The Malta Financial Services Authority (the “MFSA” or the “Authority”) has recently published its findings following supervisory engagements conducted throughout 2025 in relation to digital operational resilience within the Maltese financial services sector.
The supervisory engagements, conducted by the MFSA’s Supervisory ICT Risk and Cybersecurity Function (“SIRC”), assessed compliance with Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”) and the applicable Regulatory Technical Standards (“RTS”). The assessment focused primarily on ICT risk management, ICT-related incident management and ICT third-party risk management.
The findings demonstrated an overall improvement in compliance, with 74% of assessed controls fully achieved, 16% partially achieved and 10% not achieved. Nevertheless, the Authority identified recurring deficiencies among License Holders that had not fully achieved the assessed controls, particularly concerning ICT governance, incident classification, resilience testing and third-party oversight.
Chapter II of DORA establishes the requirements applicable to financial entities in relation to ICT risk management. Although the MFSA observed improvements in the identification and mitigation of ICT risks, certain deficiencies remain in the implementation of risk management frameworks. In particular, the Authority identified shortcomings in the maintenance of comprehensive ICT risk registers, including the continuous identification of ICT risks, and assessment of cyber threats and ICT vulnerabilities, as required under Article 8(2) of DORA.
Further deficiencies concerned crisis communication arrangements and policies governing communications with internal and external stakeholders following major ICT-related incidents, in accordance with Article 14 of DORA. The MFSA also identified insufficient regular testing of mechanisms designed to detect anomalous activities, network performance issues and ICT-related incidents.
The MFSA identified improvements in ICT-related incident management procedures and reporting arrangements under Chapter III of DORA. However, shortcomings remain in relation to the classification of ICT-related incidents and significant cyber threats.
In certain instances, License Holders failed to classify incidents in accordance with Article 18 of DORA or to adequately assess their impact against the prescribed classification criteria. Similarly, cyber threats were not consistently assessed to determine whether they should be classified as significant, having regard to the criticality of the potentially affected services, the number or relevant of clients or financial counterparts targeted and the geographical areas at risk.
The Authority highlighted that inadequate classification may affect the timely identification, escalation and reporting of incidents, potentially resulting in cyber threats being underestimated or insufficiently addressed.
Chapter IV of DORA establishes the requirements governing digital operational resilience testing. Whilst the MFSA acknowledged improvements in testing practices, certain License Holders had not established an approved Digital Operational Resilience Testing Programme, as required under Article 24(1) of DORA. Furthermore, the Authority identified instances where appropriate testing was not carried out at least annually across all ICT systems and applications supporting critical or important functions, contrary to Article 24(6) of DORA. Such shortcomings may result in vulnerabilities and potential failure scenarios remaining unidentified, particularly during operational disruptions.
The MFSA observed progress in the preliminary assessment of ICT concentration risk under Chapter V of DORA. Nevertheless, deficiencies remain in relation to contractual arrangements with ICT third-party service providers and the implementation of appropriate oversight mechanisms. Certain Licence Holders had not fully incorporated the key contractual provisions prescribed under Article 30 of DORA into their agreements with ICT service providers. In some instances, formal contractual arrangements were absent altogether.
The Authority also identified weaknesses in the application of the general principles governing ICT third-party risk management under Article 28 of DORA, including insufficient audit and access rights and inadequate oversight of dependencies on external providers.
The MFSA also assessed compliance with Commission Delegated Regulation (EU) 2024/1774, which establishes the RTS concerning ICT risk management frameworks. Although License Holders have generally established the foundations of their ICT risk management frameworks, the Authority identified shortcomings in their practical implementation, particularly concerning ICT business continuity testing, capacity and performance management, logging, ICT project management, encryption and cryptographic controls and cryptographic key management.
Of particular concern were the absence of approved capacity and performance management procedures and the failure to consider scenarios involving the insolvency or failure of ICT third-party service providers when testing business continuity plans. The MFSA emphasized that the effectiveness of ICT risk management frameworks depends on their practical implementation and integration into the daily operations of financial entities.
The Authority further identified deficiencies concerning Commission Delegated Regulation (EU) 2024/1773, which regulates policies governing contractual arrangements for ICT services supporting critical or important functions. The principal shortcomings concerned governance arrangements, due diligence assessments, and exit strategies. In particular, certain License Holders were unable to demonstrate that their management bodies had reviewed their relevant ICT third-party policies at least annually and updated them where necessary, as required under Article 3(1) of the Regulation. Further concerns related to insufficient assurance regarding ICT service providers' performance and compliance, together with inadequate exit and termination strategies.
The MFSA's findings demonstrate that, whilst progress has been achieved, further efforts are required to ensure effective compliance with DORA and its applicable RTS. License Holders should review their existing ICT risk management frameworks, incident classification procedures, testing programmes and ICT third-party arrangements against the deficiencies identified by the Authority.
Should you require further information on the MFSA's findings or assistance in reviewing your organization's digital operational resilience framework and regulatory compliance arrangements, please contact us at info@gtg.com.mt.
Author: Dr Kimberley Blundell