Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines for the Year 2026 and Onwards

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector – Register of Information Reporting Timelines for the Year 2026 and Onwards This Circular applies only to Financial Entities that fall within the scope of the DORA Regulation (EU) 2022/2554 Pursuant to Article 28(3) of Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (‘the DORA Regulation’), financial entities shall maintain a Register of Information (‘RoI’) with information on all of their arrangements with ICT Third-Party Service Providers (‘ICT TPPs’), and upon request, make the full RoI available or, as requested, specific sections, along with any information deemed necessary to the Competent Authority. The RoI permits, inter alia, the European Supervisory Authorities (‘ESAs’) to periodically designate the Critical ICT TPPs (‘CTPPs’) which will be subject to an EU-level oversight framework pursuant to Chapter V Section II of the DORA Regulation. According to the ESAs Board of Supervisors’ Decision of 08 November 2024, Competent Authorities are expected to annually report the full RoIs submitted by financial entities to the ESAs by the end of March of every Reporting Year. Reporting Timelines and Reference Dates From 2026 onwards, Authorised Persons falling within the scope of the DORA Regulation shall:

1. On an annual basis submit their full RoI (entity or consolidated level) to the Malta
   Financial Services Authority (the “Authority”);
2. Submit the RoI within the Reporting Period, which is between 01 January, or the next
   working day, and 21 March, or the next working day (both days included) of every Reporting Year.
3. Use the date of 31 December of the calendar year preceding the Reporting Period as
   the Reference Date (e.g., 31 December 2025 for Reporting Year 2026).
   3 November 2025

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt This applies to all financial entities that are authorised by the Authority up until the Reference Date of every Reporting Year. Credit Institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013 and which are directly supervised by the European Central Bank (‘ECB’), are to be guided by the ECB regarding the submission of the RoI. Procedure for Submission of Information The RoI submission must be made to the Authority via the LH Portal. Access to the RoI submission project dedicated page requires an LH Portal account linked to the Authorised Person. In the case that the project is not present on the file uploads page of the LH Portal, the Authorised Person is kindly requested to send an email to roi@mfsa.mt with an access request, which has to include the:

• Authorised Person’s Name;
• Name and Surname of the individual requesting access to the LH Portal RoI Project;
• The Designation of the individual (e.g., Compliance Officer, CEO, etc.);
• Email address of the individual as reflected within the individual’s LH Portal account.
  A RoI submission is only considered DORA compliant once it attains the status of ‘Accepted’ on the LH Portal. Should the status instead reflect ‘Rejected’, the Authorised Person is gently requested to review the feedback provided via the LH Portal and/or email, address the identified issue/s, and resubmit the RoI accordingly. The Authority would like to emphasise that it is not an XBRL Provider, and it is not able to make changes to RoI submissions or to provide extensive technical advice on the matter. The responsibility to create, maintain, and to submit (including any format conversions) a RoI in a DORA compliant ‘plain-csv’ format, is that of Authorised Persons. Failure of Reporting Obligation For the avoidance of doubt, the deadline(s) provided by this Circular further specify the requirement provided under Article 28(3) of the DORA Regulation and shall constitute the actual deadline(s) for submission of the Register of Information to the Authority. Failure to submit a fully validated and DORA compliant RoI with final acceptance confirmed on the LH Portal within the above-mentioned annual Reporting Period may result in regulatory action by the Authority by virtue of the L.N. 166 of 2024 and the MFSA Act.

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Resources and Technical Package The following resources provide essential guidance to support the accurate completion of a financial entity’s RoI submission and to ensure that a RoI is fully compliant with both the DORA Regulation and the ESAs Reporting Rules:

• The ICT Third-Party Risk section of the SIRC function Webpage within the MFSA
  website;
• The EBA Webpage dedicated to the preparations for reporting of DORA RoIs, including
  FAQs and the latest applicable Reporting Technical Package;
• The DORA Regulation Level 1 Text;
• The DORA Regulation Level 2 Text, i.e, the ITS with regard to Standard Templates for
  the RoI.
  Financial entities are to ensure that their RoI is aligned with the latest RoI Reporting Technical Package as provided by the ESAs, which can be updated from time to time, on an ongoing basis. Contact Points For any issues encountered with the RoI submission, Authorised Persons are kindly required to reach out to the Supervisory ICT Risk and Cybersecurity (‘SIRC’) function at roi@mfsa.mt. Alternatively, the ESAs can also be directly contacted using the following contact points:
• DORA Technical Support Team: DORA-Technical-Support@eba.europa.eu;
• DORA Business Support Team: ESA-DORA-Reporting@eba.europa.eu.