Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines from Competent Authorities to the European Supervisory Authorities and 2024 Dry Run ad hoc Exercise Outcomes Webinar

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines from Competent Authorities to the European Supervisory Authorities (‘ESAs’) and 2024 Dry Run ad hoc Exercise Outcomes Webinar This circular is an update to Circular titled Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 on Digital Operational Resilience for the Financial Sector published on the EU Official Journal published by the Authority in January 2023. As detailed by the latter circular, Regulation (EU) 2022/2554 (the ‘DORA Regulation’) is to be supplemented by, inter alia, a series of Technical Standards and Guidelines. Once the DORA Regulation becomes applicable (17 January 2025), pursuant to Article 28(3), financial entities shall maintain a Register of Information (‘RoI’) with information on all of their arrangements with ICT Third-Party Service Providers (‘ICT TPPs’) and upon request, make the full RoI available or, as requested, specific sections, along with any information deemed necessary to the competent authority. According to Article 28(9), the DORA Regulation is to be supplemented by an Implementing Technical Standard (the ‘ITS’) that establishes a standard template for the RoI. The latest draft version of the ITS can be found in the Final Report on Draft Implementing Technical Standards on the standard templates for the purposes of the register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third￾party service providers under Article 28(9) of Regulation (EU) 2022/2554 (note that the ITS is not yet in its final version and is subject to change). Amongst other purposes, the RoI allows financial entities to monitor their ICT TPP risk and the European Supervisory Authorities (‘ESAs’) to designate the Critical ICT TPPs (‘CTPPs’) which will be subject to an EU-level oversight framework pursuant to Chapter V Section II of the DORA Regulation. In order to designate CTPPs, the Authority must report the full RoIs submitted by Financial Entities to the ESAs. 19 November 2024

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt

1. ESAs decision on reporting timelines of the first RoI submission In line with the above, the ESAs have published a decision governing the information that competent authorities must report to them for the purposes of CTPP designation, including the deadline for the first submission of RoIs. The deadline for first submission of the RoI from competent authorities to the ESAs is set for 30 April 2025. The full decision can be found here. Further information on the reporting timelines and deadlines of the RoI from Financial Entities to the Authority will be made available in due course by the Authority.
2. 2024 Dry Run ad hoc Exercise: Outcomes Webinar As a preparatory effort for the steady RoI reporting, and as outlined via Circular titled Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector: ‘Dry￾Run’ 2024 ad hoc Exercise on the Data Collection of Registers of Information, the ESAs and participating competent authorities launched a 2024 dry run exercise. Following the exercise, the ESAs are holding a ‘ESAs Workshop on DORA Dry Run Lessons Learnt and Data Quality’ to be held 18 December 2024 between 10:00 and 13:00 CET. The workshop will be held virtually and interested parties are invite to register by 16 December 2024 using the following link. Authorised Persons may request further information by sending an email to the Supervisory ICT Risk and Cybersecurity function on the RoI dedicated mailbox, i.e., roi@mfsa.mt.