Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Additional Data Quality Checks | Year 2026

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Additional Data Quality Checks | Year 2026 This Circular applies only to Financial Entities within the scope of the DORA Regulation This circular links to: A. circular titled Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines for the Year 2026 and Onwards published by the Authority on 3 November 2025; and B. circular titled Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Reminder | Year 2026 published by the Authority on 28 January 2026. In line with Article 7 Quality of Data and Revisions of the 2024 ESAs Board of Supervisory Decisions, the European Supervisory Authorities [‘ESAs’] will be carrying out additional data quality checks on the 2026 Register of Information [‘RoI’] submissions, to address incorrect data [examples provided in Annex I overleaf]. These checks are planned to be carried out during April 2026 [subsequent to the mandated reporting period – 01 January 2026 to 21 March 2026]. In April 2026, the Authority may therefore receive additional feedback from the ESAs on submitted RoIs which fail to pass these checks, even though an ‘’Accepted’’ Status is attained on the LH Portal upon submission. In that case, the Authority will reach out the respective Financial Entities with an expectation for resubmission, without undue delay, by 30 April 2026. Financial Entities can reduce the likelihood of being asked to make a resubmission by ensuring that the RoI data is correct prior to submission. Credit Institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013 and which are directly supervised by the European Central Bank [‘ECB’], are to be guided by the ECB regarding the submission of their RoI. Queries are to be addressed to the Supervisory ICT Risk and Cybersecurity [‘SIRC’] Function at roi@mfsa.mt. 05 March 2026

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Annex I | Examples of Additional Data Quality Checks