In application
DORA: Operational resilience rules in application
ICT risk, register of third parties, incident reporting to the MFSA and testing.
Financial Services
AI and platforms ready for the supervisor’s questions.
For credit institutions, insurers, investment services firms and payment institutions in Malta we build AI whose output you can explain to the MFSA, integrations that leave the core intact and operations planned around DORA from the very first design choice.
For credit institutions, insurers and investment services firms licensed in Malta, supervised by the MFSA and, for significant banks, by the ECB.
17 January 2025
DORA in application
ICT risk management, a register of third-party arrangements, incident reporting and resilience testing, with the MFSA as competent authority in Malta.
10 July 2027
AML Regulation in application
A single EU rulebook for customer due diligence, coordinated by the new authority AMLA.
2 December 2027
High-risk AI rules for lending and insurance
Creditworthiness checks and pricing of life and health cover are high-risk uses, on the timetable amended in 2026.
What is shifting for MFSA licence holders
Resilience has become law
Since January 2025 DORA has spelt out what operational resilience means: managing ICT risk, keeping a register of every ICT third-party arrangement, classifying and reporting incidents, and testing regularly. In Malta major incidents go to the MFSA through its Licence Holder Portal, and cloud and AI providers now sit within the supervisor’s view.
Every AI decision needs a trail
Under the AI Act, credit scoring and insurance pricing are classed as high-risk, and Malta has named the MDIA as lead market surveillance authority. Model risk management must now reach machine-learning and generative models, with documentation, monitoring and human oversight in line with the impact of each decision.
Clients measure you against the best apps
Instant payments, payee name checks and open banking have made people expect speed and clarity. The coming payment services rules will push fraud prevention and API quality further still.
Decades of rules live in the core
Mainframes and core banking or policy platforms still keep the books. Change has to be built around them with APIs and events, without endangering stability or the returns you file with the MFSA.
Where licence holders get stuck, and what we build
- The challenge
Client onboarding and periodic reviews rely on analysts reading every document manually.
Our responseDocument intelligence reads and cross-checks evidence of identity, beneficial ownership and source of funds. Analysts look at the cases it flags, and each check is logged for auditors and for the forthcoming EU AML rulebook.
- The challenge
Relationship managers and service staff consult five systems for a single answer.
Our responseAn assistant that respects permissions, covers products, policies and procedures, names its sources and records what it displayed, so the advice file is never incomplete.
- The challenge
Any change to the core takes months, costs a lot and carries risk.
Our responseCore functions are opened up through APIs and event streams, moved out one at a time, and reconciled continuously until the old route can be switched off.
- The challenge
The DORA register of information and incident handling run on spreadsheets.
Our responseWe put the register, incident classification and the reporting steps towards the MFSA into your service management and cloud tooling, mapped to the critical or important functions each one supports.
- The challenge
A model that nobody can explain fails validation.
Our responseAn evaluation framework settled with your risk and validation functions: test sets, explanations where the decision calls for them, drift monitoring and a documented way for a person to override.
- The challenge
Supervisory returns are reconciled manually each quarter.
Our responseData pipelines with recorded lineage and automatic quality checks, built on the BCBS 239 principles, so each reported figure leads back to its source.
A reference landscape with control built in
AI placed between the channels and the core, with an approval step before any consequential action and the DORA controls running next to every layer.
Illustrative example
AI services reach the core only through the integration layer, and the DORA controls cover every component.
Read the diagram as text
Clients, relationship managers and service staff work through the app, the website, the branch and the contact centre.
Behind those channels are three AI services: document intake for onboarding and KYC, an assistant for advisers and service staff, and an analyst approval step that every consequential decision goes through.
The AI services connect to core systems only through an integration layer of APIs and event streams. The core systems are core banking or policy administration, the CRM and service platform, and a data platform whose lineage is documented.
Next to every layer run the DORA controls: ICT risk management, the register of ICT third-party providers, incident classification and reporting, and resilience testing. Each model is registered, validated and monitored within model risk management.
