Deloitte”, “we”, “us” or “our”).

We are committed to protecting your privacy and handling your information in an open and transparent manner.

In this privacy statement, your information is called “personal data”. We may also sometimes collectively refer to handling, collecting, protecting and storing your personal information as “processing” such personal information.

Purposes of your data processing (the “Purposes”)

We may process your personal data for any of the following purposes:

• compliance with the applicable legal, regulatory or professional requirements (including, in particular, anti-money laundering requirements);
• addressing requests and communications from competent authorities;
• internal compliance and risk analysis; and
• protecting our rights and legitimate interests;

Legal basis for your data processing:

We only process your personal data when the processing is necessary in terms of the following circumstances:

• to administer the contract, we have with you personally or to take steps to enter into the contract with you;
• for compliance with a legal obligation we are subject to; and
• for the purposes of our legitimate interest which might be:
  • to operate our business effectively and lawfully;
  • to protect our business interests (including to conduct our risk and quality assessments); and
  • to ensure that the complaints or requests delivered to us are properly addressed.

Sharing and transferring your personal data

In connection with one or more of the purposes outlined above, we may disclose details about you to:

• other members of the Deloitte Network;
• third parties that provide services to us and/or the Deloitte Network; or
• competent authorities (including courts and authorities regulating us or another member of the Deloitte Network) other entities within the Deloitte Network and other third parties as part of a corporate transaction such as a sale, divestiture, reorganisation, merger or acquisition.

Please note that some of the recipients of your personal data referenced above may be based in countries outside of the European Economic Area whose laws may not provide the same level of data protection. In such cases, we will ensure that there are adequate safeguards in place to protect your personal data, as required by the Data Protection Legislation.

In all cases, we may need to disclose your personal data if required to do so by law, a regulator or during legal proceedings.

Protection of your personal information

We use a range of physical, electronic and managerial measures to ensure that we keep your personal data secure, accurate and up to date. These measures include:

• Education and training to relevant staff to ensure they are aware of our privacy obligations when handling personal data
• Administrative and technical controls to restrict access to personal data on a ‘need to know’ basis
• Technological security measures, including fire walls, encryption and anti-virus software
• Physical security measures, such as staff security passes to access our premises.

Retention of your personal data

Your personal data, provided to us in terms of the Corporate Entity Form, shall be retained by us for a period of five (5) years from the date on which the business relationship is terminated or the occasional transaction is carried out or as required by the applicable laws or relevant regulations or for Deloitte legitimate interest.

Your rights

As a data subject, you enjoy various rights to access, control, and request information relating to, your personal data.

In practice, this means that there are a multitude of ways how you can exercise your data rights, and we are committed towards ensuring that we comply quickly and effectively whenever you would like to exercise your data subject rights.

You are fully entitled to:

• Ask to see what information we hold about you;
• Ask what we do with the information we hold about you;
• Ask us to delete the data we hold about you;
  Ask us to stop processing the data we hold about you;
• Ask us to amend data about you which you believe is inaccurate;
• Ask us to transfer your data to a third party; and
• Ask us to restrict or limit what we do with your data.

In order to exercise any of your personal data rights, you may contact us through the following channels:

Email: dataprotectionofficer@deloitte.com.mt
Phone: (+356) 2328 7100
Post:   Data Protection Officer
            Deloitte Malta,
            Deloitte Place,
            Triq L-Intornjatur,
            Central Business District,
            CBD 3050,
            Malta

Your data subject rights may be limited in circumstances where, in order to comply with your request, we would need to unduly expose personal data about someone else, or where the data you ask us to delete or amend is required for us to perform our contractual obligations towards you, or if we require such data to comply with our legal obligations.