In its General Observations Report dated 23 October 2026, the MFSA found that 74% of the controls it assessed in 2025 were fully achieved, with gaps in ICT governance, incident and cyber threat classification, digital operational resilience testing and the practical implementation of the RTS on the ICT Risk Management Framework and on the ICT third-party service providers.
The assessment covered three areas drawn from the ESAs’ “DORA Day 1” expectations: ICT risk management, incident management and ICT third-party risk. The gaps below apply only to licence holders whose controls were rated partially or not achieved.
The MFSA notes clear improvement across DORA Chapters II to V, but recurring weaknesses persist:
- ICT risk management: incomplete risk registers, missing crisis communication plans and detection mechanisms that are not tested regularly.
- Incident management: incidents and cyber threats not classified in line with DORA criteria, which can delay handling, reporting and escalation.
- Resilience testing: no approved testing programme at some firms, and critical or important systems not all tested at least annually.
- Third-party risk: contracts missing DORA’s key provisions (or absent altogether), and weak oversight, due diligence and exit planning.
- Technical standards: insufficient practical implementation, with weak spots in business continuity testing, capacity and performance management, logging, project management and encryption.
The MFSA is encouraged by the progress licence holders made in 2025 and noted increased commitment to complying with DORA and its Level 2 texts. However, the MFSA acknowledges that more work remains to be done, highlighting the gaps under the two Regulatory Technical Standards, noting the need for more in-depth day-to-day application of the risk management framework and to understand and mitigate ICT third-party risk better. Governance and organisation, cyber threat classification, and encryption and cryptographic controls remain areas of concern.