Approval comes first
AI prepares drafts, reads documents and makes suggestions. A named member of staff decides on credit, claims and account restrictions.
Explanations planned from the start
How much explanation each type of decision needs is settled during design, not added just before validation.
Exit and concentration risk
Cloud and model providers are selected with documented exit plans and alternatives, ready for the register of information.
Logs that serve as evidence
Inputs, outputs, model versions and approvals are retained, so the MFSA, the ECB where it supervises and your auditors can retrace any case.
Key dates for Maltese financial institutions
The dates that change what a delivery partner has to prove. The MFSA and the European supervisory authorities publish guidelines and technical standards on top of them.
In application
AI Act: Banned practices and AI literacy take effect
In application
AMLA: AMLA begins its work
Preparing the single rulebook and the direct supervision of certain institutions.
In application
Instant Payments Regulation: Payee checks mandatory for euro transfers
Payment providers in the euro area, Malta included, verify the payee’s name before they execute a transfer.
In application
AI Act: Transparency duties start
Clients must be informed when they are interacting with an AI system.
Status on 2 October 2026
Upcoming
AML Regulation: One EU rulebook in application
Harmonised rules on due diligence, beneficial ownership and record keeping.
Upcoming
AI Act: High-risk duties start
Covering creditworthiness checks and life and health insurance pricing, on the timetable amended in 2026.
Upcoming
AMLA: AMLA starts supervising selected institutions
Laws and standards at a glance
The EU instruments that shape most AI and platform work at Maltese licence holders, with the effect each has on a delivery programme.
This summary is meant for planning and is neither legal nor regulatory advice. EU dates were reviewed on 2 October 2026 and the Maltese references on 4 November 2026.
- DORAScopeEU-wide
The Digital Operational Resilience Act has applied since 17 January 2025 to credit institutions, insurers, investment firms, payment institutions and other financial entities. It sets rules on ICT risk management, incident reporting, resilience testing and ICT third-party risk, including mandatory contract clauses (Article 30). Legal Notice 166 of 2024 made the MFSA the competent authority in Malta, and major incidents are reported through its Licence Holder Portal.
What it means for your firmAs your ICT provider we help you meet these duties: contract clauses, incident notifications, exit plans, taking part in tests and the details your register of information requires.
SourceRegulation (EU) 2022/2554, EUR-Lex (opens external site)
- EU AI ActScopeEU-wide
AI that assesses an individual’s creditworthiness or sets risk-based premiums for life and health insurance is high-risk. Providers and deployers must put in place risk management, data governance, logs, human oversight and documentation, from 2 December 2027 under the 2026 amendment. In Malta, Legal Notice 226 of 2025 designates the MDIA as lead market surveillance authority and single point of contact.
What it means for your firmEach use case is classified early, human oversight is part of the process design and the documentation slots into your model risk framework.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- EU AML package (AMLR and AMLA)ScopeEU-wide
From 10 July 2027 the Anti-Money Laundering Regulation replaces national customer due diligence rules with a single EU rulebook. AMLA, the new authority, coordinates national supervisors and will supervise a selection of high-risk institutions itself.
What it means for your firmOnboarding and review need consistent handling of evidence and a complete audit trail, and we design document intake and case workflows to that level.
SourceRegulation (EU) 2024/1624, EUR-Lex (opens external site)
- GDPR and automated decisionsScopeEU-wide
Under Article 22, a person may refuse to be subject to a decision taken solely by automated means that significantly affects them, unless an exception applies with safeguards such as human intervention and a right to contest. In Malta the IDPC supervises the GDPR.
What it means for your firmOur processes let a staff member review, explain and alter an automated outcome, and keep a record that it happened.
SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)
- MiFID II and IDD advice recordsScopeEU-wide
The rules on investment services and insurance distribution call for suitability or demands-and-needs assessments and a record of the advice. Once AI supports an adviser, its output belongs in that record.
What it means for your firmAssistants record what they displayed and the sources behind it, so every advice file remains complete and open to review.
