Applying MFSA’s Outcome-Based Supervision to ICT Risk
DECEMBER 04, 2024

Outcome-Based Supervision

Building on the Malta Financial Services Authority’s (MFSA, the Authority) Risk-Based Approach, this year the Authority introduced an Outcome-Based approach to Supervision in various areas. In the area of ICT Risk and Cybersecurity, this approach is being led by the MFSA’s Supervisory ICT Risk & Cybersecurity (SIRC) function and aims to enhance ICT Risk Management as well as increase Digital Operational Resilience across the sector.

Adopting an Outcome-Based approach to Supervision involves a three-year cycle where Authorised Persons’ compliance is assessed on the first year and reassessed on the third year, following a period of outreach and remediation in the second year. Using this approach, the Authority would be in a position to measure the effectiveness, and therefore the outcome, of its supervisory efforts.

Here is an analysis of how this approach is applied:

Setting the Desired Outcomes

Based on previous engagements with Licence Holders and regulatory developments within the sector, the MFSA identified four priorities for 2024, in the area of ICT Risk and Cybersecurity, these being:

  • Sufficient DORA preparedness - the aim here is to engage with supervised entities on their preparations to comply with Regulation (EU) 2022/2554 and Amending Directive (EU) 2022/2556 (the “DORA Regulation”) by 17 January 2025
  • Implementation of strong risk management and compliance functions, with an emphasis on ICT risk.
  • Adequate incident management processes – the objective of this outcome is to assess whether financial entities are adequately managing their incident management policies, procedures, tools, and resources including timely detection, reporting, and escalation of incidents.
  • Satisfactory status of ICT Third-Party Providers - through this outcome, the Authority assessed the interpretation and implementation of the current applicable Acts, Regulations, Rules and/or sector-specific Guidelines on ICT Outsourcing Arrangements and against DORA provisions.

A detailed description of the outcomes can be found here.