pc
nid 93085
Jun 10, 2026
tojuri@vixio.com
Malta
Malta Financial Services Authority
horizon scanning
104% of draft length
draft in Generated
Generated
2235 charsMalta Financial Services Authority Publishes Digital Operational Resilience Observations from 2025 Authorisation Applications
On June 9, 2026, the Malta Financial Services Authority (MFSA) published a circular outlining general observations on digital operational resilience identified during the review of authorisation applications received in 2025. The circular applies to financial entities and applicants whose licences fall within the scope of the Digital Operational Resilience Act (DORA) Regulation (EU) 2022/2554. The MFSA's Supervisory ICT Risk and Cybersecurity (SIRC) Function conducted this review, overseeing Annex 05 and Annex 50 submissions.
The MFSA identified significant challenges across multiple DORA chapters. Under DORA Chapter II (ICT Risk Management), applicants most frequently struggled with implementing comprehensive ICT business continuity policies, response and recovery plans, and business impact analyses. The authority noted deficiencies in documented digital operational resilience strategies, backup policies, and restoration methods. Under DORA Chapter III (ICT-Related Incident Management), applicants encountered difficulties establishing effective incident detection, classification, and reporting processes. DORA Chapter IV (Digital Operational Resilience Testing) demonstrated the highest compliance levels with minimal observations. DORA Chapter V (Managing ICT Third-Party Risk) emerged as the second most challenging area, with applicants underestimating risks associated with ICT third-party arrangements and struggling to negotiate mandatory Key Contractual Provisions. The MFSA also highlighted concerns regarding excessive reliance on generative artificial intelligence in preparing documentation without adequate review and validation, resulting in generic and misaligned submissions.
The MFSA published updated versions of annexes in December 2025, adopting a streamlined self-assessment format accompanied by addenda outlining documentation expectations. The authority expects applicants preparing 2026 submissions to utilise these updated annexes to facilitate more efficient authorisation processes and reduce resubmission requirements. The MFSA remains committed to constructive engagement with applicants while emphasising the need for industry-wide efforts to strengthen digital operational resilience.
Agent draft
Not run yet.
Published
2317 charsMalta Financial Services Authority Publishes Digital Operational Resilience Observations from 2025 Authorisation Applications
On June 9, 2026, the Malta Financial Services Authority (MFSA) published a circular outlining general observations on digital operational resilience identified during the review of authorisation applications received in 2025.
The circular applies to financial entities and applicants whose licences fall within the scope of Regulation (EU) 2022/2554 (Digital Operational Resilience Act - DORA). The 2025 authorisation cycle revealed that while applicants are increasingly attentive to digital operational resilience, several areas continue to present material challenges. The MFSA notes that applicants have not yet achieved the level of maturity required to demonstrate fully embedded digital operational resilience. The MFSA identified significant challenges across multiple DORA chapters:
DORA Chapter II (ICT Risk Management) - applicants most frequently struggled with implementing comprehensive ICT business continuity policies, response and recovery plans, and business impact analyses. The authority noted deficiencies in documented digital operational resilience strategies, backup policies and restoration methods.
DORA Chapter III (ICT-Related Incident Management) - applicants encountered difficulties establishing effective incident detection, classification and reporting processes.
DORA Chapter IV (Digital Operational Resilience Testing) - demonstrated the highest compliance levels with minimal observations.
DORA Chapter V (Managing ICT Third-Party Risk) - emerged as the second most challenging area, with applicants underestimating risks associated with ICT third-party arrangements and struggling to negotiate mandatory key contractual provisions.
The MFSA also highlighted concerns about excessive reliance on generative artificial intelligence in preparing documentation without adequate review and validation, leading to generic, misaligned submissions. The MFSA noted that at the authorisation stage, applicants demonstrated varying degrees of preparedness across DORA chapters and the related regulatory technical standards.
The MFSA also expects applicants preparing submissions in 2026 to make full use of the updated annexes and accompanying addenda. Early alignment with these expectations will support a more efficient authorisation process and reduce the need for resubmissions.