meta_id 3092384

On 23 April 2026, the Malta Financial Services Authority (MFSA) released guidance supporting the development of codes of conduct by financial entities and threat-led penetration testing (TLPT) providers in accordance with the Digital Operational Resilience Act (Regulation (EU) 2022/2554) (DORA) and Commission Delegated Regulation (EU) 2025/1190. The MFSA is designated as the TLPT Authority for Malta under DORA. Article 27 of DORA requires financial entities identified to carry out advanced testing through TLPT at least every three years to use only testers that are certified by an accreditation body or adhere to formal codes of conduct or ethical frameworks. This requirement extends to both internal and external testers, as well as threat intelligence providers. The MFSA collaborated with the TIBER-EU Knowledge Centre to develop the "TLPT Codes of Conduct Guidance Document," which outlines recommendations and best practices for developing core principles of codes of conduct aligned with the European framework for Threat Intelligence-Based Ethical Red Teaming (TIBER-EU framework). The guidance applies to TLPT providers, including information and communications technology (ICT) third-party service providers contracted as external testers and threat intelligence providers, as well as financial entities when internal testers are selected. It addresses both natural persons and legal bodies responsible for providing or staffing testers and threat intelligence providers. Financial entities licensed by the MFSA, testers, and threat intelligence providers are strongly encouraged to review the guidance document. For further information, entities may contact the Maltese TIBER/TLPT Cyber Team at tlpt@mfsa.mt or visit the Threat-Led Penetration Testing section on the MFSA website.