DORA in Malta: what MFSA licence holders need from their ICT suppliers

01DORA in Malta as of November 2026

The Digital Operational Resilience Act (opens external site), Regulation (EU) 2022/2554, has been in application since 17 January 2025. Being a regulation, it needs no transposition: Malta designated the Malta Financial Services Authority (MFSA) (opens external site) as national competent authority by Legal Notice 166 of 2024, and licence holders report major ICT incidents through the MFSA’s Licence Holder Portal. The working detail lives in Commission technical standards covering the risk-management framework, the classification and reporting of incidents, the register of information, contract policies, subcontracting and threat-led penetration testing.

For financial entities DORA is the sector act that replaces the NIS2 provisions on ICT risk management, incident reporting and supervision, so a Maltese licence holder looks to DORA and the MFSA rather than to the NIS2 Order. On 18 November 2025 the European Supervisory Authorities, EBA, EIOPA and ESMA, announced (opens external site) the first critical ICT third-party providers that fall under their direct oversight.

02Licence holders and the ICT firms that serve them

DORA names twenty kinds of financial entity. In Malta the ones we meet most are credit institutions, insurers and investment services firms, but the list also takes in payment and electronic money institutions, crypto-asset service providers, fund managers, trading venues, insurance intermediaries, occupational pension institutions, credit rating agencies and crowdfunding platforms. The rules scale: Article 4 ties them to size, risk profile and complexity, and Article 16 offers a lighter framework to certain smaller entities.

An ICT third-party service provider is any undertaking that supplies ICT services, which DORA defines as digital and data services delivered through ICT systems to internal or external users on a continuing basis. Hosting, managed services, software as a service, application support and maintenance, and data services usually fall within it. A supplier is not itself supervised under DORA unless it is designated as critical, yet every licence holder writes its own obligations into the contracts it signs.

03The board owns the ICT risk

Under Article 5 final responsibility for ICT risk sits with the management body. The board defines, approves and supervises the risk-management framework, fixes the digital operational resilience strategy and the risk tolerance, signs off the business continuity policy and the response and recovery plans, and approves and reviews the policy for using ICT services from third parties. Its members have to keep their knowledge current, regular training included.

04Major incidents: 4 hours, 72 hours, one month

Each entity classifies ICT-related incidents against the criteria of Article 18, worked out in Delegated Regulation (EU) 2024/1772 (opens external site): the number of clients and transactions hit, how long the incident and any downtime last, its geographical reach, data lost, how critical the affected services are, and the economic effect. A major incident is then reported in three steps, on the timetable of Delegated Regulation (EU) 2025/301 (opens external site); in Malta the reports go to the MFSA through the Licence Holder Portal.

Clients whose financial interests suffer must hear about it without undue delay. An entity may let a third party file the reports, but under Article 19(5) the responsibility stays wholly with the entity.

This lands directly on suppliers. Each ICT contract has to oblige the provider to help when an incident linked to its service occurs, either free of charge or at a price fixed beforehand (Article 30(2)(f)). The licence holder can only hit its four-hour window if the supplier’s monitoring, logs and contact persons are ready before anything goes wrong.

05Testing, up to threat-led penetration tests

Article 24 asks for a testing programme based on risk and run by independent testers, internal or external, with suitable tests every year on all ICT systems and applications behind critical or important functions. Entities picked out by their competent authority must in addition run threat-led penetration tests on live production systems at least once every three years, under Delegated Regulation (EU) 2025/1190 (opens external site), which builds on TIBER-EU. Which Maltese entities are selected, and how the test is organised locally, is a matter for the MFSA’s guidance.

If a supplier’s services fall within a TLPT, the entity has to make sure the supplier participates (Article 26(3)), and the contract for a critical or important function must say so (Article 30(3)(d)). Where taking part could hurt the supplier’s other clients, DORA allows a pooled test: the supplier itself engages an external tester for several financial entities together (Article 26(4)).

06Third-party risk: strategy, register and a way out

Article 28 places ICT third-party risk inside the risk-management framework, and whatever a licence holder outsources, compliance remains its own. The main obligations:

• A third-party risk strategy, with a policy for ICT services that support critical or important functions, which the board reviews regularly.
• A register of information listing every contractual arrangement for ICT services at entity and group level, with those behind critical or important functions marked out. Implementing Regulation (EU) 2024/2956 (opens external site) fixes the templates. The entity reports on the register to its authority at least once a year and hands over the complete register when asked; the MFSA’s guidance sets how Maltese licence holders submit it.
• Checks before signing: does the service support a critical or important function, what are the risks, concentration risk included, is the supplier suitable, and are there conflicts of interest. Suppliers have to follow proper information security standards, and the most current and demanding ones where critical or important functions are involved.
• Rights to terminate, for example after a serious breach by the supplier, proven weaknesses in its ICT risk management, or circumstances that stop effective supervision.
• Exit strategies for ICT services behind critical or important functions, written down and tested, so the entity can leave without disrupting its business, weakening its compliance or harming its clients.

