Newsfeed
October 28, 2026
On 23 October 2026, the Malta Financial Services Authority (“MFSA”) published a Dear CEO Letter titled ‘Supervisory Engagements and Digital Operational Resilience 2025 – General Observations Report’ (the “Dear CEO Letter”)1. The Dear CEO Letter provides insights on how Licence Holders have performed against the MFSA’s 2025 supervisory engagements targeting compliance with Regulation (EU) 2022/2554 on digital operational resilience (“DORA”). A summary of the key findings outlined under the Dear CEO Letter is set out below.
1. DORA Chapter II – ICT Risk Management
The MFSA observes a positive shift in how Licence Holders identify and mitigate ICT risks, with several weaknesses from its 2024 engagements having been addressed. However, some Licence Holders still have not fully achieved the assessed Chapter II controls. The most frequent gaps relate to identification, communication, response and recovery, and detection. In particular, the MFSA observes difficulty in maintaining a risk register that continuously identifies all sources of ICT risk and assesses cyber threats and vulnerabilities. It also finds challenges in establishing crisis communication plans for major ICT-related incidents and in implementing communication policies for staff and external stakeholders. Lastly, it observes a lack of regular testing of the mechanisms for detecting anomalous activities.
2. DORA Chapter III – ICT-Related Incident Management, Classification and Reporting
The MFSA reports mixed results on ICT-related incident response capabilities. Licence Holders have made measurable progress on the ICT-related incident management process and on the reporting of major ICT-related incidents and the voluntary notification of significant cyber threats. However, Licence Holders that did not fully achieve the assessed Chapter III controls face difficulties in classifying ICT-related incidents in line with DORA and in consistently classifying cyber threats as significant.
3. DORA Chapter IV – Digital Operational Resilience Testing
The MFSA reports a general improvement in digital operational resilience testing practices. In particular, Licence Holders have improved in meeting the general requirements for performing resilience testing and for testing ICT tools and systems. However, gaps remain among those Licence Holders that did not fully achieve the assessed controls. Not all of them have established an approved Digital Operational Resilience Testing Programme, and some are not ensuring that appropriate tests are carried out at least annually across all ICT systems and applications supporting critical or important functions.
4. DORA Chapter V – Managing of ICT Third-party Risk
The MFSA notes that Licence Holders are increasing their efforts to comply with Chapter V, with progress in the preliminary assessment of ICT concentration risk at entity level. This is an important step towards stronger oversight of dependencies on external ICT service providers. However, some Licence Holders that did not fully achieve the assessed controls still do not sufficiently align their contractual arrangements with DORA. This is often because the key contractual provisions are only partly implemented and, in some cases, because there is no formal contractual arrangement at all.
5. DORA Regulatory Technical Standards – Risk Management Framework
The MFSA observes that Licence Holders are generally establishing the foundations of an ICT risk management framework in line with the RTS on the ICT Risk Management Framework (Commission Delegated Regulation (EU) 2024/1774, the “RTS ICTRMF“). However, practical implementation remains uneven as some Licence Holders that did not fully achieve the related controls have yet to fully embed the requirements of the RTS ICTRMF in their day-to-day operations.
According to the MFSA, weaknesses appear to varying degrees across nearly all areas of the RTS ICTRMF. The most notable relate to testing of ICT business continuity plans, capacity and performance management, logging, ICT project management, and encryption, cryptographic controls and key management. The MFSA singles out two points of particular concern: (i) the lack of approved capacity and performance management procedures, which are needed to identify the capacity requirements of ICT systems; and (ii) the failure to consider scenarios involving the insolvency or failure of ICT third-party service providers when testing business continuity plans.
6. DORA Regulatory Technical Standards – ICT Third-Party Policy
The MFSA identifies a number of concerns under the RTS on the ICT third-party service providers policy (Commission Delegated Regulation (EU) 2024/1773, the “RTS ICTTPP“). In particular, Licence Holders that did not fully achieve the assessed controls show a general level of non-compliance, especially on governance arrangements and due diligence assessments. Several could not evidence that their management body reviews, at least annually, the policy on the use of ICT services supporting critical or important functions. Others face challenges in obtaining and maintaining an appropriate level of assurance over ICT third-party performance and compliance. Exit and termination strategies also need attention.
7. Concluding Remarks
In its conclusion, the MFSA states that it is encouraged by the progress Licence Holders made during 2025 and by their evident commitment to full compliance with DORA and the Level 2 texts, noting clear improvements when compared to the previous year’s assessment. It nonetheless acknowledges that more work remains to be done, including in the areas of governance and organisation, cyber threat classification, and encryption and cryptographic controls. The MFSA also reiterates its commitment to supporting Licence Holders and looks forward to continued collaboration in building a digitally resilient financial system.
Author
Related Articles
More Insights
