Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt MFSA releases its Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements Following a comprehensive consultation process today issued its principle-based cross-sectorial guidelines titled: Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements supplemented by a consultation Feedback Statement. The Guidance document, which draws primarily from guidelines, considers technology as a core component, innovation enabler and a major determinant for operational efficiency whilst underlining the importance of resilience and regulatory compliance. It has been welcomed and attracted substantial feedback. The Authority reviewed the feedback received and the outcome of the feedback review process is provided within the accompanying Feedback Statement. The Authority plans to conduct thematic reviews on a sectoral basis on key aspects of the Guidance document, which will be cross-referenced by the respective prudential rules of the applicable sectors along with ESA Guidelines (where applicable), as illustrated in Annex 1. All queries and request(s) for further information should be addressed to sirc@mfsa.mt. 11 December 2020

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt
Annex 1 - Table with details of respective Prudential Supervision Rulebooks that will be
amended to cross-reference ESA Guidelines and the Guidance document:
Sector Amended Rule/Cross-reference to ESA Guidelines and theGuidance Document Credit and Financial Institutions i. Annex 2B of BR/12, Paragraph 17 (cross-reference to the EBA Guidelines on ICT and Security Risk Management).
ii. BR/14, Paragraph 5A
iii. FIR/02, Paragraphs 48 and 48A
(cross-reference to the EBA
Guidelines on ICT and Security Risk Management).
Insurance and Pensions i. Paragraph 5.4.1 of Chapter 5 of Part B of the Insurance Distribution Rules.
ii. Paragraph 6.14.2 of Chapter 6 of
Part B of the Insurance Rules.
iii. Paragraph 11.6.1 of Chapter 11 of
the Insurance Distribution Rules.
iv. Standard Licence Condition 4.4.16
of the Pension Rules for Service
Providers.
v. Standard Licence Condition 1.2.6 of
Part B of the Pension Rules for
Personal Retirement Schemes issued in terms of the Retirement Pensions act, 2011.
vi. Standard Licence Condition 1.2.11
of Part B of the Pension Rules for
Occupational Retirement Schemes issued in terms of the Retirement Pensions act, 2011.
vii. Paragraph 6.14.1 of Chapter 6 of
Part B of the Insurance Rules
(amended to adopt the Guidelines on outsourcing to cloud service

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt providers and the Guidelines on information communication technology security and governance). Securities and Markets i. The Financial Market Rules will be amended to cross-reference the Guidance document.
ii. Section 6 of Chapter 3 Title 6
Supplementary Organisational
Requirements (cross-reference to the EBA guidelines on ICT and Security Risk management)
iii. Self-Managed UCITS: Section 2 of
Appendix VIII - Supplementary
Licence Conditions Applicable to
Self-Managed Schemes to Part B of the Investment Services Rules for Retail Collective Investment Schemes.
iv. Self-Managed PIFs: Section 4 of
Appendix I to Part B of the
Investment Services Rules for
Professional Investor Funds -
Supplementary Licence Conditions applicable to PIFs set up as Self￾Managed Schemes.
v. Self-Managed AIFs: Section 8 of
Appendix I to Part B of the
Investment Services Rules for
Alternative Investment Funds -
Supplementary Licence Conditions applicable to Alternative Investment Funds adopting different structures.
vi. Recognised Persons: Section 2 of
Part BI of the Investment Services
Rules for Recognised Persons.
vii. Investment Firms: Title 2 of Chapter
I of Part BI of the Investment
Services Rules for Investment
Services Providers

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt
viii. UCITS Mancos: Title 2 of Chapter I of
Part BII of the Investment Services
Rules for Investment Services
Providers.
ix. AIFMs: Section 2 for De-minimis
and Section 1 for full AIFMs of Part BIII of the Investment Services Rules for Investment Services Providers.
x. Custodians: Section 1 of Part BIV of
the Investment Services Rules for
Investment Services Providers.
Trustees and other Fiduciaries, Company Service Providers
i. The respective cross-referencing
will be made available in the new version of the Rules for Company Service Providers and the new Rulebook for Trustees. Virtual Financial Assets i. The Virtual Financial Assets Rulebook Chapter 3 Virtual Financial Assets Rules for VFA Service Providers.