meta_id 3378349

On August 5, 2026, the Malta Financial Services Authority (MFSA) issued a circular to all licence holders addressing cyber risks associated with frontier artificial intelligence models (FAIMs). The circular responds to recent European publications from the European Systemic Risk Board (ESRB), European Central Bank (ECB), and European Supervisory Authorities (ESAs) concerning the evolving threat landscape. FAIMs are advanced artificial intelligence models with capabilities that may materially affect offensive and defensive cyber operations. The MFSA highlighted that these models may enable cyber activity to be conducted with greater speed and sophistication, including through accelerated discovery of vulnerabilities and development of exploits. The authority emphasised that while FAIMs may support defensive capabilities, their development represents a material change in the cyber-threat landscape. The circular does not introduce separate supervisory expectations for FAIMs; rather, it reinforces the continued relevance of existing regulatory requirements and governance principles previously communicated by the MFSA, including through its Dear CEO Letter on Artificial Intelligence issued on June 4, 2026. The MFSA encouraged licence holders to consider FAIM-related developments within existing information and communications technology (ICT) risk management and operational resilience frameworks. Key areas of focus include asset visibility, vulnerability and patch management, security monitoring, incident detection and response, defence-in-depth, recovery capabilities and digital operational resilience testing. The authority emphasised that third-party dependencies and concentration risk warrant particular attention, as licence holders may rely on common cloud, technology, software, AI model and data providers, creating shared vulnerabilities and single points of failure. For licence holders falling within the scope of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), the authority noted that DORA remains the regulatory anchor for digital operational resilience. The MFSA may consider these developments as part of ongoing supervision concerning ICT risk, cybersecurity, digital operational resilience, third-party risk and artificial intelligence governance. Licence holders may request further information by contacting sirc@mfsa.mt.