Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt MFSA releases its Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements Following a comprehensive consultation process today issued its principle-based cross-sectorial guidelines titled: Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements supplemented by a consultation Feedback Statement. The Guidance document, which draws primarily from guidelines, considers technology as a core component, innovation enabler and a major determinant for operational efficiency whilst underlining the importance of resilience and regulatory compliance. It has been welcomed and attracted substantial feedback. The Authority reviewed the feedback received and the outcome of the feedback review process is provided within the accompanying Feedback Statement. The Authority plans to conduct thematic reviews on a sectoral basis on key aspects of the Guidance document, which will be cross-referenced by the respective prudential rules of the applicable sectors along with ESA Guidelines (where applicable), as illustrated in Annex 1. All queries and request(s) for further information should be addressed to sirc@mfsa.mt. 11 December 2020

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Annex 1 - Table with details of respective Prudential Supervision Rulebooks that will be amended to cross-reference ESA Guidelines and the Guidance document: Sector Amended Rule/Cross-reference to ESA Guidelines and theGuidance Document Credit and Financial Institutions i. Annex 2B of BR/12, Paragraph 17 (cross-reference to the EBA Guidelines on ICT and Security Risk Management). ii. BR/14, Paragraph 5A iii. FIR/02, Paragraphs 48 and 48A (cross-reference to the EBA Guidelines on ICT and Security Risk Management). Insurance and Pensions i. Paragraph 5.4.1 of Chapter 5 of Part B of the Insurance Distribution Rules. ii. Paragraph 6.14.2 of Chapter 6 of Part B of the Insurance Rules. iii. Paragraph 11.6.1 of Chapter 11 of the Insurance Distribution Rules. iv. Standard Licence Condition 4.4.16 of the Pension Rules for Service Providers. v. Standard Licence Condition 1.2.6 of Part B of the Pension Rules for Personal Retirement Schemes issued in terms of the Retirement Pensions act, 2011. vi. Standard Licence Condition 1.2.11 of Part B of the Pension Rules for Occupational Retirement Schemes issued in terms of the Retirement Pensions act, 2011. vii. Paragraph 6.14.1 of Chapter 6 of Part B of the Insurance Rules (amended to adopt the Guidelines on outsourcing to cloud service

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt providers and the Guidelines on information communication technology security and governance). Securities and Markets i. The Financial Market Rules will be amended to cross-reference the Guidance document. ii. Section 6 of Chapter 3 Title 6 Supplementary Organisational Requirements (cross-reference to the EBA guidelines on ICT and Security Risk management) iii. Self-Managed UCITS: Section 2 of Appendix VIII - Supplementary Licence Conditions Applicable to Self-Managed Schemes to Part B of the Investment Services Rules for Retail Collective Investment Schemes. iv. Self-Managed PIFs: Section 4 of Appendix I to Part B of the Investment Services Rules for Professional Investor Funds - Supplementary Licence Conditions applicable to PIFs set up as Self￾Managed Schemes. v. Self-Managed AIFs: Section 8 of Appendix I to Part B of the Investment Services Rules for Alternative Investment Funds - Supplementary Licence Conditions applicable to Alternative Investment Funds adopting different structures. vi. Recognised Persons: Section 2 of Part BI of the Investment Services Rules for Recognised Persons. vii. Investment Firms: Title 2 of Chapter I of Part BI of the Investment Services Rules for Investment Services Providers

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt viii. UCITS Mancos: Title 2 of Chapter I of Part BII of the Investment Services Rules for Investment Services Providers. ix. AIFMs: Section 2 for De-minimis and Section 1 for full AIFMs of Part BIII of the Investment Services Rules for Investment Services Providers. x. Custodians: Section 1 of Part BIV of the Investment Services Rules for Investment Services Providers. Trustees and other Fiduciaries, Company Service Providers i. The respective cross-referencing will be made available in the new version of the Rules for Company Service Providers and the new Rulebook for Trustees. Virtual Financial Assets i. The Virtual Financial Assets Rulebook Chapter 3 Virtual Financial Assets Rules for VFA Service Providers.