Is a bank, in Malta

S.L. 330.20, Malta Financial Services Authority Act (Digital Operational Resilience Act (DORA)) Regulations, 2024 (L.N. 166 of 2024) · Read the law's page

• If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA), comply with DORA as implemented in Malta by these regulations; DORA prevails if the two differ (regulations 1(3) and 3).when it serves a financial business
• Send major ICT-related incident reports and any voluntary notifications of significant cyber threats to the Malta Financial Services Authority, the competent authority that receives them under DORA Article 19 (regulation 4(3)).when it serves a financial business
• Give the Malta Financial Services Authority the documents and data it asks for, attend on-site inspections and investigations and answer its questions, and carry out the corrective and remedial measures it requires (regulation 7).when it serves a financial business

S.L. 627.03, regs. 1(3), 3(2), 3(4), 4(3), 4(5), 5, 13, 14 and Annexes I, V (L.N. 214 of 2022), Accessibility Measures (European Accessibility Act) Regulations · Read the law's page

• If you provide to consumers after 28 June 2025 an electronic communications service (other than a transmission service used for machine-to-machine services), a service providing access to audiovisual media services, the websites, mobile applications, electronic tickets and ticketing, transport information and self-service terminals of an air, bus, rail or waterborne passenger transport service, a consumer banking service, e-books and dedicated software, or an e-commerce service, make the service comply with Section III of Annex I (not for urban, suburban and regional transport services) and Section IV of Annex I, subject to regulation 14 (regs. 3(2), 4(1) and 4(3)); this implements Articles 4 and 13 of Directive (EU) 2019/882.
• Make websites, including the related online applications, and mobile device-based services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Annex I, Section III, paragraph (c)).
• Make the products you use to provide the service accessible under Section I of Annex I and, where applicable, Section II, and give information about how the service works, its link to those products and their accessibility characteristics and interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable way, in text formats that can generate alternative assistive formats, in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing, with non-textual content supplemented by an alternative presentation (Annex I, Section III, paragraphs (a) and (b)).
• Where you offer support services such as help desks, call centres, technical support, relay services or training, give information on the accessibility of the service and its compatibility with assistive technologies in accessible modes of communication (Annex I, Section III, paragraph (d)).
• For electronic communications services, provide real time text in addition to voice, total conversation where video is provided in addition to voice, and synchronised emergency communications by voice and text (including real time text) and, where video is provided, total conversation, transmitted to the most appropriate public safety answering point (Annex I, Section IV, paragraph (a)).
• For services providing access to audiovisual media services, provide electronic programme guides that are perceivable, operable, understandable and robust and give information about the availability of accessibility, and transmit subtitles for the deaf and hard of hearing, audio descriptions, spoken subtitles and sign language interpretation with adequate quality, synchronised with sound and video and under user control (Annex I, Section IV, paragraph (b)).
• For air, bus, rail and waterborne passenger transport services other than urban, suburban and regional transport services, give information on the accessibility of vehicles, the surrounding infrastructure and the built environment and on assistance for persons with disabilities, and information about smart ticketing, real-time travel information and additional service information; for urban, suburban and regional transport services, make the self-service terminals you use accessible under Section I of Annex I (Annex I, Section IV, paragraphs (c) and (d)).
• For consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information understandable without exceeding level B2 (upper intermediate) of the Council of Europe Common European Framework of Reference for Languages (Annex I, Section IV, paragraph (e)).
• For e-books, provide synchronised text and audio where an e-book contains audio, do not prevent assistive technology from operating properly, ensure access to the content, navigation and layout, allow alternative renditions interoperable with assistive technologies, make e-books discoverable through accessibility metadata, and ensure that digital rights management does not block accessibility features (Annex I, Section IV, paragraph (f)).
• For e-commerce services, give the information on the accessibility of the products and services being sold when you are the responsible economic operator and it is provided, and make the identification, security and payment functions, identification methods, electronic signatures and payment services perceivable, operable, understandable and robust (Annex I, Section IV, paragraph (g)).
• Where Sections I to VI of Annex I do not address a function of the service, make that function accessible by meeting the functional performance criteria of Section VII, which include at least one mode of operation that does not require vision, hearing, vocal input, perception of colour or fine motor control (Annex I, Section VII).
• Design and provide the service in accordance with the accessibility requirements of the Regulations (reg. 13(1)).
• Prepare the information required by Annex V on how the service meets the accessibility requirements, include it in the general terms and conditions or an equivalent document, make it available to the public in written and oral format, including in a manner accessible to persons with disabilities, and keep it for as long as the service is in operation (reg. 13(2); Annex V).
• Provide information demonstrating that the service delivery process and its monitoring ensure compliance of the service with point 1 of Annex V and with the applicable requirements of the Regulations (Annex V, point 3).
• Keep procedures in place so that the service stays in conformity, taking into account changes in the characteristics of the service, in the accessibility requirements and in the harmonised standards or technical specifications by which the service is declared to meet them (reg. 13(3)).
• If the service does not conform, take the corrective measures necessary and immediately inform the competent national authorities of the Member States where the service is provided, with details of the non-compliance and the corrective measures; on a reasoned request, give a competent national authority all the information needed to demonstrate conformity and cooperate on action to bring the service into compliance (regs. 13(4) and 13(5)).
• If you rely on the fundamental alteration or disproportionate burden ground in regulation 14(1), assess it against the criteria in Annex VI, document the assessment, keep the results for five years after the service was last provided and give the authority a copy on request; renew the assessment for each category or type of service when the service is altered, when the authorities responsible for checking compliance of services ask, and at least every five years (regs. 14(2), 14(3) and 14(5)).
• Do not rely on the disproportionate burden ground where you receive funding from other sources than your own resources for the purpose of improving accessibility, and send the market surveillance authority or the relevant competent authority information that you rely on regulation 14(1) for a specific service (regs. 14(6) and 14(7)); regulation 14(7) ends with the proviso that sub-regulation (1) shall not apply to microenterprises, while Article 14(8) of Directive (EU) 2019/882 exempts microenterprises only from sending that information.
• If you are a microenterprise providing services, regulation 4(5) exempts you from complying with the accessibility requirements referred to in regulation 4(3) and any obligations relating to the compliance with those requirements, and regulation 4(1) applies in accordance with regulation 4(5); regulation 2 defines a microenterprise as an enterprise which employs fewer than ten persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million (regs. 2, 4(1) and 4(5)).

