Skip to main content
Borg Galea & Associates

Tax Audit Malta: Prepare Before the CFR Calls — or Respond With Confidence When They Do

The CFR is auditing more companies each year, and the transfer pricing rules effective January 2024 have widened the scope. Whether you have received an audit notification or want a compliance review before one arrives, our tax practitioners have handled 20+ years of CFR examinations — we know what they look for and how to protect your position.

  • Qualified tax practitioners with 20+ years handling CFR audits
  • Proactive compliance reviews that catch issues before the CFR does
  • Transfer pricing documentation under S.L. 123.207 (effective 2024)
  • Full audit representation — from initial notification through to resolution

Representing Malta businesses in CFR audits and compliance matters since 2004.

Get a Compliance Health Check

Free consultation. No obligations.

Established

CFR Expertise

6/7

Refund System Expertise

Proven

Track Record

CPA

Warranted Practitioners

Your Contacts

Andrew Fenech

Andrew Fenech

Business Development Manager

Adrian Pavia Dimech

Adrian Pavia Dimech

Audit Principal

Tatiana Muscat

Tatiana Muscat

Audit Manager

Warranted by the Malta Accountancy Board

ACCA & MIA Certified Professionals

Corporate Member of FinanceMalta, MIT & IFSP

Fully GDPR & AMLD-Compliant

What a CFR Tax Audit Covers — and Why It Matters More Than You Think

A tax audit in Malta is a formal examination by the Commissioner for Revenue (CFR) of your tax returns, financial records and supporting documentation. The purpose is to verify that your company has complied with Malta’s tax laws — primarily the Income Tax Act (Cap. 123), the Income Tax Management Act (Cap. 372) and the VAT Act (Cap. 406).

The CFR has broad powers under Articles 13 and 14 of the ITMA. Article 13 allows the Commissioner to require any information needed for audit purposes. Article 14 grants powers of entry and search — meaning the CFR can physically inspect your premises and records.

Tax audits in Malta take several forms. Desk audits are conducted at the CFR’s offices based on submitted returns. Field audits happen at your business premises and involve physical inspection. Comprehensive audits cover multiple tax years and examine income tax, VAT and payroll obligations together. Specialised audits may focus on transfer pricing or specific compliance areas.

There is also a critical distinction between a CFR-initiated audit and a voluntary tax compliance review. The first is an enforcement action you must participate in. The second is a proactive service — an advisory review conducted by your accountants to identify and resolve issues before the CFR finds them. The cost difference between fixing a problem voluntarily and defending one under audit is significant.

The Red Flags That Put Your Company on the CFR’s Audit List

The CFR uses a risk-based selection approach. While random audits do happen, most are triggered by specific red flags in your filings or external data sources. Here are the most common triggers:

Inconsistent reporting. If your tax returns show discrepancies between income declarations and financial statements, or your reported income does not match what the CFR receives through CRS and FATCA data exchanges, you move up the priority list.

Large refund claims under the 6/7 system. Malta’s shareholder refund mechanism is a core feature of the corporate tax system, but large or frequent refund claims attract increased scrutiny. The CFR reviews whether tax payments, dividend distributions and shareholder eligibility all line up properly.

Significant or unusual transactions. High-value transactions without a clear commercial rationale, complex cross-border arrangements, or transaction patterns inconsistent with your stated business activities are all red flags.

International information exchange. Malta participates in CRS (automatic exchange with OECD countries), FATCA (with the US under L.N. 78 of 2014), and DAC6 (mandatory disclosure of cross-border arrangements within 30 days). Data flowing in from these channels is actively used to cross-check local filings.

Industry risk factors. Financial institutions, entities subject to DAC6 reporting, and sectors flagged in Malta’s National Risk Assessment face higher audit likelihood. Whistleblower reports through the CFR, FIAU, or MFSA can also trigger an examination.