- PSD2 and the next payment services rulesScopeEU-wide
Payment services and open banking access currently fall under PSD2. PSD3 and the Payment Services Regulation, provisionally agreed in 2025, will follow and raise the bar for fraud prevention and API performance once their transition period ends.
What it means for your firmAn API platform built today should already plan for tighter performance targets, monitoring and the sharing of fraud data.
SourceDirective (EU) 2015/2366, EUR-Lex (opens external site)
Illustrative use cases for licence holders
Illustrative exampleDocument checks at onboarding
ID and ownership documents are read and compared at an investment services firm; an analyst rules on each flagged case and escalates to compliance where needed.
Knowledge assistant for relationship managers
Answers on products, policies and procedures with their sources, limited to what the relationship manager is allowed to see.
Complaints intake and triage
Each complaint is sorted by subject and urgency and sent on with a draft summary, while the response deadlines set by the complaints rules are tracked.
Claims intake at an insurer
Claim forms, invoices and reports are read and linked to the right policy; a claims handler signs off every payment.
Core banking functions exposed through APIs
Transactions on a credit institution’s mainframe become documented APIs and events, so new channels no longer wait for overnight batch files.
Platforms used by licence holders
Salesforce
Summit PartnerClient service at an insurer or investment services firm, onboarding journeys and adviser workspaces, linked to core systems and document intake.
SAP
Gold PartnerFinance and group consolidation, with SAP data passed to risk and supervisory reporting and its lineage documented.
The partner levels shown are FromNine’s own. Product names are trademarks of the companies that own them.
Malta
One regulator, EU rules
In Malta a single regulator, the MFSA, supervises credit institutions, insurers and investment services firms, while the ECB supervises the significant banks directly. The MFSA is also the competent authority under DORA, designated by Legal Notice 166 of 2024, and receives major ICT incident reports through its Licence Holder Portal.
The AI Act adds another Maltese authority to the picture: Legal Notice 226 of 2025 makes the MDIA the lead market surveillance authority, and the IDPC continues to supervise personal data. From 2028 AMLA will supervise some institutions directly.
We produce the evidence once and keep it current for whichever authority asks: architecture and model documentation, logs, test results and exit plans, all updated as the system changes.
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- AML RegulationAnti-Money Laundering Regulation (EU) 2024/1624 (single rulebook), with AMLA (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- Malta AI Act designationsLegal Notices 226 and 227 of 2025: the Malta Digital Innovation Authority (MDIA) as lead market surveillance authority, the IDPC for certain Annex III high-risk systems (opens external site)
Questions from licence holders
As a supplier, how do you help with our DORA duties?
We sign the contract clauses DORA calls for, tell you about incidents through the channel we agree so you can report to the MFSA via the Licence Holder Portal, keep exit plans documented, join your resilience tests and provide the details your register of information needs.
May AI support lending or underwriting decisions?
Yes, as a high-risk use under the AI Act, which means risk management, data governance, logs, human oversight and documentation, with the MDIA as Malta’s lead market surveillance authority. In our designs a member of staff takes the decision and can explain it, and the GDPR safeguards on automated decisions are kept.
Where will models and data run?
Wherever your risk appetite permits: your own cloud tenancy, an EU region of a public cloud, or your own data centre for sensitive workloads, with data kept within the EU. The choice of model and hosting is recorded together with exit options for your register of information.
Must we replace our core banking or policy system?
No. Integration is our starting point and modernisation happens step by step: APIs and events around the core come first, functions move out only where that brings a clear benefit, and reconciliation runs until the old route is closed.
How is generative AI evaluated in regulated work?
Before release, against test sets and quality thresholds agreed with your risk and validation teams; after release, through monitoring and review of uncertain output. We plan on the basis that some answers will be wrong and route those to staff.
Talk to us about your financial-services programme
Planning AI for onboarding, advice or claims, or getting your systems ready for DORA testing? Speak to engineers who design for the MFSA as much as for your clients.