Commission Delegated Regulation (EU) 2025/532 supplementing Regulation (EU) 2022/2554 on Digital Operational Resilience

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Commission Delegated Regulation under Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector Published in the EU Official Journal (Update 6) This circular is an update to Circular titled Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 on Digital Operational Resilience for the Financial Sector published on the EU Official Journal published by the Authority in June 2025. As detailed by the latter circular, Regulation (EU) 2022/2554 (“the Regulation”) is to be supplemented by, inter alia, a series of Technical Standards and Guidelines. Following an interinstitutional drafting process by the European Supervisory Authorities (”ESAs”) in agreement with the European Central Bank (“ECB”), the following was adopted and has now been published in the EU Official Journal:

1. COMMISSION DELEGATED REGULATION (EU) 2025/532 of 24 March 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions (access here). Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function on sirc@mfsa.mt. 4 July 2025