S.L. 330.20 Art. 2Interpretation. Cap. 330.

(1) In these regulations, unless the context otherwise requires:

"Act" means the Malta Financial Services Authority Act;

"Authority" means the Malta Financial Services Authority established by article 3 of the Act;

"binding legal instrument" means any directly applicable measures, including, but not limited to, any implementing technical standards, regulatory technical standards or similar measures, issued under European Union legislation;

"CRD" means Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, as amended from time to time, and includes any binding legal instruments, guidelines and other measures that have been or may be issued thereunder;

"CSIRT" means the Computer Security Incident Response Team designated or established in accordance with Article 10 of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on (DIGITAL OPERATIONAL RESILIENCE ACT (DORA))

measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive

(EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive);

"DORA Regulation" means Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector, and amending Regulations (EC) No 1060/2009, (EU) No 648/ 2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/ 1011 as may be amended from time to time, and includes any binding legal instruments, guidelines and other measures that have been or may be issued thereunder;

"Minister" means the Minister responsible for the regulation of financial services;

"Regulation (EC) No 1060/2009" means Regulation (EC) No 1060/2009 of the European Parliament and of the Council of 16 September 2009 on credit rating agencies;

"Regulation (EU) No 648/2012" means Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories;

"Regulation (EU) No 1024/2013" means Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions;

"Regulation (EU) 2016/1011" means Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/ 2014;

"Threat-Led Penetration Testing" means a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems.

(2) (a) Words and expressions used in these regulations which are defined in Article 3 of the DORA Regulation shall have the same meaning assigned to them in the DORA Regulation; and

(b) words and expressions used in the Act which are not defined herein or in Article 3 of the DORA Regulation shall have the same meaning as in the Act.