Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Submission Guidance

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Submission Guidance This Circular is a follow up to Circular titled Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines for Authorised Persons published by the Authority in January 2025 which highlighted the Register of Information reporting deadlines, potential enforcement and the tools provided by the ESAs to create an RoI. The Authority is kindly reminding the industry that Authorised Persons falling within the scope of the DORA Regulation, shall submit their RoI to the Malta Financial Services Authority between 01 April 2025 and 08 April 2025 (both days included). This applies to all Authorised Persons that are authorised by the MFSA up until and including 31 March 2025. Any Authorised Person that is authorised after 31 March 2025 will not be included in the 2025 RoI reporting exercise but will still be required to maintain an RoI and make it available to the Authority upon request. For the avoidance of doubt, the deadline(s) provided by this Circular further specify the requirement provided under Article 28(3) of the DORA Regulation and shall constitute the actual deadline(s) for submission of the Register of Information to the Authority. Failure to submit the full Register of Information from 01 April 2025 to 08 April 2025 may result in regulatory action by the Authority by virtue of the DORA Regulation, LN 166 of 2024 and the MFSA Act. The Supervisory ICT Risk and Cybersecurity Function of the MFSA has recently updated its main page on the MFSA website to include a new informational tab with regards to the Register of Information named ‘ICT Third-Party Risk‘. On this tab Financial Entities can find resources such as an introduction to the RoI regulatory obligation from DORA, an RoI Submission User Guide detailing instructions on how Financial Entities are to submit their RoI through the LH Portal and a number of FAQs collected by the ESAs and the Authority relating to the RoI. Access to the RoI submission page on LH Portal is automatically granted to all Compliance Officers with an LH Portal account. If someone other than a Compliance Officer intends to submit the RoI, they must first create an LH Portal account and then request access to the RoI submission system by emailing roi@mfsa.mt. 06 March 2025

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Additionally, the EBA have furnished their webpage on DORA preparedness with helpful resources pertaining to the RoI reporting of 2025 onwards. This page includes all the files needed to create an RoI, the validation rules that the ESAs will apply to each RoI submission and an extensive FAQ list for queries pertaining to the RoI. Lastly, regarding Significant Institutions (SIs), under Article 46(a) of DORA, the European Central Bank (ECB) ensures compliance for credit institutions classified as significant under Article 6(4) of Regulation (EU) No 1024/2013. The ECB outlines its interpretation of obligations under Article 28(3) DORA and Commission Implementing Regulation (EU) 2024/2956 (DORA ITS), including the requirement to establish and share an RoI with the ECB. The ECB shall provide further guidance on the submissions of the RoI for the credit institutions classified as significant under Article 6(4) of Regulation (EU) No 1024/2013. Financial Entities may request further information by sending an email to the MFSA Register of Information Team at roi@mfsa.mt.