MaltaMalta DORA Regulations (S.L. 330.20)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA), comply with DORA as implemented in Malta by these regulations; DORA prevails if the two differ (regulations 1(3) and 3).NIST CSF 2.0GV.OC-03
- Send major ICT-related incident reports and any voluntary notifications of significant cyber threats to the Malta Financial Services Authority, the competent authority that receives them under DORA Article 19 (regulation 4(3)).NIST CSF 2.0RS.CO-02
- Give the Malta Financial Services Authority the documents and data it asks for, attend on-site inspections and investigations and answer its questions, and carry out the corrective and remedial measures it requires (regulation 7).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulation 11(1) makes failing to comply with an Authority order, concealing or refusing to produce a required document, giving false or misleading information, obstructing the Authority and contravening DORA or the implementing regulations offences punishable by imprisonment for up to one year, a fine of up to EUR 150,000, or both; under regulation 8(5) no criminal proceedings may be taken or continued against a person on whom the Authority has imposed an administrative penalty for the same act.
Penalty structure
Regulation 8(1) caps an administrative penalty at EUR 150,000 for each infringement or failure to comply.
- Rule
- Per violation only
- As of
- Currency
- EUR
- Per violation unit
- Violation
- Per violation amount
- 150,000
Who enforces it
Enforcement body
Malta Financial Services Authority, the competent authority under regulation 4(1) and DORA Article 46; the European Central Bank for significant credit institutions and the European Securities and Markets Authority for trade repositories, credit rating agencies and critical benchmark administrators (regulation 4(2)).
Settledness
- As of
What this law does
The Malta Financial Services Authority Act (Digital Operational Resilience Act (DORA)) Regulations, 2024 (Legal Notice 166 of 2024) implement Regulation (EU) 2022/2554 (DORA) in Malta, apply to the financial entities listed in Article 2(1) of DORA, and give way to DORA in any conflict. The regulations were published in Government Gazette Supplement No. 21,285 on and came into force on .
Regulation 4 designates the Malta Financial Services Authority as Malta's competent authority under DORA Article 46 and the recipient of major ICT-related incident reports and voluntary notifications of significant cyber threats under DORA Article 19, without prejudice to the European Central Bank for significant credit institutions and the European Securities and Markets Authority for trade repositories, credit rating agencies and critical benchmark administrators.
Regulation 7 lets the Authority access documents and data, carry out on-site inspections and investigations, summon representatives of financial entities for explanations and require corrective and remedial measures for breaches of DORA and the implementing regulations or rules, and regulation 6 lets it issue Rules.
Regulation 8(1) lets the Authority impose administrative measures and penalties of up to EUR 150,000 for each infringement or failure to comply, and regulation 8(2) adds cease-and-desist orders, public notices naming the person, and the power to apply penalties and measures to members of the management body.
Regulation 11 makes it an offence to fail to comply with an Authority order, to conceal or refuse to produce a required document, to give false or misleading information, to obstruct the Authority, or to contravene a provision of DORA or the implementing regulations or rules, punishable on conviction by imprisonment for up to one year, a fine of up to EUR 150,000, or both.
When LexLint raises it
When your app profile says your app provides financial services.