Understanding DORA’s evolving requirements and the MFSA’s latest supervisory expectations for Maltese financial services firms.
The
financial services industry has become increasingly reliant on technology. From online banking and digital payments to investment platforms and cloud-based systems, technology is now central to the delivery of financial services. However, greater digitalisation also brings increased exposure to cyber threats, system failures and operational disruptions.
In response to these risks, the European Union introduced the
Digital Operational Resilience Act (Regulation (EU) 2022/2554) (“DORA”), establishing a harmonised framework to strengthen digital operational resilience across the financial sector. Although DORA became applicable on the 17
th January 2025, its implementation remains a key regulatory priority, including for financial services firms operating in Malta.
What does DORA actually require?
DORA aims to ensure that financial entities can withstand, respond to and recover from information and communication technology (‘ICT’)-related disruptions. Rather than focusing solely on cybersecurity, it adopts a broader approach to operational resilience, recognising the potential impact of technology-related incidents on business continuity, customers and financial stability.
The Regulation focuses on five key areas: ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management and information sharing relating to cyber threats.
DORA applies to a broad range of financial entities, including credit institutions, payment institutions, electronic money institutions, investment firms, fund managers, insurance and reinsurance undertakings, crypto-asset service providers and various other regulated entities identified in Article 2 of the Regulation.
However, its scope is subject to specific exclusions and exemptions, as well as simplified requirements applicable to certain categories of financial entities. Furthermore, the application of DORA’s requirements is guided by the principle of proportionality, taking into account factors such as the size of the entity, its overall risk profile and the nature, scale and complexity of its activities. Accordingly, determining how DORA applies in practice requires an assessment not only of an entity’s regulatory status, but also of the specific activities it carries out and the risks to which it is exposed.
The MFSA’s latest findings: Is the industry keeping up?
The Malta Financial Services Authority (‘MFSA’) published its Supervisory Engagements and Digital Operational Resilience 2025 – General Observations Report on the 23rd October 2026, offering valuable insight into DORA implementation within Malta’s financial services sector.
The findings show encouraging progress: 74% of the controls assessed during the MFSA’s 2025 supervisory engagements were fully achieved, 16% were partially achieved and 10% were not achieved. Nevertheless, the Authority identified recurring weaknesses among licence holders whose controls were not fully achieved, particularly in ICT governance and risk management, incident classification, resilience testing and contractual arrangements with ICT third-party service providers. These findings highlight the importance of not only establishing appropriate policies and procedures, but also ensuring that these are effectively implemented, documented and regularly reviewed.
The message is clear: having policies and procedures in place is not enough. Financial entities must also demonstrate that their frameworks are effectively implemented, regularly reviewed and capable of operating in practice.
Third-party Outsourcing: You can outsource the service, but not the responsibility
One of the most significant practical considerations under DORA is the use of external ICT service providers.
Financial institutions increasingly rely on third parties for cloud computing, data storage, payment processing and cybersecurity solutions. While these arrangements offer commercial and operational advantages, they can also introduce significant risks, particularly where a provider supports a critical or important function. Financial entities must therefore maintain visibility and oversight of their ICT third-party dependencies and continuously assess the risks associated with outsourced ICT services, taking into account both the nature of the services provided and their importance to the continuity of business operations.
DORA requires financial entities to maintain appropriate oversight throughout the lifecycle of these arrangements. This includes conducting due diligence, assessing concentration risks, monitoring providers and ensuring that appropriate contractual safeguards are in place.
Outsourcing agreements should therefore adequately address matters such as service levels, data security, access and audit rights, incident assistance, subcontracting, business continuity and termination arrangements, as applicable.
The MFSA’s findings indicate that certain licence holders continue to face difficulties in ensuring their contractual arrangements fully reflect DORA’s requirements. Financial entities should consequently review existing ICT service agreements rather than assume that contracts entered into before DORA became applicable automatically meet the relevant regulatory standards.
Incident Management and Resilience Testing: Preparation is key
DORA also places considerable emphasis on the ability of financial entities to identify, manage and report ICT-related incidents.
A cyberattack, system outage or disruption affecting an external service provider can compromise an entity’s ability to deliver services. Financial entities must therefore have appropriate procedures to identify and classify incidents, assess their impact, escalate matters internally and comply with applicable regulatory reporting obligations.
The MFSA has highlighted difficulties among certain licence holders in consistently applying DORA’s incident classification criteria. This reinforces the importance of clear internal responsibilities and regularly reviewed incident response procedures.
Equally important is resilience testing. Financial entities must establish appropriate testing programmes to identify vulnerabilities and assess whether their systems can withstand and recover from disruptions. This should also include considering scenarios involving the failure or insolvency of important ICT third-party providers, rather than focusing exclusively on internal systems.
What should financial services firms be doing now?
With DORA firmly embedded in the EU regulatory framework, financial entities should be asking themselves an important question: if a significant ICT disruption occurred tomorrow, would their organisation be adequately prepared to respond and recover?
Rather than treating compliance as a one-off exercise, firms should view digital operational resilience as an ongoing governance and risk management priority. To assess whether their organisation is truly prepared, financial entities should consider the following key questions:
- Are your ICT risks properly managed? Ensure that potential vulnerabilities are identified, assessed and addressed before they develop into more serious operational issues.
- Are your outsourcing arrangements adequately protected? Review existing ICT service agreements to ensure that the necessary contractual safeguards and oversight mechanisms are in place.
- Would your organisation know how to respond to an ICT incident? Ensure that employees understand their responsibilities and that appropriate escalation and reporting procedures are established.
- How resilient are your systems in practice? Regularly test resilience arrangements to identify weaknesses and assess whether critical or important functions can continue, or be restored, following a disruption.
- Is digital resilience receiving sufficient attention at board level? Ensure that the management body and senior management actively oversee ICT risks and allocate adequate resources to managing them.
These considerations are particularly relevant in light of the MFSA’s 2026 Supervisory Priorities, which reaffirm the Authority’s focus on assessing ICT and cyber-resilience frameworks in line with DORA.
Ultimately, firms should not wait for a regulatory inspection or an operational incident to identify weaknesses. Taking proactive steps can help strengthen resilience, address potential regulatory shortcomings and minimise disruptions affecting both the business and its customers.
DORA represents more than another regulatory obligation. It reflects a broader shift in how financial institutions must approach technology-related risks, placing operational resilience, accountability and effective governance at the centre of their operations.
For Maltese financial services firms, the MFSA’s latest findings provide a useful indication of where supervisory attention is likely to remain focused in the coming years. Firms that proactively review their governance frameworks, contractual arrangements, incident response capabilities and ICT risk management measures will be better positioned to meet regulatory expectations and navigate an increasingly digital financial environment.
Ultimately, digital resilience is not simply about regulatory compliance. It is about protecting business continuity, maintaining customer confidence and ensuring that organisations can continue to operate effectively in an increasingly complex and interconnected digital environment. Firms that embed resilience into their governance, risk management and operational practices will be better positioned to meet regulatory expectations and navigate future challenges with confidence.
CSB Group can assist financial services firms in navigating their DORA obligations, reviewing
ICT-related contractual arrangements and strengthening their
regulatory compliance and digital operational resilience frameworks. Contact our team to discuss how we can support your business in addressing its regulatory responsibilities and managing technology-related risks effectively.
This article has been authored by Dr. Samira Zammit – Legal Advisor.
