Recovery and Resolution (Amendment No. 3) Regulations, 2024

Suppliment tal-Gazzetta tal-Gvern ta’ Malta, Nru. 21,346, 15 ta’ Novembru, 2024

L.N. 303 of 2024

MALTA FINANCIAL SERVICES AUTHORITY ACT

(CAP. 330)

Recovery and Resolution (Amendment No. 3) Regulations, 2024

IN EXERCISE of the powers conferred by articles 20A and 20D

of the Malta Financial Services Authority Act, the Minister

responsible for the regulation of financial services, acting on the

advice of the Malta Financial Services Authority and of the Resolution

Authority, has made the following regulations:-

(1) The title of these regulations is the Recovery and Citation, scope

Resolution (Amendment No. 3) Regulations, 2024 and these and

commencement.

regulations shall be read and construed as one with the Recovery and S.L. 330.09.

Resolution Regulations, hereinafter referred to as "the principal

regulations".

(2) The scope of these regulations is to transpose the

provisions of article 5 of Directive (EU) 2022/2556 of the European

Parliament and of the Council of 14 December 2022 amending

Directives 2009/65/EC, 2009/138/EC, 2011/61/EU, 2013/36/EU,

2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as

regards digital operational resilience for the financial sector.

(3)

These regulations shall come into force on the 17th January

2025

Provided that regulation 4 shall come into force upon the

publication of these regulations in the Gazette.

In sub-regulation (1) of regulation 2 of the principal Amends

regulations, immediately after the definition "director" there shall be regulation

the principal

added the following new definition

regulations.

" "DORA Regulation" means Regulation (EU) 2022/2554 of the

European Parliament and of the Council of 14 December 2022 on

digital operational resilience for the financial sector and amending

Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/

2014, (EU) No 909/2014 and (EU) 2016/1011, as amended from time

to time, and includes any binding legal instruments, guidelines and

other measures that have been or may be issued thereunder;".

Sub-regulation (7) of regulation 10 of the principal Amends

regulation 10 of

regulations shall be amended as follows

the principal

regulations.

(a) paragraph (c) thereof shall be substituted by the

following new paragraph

"(c) a demonstration of how critical functions and

core business lines could be legally and economically

separated, to the extent necessary, from other functions so

as to ensure continuity and digital operational resilience

upon the failure of the institution."; and

(b) paragraph (q) thereof shall be substituted by the

following new paragraph

"(q) a description of essential operations and

systems for maintaining the continuous functioning of the

institution’s operational processes, including network and

information systems as referred to in the DORA

Regulation;".

Sub-regulation (1) of regulation 44A of the principal

regulations shall be amended as follows

(a) the words "Where a seller of eligible liabilities meets

all the conditions referred to in Article 72a of the CRR with the

exception of point (b) of Article 72a(1) and paragraphs 3 to 5 of

Article 72b of that Regulation, the sale of the eligible liabilities

mentioned above to a retail client as defined in point (11) of

Article 4(1) of Directive 2014/65/EU, shall be permitted when

the following conditions are fulfilled:" shall be substituted by the

words "A seller of eligible liabilities which meet all the

conditions referred to in Article 72a of the CRR with the

exception of point (b) of Article 72a(1) and paragraphs 3 to 5 of

Article 72b of the CRR, may sell such liabilities to a retail client

as defined in paragraph (11) of Article 4(1) of Directive 2014/65/

EU only where all of the following conditions are fulfilled:"; and

(b) in paragraph (b) thereof, the words "retail client;"

shall be substituted by the words "retail client; and".

The Schedule to the principal regulations shall be amended

as follows

(a) item (16) of Section A thereof shall be substituted

by the following new item

"(16) arrangements and measures necessary to

maintain the continuous functioning of the institution’s

operational processes, including network and information

systems that are set up and managed in accordance with the

DORA Regulation;";

(b)

Section B thereof shall be amended as follows

(i) item (14) thereof shall be substituted by the

following new item

"(14) an identification of the owners of the

systems identified in item (13), services level

agreements related thereto, and any software and

systems or licences, including a mapping to their

legal entities, critical operations and core business

lines, as well as an identification of critical ICT third-

party services providers as defined in paragraph (23)

of Article 3 of the DORA Regulation;"; and

(ii) immediately after item (14) thereof, as

substituted, there shall be added the following new item

"(14A) the results of institutions’ digital

operational resilience testing under the DORA

Regulation;"; and

(c)

Section C thereof shall be amended as follows

(i) item (4) thereof shall be substituted by the

following new item

"(4) the extent to which the service

agreements, including contractual arrangements on

the use of ICT services, that the institution maintains

are robust and fully enforceable in the event of

resolution of the institution;" and

(ii) immediately after item (4) thereof, as

substituted, there shall be added the following new item

"(4A) the digital operational resilience of the

network and information systems supporting critical

functions and core business lines of the institution,

taking into account major ICT-related incident

reports and the results of digital operational resilience

testing under the DORA Regulation;".

€0.18