Penalties and Interest: What a Tax Audit Can Cost You

Understanding the financial exposure helps you decide whether a proactive review is worth the investment.

ItemRate / AmountLegal Basis
Interest on late income tax payments0.33% per month (approx. 4% p.a.)ITMA (Cap. 372)
Late filing of VAT returnEUR 5 per dayArticle 76, VAT Act (Cap. 406)
Interest on late VAT paymentsRate prescribed by MinisterL.N. 51 of 2014
Additional tax for understatementDetermined per caseITMA (Cap. 372)
Standard audit lookback period6 yearsITMA (Cap. 372)
Extended period (fraud or omission)12 yearsITMA (Cap. 372)

Voluntary disclosure and cooperation with the CFR can result in penalty mitigation or full remission. Separate applications are required for income tax and VAT penalties.

Transfer Pricing: New Thresholds That Could Trigger Your Next Audit

New rules under S.L. 123.207 require formal documentation for cross-border arrangements exceeding these thresholds.

Transaction TypeAnnual ThresholdDocumentation Required
Revenue nature transactionsEUR 6,000,000Master file + local file
Capital nature transactionsEUR 20,000,000Master file + local file

Applies to basis years commencing on or after 1 January 2024. Arrangements entered into before that date are grandfathered if not materially altered. Dividends to associated enterprises are excluded from revenue aggregation. Documentation must follow Chapters I and V of the OECD Transfer Pricing Guidelines 2022.

Not sure if your records would survive a CFR audit? Let us check before they do.

Get My Compliance Review

What to Do When You Receive a CFR Audit Notification

A structured response protects your position. Here is the process we follow with every client.

01

Review the Notification Scope

We analyse the CFR’s letter to understand exactly which tax years, tax types and areas are under examination. This determines what records you need to gather and where the risk areas are likely to sit.

02

Gather and Organise Documentation

We prepare a complete document set — tax returns, financial statements, bank records, contracts, invoices and transfer pricing files. Everything is reviewed for consistency before anything goes to the CFR.

03

Respond to CFR Information Requests

We handle all correspondence with the Commissioner’s office, respond to queries within required timeframes and attend interviews or site visits on your behalf where needed.

04

Negotiate and Resolve

If the CFR proposes adjustments, we evaluate the findings, present counter-arguments where justified, negotiate penalty mitigation where applicable and exercise appeal rights if the assessment is unfounded.

What You Get With Borg Galea’s Tax Audit Support

Proactive Compliance Reviews

We run the same checks the CFR would — before they do. Our pre-audit health checks cover income tax, VAT, payroll and transfer pricing. Issues caught early cost a fraction of what they cost under formal audit.

Full CFR Representation

From initial notification through to final resolution, we manage the entire audit process. You deal with us; we deal with the Commissioner. That includes correspondence, document preparation, interviews and appeals.

Transfer Pricing Documentation

The new rules under S.L. 123.207 are barely two years old and many companies are not yet compliant. We prepare master files and local files aligned with the 2022 OECD Guidelines, covering loans, services, royalties and intercompany transactions.

Penalty Mitigation Experience

When the CFR assesses additional tax, we negotiate. Voluntary disclosure, demonstrated cooperation and well-documented positions all count toward reducing penalties and interest. We know what works because we have done it repeatedly.

