The MFSA’s latest ICT circulars underline a clear supervisory focus on digital operational resilience, with particular scrutiny on authorisation applications, TLPT provider standards, and emerging cyber threat awareness. The message is that firms need stronger, more tailored documentation and a better practical grasp of DORA requirements, especially around ICT risk management and third-party oversight.
Among the main pressure points, the MFSA highlighted weaknesses in business continuity, incident handling, patch and vulnerability management, and contractual controls for ICT outsourcing arrangements. It also noted that overreliance on unverified generative AI in submissions can create generic or inaccurate materials that slow down authorisation processes.
Authors
Share this article
