MFSA findings on digital operational resilience in 2025

The Malta Financial Services Authority (MFSA) has published its general observations following the execution of its annual Supervisory Engagement Plan for 2025, conducted by the Supervisory ICT Risk and Cybersecurity (SIRC) function. This plan, grounded in a risk-based and outcomes-focused supervisory methodology, assessed licence holders’ adherence to digital operational resilience requirements, as outlined in the MFSA Supervisory Priorities 2025.

The MFSA noted progress across the sector in continuously fortifying digital operational resilience. Its findings also identified areas requiring further attention and improvement.
 

Supervisory priorities

The MFSA concentrated its supervisory efforts on three core areas which are:

1. The information and communication technology (ICT) risk management framework, including the required documentation that Digital Operational Resilience Act (DORA) mandates financial entities to have;
2. ICT-related incident management; and
3. The ICT third-party risk management.

Across all the assessed controls in these key areas, it was noted that 74% were fully achieved, 16% partially achieved, and 10% not achieved, reflecting continued improvement compared to 2024.

ICT risk management

There is continuous improvement as to how ICT risks are identified and mitigated by licence holders. For those who were unable to fully achieve the assessed controls, demonstrated challenges in the following:

• maintaining a register of ICT risk sources;
• assessing cyber threats and ICT vulnerabilities;
• establishing crisis communication plan for major ICT incidents;
• implementing communication policies for internal and external stakeholders; and
• testing of prompt detection of anomalies.

Incident management

The MFSA observed progress in ICT incident management and reporting, although there are still licence holders who continue to struggle with classifying incidents and assessing their impact as per DORA’s prescribed criteria. Significant cyber threats are also not consistently assessed against the criticality of the services they could affect.

These gaps can delay response and reporting, increasing the risk that threats are underestimated or not escalated promptly.

Digital operational resilience testing

While progress has been observed across industries establishing digital operational resilience testing practices, there are still gaps when it comes to execution of the appropriate tests at least on an annual basis especially those concerning critical or important functions.   

Third-party risk management

While progress has been made in assessing ICT concentration risk, the MFSA identified a need to strengthen oversight of ICT third-party providers such as:

• aligning contracts with DORA requirements including key provisions and audit rights;
• reviewing ICT third-party policies;
• conducting due diligence and monitoring providers; and
• establishing exit and termination strategies.

MFSA recognises the progress made towards DORA compliance but emphasises that sustained effort is needed to address remaining gaps, embed regulatory requirements in day-to-day practices and strengthen operational resilience across the sector.

For reference, the full MFSA letter can be accessed here.

How can Deloitte help?

Deloitte can help you strengthen your existing risk and control framework through our Risk Navigator, as DORA-related supervisory expectations continue to evolve and regulatory scrutiny increases.

We can assess your existing arrangements, strengthen reporting and monitoring, and provide ongoing support across risk, information security, third-party risk and compliance. Our integrated approach helps you respond to evolving requirements and prepare for regulatory reviews and inspections.

Speak to us for more information on our solutions.