Tax Audit Malta: Your Questions, Straight Answers

The standard lookback period is six years from the relevant tax year. However, in cases involving fraud or deliberate omission, the CFR can go back up to 12 years. Both periods are governed by the Income Tax Management Act (Cap. 372). This is why maintaining proper records for at least six years is not optional — it is a legal requirement.
A desk audit is conducted at the CFR’s offices and is based on a review of your submitted returns and documentation. A field audit takes place at your business premises, where inspectors physically examine records, assets and operations. Field audits are more invasive and typically cover a broader scope. Comprehensive audits may combine both approaches across multiple tax years.
Interest on unpaid income tax accrues at approximately 0.33% per month, which works out to roughly 4% per year. For VAT, interest rates are prescribed by the Minister under Legal Notice 51 of 2014. These charges compound quickly on larger amounts and apply from the original due date, not from the date the audit starts.
Yes, in many cases. The CFR recognises voluntary disclosure and cooperation as grounds for penalty mitigation or full remission. If you identify and correct errors before the CFR raises them, your position is substantially stronger. You need to submit separate applications for income tax and VAT penalty remission to the Commissioner for Tax and Customs.
If your company has cross-border arrangements with associated enterprises and those transactions exceed EUR 6 million per year (revenue) or EUR 20 million (capital), then yes — you need formal transfer pricing documentation from basis years commencing 1 January 2024. This includes a master file and local file prepared in line with the OECD Transfer Pricing Guidelines 2022. Dividends paid to associated enterprises are excluded from the revenue aggregation.
Failure to respond to CFR information requests can result in penalties for non-compliance and undermines your negotiating position. The CFR has powers under Articles 13 and 14 of the ITMA to compel information and access premises. Non-cooperation also makes penalty mitigation harder to argue for later. Our strong advice is to respond promptly and thoroughly, with professional support.
Malta’s shareholder refund mechanism means the company pays 35% and shareholders claim back up to 6/7. Large refund claims are one of the most common audit triggers. The CFR checks whether tax was actually paid in full, distributions followed proper procedures, and shareholders are genuinely eligible. Companies that claim refunds without meticulous documentation are asking for trouble.
It is a proactive audit conducted by your advisors — not the CFR. We review your income tax, VAT, payroll and transfer pricing positions against current law and identify any gaps or exposures. The goal is to fix issues while the cost is low and the resolution is in your hands, rather than waiting for the CFR to find them under formal audit conditions.
Simple desk audits can be resolved in three to six months. Field audits and comprehensive examinations often take 12 to 24 months, depending on the complexity of the company’s affairs, the number of tax years under review and how promptly information requests are answered. Having organised records and professional representation can significantly shorten the timeline.
At minimum: tax returns and supporting schedules, audited financial statements, bank statements, contracts with clients and suppliers, sales and purchase invoices, payroll records, and board minutes. If transfer pricing rules apply, add your master file, local file, intercompany agreements and functional analysis. All records should be retained for at least six years under Article 19 of the ITMA.
Yes, and substance requirements are taken increasingly seriously. You need a physical office, qualified local directors and employees, and genuine business decisions made in Malta. Companies lacking substance face higher audit risk, potential denial of tax benefits, additional assessments and challenges to their tax residency status. This applies especially to holding companies, IP structures and international entities claiming treaty benefits.
DAC6 is an EU directive requiring mandatory disclosure of reportable cross-border tax arrangements within 30 days of implementation. Malta implements this through automatic information exchange with EU tax authorities. Arrangements that meet specific hallmarks — indicating potential aggressive tax planning — must be reported. Yes, DAC6 disclosures can and do trigger CFR audits, particularly for complex cross-border structures.
We begin with a short call to understand your company structure, the tax years in question and any specific concerns. From there, we review your income tax filings, VAT returns, payroll records and — where applicable — transfer pricing documentation against current law. You receive a written report identifying gaps, exposure areas and recommended actions. The initial consultation is at no obligation and we typically respond within one working day of your enquiry.

Fix Compliance Gaps Before the CFR Finds Them

Tell us about your company and we will assess your compliance position — no obligation. Whether you need a proactive review, transfer pricing documentation or help responding to a CFR notification, we typically respond within one working day.

You will speak with

Andrew Fenech

Andrew Fenech

Business Development Manager

Adrian Pavia Dimech

Adrian Pavia Dimech

Audit Principal

Tatiana Muscat

Tatiana Muscat

Audit Manager

  • Free initial consultation
  • Response within 24 hours
  • No obligations whatsoever

Please fill in all required fields marked with *.

We'll respond within one business day.