What has to be in the contract

Article 30 fixes the minimum terms. Each ICT contract must be written down, in a single document that includes the service levels, and must deal with at least:

• a full description of the services and functions, and whether subcontracting is permitted and under what conditions;
• where the services are delivered and where data is processed and stored, with prior notice of any move;
• the availability, authenticity, integrity and confidentiality of data, personal data included;
• access to data, its recovery and its return in an easily accessible format if the supplier becomes insolvent, stops the service or the contract ends;
• descriptions of the service levels;
• help with ICT incidents linked to the service, free of charge or at a price agreed beforehand;
• full cooperation with the competent and resolution authorities, in Malta the MFSA among them;
• rights of termination and minimum notice periods;
• taking part in the entity’s ICT security awareness programmes and resilience training.

Where the service supports a critical or important function, Article 30(3) adds exact quantitative and qualitative performance targets, duties to notify and report, contingency plans that the supplier puts in place and tests, participation in TLPT, unrestricted rights for the entity and its supervisor to access, inspect and audit, and an exit strategy with a compulsory transition period. Delegated Regulation (EU) 2025/532 (opens external site) describes what the entity must assess when such services are subcontracted.

07Critical ICT third-party providers

Article 31 lets the European Supervisory Authorities designate ICT providers that are critical to the financial sector, looking at systemic impact, how important the dependent financial entities are, the provider’s role in critical or important functions and how hard it would be to replace. One of the three authorities becomes Lead Overseer for each critical provider and may ask for information, investigate, inspect and make recommendations.

The first list (opens external site) of 18 November 2025 named 19 providers, ranging from cloud and data centre operators to telecoms, IT services, market data and enterprise software firms. A designation does not take any duty off the licence holder, which still keeps the register, the contract terms and an exit strategy for each of those providers.

08What an ICT supplier should have on file

Few suppliers to Maltese licence holders will ever be designated critical, but every one of them meets DORA in contracts, due diligence and audits. A supplier that has the following ready shortens the procurement and makes its client’s exchanges with the MFSA easier:

• Data for the register. What the client must record about you: legal entity and identifiers, the services you deliver and the functions behind them, locations, and the subcontractors further down the chain.
• Contract terms aligned with Article 30. Preferably a standard DORA addendum that answers both lists, so clauses are not negotiated one by one.
• Evidence for incidents. Monitoring, logs with dependable timestamps and a notification procedure that lets the client classify and report within hours.
• Continuity that has been tested. Contingency plans and restore tests, with their dates and outcomes.
• Security you can demonstrate. Information security standards, access control, a secure development lifecycle and vulnerability handling, with independent proof wherever possible.
• Ready for audits and tests. A practical way to receive auditors and inspectors and to join a TLPT, pooled where that suits.
• A way out. Data returned in formats the client can use, documentation and transition support for a period agreed in advance.

That is how we act as an ICT supplier to financial entities: we agree the contract terms DORA asks for, report incidents through the channel we agreed, document exit plans, join resilience tests and provide what your register of information needs. Our page on trust and compliance explains our way of working, including our ISO/IEC 27001 certification for information security management.

09A working plan for licence holder and supplier

1. 01Finish the register. Tie each ICT contract to the functions it supports and flag those that are critical or important.
2. 02Fill the contract gaps. Hold each contract against Article 30 and sign an addendum where terms are missing.
3. 03Agree how incidents are handled. Settle classification inputs, contact persons and notification times with each critical supplier, and try them out.
4. 04Bring suppliers into testing. Include them in the testing programme and, where it applies, in scoping a TLPT.
5. 05Write exit strategies and test them. Per critical or important function: the alternatives, how data comes back and how long the transition lasts.
6. 06Keep an eye on concentration. Relying on one provider for several critical functions is a risk to record and manage (Article 29).

10Your competent authority in Malta

The text of DORA is identical across the Union, but for most financial entities supervision stays national. Malta has a single financial services regulator, the MFSA, which supervises credit institutions, insurers and investment services firms; significant banks are supervised by the ECB. The format and channel for the register of information and for incident reports, and the arrangements for TLPT, are set nationally, so follow the MFSA’s guidance and its publications on ICT risk and cybersecurity.

11What to follow next

• The MFSA’s supervisory priorities and findings on the register of information and on incident reporting.
• How the Lead Overseers supervise critical ICT third-party providers, and any recommendation that affects services you rely on.
• The Digital Omnibus proposal (opens external site), COM(2025) 837, under which major incident reports under DORA would go through a single entry point operated by ENISA. In October 2026 the European Parliament had not yet finished with it; until it is adopted and applies, the Licence Holder Portal and the current time limits stay as they are.

Outside the financial sector, comparable supply-chain duties follow from NIS2, which Malta applies through its NIS2 Order; see our article on NIS2 and software suppliers. The European Supervisory Authorities collect the technical standards and the oversight framework on their DORA pages (opens external site).