Update on the Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Update on the Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements In December 2020 the Malta Financial Services Authority (‘MFSA’, the ‘Authority’) released its principle-based cross-sectoral Guidance on Technology Arrangements, ICT and Security Risk Management, and Outsourcing Arrangements (the ‘Guidance Document’) drawn primarily from European Supervisory Authorities’ (‘ESAs’) Guidelines. The scope and application are detailed under Title 1 of the Guidance Document. Since the release of the Guidance Document, there have been important legislative developments, most noticeably the adoption of Regulation (EU) 2022/2554 (the ‘DORA Regulation), as informed via Circular titled Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 on Digital Operational Resilience for the Financial Sector published on the EU Official Journal, published by the Authority in January 2023. The DORA Regulation is cross-sectoral and its scope is provided under Article 2. The DORA Regulation will not apply to certain sectors, whilst certain financial entities have been specifically excluded from its scope pursuant to Article 2(3). With a view to simplify the expectations of the Authority in relation to ICT and Security Risk Management & Outsourcing Arrangements, and to provide the required level of clarity at this stage, the Authority wishes to inform the industry that, as of the date of applicability of the DORA Regulation (17 January 2025):

1. The Guidance Document will no longer apply to Authorised Persons which are in
   scope of the DORA Regulation;
2. The Guidance Document will continue applying to Authorised Persons which are not
   in scope of the DORA Regulation. A list of such Authorised Persons is provided in
   Annex 1 of this Circular.
   The Guidance Document and the relevant Rules currently cross-referencing it, will be amended at a later stage to reflect the above-mentioned update. Authorised Persons may request further information or clarifications by sending an email to the Supervisory ICT Risk and Cybersecurity function on sirc@mfsa.mt. 26 March 2024

Circular
Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt
Annex 1 – Updated Applicability and Scope of the Guidance
Document as of 17 January 2025

• Trustees and other Fiduciaries.
• Company Service Providers.
• Professional Investor Funds (‘PIFs’), including self-managed PIFs.
• Investment Service Providers that are Custodians and Depositories.
• Recognized Fund Administrators.
• Managers of alternative investment funds as referred to in Article 3(2) of Directive
  2011/61/EU (‘De Minimis alternative investment fund managers’).
• Insurance intermediaries, reinsurance intermediaries and ancillary insurance
  intermediaries which are microenterprises or small or medium-sized enterprises.
• Institutions for occupational retirement provision which operate pension schemes
  which together do not have more than 15 members in total.
• Insurance and reinsurance undertakings as referred to in Article 4 of Directive
  2009/138/EC.
• Personal Retirement Schemes and Administrators of Personal Retirement Schemes.
• Financial Institutions that solely provide activities of the first schedule of the Financial
  Institutions Act (Cap. 376 of the Laws of Malta).
• Authorised Credit Servicers in terms of the Credit Services and Credit Purchasers Act.