Circular to Credit Institutions on Amendments to Banking Rules BR/14 and BR/24

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Circular to Credit Institutions on Amendments to Banking Rules BR/14 and BR/24 The Authority is hereby issuing amended versions of Banking Rules BR/14 on Outsourcing and BR/24 on the Internal Governance of credit institutions. These amendments have been carried out primarily due to the update by the European Banking Authority of the Guidelines on ICT and security risk management (EBA/GL/2025/02) (the “EBA Guidelines”) which have been reduced in scope following the entry into force of Regulation (EU) 2022/2554 (the “DORA Regulation”). The updated EBA Guidelines outline requirements in the area related to “Payment service user relationship management”. The amendments to the Banking Rules are also catering for a few other adjustments as explained below. Amendments to Banking Rule BR/14 on Outsourcing BR/14 has been amended as follows: a) Removal of references to the MFSA’s Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements document in paragraph 5A, and in the footnote to paragraph 22 since the Guidance document no longer applies to credit institutions, as outlined in an MFSA Circular dated 26 th March 2024; b) Inclusion of a new paragraph 8A to provide clarity on the interaction between the requirements of the Rule with those emanating from the DORA Regulation; and c) Removal of reference to the EBA Guidelines as mentioned in the footnote to paragraph 22 as the updated Guidelines are not deemed to be relevant within the context of this Rule. 16 May 2025

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Amendments to Banking Rule BR/24 on Internal Governance BR/24 is being amended to include reference to the updated EBA Guidelines in paragraphs 4(c), 73(a), and 295. While the scope of the EBA Guidelines has been narrowed down, the topic of “Payment service user relationship management” is still deemed as relevant within the context of this Rule. The amended Rules shall be applicable from 20 May 2025. This Circular shall not be construed as a replacement of the provisions of the amended Rules, and the updated Rules shall prevail in case of any conflict. Any queries in relation to the above should be directed to Banking Supervision (Policy and Legal) on bsupolicy@mfsa.mt.