Draft Regulatory Technical Standards on Subcontracting ICT Services under DORA

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Draft Regulatory Technical Standards on Subcontracting ICT Services under Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector Submitted to the European Commission This circular is an update to Circular titled Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 on Digital Operational Resilience for the Financial Sector published on the EU Official Journal published by the Authority in January 2023. As detailed by the latter circular, Regulation (EU) 2022/2554 (“the Regulation”) is to be supplemented by, inter alia, a series of Technical Standards and Guidelines. Following an interinstitutional drafting process by the European Supervisory Authorities (”ESAs”) and a public consultation as detailed by Circular titled ESAs Joint Committee Public Consultation on the Second Set of Technical Standards under Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector, the Draft Regulatory Technical Standards to specify the elements which a financial entity needs to determine and assess when subcontracting ICT services support critical or important functions as mandated by Article 20(5) of Regulation (EU) 2022/2554 (hereinafter referred to as the ‘RTS’) has been submitted to the European Commission (“EC”) by the ESAs. The EC will now review the submitted RTS with the objective of adopting it in the coming months. Financial entities and other stakeholders are invited to refer to the following ESAs links for the submitted RTS:

1. European Banking Authority
2. European Insurance and Occupational Pensions Authority
3. European Securities and Markets Authority Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function on sirc@mfsa.mt. 31 July 2024