Provisional Agreement Reached on the Digital Operational Resilience Act (DORA)

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Provisional Agreement Reached on the Digital Operational Resilience Act (DORA) This circular builds upon past circulars and publications which already made mention to the upcoming Digital Operational Resilience Act (“DORA”, “the Regulation”) applicable to the financial services sector. From the time these circulars and publications were published, the Regulation has gone through a rigorous interinstitutional negotiation process at a European Union (EU) level. In May 2022, a provisional political agreement on DORA has been reached. However, a series of minor, technical-based, provisions still needed to be further discussed at a EU￾level. On 23 July 2022, a provisional agreement was reached and the Regulation is now expected to go through a process of voting and adoption. The provisional agreement text is available here. DORA is expected to come into force in Q1 2023 and to be fully applicable by Q1 2025 following a two-year implementation period. In addition to the Regulation itself – amending Regulations (EC) No 1060/2009; (EU) No. 648/2012; (EU) No 909/2014; (EU) 600/2014; and (EU) No 2016/1011 – DORA is accompanied by a Directive – amending Directives 2009/65/EC; 2009/138/EC; 2011/61/EU; 2013/36/EU; 2014/59/EU; 2014/65/EU; (EU) 2015/2366; and (EU) 2016/2341. At a EU-level, policy work on DORA continues, as the Regulation introduces a series of Regulatory and Implementing Technical Standards and Guidelines. The submission periods of these Level 2 and Level 3 texts vary, in their majority, between twelve to eighteen months from the Regulation’s entry into force. DORA introduces provisions – subject to different layers of proportionality – on financial entities in the areas of ICT risk management framework, ICT-related incidents, digital operational resilience testing (including advanced testing) managing of risk associated with the use of ICT-third party providers, EU-level oversight framework of critical ICT-third party providers and an optional provision on information sharing between financial entities. Overall, DORA is a complex cross-sectoral Regulation which introduces a series of novel, directly applicable, requirements. It is recommended that Authorised Persons look at the provisional agreement, start with their preparations and continue to follow developments. Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function within the MFSA on sirc@mfsa.mt. 28 July 2022