By Francesco Guarascio
BRUSSELS (Reuters) - Malta's biggest bank failed for years to detect or address risks involving thousands of payments, the European Central Bank (ECB) said, detailing "severe shortcomings" that could have allowed money laundering or other criminal activities.
A confidential ECB report seen by Reuters said Bank of Valletta (BoV) (MT:BOV) had not dealt with a litany of risk management failings despite repeated warnings from the Frankfurt-based regulator stretching back to 2015.
The report -- adopted by the ECB in the summer after an inspection late last year -- calls for remedial measures, including assessing if BoV's top managers are fit for their jobs and reducing exposure to risks posed by foreign clients by the end of this year.
BoV said it was strengthening its risk controls, governance structure and anti-financial crime defenses and said customers who operated in the gaming industry, a key business in Malta, were most at risk of being hit by remedial measures.
"The Bank is today engaged in a priority process - agreed with, and monitored by, its regulators - to deal with the legacy issues highlighted by the report," BoV said in an email on Wednesday.
BoV is the main financial pillar of the Maltese economy, whose growth has been fueled by attracting offshore gambling, financial and ship registration industries under the centre-left government of Prime Minister Joseph Muscat.
The Mediterranean island, the euro zone's smallest state, already faces questions over its ability to combat crime two years after journalist Daphne Caruana Galizia, who had reported on government corruption, died in a car bombing.
The 47-page ECB report highlights the vulnerability to suspicious transactions of the euro zone's financial system, which has already been rocked by widely-reported money laundering scandals at some of its top banks.
A spokeswoman for the ECB declined to comment on Tuesday.
However, the ECB lacks power over anti-money laundering lapses, apart from the extreme measure of revoking a bank's license.
Malta's police, whose chief is appointed by the government, declined to say whether they were investigating BoV, while a spokesman for Muscat said the prime minister trusted the bank.
A senior ECB official said BoV had shown "a change of attitude" with its new "de-risking" plan launched in May, but warned that Frankfurt would consider restricting BoV's services to foreign clients and gaming companies if it again failed to shape up. It could deploy such measures as part of its remit to protect financial stability.
Italy's UniCredit (MI:CRDI), which owns 10% of BoV, declined to comment, adding that its stake was "non-strategic".
Although BoV is financially solid as most of its revenues come from local mortgages and deposits, it was exposed to disproportionate risks from its foreign clients, the ECB official said.
FOREIGN CAPITAL
With a population of only 420,000, Malta has sought to attract foreign capital with schemes such as a cash for passport program, although the EU has repeatedly warned of the risks of this attracting the proceeds of criminal activities.
Despite these warnings, the ECB report said that when foreign nationals seeking to buy passports under the scheme opened an account at BoV, the bank registered them as Maltese citizens, which reduced their risk profile.
The report said BoV's earlier de-risking strategy in 2018 had focused mainly on maintaining accounts and more than 13,000 suspicious payments, some dating back to February 2014, were still waiting to be assessed.
Meanwhile the number of high-risk foreign customers had actually risen and in many cases BoV had no information about the origins of their wealth.
The ECB said BoV had no unit to identify bribery and corruption among international clients and did not keep a record of those who had payments blocked due to money laundering risks.
BoV declined to comment on specifics of its risk management systems or any customers named in the ECB report saying its dealings with regulators and clients were confidential.
ECB investigators identified a lack of checks over accounts held by Malta's Pilatus Bank, which was shut last year after its Iranian owner Ali Sadr Hashemi Nejad was arrested in the United States on money-laundering and sanctions violation charges.
Despite warnings, BoV kept scant details about the source of wealth of Pilatus' directors and no documentation was provided when Ali Sadr opened an account in 2014, the report said.
Pilatus did not answer to repeated calls. A lawyer for Ali Sadr did not reply to questions.
In another case, BoV allowed CenturionBet, a gambling company which the ECB said had its license withdrawn in Britain in 2009, to continue transferring money even though its license had also been revoked by Maltese authorities in 2017.
CenturionBet did not reply to Reuters questions.