ICT Outsourcing Arrangements – Sector Specific Guidelines and Updated Registers

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt ICT Outsourcing Arrangements – Sector Specific Guidelines and Updated Registers EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) The European Banking Authority (EBA) published a final report on EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02), dated 25 February 2019, applicable to Credit Institutions, Financial Institutions and Investment Firms. These Guidelines have been implemented in Banking Rule BR/14 and cross-referenced by the Investment Services Rules for Investment Services Providers (Part BI: Rules applicable to Investment Services Licence Holders which qualify as MiFID Firms), These Guidelines entered into force on 30 September 2019 to all outsourcing arrangements entered into, reviewed or amended on or after this date, with Paragraph 63 (b) [outsourcing to a service provider located in a third country] applying as of 31 December 2021. The Authority would like to remind the respective Authorised Persons of their obligation to comply with these Guidelines (the compliance obligations for Credit Institutions derive directly from, and are enforceable through Banking Rule BR/14 implementing these EBA Guidelines, whilst outsourcing in the case of Financial Institutions must be in line with the provisions of Banking Rule BR/14 as well, as required by Financial Institutions Rule FIR/01), including with the requirement to maintain an updated register of information on all outsourcing arrangements at the institution and, where applicable, at sub-consolidated and consolidated levels, as set out in Section 2, and should appropriately document all current outsourcing arrangements, distinguishing between the outsourcing of critical or important functions and other outsourcing arrangements. The requirements of what should be within the register are included within the same Guidelines (Banking Rule BR/14 in case of Credit Institutions and Financial Institutions). EIOPA Guidelines on Outsourcing to Cloud Service Providers (EIOPA-BooS-20-002) The European Insurance and Occupational Pensions Authority (EIOPA) published the Guidelines on Outsourcing to Cloud Service Providers (EIOPA-BoS-20-002) on 06 February 2020. The Guidelines, which apply to Authorised Insurance Undertakings and Authorized Reinsurance Undertakings have been adopted in Chapter 6: System of Governance of the Insurance Rules. 24 January 2022

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt These Guidelines entered into force on 1 January 2021 to all cloud outsourcing arrangements entered into or amended on or after this date. Authorised Undertakings should review and amend accordingly existing cloud outsourcing arrangements related to critical or important operational functions or activities with a view to ensuring compliance with the Guidelines by 31 December 2022. The Authority would like to remind the respective Authorised Undertakings of their obligation to comply with these Guidelines, including with the requirement to keep record of its cloud outsourcing arrangements, for instance, in the form of a dedicated register which should be kept updated over time. The requirements of what should be within the register are included within the same Guidelines. ESMA Guidelines on Outsourcing to Cloud Service Providers The European Securities and Markets Authority (ESMA) published the Guidelines on Outsourcing to Cloud Service Providers dated 18 December 2020, applicable to “(i) alternative investment fund managers (AIFMs) and depositaries of alternative investment funds (AIFs), (ii) undertakings for collective investment in transferable securities (UCITS), management companies and depositaries of UCITS, and investment companies that have not designated a management company authorised pursuant to UCITS Directive (iii) central counterparties (CCPs), including Tier 2 third-country CCPs which comply with the relevant EMIR requirements, (iv) trade repositories (TRs), (v) investment firms and credit institutions when carrying out investment services and activities, data reporting services providers and market operators of trading venues, (vi) central securities depositories (CSDs), (vii) credit rating agencies (CRAs), (viii) securitisation repositories (SRs), and (ix) administrators of critical benchmarks”. These Guidelines have been integrated into the MFSA Rulebooks as indicated in Circular ESMA Guidelines on Outsourcing to Cloud Service Providers published on 21 June 2021. These Guidelines apply from 31 July 2021. Firms should review and amend accordingly any existing cloud outsourcing arrangements with a view to ensuring that they take into account these guidelines by 31 December 2022. The Authority would like to remind the respective Authorised Persons of their obligation to comply with these Guidelines, including with the requirement to maintain an updated register of information on all its cloud outsourcing arrangements, distinguishing between the outsourcing of critical or important functions and other outsourcing arrangements. The requirements of what should be within the register are included within the same Guidelines.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Guidance on Technology Arrangements, ICT and Security Risk Management and Outsourcing Arrangements The Malta Financial Services Authority (“MFSA”, the “Authority”) published a Guidance on Technology Arrangements, ICT and Security Risk Management and Outsourcing Arrangements (Guidance Document) dated 11 December 2020, applicable to the entities listed within Section 1.1.9 of the same document. Without prejudice to all applicable Acts, Regulations, rules or sector specific guidelines, the Authority would like to remind the respective Authorised Persons of their obligation to comply with these Guidance Document, including with the requirement to maintain an updated register of information on all outsourcing arrangements at the authorised firm and, where applicable, at sub-consolidated and consolidated levels. The requirements of what should be within the register are included within the same Guidance Document. In the event of any inconsistency or conflict between this Guidance Document and any applicable Acts, Regulations, rules or sector-specific guidelines, the provisions of the said Acts, Regulations, rules or sector-specific guidelines shall always prevail. All queries and request(s) for further information should be addressed to sirc@mfsa.mt.