2023-11-20

Added · Updated

European Commission Public Consultation on Two Delegated Acts under Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector

The Maltese Financial Services Authority invites stakeholders to provide feedback on two draft delegated acts under Regulation (EU) 2022/2554 concerning digital operational resilience. These acts specify the criteria for designating critical ICT third-party service providers and determine the oversight fees charged by the Lead Overseer. The European Commission plans to adopt these acts in the second quarter of 2024, with comments due by 14 December 2023.

Malta Financial Services Authority logo

Malta

Malta Financial Services Authority

Click to view thumbnail

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt European Commission Public Consultation on Two Delegated Acts under Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector This circular is an update to Circular titled Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 on Digital Operational Resilience for the Financial Sector published on the EU Official Journal published by the Authority in January 2023. As detailed by the latter circular, Regulation (EU) 2022/2554 (“the Regulation”) is to be supplemented by, inter alia, two delegated acts to be adopted by the European Commission (‘EC’). The delegated acts supplement the Oversight Framework of Critical ICT third-party service providers, as established by Chapter V, Section II of the Regulation. More specifically, the two draft delegated acts supplement the Regulation by:

  1. specifying the criteria for the designation of ICT third-party service providers as critical for financial entities; and
  2. determining the amount of the oversight fees to be charged by the Lead Overseer to critical ICT third-party service providers and the way in which those fees are to be paid. Following an interinstitutional drafting process, the delegated acts were sent to the EC. The EC, following public consultation, plans to adopt the delegated acts in the second quarter of
  3. Financial entities and other interested stakeholders are invited to provide their feedback for both delegated acts via this link. The deadline for the submission of comments is 14 December 2023. More information on the public consultation and the draft delegated acts can be found in the above-mentioned link. Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function on sirc@mfsa.mt. 20 November 2023