S.L. 460.41, arts. 18, 19 and 24, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of incidents on the recipients of your services and on other services (article 19(1)).
• Base those measures on an all-hazards approach and cover at least: policies on risk analysis and information system security; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of the measures; basic cyber hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; human resources security, insider risk management, access control and asset management; multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems where appropriate; and logging and traceability (article 19(2)).
• When choosing supply chain measures, take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of its products and cybersecurity practices, including its secure development procedures (article 19(3)).
• Appoint a security liaison officer with the necessary expertise, who develops and maintains your business continuity plans, ensures risk assessments are carried out, maintains and exercises your operator security plan and acts as your point of contact with the CIP Department or the designated competent authority (article 19(1)(c)).
• Receive CSIRT monitoring services from an internal CSIRT or an autonomous CSIRT that meets the requirements of article 9(1) (article 19(1)(d)).
• Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).
• Register on the national self-registration mechanism of the CIP Department with your name, the CSIRT providing monitoring services to you, your contact details and IP ranges, your sector and the Member States where you provide services, and notify it of any change without delay and within two weeks (article 7(4) and (5)); a DNS service provider, top-level domain name registry, domain name registration service, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider also submits the article 24(1) registry information by the prescribed date and notifies changes within three months.
• Where you find you do not comply with the measures in article 19(2), take, without undue delay, all necessary, appropriate and proportionate corrective measures (article 19(4)).
• This binds an essential or important entity under articles 3 and 4 of the Order that falls under Malta's jurisdiction under article 23: an entity established in Malta or, for a DNS service, top-level domain name registry, domain name registration, cloud computing, data centre, content delivery network, managed service, managed security service, online marketplace, online search engine or social networking services platform provider, one whose main establishment in the Union is in Malta or whose Union representative is established in Malta. It reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and are named in the First or Second Schedule, or where the Order names you regardless of size; the Second Schedule names online marketplace, online search engine and social networking services platform providers, and the wider sector classes it reaches (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT services management, public administration, space and others) are reached by declaring that you are an essential or important entity.